Financial Licensing · Brazil

Brazil VASP Authorization (BCB)

The Central Bank of Brazil (BCB) regulates Virtual Asset Service Providers under Resolutions 519 and 520. BCB authorization is mandatory for any entity seeking to operate as a VASP in Brazil — one of the world's largest virtual asset markets.

BrazilBCBVASPCrypto LicenceVirtual AssetsLatAm
Overview

BCB VASP Authorization Framework

Brazil is one of the highest-volume virtual asset markets globally. The Central Bank of Brazil (BCB) administers the VASP authorization regime under BCB Resolution 519 (authorization framework) and BCB Resolution 520 (modality structure), placing Brazil among the most substantively regulated virtual asset jurisdictions in Latin America.

Authorization is pursued in two phases. A favorable Phase 1 decision allows the applicant to continue operating under the BCB transition regime while the final analysis is completed. Phase 2 consolidates governance, financial crime controls, and the full dossier through to final BCB authorization.

Marensa Advisory delivers the full BCB authorization engagement in partnership with a Brazil-licensed regulatory correspondent — covering business model mapping, modality selection, AML/CFT programme design, corporate structuring, and BCB liaison throughout both phases.

Discuss Brazil VASP Authorization
What We Cover
  • VASP modality selection — Intermediary, Custodian, or Broker
  • Business model mapping and BCB regulatory fit analysis
  • Phase 1 diagnosis: corporate, prudential, and governance review
  • Phase 2: complete regulatory dossier and BCB submission
  • AML/CFT programme design aligned to BCB standards
  • MLRO appointment and financial crime controls
  • Custody, segregation, and private key management frameworks
  • Local director and registered address arrangements
  • BCB interaction and liaison throughout authorization
  • Post-authorization compliance programme and ongoing support
Regulatory Framework

VASP Modalities Under BCB Resolution 520

BCB Resolution 520 establishes three VASP modalities. The correct modality is confirmed during Phase 1 business model mapping — it determines capital requirements, prudential obligations, and governance structure.

Modality A — Virtual Asset Intermediary
For platforms whose activities centre on facilitating client transactions without holding principal risk on the underlying virtual assets. Typically the lowest prudential bar of the three modalities. Precise activity scope must be mapped against BCB's intermediary definition — drift into broker-like activity can trigger reclassification.
Modality B — Virtual Asset Custodian
For platforms and infrastructure providers whose core function is safeguarding client virtual assets and access instruments (private keys), without executing trades or intermediating transactions. Custodians carry strict liability for client asset losses and must maintain full segregation between client and proprietary holdings.
Modality C — Virtual Asset Broker
For platforms combining intermediation and custody in a single entity — taking positions, providing liquidity, or bearing principal exposure in client transactions. Generally carries the highest prudential and capital bar, consistent with the upper end of BCB's minimum capital range (up to USD 7.3M equivalent).
Minimum Capital — BCB/CMN No. 14
Minimum share capital ranges from USD 2.1M to 7.3M (R$10.8M–R$37.2M) under Joint Resolution BCB/CMN No. 14. Intermediary or Custodian alone sits toward the lower end; Broker, combining both activities, sits toward the higher end. Final figure confirmed with our Brazilian correspondent once modality is set.
Phase 1 — Favorable Decision
A favorable Phase 1 BCB decision allows the applicant to continue operating under the transition regime while BCB completes its final analysis. This is a meaningful commercial benefit — it removes operational uncertainty during the authorization process and allows the business to maintain its user base and revenue.
AML/CFT & Compliance Requirements
BCB requires comprehensive financial crime controls across both phases: AML/CFT policy suite, MLRO appointment, customer due diligence framework, transaction monitoring, suspicious activity reporting, Travel Rule compliance, and an annual AML/CFT risk assessment. BCB scrutinises these submissions closely — a weak AML/CFT programme is a primary cause of delays.
Engagement Structure

Two-Phase Authorization Process

01
Phase 1 — Diagnosis & Adaptation
Business model mapping, modality selection, corporate and prudential fit review, governance assessment, and preparation of the Phase 1 document package for BCB submission. A favorable Phase 1 decision permits continued operation under the BCB transition regime.
02
Phase 2 — Regulatory Consolidation
Design and implementation of governance, financial crime, and virtual asset control policies. Preparation of the complete regulatory dossier, corporate contracts, and supporting documentation. BCB interaction and liaison through to final VASP authorization.
03
Post-Authorization — Ongoing Compliance
Implementation of any final adjustments required by BCB, plus continued compliance with ongoing VASP regulation — BCB reporting obligations, AML/CFT review cycles, custody and segregation monitoring, and licence condition management.
04
Local Correspondent & On-the-Ground Support
The engagement is delivered in partnership with a Brazil-licensed regulatory correspondent providing local director services, registered address, and direct BCB representation. Local services are provided on a monthly retainer throughout the engagement.
Compliance Workstreams

High-Sensitivity Areas Addressed Across Both Phases

BCB applies particular scrutiny to the following areas. These are built into both phases of the engagement from the outset, not added at the end.

