Brazil's $319 billion cryptocurrency market faces October licensing deadline: CertiK

New Regulations on Regulation of Brazil's Cryptocurrency Market: Application Deadlines and Compliance Requirements

Brazil is one of the world's largest cryptocurrency markets, and its regulators recently set a clear date for bringing the market into formal supervision. A new report from blockchain security company CertiK details the requirements of these rules and what they mean for companies and users in the market.

According to Chainalysis data cited in the report, Brazil ranks fifth in the world in terms of real cryptocurrency adoption rates, and its chain value reached US$318.8 billion in the 12 months ending June 2025. Nearly one-third of cryptocurrency activity in Latin America takes place through Brazilian wallets and platforms, almost double the combined size of the two closely followed markets of Argentina and Mexico.

This regulatory framework is based on Law 14.478/2022 (Legal Framework for Virtual Assets) and entered a critical stage on November 10, 2025, when the Central Bank of Brazil (BCB) issued three resolutions simultaneously. Together, the resolutions clarify which entities must be licensed, set minimum capital requirements, and connect cryptocurrencies with the country's foreign exchange rules.

Any company that allows customers to trade, hold or send cryptocurrencies (i.e., virtual asset service providers (VASP) must submit an authorization application by October 30, 2026. The application materials must include a "reasonable assurance report" issued by an audit firm registered with the securities regulatory authority to prove that the company's anti-money laundering and sanctions control measures are actually effective. Simply stating compliance is no longer enough and must be confirmed by an independent third party.

The entry threshold is not low. The minimum capital requirements range from approximately 10.8 million reais to 37.2 million reais (approximately US$2 million to US$6.7 million), depending on the type of license, and the Central Bank of Brazil prohibits operators from using shared office space as a registered address. The report estimates that there are currently about 120 service providers serving the market, most of which do not have formal licenses.

Foreign companies that previously provided services to Brazil through offshore shell companies must now move operations into Brazil within 270 days. The scope of supervision is very precise, and the report bluntly stated its purpose: to end the era of "Portugal websites, global mobility, and no local presence."

The report calls Brazil a "stablecoin country." About 80% of the declared crypto trading volume is conducted through tokens anchored in the US dollar; of which USDT alone accounts for 88.7% of the traffic. Between 2019 and 2025, the total stablecoin trading volume reached 1.13 trillion reais. Even in the context of years of tightening regulation, from exchange closures to ATM promotion, Tether's USDT has been redeemable for cash at 24000 ATMs across the country.

This direct or indirect dependence on foreign currencies is why Brazil's central bank is more deeply involved in cryptocurrency regulation than other regulators. CertiK pointed out: "When three out of every four reals in crypto assets flow through instruments anchored in foreign currencies, this phenomenon is no longer just a consumer protection issue, but a monetary policy issue. This really largely explains what follows in the report: why central banks, rather than capital market regulators, dominate the regulatory framework; why foreign exchange and cross-border flows are at the heart of the rules; and why stablecoins will lead the next wave of regulation."

According to CertiK's own Hack3d tracking data, in the first half of 2026, 344 security incidents caused industry losses of US$1.32 billion. Among them, wallet intrusions caused $444.5 million in losses, and phishing attacks caused $366.3 million in losses. The two biggest losses-Kelp DAO ($291 million) and Drift Protocol ($285 million)-stem from operational and infrastructure failures rather than smart contract vulnerabilities.

Marcos Rocha of Veirano Advogados, a law firm that participated in the application consultation, told CertiK that the market underestimated the complexity of the work. "The most common issue we observe is underestimating the complexity and time period involved in preparing authorization applications," he said. He added: "The review will be thorough, detailed and highly technical."

Antônio Neto, head of Latin America growth at the Solana Foundation, described a clear trend towards licensed operators. "The first real wave we saw was that projects chose to operate under an authorized PSAV (virtual asset service provider) rather than applying for their own licenses," he said. He also pointed out in a subsequent section of the report: "The Brazilian market is moving structurally towards a regulated track."

Capital thresholds and guaranteed reporting bottlenecks will reshape the industry landscape. The core point of the report is that the license itself becomes an asset, and the acquisition of authorized local operators becomes a fast track for foreign entrants. The report points out that this is the same pattern after the implementation of the European MiCA and Dubai VARA regulatory frameworks, where unlicensed transaction volumes are shifted to survivors.

The report clearly identifies several grey areas, including unmanaged wallets, DeFi front-ends and tokenized securities. The Securities Regulatory Agency (CVM) said these fall within its jurisdiction regardless of the underlying blockchain. CVM pointed out that tokenized stocks are still stocks.

report concluded that the Brazilian market is at a stage where "proven capabilities replace committed capabilities."

For the approximately 120 service providers currently serving Brazilian users, authorization applications must be submitted to the Central Bank of Brazil by October 30, 2026, accompanied by an independent assurance report.