Brazil Lowers the Barrier for Banks to Enter Crypto, Without Letting Go of Oversight

Brazil is reshaping how traditional financial institutions enter the crypto market, opting for speed and clarity rather than deregulation. A new rulebook issued by the Central Bank of Brazil signals a pragmatic shift: banks and brokers can now offer crypto services through a streamlined process, provided they meet strict compliance standards verified by independent certifiers.

The framework is formalized under Instrução Normativa BCB No. 701, published on January 23, 2026, and set to take effect on February 2. Rather than reinventing Brazil’s crypto regime, the measure operationalizes elements of Resolution No. 520 from late 2025, clarifying what institutions must submit and how the central bank expects compliance to be demonstrated.

Under the new rules, banks and securities firms seeking to provide crypto intermediation or custody must notify the central bank and submit independent certification through its APS-Siscom system. If all requirements are met, institutions may begin offering crypto services after 90 days. If not, the communication is deemed ineffective, and the institution remains barred from entering the market.

A key feature of the policy is the reliance on external, qualified certifiers. These third parties must confirm that applicant institutions comply with Brazil’s rules for virtual asset service providers, while also declaring the absence of corporate or commercial ties that could create conflicts of interest. The central bank retains supervisory authority, but the initial verification burden shifts outward, accelerating market entry without abandoning prudential control.

Safeguarding client assets sits at the center of the framework. Certifiers must verify that customer funds are fully segregated from corporate assets and backed by demonstrable reserves. Institutions are also required to present recovery plans for client assets, governance structures, internal controls, and cybersecurity measures, including incident response protocols.

The scope of certification extends beyond balance sheets. Operational risks tied to outsourced services, cloud infrastructure, and data processing must be assessed, as must the technical and legal compliance of key suppliers, including those based abroad. Certifiers are also tasked with reviewing controls related to anti-money laundering, counter-terrorist financing, and proliferation-financing risks, as well as procedures designed to prevent abusive conduct in virtual asset markets.

Transparency toward users is another explicit requirement. Institutions must clearly disclose the nature of their crypto services, support channels, custody arrangements, third-party providers, insurance or guarantee mechanisms, and the specific risks associated with both the digital assets and their underlying blockchains. Staking services, where offered, must be explained with equal clarity.

To strengthen accountability, certifiers are now required to retain working papers and internal memos for five years, enhancing the central bank’s ability to conduct retrospective reviews or request further clarification.

Legal and academic observers see the move as a meaningful accelerant. Isac Costa, director of the Brazilian Institute of Technology and Innovation, noted that banks may begin operating without completing the full authorization process typically required of standalone crypto firms, as long as certification confirms full compliance. He suggested that auditors with crypto expertise are likely to fill the certifier role, an issue the central bank may further define.

Brazil’s approach reflects a balancing act. By simplifying entry while maintaining strict standards, the central bank aims to bring crypto activity into the regulated banking system rather than pushing it to the margins. The message is clear: crypto is welcome in Brazil’s financial sector, but only on terms that preserve stability, transparency, and consumer protection.