On 10 August, FinanceFeeds reported CertiK’s warning that Brazil’s crypto licence deadline was approaching. The practical issue is now clearer: an existing provider does not need a final licence by 30 October 2026, but it does need to submit the first phase of a complete authorisation request to the Banco Central do Brasil by that date.
The filing is more than a registration form. Under Normative Instruction 739, it must include a reasonable-assurance report from an independent audit firm registered with Brazil’s securities regulator, the CVM, covering the effectiveness of anti-money-laundering, counter-terrorist-financing and sanctions controls. For providers that have not already tested and remediated those systems, the audit can become the critical path.
What Changes on 30 October 2026
BCB Normative Instruction 704 fixes 30 October 2026 as the Phase 1 deadline for companies that were already providing virtual-asset services when the new regime took effect. A timely application allows an incumbent to continue its existing activities while the central bank reviews the case, but it does not amount to approval and does not let the firm add a new service category.
The enforcement provision is in Resolution BCB 520. From 30 October, institutions authorised by the BCB may not execute or facilitate virtual-asset market transactions with a Brazilian provider that is neither authorised nor in the authorisation process. A provider that misses the filing window must stop operating under the transition rules, while a filed application that is later rejected or archived also triggers a 30-day wind-down.
That distinction matters because the rule is often shortened to a ban on all banking relationships. The text targets regulated institutions’ execution or facilitation of virtual-asset transactions with an unapproved counterparty, giving the deadline real force without saying that every ordinary payment involving the company becomes unlawful. It sits alongside Brazil’s broader decision to treat specified crypto transfers as foreign-exchange business, which FinanceFeeds examined in its report on cross-border settlement under Resolutions 519, 520 and 521.
Phase 1 Requires Evidence, Not a Promise to Comply
The Phase 1 package goes to the BCB’s Department of Financial System Organisation through the central bank’s filing systems. It includes corporate and ownership records, declarations concerning controllers and managers, evidence of the origin and movement of capital, tax-information authorisations and audited financial statements for the previous three financial years, where applicable.
A favourable Phase 1 decision starts a second stage. The applicant then has 60 days, with one possible 60-day extension, to deliver the operational material requested by the BCB, including evidence that governance, technology, security and control arrangements are working. The process therefore separates entry into the review queue from the final authorisation decision.
IN 739 raises the burden at the front of that queue. Its report must follow the NBC TO 3000 assurance standard and provide reasonable assurance, a higher level of confidence than limited assurance, on whether the firm’s controls are effective. An auditor must be able to test how customer due diligence, transaction monitoring, suspicious-activity escalation, sanctions screening and related governance operate in practice, rather than merely confirm that written policies exist.
CertiK estimates that about 120 providers fall within the transition and argues that the pool of CVM-registered audit firms able to perform this specialised work is narrow. The BCB has not published a live total of Phase 1 applications, so there is no verified basis for saying how many firms have filed or that most are unable to file. What can be established is that an incomplete assurance exercise cannot be replaced by a pledge to finish it after the deadline.
Capital Floors May Reshape the Provider List
Under the BCB’s risk-based minimum capital framework, the new capital and net-worth requirements run from R$10.8 million to R$37.2 million, depending on the activities and risk components in a provider’s model. Custody, intermediation and brokerage or exchange functions carry different components, so a platform combining several services can face the upper end of the range rather than one flat threshold.
The final numbers are materially higher than the R$1 million to R$5 million range discussed during consultation, a change that Brazilian industry representatives have said may weigh most heavily on smaller operators. The rules do not prove that consolidation will follow, but they make partnership, acquisition, a narrower service scope or exit more plausible choices for firms that cannot support both the capital and control infrastructure.
Capital is only one of several obligations. The framework also covers client-asset segregation, governance, cyber security, record keeping and reporting. Further controls are still being layered onto the market, including the 24-hour hold on certain higher-value crypto transfers from January 2027 and continuing work on rules for institutional crypto infrastructure.
Foreign Exchanges Need a Brazilian Route to Market
An offshore exchange serving users in Brazil cannot treat the October date as a domestic-company issue. The transition rules require Brazilian activity to sit inside an authorised local structure. A foreign group can establish or acquire that structure, or supply services under contract to an authorised Brazilian provider where the rules permit, but the Brazilian entity remains accountable to the BCB.
That makes access to local banking and payment rails part of the licensing analysis. Pix connectivity is commercially important, as shown by the recent entry of a newly licensed payment institution covered in FinanceFeeds’ report on Boku’s launch in Brazil’s Pix market. It does not substitute for SPSAV authorisation when the underlying business is custody, intermediation or exchange of virtual assets.
The scale explains why international platforms are unlikely to ignore the exercise. Brazil received $318.8 billion in on-chain value in the year to June 2025, close to one-third of Latin America’s total, according to data cited by Decrypt. Regulatory treatment also reaches beyond licensing into taxation and market conduct, subjects FinanceFeeds has followed through Brazil’s proposed tax treatment for cross-border crypto payments and earlier enforcement against unauthorised derivatives.
The real countdown is therefore not to a licence award. It is to the point at which an incumbent must have assembled a credible Phase 1 record, secured a qualified auditor and obtained reasonable assurance over controls that have already operated. Firms that begin with the form and leave the audit until last may discover that the scarce input is time, not paperwork.