Brazil flips the switch on October 30, 2026. If you serve Brazilian users, touch BRL rails, or rely on local banking partners, that date isn’t just a circle on the calendar — it’s the line between continuity and getting shut out.
The short version: by that day, you either need to be authorised or demonstrably in the authorisation process with the Central Bank of Brazil (BCB). Otherwise, Brazilian banks and payment institutions won’t be able to deal with you. That’s not conjecture — it’s in black and white.
This guide trims the legal noise into a practical plan. What to file. How to keep banking intact. Where the capital bites. And the stuff that tends to blow up in the final week if you leave it too late.
| Aspect | What to Know |
|---|---|
| Hard cutoff | From October 30, 2026, BCB-supervised entities can’t conduct or facilitate virtual-asset operations with counterparties that aren’t authorised or in the authorisation process (Banco Central do Brasil — Resolução BCB nº 520). |
| First filing deadline | Pre-existing VASPs must submit the phase‑1 authorisation package by October 30, 2026 to be considered “in process” (Instrução Normativa BCB nº 704). |
| Who’s affected | Exchanges, brokers, custodians, OTC desks, payment/settlement operators, and any platform interfacing with Brazilian banking or payment rails. |
| Capital floors | Minimum paid‑in capital for SPSAVs is risk‑based and has been reported across business models from roughly R$10.8m to R$37.2m under the prudential framework (Resolução BCB nº 517 / Conjunta (CMN)). |
| FX and per‑transaction caps | Recent industry analyses flag USD 100k caps for standard VASPs and USD 500k for banks/authorised FIs on cross‑border transactions; structure flows accordingly (Avalon Blockchain Consulting). |
| Continuity trigger | File phase‑1 before the deadline to maintain relationships with Brazilian counterparties who must refuse non‑authorised parties after the cutoff (Fystack 90‑day action plan). |
| Scope creep risk | Activities touching custody, exchange, brokerage, and settlement each carry different risk weights and supervisory expectations; map your exact model early. |
Core concepts behind Brazil’s 2026 cutoff
Brazil formalised crypto service providers under a regime that puts the Central Bank in the driver’s seat for most virtual‑asset operations. If you’re going to operate at scale — take custody, match orders, settle, or intermediate — you’re expected to do it as an SPSAV, a supervised entity with prudential, governance, and conduct rules.
Authorisation happens in phases. Phase‑1 is the gateway: you file the core corporate and programmatic documentation that shows you’re real, capitalised, and organised. Hit that by the deadline and you’re treated as “in the process,” which lets Brazilian counterparties continue to serve you while the Central Bank works through the rest. Miss it and counterparties will likely step back overnight because they legally have to.
The prudential layer matters. Minimum capital scales with what you do and how risky it is. Industry write‑ups on the rules as implemented report floors ranging roughly from R$10.8 million to R$37.2 million across VASP business models, aligning with the methodology in the BCB/CMN rules (Resolução BCB nº 517). That’s paid‑in capital, not just a promise on a spreadsheet.
Operationally, plan for FX and transfer constraints. Recent market notes cite per‑transaction caps at USD 100,000 for standard VASPs and USD 500,000 for banks/authorised institutions within the BCB framework. That shapes how you manage settlement, pre‑funding, and partner selection for BRL on/off‑ramps (Avalon Blockchain Consulting).
Quick glossary
- SPSAV: The supervised corporate form for virtual‑asset service providers in Brazil, subject to BCB prudential and conduct rules.
- VASP: Virtual‑asset service provider. Covers exchanges, brokers, custodians, and similar businesses handling client assets or transactions.
- Phase‑1 authorisation: The initial filing that gets you recognised as “in the process” with the BCB; essential for keeping banking and payment partners engaged (Instrução Normativa BCB nº 704).
- Prudential capital: Paid‑in capital calibrated to your activities and risks. Reported floors range roughly from R$10.8m to R$37.2m under the BCB/CMN framework (BCB nº 517).
- PIX: Brazil’s instant payment system. If you’re plugging into BRL rails, PIX uptime, limits, and reconciliation flow right into your compliance controls.
- “In the process”: Regulatory status that kicks in when you’ve properly filed phase‑1; it’s what lets partners keep transacting after the deadline (Fystack).
