Brazil Crypto Licence Deadline: Costs, Gaps, and Compliance Risk
Brazil's 30 October 2026 application deadline for crypto exchange licences has landed, and the industry is anything but settled. Exchanges that filed in time can continue operating while the Banco Central do Brasil (BCB) processes their applications — a review that practitioners say can take up to two years. Those that missed the cutoff must wind down services within 30 days. Yet even for those who did file, the harder work is only beginning: unresolved questions on self-custody wallet identification, a $100,000 international transfer cap, and unclear minimum reporting thresholds are already generating compliance risk across the sector. For accounting firms, auditors, and CFOs advising Brazilian virtual asset service providers (VASPs), these gaps carry direct implications for how transaction records are structured, how AML controls are documented, and how capital adequacy is presented to regulators.
How Brazil Got Here: The Regulatory Framework
Brazil formalised its VASP regime in November 2025, placing crypto exchanges, custodians, and related service providers under BCB supervision. The country's appetite for digital assets is significant context: Chainalysis data cited in Cointelegraph's reporting puts Brazilian crypto activity at $252.5 billion between July 2025 and June 2026, ranking the country first globally for grassroots adoption. That scale made a supervised framework a political and financial-stability priority, not a peripheral experiment.
The framework assigns licensing obligations based on service type, with capital floors, technical certification requirements, custody audits, and AML controls all forming part of the authorisation package. The BCB is the sole competent authority for reviewing applications, meaning there is no distributed or state-level licensing pathway to fall back on.
The two-year review window and what it means operationally
Fabio Cendão, founding partner at FCM Law in Brazil, described the filing itself as "the easy part." Once an application is in, a VASP can keep its doors open during the review period, but it must operate as if the final authorisation conditions already apply. That creates an unusual position: a business is not yet fully licensed, yet it is expected to maintain the compliance infrastructure of one. Accounting teams need to reflect that status accurately in financial statements and regulatory reporting, particularly when categorising provisions for compliance costs and contingent liabilities arising from licence uncertainty.
The Capital Requirement Problem for Smaller Operators
Minimum capital requirements under the Brazilian rules range from 10.8 million Brazilian reais (approximately $2 million) to 37.2 million reais, depending on the scope of services offered. Cendão warned that for smaller exchanges, accumulating that capital while simultaneously funding technical certification, custody audits, and ongoing AML controls could make compliance economically unviable.
Market concentration risk
If smaller operators exit — either by missing the deadline or by finding compliance costs prohibitive — the market will consolidate around larger, better-capitalised platforms. For accounting firms that serve a broad range of VASP clients, this is a client-portfolio risk worth pricing in now. Operators that cannot meet the capital threshold face a forced wind-down, and the mechanics of that wind-down carry their own unresolved questions (addressed below).
For CFOs at mid-sized exchanges, the capital adequacy calculation is not simply about having the funds on hand. It is about demonstrating to the BCB that those funds are maintained in the right form, are not double-counted against operational reserves, and are reconcilable against audited accounts. Binance files for Brazil crypto licence ahead of the October deadline — and even large operators like Binance have flagged open questions to the regulator, which underscores that capital adequacy alone does not resolve the compliance picture.
Three Open Regulatory Questions Driving Uncertainty
Thiago Sarandy, Binance Brazil's general manager, told Cointelegraph that the industry's core ambiguities cluster around three specific areas. The BCB has not yet responded to questions submitted by ABCripto, the Brazilian crypto industry association. Until it does, exchanges are making judgment calls on rules that carry enforcement consequences.
Self-custody wallet identification
Brazil's rules require exchanges to verify the origin and destination of crypto transfers, including those involving self-custodial wallets. That is a meaningful technical and procedural challenge. Self-custody wallets by definition are not held on a regulated platform, so there is no counterparty record to query. The FATF Travel Rule framework provides some guidance on this globally, but Brazil has not yet published detailed technical specifications for how exchanges should satisfy the requirement in practice. Until they do, exchanges must design their own procedures — and those procedures may not survive a BCB audit if the regulator later takes a different view.
For accounting and compliance teams, this creates a documentation challenge. Every self-custody transfer in or out of a Brazilian exchange should be flagged in the transaction ledger, with whatever enhanced due diligence the exchange has applied noted in the audit trail. Using reliable crypto compliance reporting processes to maintain that trail is not optional — it is the only defence if the BCB later asks why a particular transaction was processed without a verified destination.
The $100,000 international transfer cap
A $100,000 limit applies to certain international crypto transfers where the counterparty is not authorised to operate in Brazil's foreign exchange market. The word "certain" is doing a lot of work here, because the BCB has not published a definitive list of transaction types that fall within or outside the cap. Sarandy flagged this directly as a source of operational uncertainty. Exchanges that apply the cap too narrowly risk regulatory breach; those that apply it too broadly may obstruct legitimate business flows and face commercial pushback from institutional clients.
