Brazil's Central Bank rules for exchanges and self-custody wallets: the updated guide

Quick answer

Brazil's Central Bank rules for the crypto market changed significantly between November 2025 and October 2026, and two dates matter now. For exchanges already operating in Brazil, the deadline to file for Central Bank authorization is October 30, 2026; those who do not file have up to 90 days to wind down operations in an orderly way. For anyone holding crypto in a self-custody wallet, self-custody remains legal, but transfers between a regulated exchange and a self-custody wallet of $10,000 or more now trigger a report to Coaf, Brazil's financial-crimes council — a rule that was due to start on October 1, 2026, but that the Central Bank itself postponed, on that same day, to January 2027.

This guide gathers the rules in force, each one's deadline, what changes for exchange users and what changes for anyone holding assets outside a platform, with a source and date for every figure. If you are new to the topic, start with Crypto regulation in Brazil: what Central Bank rules change for users, which covers the general picture; this article goes deeper into deadlines, practical requirements and the specific rules for self-custody wallets.

The legal framework: Law 14,478/2022 and the Central Bank's role

Law 14,478/2022, Brazil's Legal Framework for Virtual Assets, made the Central Bank the body responsible for regulating and supervising virtual-asset service providers in Brazil, without banning self-custody. Since then, the Central Bank has published resolutions detailing how this market must operate. As of this update, the main ones are BCB Resolutions 519, 520 and 521 (published November 10, 2025) and BCB Resolutions 589 and 591 (from 2026, the latter replacing BCB Resolution 588).

VASP rules: the three license types for exchanges and brokers

BCB Resolutions 519 and 520 created the PSAV category (Prestadora de Serviços de Ativos Virtuais, Brazil's term for a virtual-asset service provider, or VASP). Any company offering buying, selling, custody or intermediation of crypto-assets in Brazil now needs Central Bank authorization to operate, under three license types:

• Intermediaries: trade virtual assets on behalf of clients, without holding the assets.
• Custodians: hold clients' crypto-assets and access instruments (keys).
• Brokers: a combined license covering both intermediation and custody — the model used by most exchanges known in Brazil.

To be authorized, a company must prove minimum capital between R$10.8 million and R$37.2 million, depending on the license type and size, plus maintain asset segregation (client funds cannot be mixed with the company's own cash), corporate governance, auditable internal controls, a cybersecurity policy and anti-money-laundering mechanisms.

The deadlines that apply now

BCB Resolutions 519 and 520 took effect on February 2, 2026. From that date, anyone already providing virtual-asset services in Brazil had 270 calendar days to file for authorization — a deadline that falls on October 30, 2026. BCB Resolution 521 treats part of these activities as foreign-exchange and international capital-market operations; most of its rules also apply since February, but the duty to report international-operation data to the Central Bank every month (the so-called travel rule, including identification of the destination wallet's owner) only took effect on May 4, 2026.

After filing, a company can keep operating while the Central Bank reviews the request — a process that can take up to three years. Anyone who misses the deadline has up to 90 days to wind down operations in an orderly way, returning assets to clients. From November 6, 2026, institutions already authorized by the Central Bank (banks, securities brokers and other PSAVs) are barred from moving funds with providers that have no authorization request underway.

This timeline is already reshaping the sector. Coinext announced it is shutting down its Brazilian operations, and NovaDAX left the country in June 2026, citing the cost of complying with the new requirements. Before keeping funds on an exchange, it is worth checking whether it has filed for authorization or announced an exit plan — and, either way, following the exchange checklist further down in this guide.

Summary table: dates and figures that matter

What changes for self-custody wallets

Self-custody — holding the keys to your own crypto-assets yourself, on a hardware wallet, for instance — remains legal. Law 14,478/2022 neither bans it nor forces anyone to keep assets on an exchange. What changed is what happens at the bridge between a regulated platform and a self-custody wallet.

BCB Resolution 588/2026 (September 23, 2026) determined that transfers of virtual assets between a platform and a self-custody wallet — in either direction — of $10,000 or more (roughly R$52,200 at the time) now trigger an automatic report to Coaf, Brazil's Council for Financial Activities Control. It is a value-based report, not a suspicion-based one: no sign of wrongdoing is required for the exchange to report it.

The rule was due to start on October 1, 2026. On that same day, the Central Bank published BCB Resolution 591/2026, which revoked Resolution 588 and kept the same duty but stretched the calendar: transfers made between October and December 2026 only need to be reported on the first business day of January 2027, instead of immediately. The same extension applies to cash foreign-exchange operations at the same value threshold.

In practice, to move assets from an exchange to your own wallet (or the other way around), the regulated platform needs to identify the owner of the destination wallet. The exact verification mechanism is still being worked out by the market; what is already certain is that, above certain amounts, the exchange will ask for more identification information than it did before February 2026. This does not give the Central Bank access to your private keys, nor does it turn your self-custody wallet into something regulated — the duty falls on the authorized institution on the other end of the transfer.