Step-by-step playbook to be ready by October 30
- Map your activities precisely. List everything you do in Brazil or with Brazilian users — custody, order matching, brokerage, settlement, staking, remittance — and align each with the SPSAV categories and risk drivers.
- Assemble the phase‑1 package. Work with local counsel to compile the corporate docs, governance chart, key‑person fit‑and‑proper attestations, AML/CFT framework, risk program overview, business plan, and capital plan required under the phase‑1 submission (Instrução Normativa BCB nº 704).
- Lock down paid‑in capital. Calibrate minimum capital to your model using the BCB/CMN methodology. Don’t rely on “soft” commitments — the floors reported for SPSAVs are material and need to be evidenced (BCB nº 517).
- Harden AML, sanctions, and Travel Rule. Document KYC tiers, sanctions screening, blockchain analytics, Travel Rule implementation, and suspicious activity workflows. Make sure these controls actually plug into PIX, fiat rails, and your wallet stack.
- Prove client asset segregation. Spell out your wallet architecture, omnibus vs. segregated accounts, reconciliation cadence, key management, and incident response. If you use a third‑party custodian, include diligence files and SLAs.
- Banking and FX design. Align BRL on/off‑ramps with per‑transaction caps and liquidity needs. Test flows end‑to‑end with partner banks and payment institutions so there are no surprises on day one (Avalon).
- File early and confirm “in process” status. Submit before October 30 and get written confirmation. Partners will ask for proof to keep accounts open after the cutoff (Fystack).
- Prep for supervisory Q&A. Expect clarifications, not just a rubber stamp. Designate a local point person and keep a tracker for RFI responses, translations, and updated appendices.
Choosing your route: full licence, partner, or pause
Not every exchange will sprint toward a full SPSAV licence on day one. Some will file to keep options open, then operate through a licensed partner while the application matures. Others will geofence and revisit later. The choice comes down to control, time, cost, and risk tolerance.
| Option | Control | Time to market | Cost profile | Banking continuity post‑deadline | Biggest risk |
|---|---|---|---|---|---|
| Apply as SPSAV (in‑house) | High: you own custody, matching, and risk | Medium/long: filing, Q&A, buildout | High: capital floors, governance, staffing | Strong if phase‑1 filed by Oct 30 and partners accept proof | Regulatory delays; capital drag if scope is too broad |
| Operate via licensed partner | Medium: you focus on front‑end; partner runs rails | Short: piggyback on existing permissions | Medium: integration and partner fees | Depends on partner’s status and your own phase‑1 filing | Concentration risk; partner control over flow and limits |
| Geofence / pause Brazil | High (outside Brazil), zero locally | Immediate (but no Brazil growth) | Low near‑term; opportunity cost | N/A — counterparties will disengage after the cutoff | Loss of market share; recovery later may be harder |
One practical note: even if you plan to rely on a partner route, filing your own phase‑1 by the deadline creates optionality and reduces the chance of abrupt de‑risking by banks that prefer counterparties “in process.”
Keeping banking open: FX corridors, PIX, and the cutoff reality
The tender spot for exchanges is always fiat access. Brazil is no different, but the 2026 rule changes heighten the stakes. After October 30, BCB‑supervised entities are prohibited from conducting or facilitating virtual‑asset operations with non‑authorised or non‑filing counterparties. That includes your settlement bank, your payment institution, and the fintech that powers your PIX. If they keep you onboard without your filing in place, they’re the ones out of bounds (Resolução BCB nº 520).
On top of the legal bright line, there are practical throughput constraints. Industry notes put per‑transaction caps at USD 100,000 for standard VASPs and USD 500,000 for banks/authorised institutions in the BCB framework. That won’t kill you if you batch well and pre‑fund where needed, but it does change treasury routines, especially for OTC and institutional flows (Avalon).
Pro tip: don’t wait for “final approval” to test rails. File phase‑1, secure written acknowledgment, then run low‑value live tests across PIX, FX, and reconciliation. You want operational proof before volume arrives.
