Daniel de Paiva Gomes
Founding partner

Daniel de Paiva Gomes holds a PhD from PUC-SP and a Master’s in Tax Law from FGV Law School São Paulo, complementing his legal background with a Master of Science in Blockchain and Digital Currencies from the University of Nicosia. He holds the Advanced Professional Certificate in International Taxation (APCIT) from the International Bureau of Fiscal Documentation (IBFD) and is a Certified Information Privacy Manager (CIPM) and Certified Data Protection Officer/Brazil (CDPO/BR) by the International Association of Privacy Professionals (IAPP). A practicing attorney, he lectures on digital asset regulation and taxation at renowned institutions including IBMEC, FGV, and IBET, and serves as a professor at theblink.com.br. He sits on the Board of Directors of the Brazilian Association of Cryptoeconomy (ABCRIPTO), co-coordinating the stablecoins working group. Furthermore, he co-coordinates the virtual assets committee at Abracam (Brazilian Association of Foreign Exchange), helping drive strategic national regulatory frameworks and standard legal compliance guidelines.

Eduardo de Paiva Gomes
Founding partner

Eduardo de Paiva Gomes is a PhD candidate at PUC-SP and holds a Master’s in Tax Law from FGV Law School São Paulo, alongside a Master of Science in Blockchain and Digital Currencies from the University of Nicosia. He also holds the Advanced Professional Certificate in International Taxation (APCIT) from the International Bureau of Fiscal Documentation (IBFD). In addition to his legal work as a practicing attorney, he serves as an Administrative Judge on the Municipal Tax Council of the City of São Paulo, teaches digital asset regulation at IBMEC, FGV, and IBET, and is a professor at theblink. com.br. He is the co-coordinator of the stablecoins working group at ABCRIPTO (Brazilian Association of Cryptoeconomy) and the co-coordinator of the virtual assets committee at Abracam (Brazilian Association of Foreign Exchange). Through these prominent leadership roles, Eduardo actively contributes to developing strategic regulatory frameworks, legal compliance guidelines, and tax policies throughout Brazil.

Key Developments and the Latest Trends in Brazil — From a Legal Perspective: the new Central Bank framework for virtual asset service providers in Brazil

Paiva Gomes Advogados advises on legal and tax matters involving cryptocurrencies, digital assets, and digital law more broadly, supporting clients in structuring operations and navigating evolving regulatory frameworks. The firm is particularly active in mandates requiring precise tax treatment of digital transactions, combining legal and economic analysis in a rapidly developing space.

Introduction

Law No. 14,478/2022 is the Legal Framework for Virtual Assets in Brazil. It set out the core definitions and designated a regulator, but left the operational rules to be written, and for years the statute remained without the regulation needed to give it practical effect. That gap has now been closed: in November 2025, nearly three years after the law was enacted, the Central Bank of Brazil (Banco Central do Brasil, the “BCB”) published Resolutions No. 519, 520 and 521 of 2025, which govern the provision of virtual asset services and lay down every requirement for obtaining a license. A defining feature of the new regime is its territorial reach: a foreign entity may not serve the Brazilian market from abroad; to offer virtual asset services to Brazilian clients, it must do so through a Brazilian-incorporated, BCB-authorised entity, which means establishing a local presence.

The framework entered into force on 2 February 2026. Companies already in operation before that date – Brazilian or foreign – were granted a grace period: a transitional window that lets them keep operating until their authorization request is decided, provided they file it by 29 October 2026 (new entrants, by contrast, must be authorized before they may begin).

What gives that window its force is Article 91 of Resolution 520: from 30 October 2026, financial institutions, payment institutions and other institutions authorised to operate by the BCB may no longer carry out or enable virtual asset operations whose counterparty is a provider that is neither authorized nor in the process of authorization in Brazil.

This makes the filing deadline a window of opportunity, not a mere cut-off. Filing in time preserves the right to keep operating while the request is examined; missing it does not bar a later application, but it forfeits that right – the provider must then wait until its license/ authorization is actually granted before it can operate.

What the law regulates and who may provide the services

Under Law No. 14,478/2022, a virtual asset is a digital representation of value that can be traded or transferred electronically and used for payment or investment purposes — expressly excluding national and foreign currency, electronic money, and instruments already qualified as securities or financial assets.