From a digital asset accounting software perspective, this cap needs to be configured as a hard rule in transaction-monitoring systems, but it cannot be configured correctly until its scope is clear. In the interim, conservative firms are applying it to all international transfers with unauthorised counterparties and documenting that approach explicitly.
Minimum reporting thresholds
Sarandy also highlighted uncertainty around the minimum transaction value that triggers a reporting obligation. Without a defined threshold, exchanges face a binary choice: report everything (which floods the BCB with data and strains internal systems) or apply their own threshold and risk under-reporting. Sarandy warned that inconsistent approaches across the industry "put in jeopardy the oversight capacity" of the regulator — a concern that is as much about systemic data quality as it is about individual firm liability.
The Banking Channel Cutoff from 6 November
One of the most operationally immediate consequences of the deadline is the rule change taking effect on 6 November 2026. From that date, banks and payment institutions in Brazil face restrictions on conducting crypto-related transactions with providers that have not been authorised (or at least applied for authorisation). This is not a soft preference — it is a hard operational constraint on the Brazilian banking sector.
Implications for unlicensed provider relationships
For any exchange that missed the 30 October filing deadline, the 6 November banking restriction is existential. Without access to fiat on-ramps and off-ramps through the regulated banking system, a crypto exchange cannot function commercially. Marcelo de Castro Cunha Filho, a lawyer at Machado Meyer, noted that it remains unclear how exchanges in this position should return crypto assets to customers who either have no account with an authorised provider or who have not consented to a transfer of their assets. That is a genuine legal gap with accounting consequences: if an exchange cannot return assets cleanly, it may be holding liabilities on its balance sheet with no clear settlement path.
Accounting firms advising affected clients should document this exposure now and consider whether provisions need to be raised in the current reporting period. The 30-day wind-down window from the filing deadline is tight, and the absence of regulatory guidance on customer asset return makes the provision calculation speculative — which itself needs to be disclosed.
What Accounting and Compliance Teams Should Do Now
The regulatory picture in Brazil is partially drawn. The framework exists, the deadline has passed, and enforcement is imminent. But the detail-level guidance that makes compliance operational has not fully arrived. That gap is the working environment for the next several months.
Immediate priorities for firms advising Brazilian VASPs
First, confirm that every VASP client has either filed its BCB application or has a documented plan for the 30-day wind-down. The absence of a filing is not an ambiguous situation — it is a defined regulatory event with a defined timeline.
Second, map each open regulatory question (self-custody ID, the $100k cap, reporting thresholds) to the client's transaction-monitoring configuration and flag where the current setup depends on assumptions rather than published guidance. Those assumptions should be documented and revisited as soon as the BCB responds to ABCripto's submissions.
Third, review capital adequacy presentations. The BCB's capital floors are in Brazilian reais, and exchange-rate movements between now and the completion of a multi-year review process could affect how a USD-reported firm presents its position. Hedging strategy and the accounting treatment of any hedges need to be consistent with the firm's broader financial statements.
Fourth, consider the AML audit trail for self-custody transactions specifically. Firms should review how AI-driven AML controls are reshaping transaction monitoring obligations globally, because Brazil's self-custody identification challenge is a local instance of a problem regulators worldwide are beginning to address systematically. Aligning Brazil-specific procedures with emerging international practice reduces the risk of having to rebuild systems when BCB guidance eventually arrives.
Finally, crypto bookkeeping software used by Brazilian exchange clients should be capable of flagging transactions by counterparty authorisation status, applying configurable transfer caps, and producing audit-ready reports that the BCB can interrogate. If the current toolset cannot do that, a gap analysis is overdue.
Frequently Asked Questions
What happens to exchanges that missed the 30 October 2026 deadline?
They must cease providing services within 30 days of the deadline. From 6 November, Brazilian banks and payment institutions are also restricted from processing crypto transactions with providers that have not filed for authorisation, which effectively cuts off fiat access for unlicensed operators.
How long does the BCB licence review take?
According to practitioners cited in Cointelegraph's reporting, the review process can take up to two years. During that period, exchanges that applied on time are permitted to continue operating under the pending-authorisation status.
What are the minimum capital requirements for Brazilian crypto exchanges?
They range from 10.8 million Brazilian reais (approximately $2 million) to 37.2 million reais, depending on the specific services the exchange offers. These figures sit alongside additional requirements for technical certification, custody audits, and AML controls.
Why is self-custody wallet identification a compliance problem?
Brazil's rules require exchanges to verify the origin and destination of all crypto transfers, including those to and from self-custodial wallets. Because self-custody wallets are not held on regulated platforms, there is no counterparty record to query. The BCB has not yet published technical specifications for how exchanges should satisfy this requirement, leaving firms to design their own procedures under enforcement risk.
What does the $100,000 international transfer limit cover?
The cap applies to certain international crypto transfers where the counterparty is not authorised to operate in Brazil's foreign exchange market. The precise scope of "certain" transfers has not been fully defined by the BCB, which is one of the open questions ABCripto has submitted to the regulator for clarification.
Source: Cointelegraph