Two housekeeping items that save pain later. First, get explicit, written partner policies on what they accept as proof of “in process” status and how long they’ll maintain service while your file is under review. Second, align reporting cadences — suspicious activity reports, chargeback monitoring, and blockchain analytics escalations — with the formats your partners expect. It’s easier to inherit their templates than push your own.
Capital and custody: where the regulator will lean in
Capital isn’t just a box tick. It’s the lens the Central Bank uses to size your risk. The rules’ methodology ties minimum paid‑in capital to activity and profile, with floors that industry commentary pegs between roughly R$10.8m and R$37.2m across typical VASP setups (Resolução BCB nº 517 / Conjunta). If you under‑capitalise on paper and then describe an aggressive product roadmap, expect questions.
Custody is the other big lever. Whether you run keys yourself or use a third‑party custodian, the file should show end‑to‑end control: segregation of client assets, reconciliation frequency, access management, incident playbooks, and insurance where available. Don’t bury service‑level terms. The supervisor will look for them, and so will your banks.
For groups with global tech stacks, avoid the “we’ll fix it later” trap. If your wallet system or analytics vendor doesn’t meet Brazil’s data or auditability expectations, switch now or layer compensating controls you can defend in writing.
90‑day VASP authorisation timeline / action plan (shows key milestones and the October 30, 2026 filing deadline) — useful visual for exchanges planning tasks and dates. — Source: Fystack
Pitfalls & red flags that trip teams up
- Missing the definition of “in process.” A submission isn’t enough if it’s incomplete. Aim for a clean phase‑1 file and obtain acknowledgment; partners will ask for it (Fystack).
- Underestimating capital floors. Treat the reported ranges seriously and evidence paid‑in funds. Conditional parent letters don’t meet prudential intent (BCB nº 517).
- Banking letters without enforceable terms. General “support” notes won’t save your accounts after October 30 if you’re not authorised or in process (Resolução BCB nº 520).
- FX flow design that ignores caps. Treasuries built for uncapped corridors break under USD 100k/500k per‑transaction limits; redesign batching and pre‑funding now (Avalon).
- Unclear Travel Rule handling. If you can’t show how you exchange originator/beneficiary data with counterparties, approvals slow and partners balk.
- Late translations and document hygiene. Sloppy Portuguese, missing board minutes, or outdated org charts trigger follow‑ups that burn the clock you don’t have.
Frequently Asked Questions
Who exactly needs to file by October 30, 2026?
Any virtual‑asset service provider with Brazilian clients, BRL rails, or Brazilian banking/payment partners that falls within the SPSAV scope. If your counterparties are supervised by the BCB, they’ll be barred from operating with you after the cutoff unless you’re authorised or in the authorisation pipeline (Resolução BCB nº 520).
What counts as being “in the authorisation process”?
A proper phase‑1 submission under the BCB’s procedural rules. Pre‑existing providers are expected to file that package by October 30, 2026 to preserve continuity with Brazilian counterparties (Instrução Normativa BCB nº 704).
What happens if we miss the deadline?
Expect Brazilian banks and payment institutions to suspend service quickly to comply with the prohibition in BCB Resolution 520. Re‑opening later is possible, but you’ll be starting from a cold stop and may face tighter onboarding thresholds (BCB nº 520).
How much capital do we need to evidence?
It depends on activities and risk profile. Under the BCB/CMN prudential methodology, industry write‑ups of the implemented rules report floors from roughly R$10.8m to R$37.2m for SPSAVs. Your counsel can help map the exact calibration to your model (BCB nº 517).
Can we rely entirely on a licensed partner instead of filing?
You can operate via a licensed partner for some functions, but many counterparties will still ask for your own phase‑1 filing as assurance. Filing preserves optionality and reduces the risk of sudden de‑risking after the deadline.
Are there limits on cross‑border transaction sizes?
Market analyses published this quarter flag per‑transaction caps at USD 100,000 for standard VASPs and USD 500,000 for banks/authorised FIs under the BCB framework. That shapes treasury, batching, and pre‑funding strategies (Avalon).
Where should we start if we’re late?
Prioritise the phase‑1 file: capital evidence, governance, AML/Travel Rule, and custody segregation. Several industry timelines suggest a focused 90‑day push is realistic if you dedicate a cross‑functional team and move decisions quickly (Fystack).