Resolution 520 adopts a closed-perimeter model: only the activities expressly listed may be performed, and anything outside the list is presumed impermissible absent a positive act of the BCB. Each pillar is broader than it first appears. Intermediation reaches well beyond buying and selling: it also covers exchanging virtual assets, managing portfolios, acting as a fiduciary agent, staking and providing virtual asset services in the foreign-exchange market. Custody is not merely holding a private key; it extends to keeping each client’s position up to date and reconciled against the underlying ledger, executing the holder’s transfer instructions, and handling the on-chain events that affect the asset. On this basis, Resolution 520 is built around three regulated profiles: the intermediary, the custodian and the broker, which combines both. These activities may be carried out only by an authorised provider, and “provider” here is itself a category worth unpacking.

A virtual asset service provider — “PSAV” in the Brazilian acronym, a VASP in the international vocabulary — is therefore a genus, not a single type of entity. It comprises two species, each with its own route into the regime.

The first species is the already-authorised institution: a bank, foreign-exchange broker, securities dealer (DTVM) or securities broker (CTVM) that wishes to add virtual asset services to its existing business. Its route is different, not easier: instead of a fresh authorisation proceeding, it files a communication to the BCB together with a technical certification. That certification is demanding in its own right – it consolidates a long list of technical, operational and control requirements – and is far from a formality. And the timing turns on whether the institution already provides virtual asset services: one that already offers them keeps operating, whereas one that is not yet active in virtual assets is, in effect, frozen for ninety days – it may begin the new activities only ninety days after its formal communication to the BCB.

The second species is the VASP company (the SPSAV – sociedade prestadora de serviços de ativos virtuais). Its route depends on whether it was already operating when the resolutions took effect. A new entrant must be authorised before it may begin: it files a complete application and may start only once the BCB grants the licence.

A VASP company already in activity follows a transitional, two-phase route, and this is precisely what delivers the grace period. In Phase 1, filed by 29 October 2026, it proves it was operating on the reference date and must already evidence substantive compliance with the core prudential rules: risk management, cybersecurity and incident response, AML and targeted-sanctions controls, and the accounting and audit standards applicable to BCB-regulated institutions. Phase 2, filed within 60 days of a favourable Phase 1 decision, raises the bar further: the provider must demonstrate compliance with Resolution 520 in its entirety and submit the documents required by the regulation.

For a foreign entity, this two-species structure is also a menu. Since it can reach Brazilian clients only through a Brazilian-incorporated provider, it must choose its vehicle: it may operate through an already-authorized institution that offers virtual asset services, or it may set up an SPSAV of its own. Each path carries a different cost, timeline and degree of control, and the choice is one of the first strategic decisions for any group entering the market.

Prudential parity and the segregation of client assets

A central policy choice of the framework is parity. The BCB set out to impose on virtual asset service providers the same anti-money-laundering, compliance and prudential duties already required of authorised institutions (banks, foreign-exchange brokers, securities dealers (DTVMs) and securities brokers (CTVMs). In practice this means AML/CFT programmes and know-your-customer procedures, a cybersecurity policy with an incident-response plan, structured risk management, a recovery plan, and governance anchored in a designated responsible director.

Of all these duties, the segregation of client assets is the one that best illustrates how the regulation adapts traditional prudential thinking to a crypto-native environment. The underlying principle is orthodox and familiar from banking and securities law: a provider’s own assets must never be commingled with those of its clients, so that client property remains identifiable and recoverable even if the provider fails. What is distinctive is how that principle is applied, because client value sits in two very different forms — fiat and virtual assets — that do not behave the same way.

For funds held in national currency, Resolution 520 takes the conventional route: it requires fiduciary segregation through an individualised payment account for each client. For the virtual assets themselves the regulation is more flexible given that it permits the use of an omnibus wallet – a single wallet aggregating multiple clients’ holdings – as long as the provider keeps the internal records and controls needed to attribute the assets to each client at all times.

The Relevant Service Providers

No provider performs every function in-house, and Resolution 520 anticipates this through a defined figure: the relevant service provider. The concept is specific: it is any party whose service affects the provider’s performance of its activities or the full exercise of its clients’ rights, and the regulation pairs it with an open, exemplificative list: custodians, liquidity providers, market makers, electronic-money issuers and providers of technology specifically related to virtual asset services.

Two features matter most for an international readership. First, a relevant service provider may be located in Brazil or abroad and does not itself require a licence: it operates business-to-business, under contract with the licensed provider, which remains fully and inescapably liable for its acts. This is the principal lawful channel through which a foreign group entity can keep participating in the Brazilian market without being authorised in its own right.

Second, while a baseline applies to every relevant service provider,

some of the enumerated examples carry extra, activity-specific requirements. Custody abroad is one such case: a Brazilian provider may use a foreign custodian only on additional conditions, such as compliance with Brazilian law and regulation, a representative in Brazil, and enforceable guarantees.

