The Central Bank of Brazil has tightened rules for virtual asset service providers (VASPs), requiring them to maintain a minimum capital buffer from 2027 to guard against financial losses. Companies must establish formal risk management structures and submit detailed financial and operational reports to regulators. Officials said the steps aim to strengthen market stability and ensure investor protection, pushing crypto compliance closer to standards faced by traditional financial institutions.
Regulatory Scope Expanded: Capital Buffers and Risk Management Mandated
The new framework subjects crypto platforms to stricter capital, risk oversight, and reporting requirements. Entities designated as SPSAV in Brazil's regulatory system are specifically targeted. These firms operate across digital asset verticals including token and cryptocurrency transactions, custody, broker services, and client fund transfers. As the country's monetary authority, the Central Bank oversees both the financial system and payment infrastructure.
Under the framework, service providers and their affiliates are classified as Type 3 entities, monitored under a supervision regime comparable to that of securities dealers and distribution firms. Regulators cited a need for similar oversight for institutions sharing related risk profiles. The classification compels crypto firms to step up governance, capital planning, and internal audit mechanisms. Compliance costs could notably increase, especially for smaller participants. Platforms must enhance loss-absorbing capacity, build ongoing risk monitoring systems, and update governance practices.
Transition Timeline: Full Segment 4 Shift by June 2028, Segment 5 Exclusion
Authorities plan to move all VASPs to a Segment 4 classification by June 30, 2028, applying across the board regardless of company size. The phased rollout gives firms extra time to achieve compliance. Additionally, the same rulebook bars Segment 5 financial firms from offering virtual asset services. Segment 5 consists of smaller institutions under lighter oversight. Central Bank analysis concluded that crypto asset services require stricter monitoring than this segment allows.
Brazil's Broader Regulatory Push: From AML to Audits
The latest rules dovetail with earlier efforts. Regulations implemented in November 2025 already tackled governance structures, anti-money laundering protocols, foreign currency transactions, and operational standards. Further measures were rolled out throughout 2026: the National Monetary Council mandated compliance with banking secrecy policies under Supplementary Law 105, and the Central Bank made independent financial audits a prerequisite for operation permits and license renewals. These actions together represent a multi-front tightening of Brazil's crypto oversight, from institutional classification to operational auditing.