Brazil is moving into a more detailed phase of crypto-market supervision. The Banco Central do Brasil (BCB) has adopted two new measures that expand anti-money-laundering reporting for virtual-asset transfers and increase the information that regulated crypto-service providers must supply for supervisory purposes.
The changes were published on September 23, 2026, through Resolutions BCB 588 and 589. The central bank says the measures are intended to strengthen the security and integrity of the virtual-asset market, improve the information available for supervision and provide greater predictability for market participants.
The most visible change for users concerns self-custody wallets. Starting October 1, transfers of virtual assets to or from self-custodied wallets with a value equal to or above the equivalent of US$10,000 must be subject to specific reporting to Brazil’s Financial Activities Control Council, known as Coaf.
At the same time, the BCB is increasing transparency requirements for service providers, including reporting on customer balances, custody, reserves and staking.
SEC Data Show U.S. IPO Activity Accelerates in First Half of 2026→
Robinhood’s Evolving Wealth Management Strategy Targets the Future of Retail Investing→
Fed Rate Hike May Not Rattle Crypto Markets, Grayscale Says→
Solana Tokenized Equity Supply Surges to Record $684M Amid Multi-Platform Expansion→The measures do not ban self-custody.
What Brazil changed on September 23
The BCB’s announcement covers two related but distinct areas.
Resolution BCB 588 modifies Brazil’s anti-money-laundering and counter-terrorist-financing framework. The new provision specifically covers transfers of virtual assets to or from self-custodied wallets when the value is at least the equivalent of US$10,000.
Resolution BCB 589 changes the rules for virtual-asset service providers and other authorized institutions offering virtual-asset services. It expands information requirements and adjusts the timeline for interactions with unauthorized service providers.
The two measures are therefore connected, but they should not be treated as one single reporting rule.
One focuses primarily on transaction monitoring.
The other focuses on institutional reporting and supervision.
The US$10,000 self-custody threshold
The measure that will attract the most attention from crypto users is the new reporting threshold.
From October 1, a transfer of virtual assets with a value of US$10,000 or more involving a self-custodied wallet falls within the specific communication requirement under Resolution 588. The rule applies in both directions: transfers to a self-custodied wallet and transfers received from one.
This distinction is important:
A reporting threshold is not a transaction ceiling.
It does not mean that a Brazilian user is prohibited from moving US$10,000 or more in crypto. Nor does reaching the threshold by itself establish that a transaction is suspicious or illegal.
The obligation is placed on the regulated institution responsible for the relevant transaction reporting framework.
A legal and compliance specialist quoted after the announcement, Thiago do Amaral Santos, described the measure as covering transfers in both directions and distinguished the threshold-based communication from the separate process for reporting suspicious activity.
That distinction is important for users.
Self-custody remains permitted
Brazil’s new rule should not be confused with a ban on self-custody.
A self-custodied wallet is one in which the user controls the private key and can move the assets without requiring a virtual-asset service provider to execute the transfer. Brazil’s existing virtual-asset framework recognizes that structure.
What changes is the amount of information available to the regulated financial system when assets move between an institution and such a wallet.
The BCB explained that self-custody can reduce the amount of information available for monitoring and risk assessment compared with assets held directly by an institution authorized by the central bank.
The regulatory response is therefore centered on traceability and information, rather than eliminating private-key control.
What Resolution 589 adds for service providers
The second major change is broader and more technical.
Resolution 589 requires eligible institutions to provide information related to:
- customer accounting balances;
- virtual assets held in custody, including quantities and financial values;
- aggregate custody positions attributed to individual clients;
- verifiable evidence of reserves by virtual asset;
- customer assets allocated to staking, where the institution provides staking services.
The central bank says these changes improve the data available for supervision and monitoring.
The reporting architecture is also being moved toward more detailed regulatory instructions. Resolution 589 states that the BCB will define the form and additional conditions for sending the information.
This is significant because supervisory reporting is increasingly becoming part of the operational infrastructure of the crypto industry.
Proof of reserves becomes a supervisory data point
The inclusion of verifiable reserve information is especially relevant for custodial platforms.
Proof-of-reserves systems are designed to provide evidence about assets held by an institution, although the strength of such systems depends on methodology, scope, liabilities and verification procedures.
