Brazil’s crypto framework raises the bar for banks and exchanges

At a glance

What this is: Brazil’s central bank has moved crypto activity into a formal supervisory framework that combines authorisation, AML, cybersecurity, and capital requirements.

Why it matters: For IAM, PAM, and compliance teams, the practical issue is that crypto service delivery now depends on provable access governance, transaction monitoring, and operating controls that satisfy bank-style supervision.

Context

Brazil’s crypto framework is primarily a governance story, not a product story. The central bank has extended financial-sector supervision into virtual-asset activity because crypto now sits inside the same risk perimeter as payments, custody, and cross-border value movement. That means firms cannot rely on informal operating models, especially where customer assets, transaction monitoring, and security controls intersect.

The identity and access implication is straightforward: once a crypto business is treated like a supervised financial institution, its control environment has to prove who can act, who can approve, and how access is limited across systems and counterparties. That makes entitlement governance, operational segregation, and auditability part of regulatory readiness rather than optional security hygiene.

Key questions

Q: What fails when crypto firms do not build regulated access governance into their operating model?

A: They can meet the letter of a licensing process and still fail the substance of supervision. If client assets, approval rights, monitoring, and audit trails are not clearly separated, the firm cannot prove who is authorised to move value or recover service after disruption, which is now a regulatory weakness as well as a security one.

Q: Why do stablecoins create more compliance complexity than traditional transfers?

A: Stablecoins combine real-time settlement with cross-border reach, so compliance must keep pace with the transfer itself. Differing thresholds, reporting rules, and supervisory expectations make manual processes brittle, and that fragility grows as transaction volume and jurisdiction count increase.

Q: What signs show that a crypto firm is not ready for bank-style supervision?

A: Common warning signs include unclear control ownership, weak segregation between client and firm assets, incomplete audit evidence, and transaction monitoring that cannot explain cross-border wallet activity. If the firm cannot produce consistent records for those areas, it is likely to struggle with both compliance reviews and operational resilience expectations.

Q: How should compliance teams and security teams share responsibility under crypto regulation?

A: Compliance should define the regulatory obligations, evidence requirements, and reporting thresholds, while security should prove that identity management, access control, and resilience mechanisms can satisfy them in practice. The shared responsibility is to make the controls auditable, repeatable, and tied to the specific services the firm offers.

Technical breakdown

Why virtual-asset supervision now looks like financial-services governance

Brazil’s framework matters because it pulls crypto firms into an authorisation model that resembles supervised banking operations. Instead of treating exchanges, custodians, and intermediaries as loosely governed technology businesses, the rules expect documented controls, accountable roles, and supervisory oversight. That changes the security baseline: access, record-keeping, audits, and incident response become regulated operating requirements. For firms serving customers or moving value across borders, the question is no longer whether controls exist in policy, but whether they are demonstrable in practice and aligned to the firm’s actual activity profile.

Practical implication: Practitioners need to map crypto services to regulated control owners, evidence streams, and approval paths before supervisory review starts.

How stablecoin transfers become an identity and monitoring problem

The framework’s treatment of stablecoins as FX-linked activity closes a long-standing gap between wallet movement and regulated transfer oversight. Once transactions such as international payments, card-related transfers, or flows to and from self-custodied wallets fall inside supervisory scope, firms need reliable customer identification, transaction monitoring, and reporting logic. That is not just a compliance workflow. It is an identity governance problem because the firm must know which customer, wallet, and counterparty relationship is behind each transfer and whether the activity fits the declared risk profile.

Practical implication: Security and compliance teams should align wallet attribution, transaction monitoring, and customer identity data before cross-border volume increases.

What cybersecurity safeguards mean when regulators expect service resilience

Brazil’s rules require documented security measures, identity management controls, continuity planning, and incident response for systems and methods that deliver crypto services. That is important because crypto firms often depend on complex service chains, third-party infrastructure, and sensitive key or account handling. When smart contracts are part of the service model, the framework also expects risk assessment, testing, and ongoing monitoring for vulnerabilities. In practical terms, the regulation does not just ask whether a firm is secure. It asks whether the firm can prove resilience, recover service delivery, and govern the access paths that make the service possible.

