Brazil sets October 30 licensing deadline for crypto firms

What happened

Brazil has set a hard authorization date for crypto firms. Decrypt reported that any company letting customers trade, hold or send crypto, known as a virtual asset service provider, must file for Central Bank authorization by October 30, 2026. The application has to include a reasonable assurance report from an audit firm registered with the securities regulator, attesting that the firm's anti-money-laundering and sanctions controls actually work. The report, from blockchain security firm CertiK, lays out what the rules require and why they matter for companies and users inside the market.

The framework rests on Law 14,478/2022, the Legal Framework for Virtual Assets. It came into focus on November 10, 2025, when the Central Bank of Brazil published three resolutions at once. Together they define who must be licensed, set capital floors, and connect crypto to the country's foreign-exchange rules. The Central Bank, rather than the capital markets regulator, leads the regime, a choice the report links to the role crypto plays in cross-border flows.

The entry costs are substantial. Minimum capital runs from roughly 10.8 million to 37.2 million Brazilian reais, about 2 million to 6.7 million dollars depending on the license category. The Central Bank also bars operators from using co-working spaces as their registered office. The report estimates about 120 providers currently serve the market, most without a formal license. Foreign firms that served Brazil from offshore structures now have to bring operations onshore within 270 days. The report describes the perimeter bluntly: a Portuguese-language website with global liquidity and no local presence will no longer be enough.

Scale explains why the deadline matters beyond Brazil. The country ranks fifth worldwide for real crypto adoption, according to Chainalysis data cited in the report, and received 318.8 billion dollars in on-chain value over the twelve months to June 2025. Nearly a third of all Latin American activity flowed through Brazilian wallets and platforms, roughly double the next two markets, Argentina and Mexico, combined. A licensing decision in a market of that size affects global exchanges, stablecoin distributors and local brokers at the same time.

Why it matters

The report calls Brazil a stablecoin nation, and the figures show why the Central Bank is the lead regulator. About 80 percent of declared crypto volume moves through dollar-pegged tokens. Tether's dollar token alone accounts for 88.7 percent of that flow, and total stablecoin activity reached 1.13 trillion reais between 2019 and 2025. The same token is already cashable at 24,000 automated teller machines across the country. When four out of every five reais in crypto pass through an instrument pegged to a foreign currency, the report argues, crypto oversight becomes monetary policy as well as consumer protection. That single fact shapes the rules that follow: why the Central Bank leads, why foreign exchange and cross-border flows sit at the heart of the regime, and why stablecoins head the next regulatory wave.

For firms, the assurance report changes the nature of compliance. Saying controls exist is no longer enough. An independent party has to confirm that anti-money-laundering and sanctions controls work. That requirement creates a bottleneck. Audit capacity, technical review and application preparation all take time, and the report warns that the market underestimated the work. A lawyer at a firm that advised on filings told CertiK that the most common issue observed is underestimation of the complexity and timing involved in preparing an authorization application, and added that the review will be thorough, detailed and highly technical. Readers should treat October 30 as a filing deadline, not as the date every applicant becomes licensed. Review will continue after filing.

The structure of the market is likely to change around the deadline. The report's thesis is that a license becomes an asset, and acquisition of an already-authorized local operator becomes the fast route in for foreign entrants. It points to the same pattern after Europe's markets framework and Dubai's virtual assets regime, where unlicensed volume migrated to the survivors. A regional growth head at the Solana Foundation described a swing toward licensed operators, saying projects are choosing to operate under an authorized provider rather than pursue their own license, and argued that the Brazilian market is structurally moving onto the regulated rail. Smaller providers face a choice between applying on their own, partnering under another firm's authorization, selling to a licensed operator, or leaving.

Security history forms part of the backdrop, though it is not the licensing test itself. Per CertiK tracking cited by Decrypt, 1.32 billion dollars left the industry to hacks and exploits across 344 incidents in the first half of 2026. Wallet compromises drove 444.5 million dollars of that total, and phishing took 366.3 million dollars. The report's verdict is that Brazil's market is moving to a standard in which the ability to prove replaces the ability to promise. That phrase captures the assurance model: capital, local presence and independent control testing replace self-declaration.

Gray zones remain. The report flags non-custodial wallets, decentralized finance front ends and tokenized securities as areas needing care. The securities regulator maintains that tokenized securities remain its territory regardless of the blockchain underneath, and that a tokenized share is still a share. Firms offering several products may therefore need to answer to two regulators for different parts of the same service.

What to watch

The immediate marker is the filing itself. Watch for announcements by the roughly 120 providers now serving the market: who files by October 30, who partners under an authorized provider, who seeks acquisition, and who withdraws service from Brazilian users. Because the report says most providers lack a formal license today, the filing round will reveal how much of the current market intends to stay.

The second marker is the assurance bottleneck. Registered audit firms must attest that controls work, and the Central Bank review is described as thorough and technical. Application quality, review timelines and any requests for additional information will decide whether filing leads to authorization in months or much longer. A deadline for filing does not guarantee a deadline for approval.

The third marker is stablecoin distribution. With about 80 percent of declared volume in dollar-pegged tokens and cash-out access at 24,000 machines, any change in which firms may distribute or redeem stablecoins will be visible to ordinary users quickly. Readers should watch whether licensed operators keep those rails open on the same terms, and whether offshore-only services restrict Brazilian access after the 270-day onshore window.

Finally, watch the boundary between the Central Bank and the securities regulator. Tokenized securities, staking-like products and yield features can sit near that line. Clear statements on which license covers which product will matter more than the headline deadline. For now, the confirmed position is precise: applications carrying an independent assurance report must reach the Central Bank by October 30, 2026, and the capital and local presence rules will decide who can keep serving one of the world's largest crypto markets.