Resolution 589 requires eligible institutions to provide verifiable reserve demonstrations for virtual assets held for clients.
That does not automatically mean the BCB has adopted one universal proof-of-reserves technology.
The resolution instead creates a supervisory requirement for the institution to demonstrate the reserves it holds under the specified framework.
This is part of a wider shift in crypto regulation toward balance-sheet visibility and reconciliation.
Staking enters the supervisory framework
The new rules also explicitly cover staking.
Where an institution provides staking services, it must report the total amount of customer virtual assets allocated to those activities.
That matters because staked assets can have different liquidity and operational characteristics from assets held freely in custody.
For regulators, separating ordinary custody from assets deployed in staking can improve their ability to assess the overall composition of client assets.
For service providers, it means internal systems increasingly need to distinguish different asset states rather than simply tracking a single customer balance.
Expert opinions: the focus is shifting toward traceability
Legal and compliance specialists have highlighted the fact that the new rules address more than simple authorization.
Thiago do Amaral Santos, a digital-assets lawyer and professor at FGV and Insper, said the measures move the focus toward how assets move, where they are held and which positions belong to clients.
That interpretation is consistent with the BCB’s own explanation.
The regulator says the purpose is to strengthen the ability to monitor transactions involving self-custodied wallets and improve the information available for supervisory assessment.
In practical terms, Brazil’s framework is moving toward a model in which the regulated perimeter becomes increasingly data-rich.
A new deadline for dealing with unauthorized crypto providers
Resolution 589 also changes the timeline for relationships between regulated financial institutions and virtual-asset service providers.
From November 6, 2026, financial institutions, payment institutions and other entities authorized by the BCB may not conduct or facilitate virtual-asset-market operations with counterparties that provide virtual-asset services but are not authorized to operate in Brazil, except where expressly permitted by the resolution.
The exact transition dates matter because the rule contains different effective dates.
Brazil’s 2026–2027 crypto-regulation timeline
| Date | Measure | Practical significance |
|---|---|---|
| September 23, 2026 | Resolutions 588 and 589 published | New regulatory framework announced |
| October 1, 2026 | Resolution 588 takes effect | US$10,000+ self-custody transfers enter specific Coaf reporting |
| October 1, 2026 | Resolution 589 art. 91 amendment takes effect | Updated institutional counterparty rules begin |
| November 6, 2026 | Restriction applies | Authorized institutions must cease covered operations with unauthorized virtual-asset providers, subject to exceptions |
| January 1, 2027 | Remaining Resolution 589 provisions take effect | Expanded supervisory reporting on balances, custody, reserves and staking |
The staggered implementation gives companies a short period to adapt systems, reporting processes and counterparties.
What the rules mean for crypto exchanges
For exchanges and other virtual-asset providers, the new requirements increase the importance of internal data architecture.
A compliant platform increasingly needs to know:
Who owns the assets?
Where are they held?
How much is in custody?
Which assets are being staked?
What reserves back customer positions?
Which external counterparties are authorized?
This means blockchain transaction monitoring alone is not enough.
Firms need accounting, custody, compliance and blockchain data to reconcile with each other.
The regulatory shift could therefore increase the importance of specialized compliance software, blockchain analytics, transaction screening and custody controls.
What it means for ordinary crypto users
For retail users, the most important point is that the rules primarily affect transactions involving regulated institutions.
A self-custody wallet is not itself being prohibited.
However, when a user transfers a sufficiently large amount between a regulated provider and a self-custodied wallet, the transaction enters the specific communication framework starting October 1.
Users should also understand that reporting to Coaf is not automatically a criminal finding.
A transaction can be reportable because it meets a defined threshold, while suspicious-activity reporting operates under a different logic.
That distinction is important when evaluating headlines about “crypto surveillance.”
The regulation increases the information available to authorities, but it does not create an automatic presumption that every reported transaction is illicit.
Implications for stablecoins and institutional crypto
The new framework is also relevant to Brazil’s growing stablecoin and institutional-digital-asset market.
Stablecoins often move between exchanges, custodians, businesses and self-custodied wallets. As Brazilian institutions expand their involvement in digital assets, more of those flows can intersect with regulated financial infrastructure.