Virtual Asset Custody
Custody framework design, custody reports to BCB, and ongoing custody policy — required for Modality B and any entity holding client virtual assets.
Private Key Management
Protection, control, and management of private keys — including hot/cold storage policy, key ceremony procedures, and access control frameworks.
Asset Segregation
Client versus proprietary virtual asset controls — strict segregation required by BCB, with particular emphasis for Custodian and Broker modalities.
Cybersecurity
Information security framework, incident response plan, and technology risk controls — BCB requires documented cybersecurity governance as part of the authorization dossier.
AML/CFT Programme
Full AML/CFT policy suite aligned to BCB and FATF VASP guidance — CDD, transaction monitoring, STR filing, MLRO, Travel Rule compliance, and annual risk assessment.
Business Continuity
Operational resilience and continuity planning — BCB expects documented continuity procedures covering technology failure, key person departure, and systemic disruption.
Why Marensa

Brazil VASP. Properly Structured.

Brazil is a high-volume, high-scrutiny VASP market. BCB authorization is substantive — the process requires genuine corporate, prudential, governance, and AML/CFT readiness, not just a document submission.

We deliver the engagement in partnership with a Brazil-licensed regulatory correspondent, combining our international GRC expertise with direct BCB representation on the ground. The result is an authorized VASP that can actually operate — with banking, compliance, and governance in place from day one.

The minimum engagement term is 12 months — from Phase 1 diagnosis through final authorization and initial post-license compliance.

Start the Conversation
BCB
Regulator
2 Phases
Authorization Process
~12 Mo
Minimum Engagement
3 Types
VASP Modalities
FAQ

Common Questions

Which BCB VASP modality is right for my business? +

Modality is confirmed during the Phase 1 business model mapping exercise, once your precise service scope and transaction journey are documented. As a general guide: platforms facilitating transactions without holding principal risk are typically Intermediary (A); platforms safeguarding client assets without executing trades are typically Custodian (B); platforms combining both, or taking principal positions, are typically Broker (C). Broker carries the highest capital and prudential requirements.

What is the minimum capital required for BCB VASP authorization? +

Under Joint Resolution BCB/CMN No. 14, minimum share capital ranges from R$10.8M to R$37.2M (approximately USD 2.1M to 7.3M at current rates). Intermediary and Custodian alone sit toward the lower end of that range; Broker — combining both activities — sits toward the higher end. The exact figure is confirmed with our Brazilian correspondent once modality is determined and communicated to BCB.

How long does Brazil VASP authorization take? +

The full authorization process — from Phase 1 diagnosis through Phase 2 submission to final BCB authorization — is scoped as a minimum 12-month engagement. A favorable Phase 1 decision, which allows continued operation under the BCB transition regime, is achievable within the earlier months of the engagement depending on the quality and completeness of the application.

Can we continue operating in Brazil while the authorization is pending? +

Yes — a favorable Phase 1 BCB decision allows the applicant to continue operating under the BCB transition regime while the final Phase 2 analysis is being completed. This is one of the most commercially valuable aspects of the two-phase structure: early structuring and a strong Phase 1 submission preserves operational continuity during the authorization process.

What AML/CFT obligations apply to BCB-authorized VASPs? +

BCB-authorized VASPs are subject to Brazil's AML/CFT law and BCB supervision standards. The authorization dossier must include a full AML/CFT policy suite, a designated MLRO, a customer due diligence framework proportionate to VASP risk, transaction monitoring procedures, suspicious transaction reporting processes, Travel Rule compliance, and an AML/CFT risk assessment. BCB reviews AML/CFT submissions carefully — a weak or generic programme is a primary cause of authorization delays or rejection.

Do we need a local director and registered address in Brazil? +

Yes. BCB authorization requires a local presence in Brazil — including a local director and registered address. These are provided as part of the engagement through our Brazil-licensed regulatory correspondent, billed at a local services monthly rate for the duration of the engagement and beyond if continued local presence is required.

Related Services

You May Also Need

UAE VASP Licence (VARA)
Dubai VARA licence — the premium global virtual asset regulatory framework for entities seeking a Gulf presence alongside a LatAm footprint.
Learn more →
Seychelles VASP Registration
Cost-effective offshore VASP registration for early-stage virtual asset businesses — a lighter-touch complement to the BCB authorization.
Learn more →
AML/CFT & Regulatory Compliance
Standalone AML/CFT programme design, MLRO appointment, and compliance framework build — for VASPs at any stage of the BCB process.
Learn more →
Ask Maya