Travel rule: what changes in cross-border operations

BCB Resolution 521 began treating part of PSAVs' activities as foreign-exchange and international capital-market operations. Since May 4, 2026, authorized exchanges (or those with authorization pending) must report international crypto-asset operations to the Central Bank every month, including identification of the owner of the origin or destination wallet. This requirement, known as the travel rule, follows a logic similar to an international recommendation from the FATF (Financial Action Task Force) aimed at making it harder to use crypto-assets for money laundering and terrorism financing. For users, the practical effect is similar to the other rules: more identification whenever moving value across borders.

What a PSAV must now report to the Central Bank

BCB Resolution 589/2026 expanded the information a PSAV must send the Central Bank after filing for authorization: accounting balance, total virtual assets under custody, position by client, proof of reserves and assets held in staking or custodied abroad. For users, this means more transparency about how much an exchange actually holds on clients' behalf — but the rule's existence does not replace checking whether the exchange is actually complying with it.

Risks and precautions

• Regulation is not a guarantee of price or outcome: an authorized exchange can be operationally sound and you can still lose money to the volatility of the asset you bought.
• The authorization process is long: the Central Bank can take up to three years to decide on a filed request. A filed request is not the same as a granted authorization; ask the exchange which stage of the process it is in.
• Scams stay off the regulation's radar: no Central Bank resolution stops you from falling for phishing, sending assets to the wrong address or using a cloned platform. Responsibility for your account's and your wallet's security remains yours.
• Reporting calendars can change again: BCB Resolution 591 showed that the Central Bank itself can postpone a rule on the very last day. Treat the dates in this guide as current as of the consultation date noted at the end, and confirm on the Central Bank's website before acting.
• A self-custody wallet is not anonymous before the law: the Coaf report does not depend on suspicion; large amounts moved between an exchange and a self-custody wallet are reported regardless of the intent behind the transfer.

Checklist: exchanges and self-custody in 2026

• Confirm whether the exchange you use has already filed for (or received) Central Bank authorization, not just a generic claim of being "compliant."
• If an exchange has announced it is leaving Brazil, plan the withdrawal of your assets ahead of time, rather than waiting for the last day.
• When moving large amounts to or from your own wallet, be ready to provide more identification information than you did before 2026.
• Do not treat a "Coaf report" as an accusation: it is an automatic, value-based report, not a sanction.
• Keep records of where your crypto-assets came from, especially if you move amounts near or above $10,000.
• Follow news from your exchange and the Central Bank: the deadlines in this guide can be adjusted, as already happened with BCB Resolution 591.
• For wallet security itself (backups, recovery phrase, devices), see the self-custody guide linked just below.

Frequently asked questions

Was crypto self-custody banned in Brazil?

No. Law 14,478/2022 does not ban holding crypto-assets in a self-custody wallet. There is a rule requiring a Coaf report for transfers of significant value between an exchange and a self-custody wallet, but that is not a ban on self-custody.

What is a PSAV?

It is the Prestadora de Serviços de Ativos Virtuais, the category created by BCB Resolutions 519 and 520 for companies that intermediate, custody or trade crypto-assets in Brazil — Brazil's term for a VASP. Every PSAV needs Central Bank authorization to operate.

What happens to an exchange that does not file for authorization by October 30, 2026?

It has up to 90 days after the deadline to wind down operations in an orderly way and return assets to clients. From November 6, 2026, already-authorized institutions are also barred from moving funds with providers that have no authorization request underway.

Is the Coaf report for self-custody wallets already in force?

The duty exists since BCB Resolution 588/2026, but the calendar was stretched by BCB Resolution 591/2026: transfers made between October and December 2026 only need to be reported on the first business day of January 2027.

Does the Central Bank gain access to my private keys?

No. The duty falls on the exchange or regulated institution, which must identify the owner of the destination wallet and, above a certain amount, report the transfer to Coaf. The Central Bank does not start custodying or directly accessing self-custody wallets.

Do these rules apply only to Brazilian exchanges?

The authorization rules (PSAV) apply to anyone providing virtual-asset services in Brazil. International platforms serving Brazilian users also need to comply; some coverage of the topic points to November 2026 as an adjustment window for foreign operators, but confirm the specific situation of each platform before deciding where to keep your assets.

Read also

• Crypto regulation in Brazil: what Central Bank rules change for users
• Self-custody in 2026: how to choose a wallet and set up recovery
• How to choose a crypto exchange
• Stablecoins in Brazil: the new transparency rules

Informational and educational content. It does not constitute investment advice, an offer or a solicitation to buy or sell assets.

Sources: Agência Brasil — Central Bank sets rules for the crypto-asset market (Nov 10, 2025); Lefosse — Central Bank regulates the use of virtual assets and the operation of PSAVs; TechCripto — crypto regulation: what exchanges must do before the Central Bank's deadline (Oct 5, 2026); BlockTrends — Central Bank expands crypto traceability and requires Coaf reporting; LetsMoney — Central Bank postpones Coaf reporting on crypto self-custody to 2027; Morning Jog — what changes in February 2026 for cold-wallet users. Checked on Oct 8, 2026.