The emphasis on reserves and custody is particularly relevant for stablecoin-related businesses and institutional platforms.
CryptoQuorum has examined this broader trend in its recent coverage of stablecoin regulation and institutional crypto adoption.
The Brazilian approach fits into a global regulatory trend: digital assets are increasingly being treated as part of financial infrastructure rather than as a separate technology sector.
Brazil is building a more integrated crypto framework
The new measures are not an isolated regulatory event.
Brazil has spent several years developing a framework for virtual-asset service providers, while the central bank has increasingly taken responsibility for the sector.
The existing Resolution 520 established the framework governing virtual-asset service providers and the provision of virtual-asset services by other BCB-authorized institutions.
The September 2026 changes deepen that framework by increasing supervisory visibility.
The direction is significant because Brazil is simultaneously developing advanced digital-payment infrastructure through Pix and the Drex project.
The BCB describes Drex as a regulated environment for transactions involving digital assets, with financial institutions acting as intermediaries and transactions settled within the Drex platform.
The result is an increasingly interconnected digital-finance architecture:
Pix → instant payments
Drex → regulated digital-asset infrastructure
Virtual-asset regulation → supervised crypto intermediaries
Blockchain analytics and reporting → transaction-level monitoring
That makes Brazil an important market to watch for the convergence of traditional finance and digital assets.
What companies need to prepare for
The implementation schedule creates several near-term priorities for market participants.
Compliance systems
Providers need mechanisms to identify transfers involving self-custody and calculate the applicable dollar-equivalent threshold.
Custody reconciliation
Institutions need accurate records matching client balances with assets held in custody.
Reserve reporting
Platforms offering custody must be able to produce verifiable reserve information.
Staking data
Where staking is offered, customer assets allocated to the activity need to be separately identifiable.
Counterparty due diligence
Financial institutions need processes for determining whether virtual-asset counterparties are authorized to operate in Brazil.
Data infrastructure
The BCB’s future instructions on reporting formats mean institutions will need systems capable of adapting to detailed supervisory specifications.
What to watch next
The next important developments will involve implementation rather than another headline policy announcement.
The first milestone is October 1, 2026, when the self-custody reporting requirement becomes effective.
The second is November 6, when the restriction on covered relationships with unauthorized virtual-asset service providers begins to apply.
The third is January 1, 2027, when the expanded reporting provisions covering balances, custody, reserves and staking take effect.
The BCB will also need to define the detailed procedures and conditions for some of the new supervisory reports.
That means the practical meaning of the regulation will become clearer as technical instructions and industry implementation processes develop.
Bottom line
Brazil’s latest crypto regulation measures move the market toward a more detailed supervisory model centered on traceability, custody information, reserve transparency and institutional accountability.
Resolution 588 introduces specific Coaf reporting for virtual-asset transfers involving self-custodied wallets at or above US$10,000, effective October 1, 2026.
Resolution 589 expands the information that eligible institutions must provide about customer balances, custody positions, verifiable reserves and staking, with those reporting provisions taking effect January 1, 2027.
The second resolution also establishes a November 6 deadline for the restriction on covered operations with virtual-asset service providers that are not authorized to operate in Brazil, subject to the exceptions specified in the regulation.
The central bank says the objective is to strengthen the security and integrity of the market while improving supervisory information and predictability for participants.
For users, the central distinction is simple: self-custody remains possible, but large transfers involving regulated intermediaries will generate more regulatory visibility.
For exchanges, banks and other financial institutions, the change is broader. Compliance will increasingly depend on the ability to reconcile blockchain activity with customer balances, custody records, reserves, staking positions and counterparty status.
That makes Brazil’s latest move less about restricting cryptocurrency technology and more about integrating the digital-asset market into the country’s existing financial-supervision framework.
Disclaimer
This article is provided for informational and educational purposes only and does not constitute financial, investment, legal, tax, regulatory or other professional advice. Regulatory requirements can change, and the practical application of the rules may depend on subsequent Banco Central do Brasil instructions and a user’s or institution’s specific circumstances. The US$10,000 threshold described above concerns reporting requirements and does not by itself constitute a transaction ban or a finding of suspicious or unlawful activity. Readers and businesses should review the official regulations and seek qualified professional advice where appropriate.