Publications

Authorization tracks provided by the Normative Instruction

The Instruction sets out distinct authorization regimes depending on whether a company is already operating or has yet to begin activities.

For companies already operating: a two‑phase process, with a deadline of 10/30/2026 to prove active operations and submit audited financial statements. After the Central Bank’s Phase‑1 approval, there are 60 additional days (extendable) to complete the file, notably including the business plan and proof of economic capacity.

For new entrants: the entire documentation package must be filed at once, including proof of financial capacity, source of funds, business plan, and governance structure.

Standardized documentation

All document templates are available in the Financial System Organization Manual (Sisorf — Manual de Organização do Sistema Financeiro). Applications are filed with the Department of Financial System Organization (Deorf — Departamento de Organização do Sistema Financeiro), and data are entered in the Unicad system (Unicad — the Central Bank’s unified registry). Using Sisorf templates is mandatory and conditions the Central Bank’s analysis.

Governance requirements

The rule requires virtual‑asset companies to adopt governance standards aligned with those imposed on financial institutions, including: • Corporate governance structure
• Internal controls and risk management
• Information‑technology infrastructure
• Anti‑money‑laundering policies under Law No. 9,613/1998 (Brazil’s AML statute)
This governance must be proportionate to the company’s size and risk profile.

Transparency on resources and financial capacity

Controlling shareholders and significant partners must demonstrate: • Economic‑financial capacity to structure and operate the company
• Lawful origin of funds invested in share capital
• Three‑year asset‑evolution history (for controllers abroad)
• Fitness and absence of legal impediments
The Central Bank will run checks in public and private databases, including judicial and administrative records.

Who must comply

The rule directly affects: • SPSAVs — Sociedades Prestadoras de Serviços de Ativos Virtuais (legal entities providing virtual‑asset services), i.e., firms engaged in buying, selling, custody, and intermediation of cryptoassets
• Foreign‑exchange brokers, CTVMs, and DTVMs — CTVM (Corretora de Títulos e Valores Mobiliários: securities broker‑dealer) and DTVM (Distribuidora de Títulos e Valores Mobiliários: securities distributor) seeking authorization or required to notify changes to the Central Bank
• Controllers and significant partners — individuals or legal entities with a qualified stake, who must prove financial capacity and fitness
• Administrators — appointed or elected officers and directors, who must demonstrate technical qualifications and market knowledge
• Third‑party service providers — companies delivering material services to PSAVs (PSAV — Prestadora de Serviços de Ativos Virtuais: Virtual Asset Service Provider) must be identified in the business plan

Key regulatory deadlines for SPSAVs

October 30, 2026: final date for operating SPSAVs to file Phase 1, submitting: • Statement attesting the firm was operating on the reference date
• Audited financial statements for the last three fiscal years
• Declarations of unblemished reputation
• Authorizations for access to tax and registration data
• Information on control structure

60 days after Phase‑1 approval: deadline to file Phase 2 with supplemental documents: • Proof of economic‑financial capacity
• Source of funds invested
• Executive summary of the business plan
• Full documentation for administrators
This period may be extended once for 60 days upon justification to the Central Bank.

Other important deadlines

5 days: notify the Central Bank of the effective start of operations after receiving authorization (maintained by IN BCB 704, art. 7).
15 days: file authorization requests for changes to share capital, corporate name, assumption and exercise of office by appointed/elected administrators, or to request cancellation of authorization.
30 days: file authorization requests for transfer or change of control, merger, demerger, or change in the SPSAV’s operating modality.

Points of attention for your company

Audited financial statements are mandatory
For SPSAVs already operating, financials for the last three fiscal years must be audited by an independent auditor registered with the CVM (CVM — Comissão de Valores Mobiliários: Brazil’s Securities and Exchange Commission). If you do not yet have this setup, arrange for independent audit in advance.

Required business‑plan content
The executive summary or full plan (where required) must cover:
• Governance structure and internal controls
• IT and information‑security infrastructure
• Outsourced services in Brazil and abroad
• Anti‑money‑laundering policies
• Economic‑financial feasibility analysis
The Central Bank reviews the plan as a central element of its viability and governance assessment.

Controllers abroad have specific requirements
If your controllers (individuals or legal entities) are domiciled overseas, you must provide documentation enabling verification of asset evolution over the last three fiscal years.

Source of funds will be verified
The declaration of source of funds is subject to substantive review by the Central Bank, which may request supporting documentation, particularly in cases of:
• Capital increases exceeding 50% of share capital
• Successive capital raises in the preceding six months
• Breach of operating limits
• Regularization plans

Corporate changes require prior approval
Share‑purchase agreements transferring control must include a clause conditioning closing on Central Bank approval. This applies to:
• Transfers of control
• Admission of new significant partners
• Mergers, demergers, and incorporations

Required steps if authorization is denied

If the authorization request is denied and the company has already been registered with the state Board of Trade, there are only 15 days to:
• Dissolve the company, or
• Change the corporate purpose to a non‑regulated activity and amend the corporate name

Ongoing communications and authorization requests to the Central Bank

Even after authorization is granted, material changes must be reported to the Central Bank via Unicad (the unified registry), including:
• Changes to share capital
• Assumption and exercise of office by administrators
• Transfer/change of control, merger, demerger, and change of operating modality
• Start or suspension of activities
Failure to meet filing or communication deadlines can cause regulatory complications.

What to do now

If your company operates or plans to operate with virtual assets, foreign exchange, or securities:
• Determine whether you fall under the transitional two‑phase regime or the full authorization procedure (operating firms use the transitional two‑phase track; new entrants follow the complete process from the outset).
• Map required documentation: compile the documents for your applicable regime and identify gaps that could affect your authorization timeline.
• Organize audited financial statements: plan the preparation of audited financials — a core requirement for operating SPSAVs and critical to meeting regulatory deadlines.
• Review governance: assess whether internal controls, AML policies (anti‑money‑laundering), and IT infrastructure meet regulatory requirements.
• Watch the deadlines: especially October 30, 2026 for operating PSAVs/SPSAVs — this date is not extendable.

Why early preparation matters

Normative Instruction BCB 704/2026 marks the transition of Brazil’s virtual‑asset market to a fully regulated environment. Early alignment of governance, documentation, and internal controls reduces the risk of denial and delays in the authorization process. For companies already operating, advance organization of documents is essential given the short window to complete Phase 2. The complexity of procedures and breadth of required documentation make specialized legal support advisable from document‑preparation through direct interaction with the Central Bank.