Brazil’s crypto market is heading into a licensing phase with a fixed deadline. A new report from blockchain security firm CertiK says any virtual asset service provider, or VASP, that lets customers trade, hold, or send crypto must apply for authorization by October 30, 2026. The filing must include a “reasonable assurance report” from an audit firm registered with the securities regulator, confirming that the company’s anti-money-laundering and sanctions controls work in practice.
The report focuses on what the rules demand and what that means for businesses and users in one of the world’s largest crypto markets. Citing Chainalysis data, CertiK says Brazil ranks fifth globally for real crypto adoption and received $318.8 billion in on-chain value in the 12 months through June 2025. Nearly one-third of all Latin American activity flowed through Brazilian wallets and platforms, roughly twice the combined total of Argentina and Mexico, the next two markets.
The legal basis and the central bank’s resolutions
The regime is built on Law 14,478/2022, described as the Legal Framework for Virtual Assets. CertiK says the framework came into sharper focus on November 10, 2025, when the Central Bank of Brazil, or BCB, published three resolutions at once. Together, those resolutions define which firms must be licensed, set minimum capital requirements, and link crypto activity to the country’s foreign-exchange rules.
Under the new system, any company serving customers through crypto trading, custody, or transfer services must submit its application by October 30, 2026. A simple compliance claim will not suffice. The applicant has to provide an independent assurance document showing that internal controls tied to anti-money-laundering and sanctions screening are functioning, not just described on paper.
Capital thresholds and onshore requirements
CertiK says the cost of entry is substantial. Minimum capital ranges from about R$10.8 million to R$37.2 million, or roughly $2 million to $6.7 million, depending on the license category. The BCB also bars operators from using co-working spaces as their registered office.
The report estimates that around 120 providers currently serve the Brazilian market, most of them without a formal license. Foreign firms that previously operated through offshore shell structures now have 270 days to bring operations onshore. CertiK describes the policy perimeter in blunt terms: the model of running a Portuguese-language site with global liquidity but no local presence is set to end.
Why stablecoins are central to the regulatory push
CertiK characterizes Brazil as a “Stablecoin Nation.” According to the report, about 80% of declared crypto volume moves through dollar-pegged tokens. USDT alone accounts for 88.7% of that flow, and total stablecoin activity reached R$1.13 trillion between 2019 and 2025.
Decrypt noted that it had previously reported Tether’s USDT was already cashable at 24,000 ATMs across Brazil, even as the country’s regulatory tightening had been underway for years, from exchange closures to ATM rollouts.
CertiK argues that Brazil’s reliance, whether direct or indirect, on foreign money explains why the central bank has taken a leading role in crypto oversight. The report states: 「When four out of every five reais in crypto pass through an instrument pegged to a foreign currency, the phenomenon ceases to be a matter of consumer protection and becomes a matter of monetary policy.」 It adds that this helps explain why the central bank, rather than the capital markets regulator, leads the regime, why foreign exchange and cross-border flows sit at the heart of the rules, and why stablecoins are likely to be at the front of the next regulatory wave.
Security losses and the coming review process
Using its own Hack3d tracking, CertiK says the crypto industry lost $1.32 billion to hacks and exploits across 344 incidents in the first half of 2026. Wallet compromises accounted for $444.5 million, while phishing caused $366.3 million in losses. The two biggest cases were Kelp DAO at $291 million and Drift Protocol at $285 million. In both, the report says, the root cause was operational and infrastructure failure rather than broken smart contracts.
Marcos Rocha of Veirano Advogados, a law firm that advised on the filings, told CertiK that the market had underestimated the work involved. 「The most common issue we have observed is the underestimation of the complexity and timing involved in preparing an authorization application,」 he said. He added that 「the review will be thorough, detailed, and highly technical.」
Licensed operators may gain ground
Antônio Neto, Head of Growth LATAM at the Solana Foundation, said the market is already shifting toward authorized operators. 「What we’re seeing as the first real wave is projects choosing to operate under an authorized PSAV rather than pursue their own license,」 he said. Later in the report, he argued that 「the Brazilian market is structurally moving onto the regulated rail.」
CertiK’s broader thesis is that capital floors and the assurance bottleneck will reshape the competitive field. In that view, a license becomes an asset. For foreign entrants, acquiring a local operator that already holds authorization could become the fastest route into the market. The report points to a similar pattern after Europe’s MiCA framework and Dubai’s VARA regime, where volume from unlicensed players moved to firms that remained in operation.
Gray areas remain under the new regime
The report also flags unresolved areas, including non-custodial wallets, DeFi front ends, and tokenized securities. CertiK says the securities regulator, CVM, has stated that tokenized securities remain within its jurisdiction regardless of the blockchain used underneath. A tokenized share, in the CVM’s view, is still a share.
The report’s conclusion is that Brazil’s market is entering a stage in which the ability to prove replaces the ability to promise. For the roughly 120 providers now serving Brazilian users, that means one immediate requirement: get the application to the Central Bank by October 30, 2026, with an independent assurance report attached.