Resolution 521: virtual assets enter the FX market for reporting purposes

Resolution 521 produced one of the most misunderstood features of the framework. It brought certain virtual asset services into the foreign-exchange market, but it is essential to be precise about what that means. It is not the settlement of an exchange operation, and it does not, by itself, trigger the financial-transaction tax on FX (IOF-câmbio). It is the inclusion of these services within the FX market for informational and reporting purposes, so that the BCB can monitor cross-border virtual asset flows with the same transparency it applies to traditional foreign exchange.

Four categories of operation are caught: (I) international payment or transfer with virtual assets; (II) transfers of virtual assets to or from a provider’s client to settle an obligation arising from the international use of a card or other electronic means of payment; (III) transfers of virtual assets to or from a self-custody wallet that do not themselves involve an international payment or transfer; and (IV) the purchase, sale or exchange of fiat-referenced virtual assets (stablecoins).

For the first of these (international payments and transfers) the framework sets per-operation limits where the counterparty is not an institution authorised to operate in the foreign-exchange market, and these limits differ by entity type, which forces product-structuring decisions. A VASP company (SPSAV) is subject to a limit of USD 100,000, while a securities broker or dealer (CTVM/DTVM) or a foreign-exchange broker may operate up to USD 500,000. A bank has no such ceiling, but only if it is also a VASP. These thresholds mean that the choice of operating entity is not a back-office detail: it shapes which products, and which ticket sizes, are commercially viable.

Stablecoins are permitted

A frequent question from abroad is whether Brazil has restricted stablecoins. It has not. Stablecoins are not prohibited. The position is more subtle: neither Law No. 14,478/2022 nor the 2025 resolutions regulate the issuance of stablecoins. Resolution 520 establishes only the concept without setting any parameters for issuance. Issuance is therefore permitted but unregulated. The gap is the subject of Bill No. 4,308, currently under discussion in the Chamber of Deputies, which would bring stablecoin issuance expressly within the legal framework.

The absence of an issuance regime does not mean stablecoins sit in a legal vacuum on the use side. They may be freely used in Brazil, in both domestic and cross-border operations: a client may buy, sell, exchange or hold them, and a licensed provider may intermediate those operations, in each case under the ordinary VASP rules (and, where an operation crosses the border, under the foreign-exchange reporting and limits described above). What remains unregulated are the conditions of issuance, not whether stablecoins may circulate and be transacted, which they plainly may.

The tax dimension: consumption-tax reform and DeCripto

The regulatory picture is incomplete without its tax counterpart, and two developments stand out.

The first is Brazil’s consumption-tax reform. Constitutional Amendment No. 132/2023, regulated by Complementary Law No. 214/2025, replaces the existing consumption taxes with a dual value-added tax: the IBS (Imposto sobre Bens e Serviços, a tax on goods and services levied at state and municipal level) and the CBS (Contribuição sobre Bens e Serviços, the equivalent federal social contribution on goods and services). It places the provision of virtual asset services within the specific regime for financial services. The practical challenge will be to delimit, pragmatically, which virtual asset services fall within that specific regime, in light of the products actually offered by each provider and their legal-regulatory qualification. The classification of a given product will drive its tax treatment, so the regulatory and tax analyses cannot be conducted in isolation from one another.

The second is DeCripto, the new crypto-asset reporting declaration introduced by Normative Instruction RFB No. 2,291/2025, with monthly reporting beginning in July 2026. DeCripto marks Brazil’s convergence with the OECD’s Crypto-Asset Reporting Framework (CARF), the global standard for the automatic exchange of crypto-asset tax information. Its most consequential feature for international players is its reach: the obligation extends to providers domiciled abroad that meet the criteria for “providing a crypto-asset service in Brazil”, that is, using a “.br” domain; contracting with a local entity to receive funds from Brazilian residents; directing the service to Brazilian residents (including through local payment means such as Pix); or advertising clearly aimed at the Brazilian public. A foreign provider that touches the Brazilian market through any of these nexuses falls within the Brazilian reporting net, regardless of where it is incorporated.

Conclusion

The 2025 resolutions are a watershed for the Brazilian virtual asset market. They are also demanding. Providers face minimum capital requirements calibrated by modality under a new cost-plus-activities methodology, and a continuous compliance burden modelled on that of regulated financial institutions, alongside the structuring choices imposed by the foreign-exchange and tax regimes. None of this is trivial, and for some incumbents the bar will be high.

Yet the direction of travel is clear and, on balance, positive. By bringing virtual asset service providers within a coherent prudential, foreign-exchange and tax perimeter, Brazil has given the market legal certainty, and institutional legitimacy. The requirements are challenging, but the regulation is an important, and constructive, step in the maturation of the Brazilian market.