Practical implication: Teams should treat continuity, identity management, and smart-contract monitoring as supervisory evidence, not separate technical projects.

Threat narrative

Attacker objective: The attacker’s objective is to move value or exploit service weaknesses while avoiding the monitoring, reporting, and resilience expectations now applied to regulated crypto activity.

1. Entry occurs through poorly governed crypto service operations that expose customer-facing transaction paths, custody workflows, or smart-contract dependencies to abuse.
2. Credentialed access and platform controls then become the leverage point for moving funds, masking activity, or bypassing monitoring and reporting expectations.
3. The impact is regulatory and operational: firms face fraud exposure, weak auditability, and the inability to prove that transaction controls and security safeguards are working.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Crypto regulation is becoming identity governance by another name. Once a virtual-asset firm is required to prove authorisation, segregation of client assets, auditability, and monitored transfers, access governance stops being an internal IT concern. The operating model now has to show who can touch customer value, who can approve exceptions, and how those privileges are reviewed. For practitioners, the policy question is no longer whether the business has controls, but whether the controls are defensible to a supervisor.

Stablecoin compliance creates a transaction identity problem, not just an AML problem. Brazil’s treatment of stablecoin movement as FX activity means firms need consistent linkage between customers, wallets, counterparties, and transaction context. That is where traditional KYC often falls short because it identifies a person at onboarding but not necessarily the live behaviour of the wallet they control. Practitioners should expect stronger demand for transaction-level attribution and monitoring evidence.

Security baseline requirements are now part of market access. The framework effectively turns cybersecurity into a licensing condition for crypto service delivery. That matters because resilience, incident response, and smart-contract governance are no longer post-incident concerns; they are part of whether the business can operate at all. Firms that separate compliance from security will struggle to evidence readiness. The practical conclusion is that operating controls and supervisory controls are converging.

Governance debt will separate scaled players from fragile ones. Firms that already have clear client asset segregation, documented controls, and repeatable monitoring will adapt faster than smaller or offshore operators that relied on light-touch oversight. This does not just raise compliance effort. It changes the competitive structure of the market by rewarding institutions that can sustain auditable identity, access, and transaction governance over time.

Brazil’s framework signals a wider LATAM shift toward supervised crypto operating models. The region’s large institutional and retail adoption means regulators are increasingly forcing crypto into the same accountability structure as traditional financial services. For practitioners, that means any cross-border or multi-jurisdiction operating model should now assume bank-grade evidence demands, especially where identity, custody, and monitoring intersect.

What this signals

Crypto supervision is becoming a control-design exercise. Firms that still treat compliance as a reporting function will find the gap widening as regulators expect evidence of access governance, segregation, and recovery readiness. The practical signal for practitioners is to align identity controls with licensed services before market expansion forces the issue.

Transaction identity will matter more than onboarding identity. A customer who is verified at signup can still create risk if the live wallet, counterparty, or transfer pattern is not visible to monitoring tools. The programme implication is to connect identity data with on-chain activity so risk scoring reflects what the customer is doing now, not only who they were at onboarding.

For practitioners

• Map crypto services to regulated control owners Document who owns authorisation, custody, monitoring, audit, and incident-response controls for each virtual-asset service line and make the mapping available for supervisory review.
• Strengthen wallet attribution and transaction monitoring Align customer identity data with on-chain monitoring so transfers involving self-custodied wallets, stablecoins, and cross-border payments can be attributed and reported consistently.
• Separate client assets from operating assets Enforce segregation rules in custody and exchange workflows so client balances cannot be reused, commingled, or handled through ambiguous approval paths.
• Document resilience and incident-response evidence Keep continuity plans, recovery procedures, and security test records ready for systems that deliver crypto services, including any smart-contract dependencies.

Key takeaways

• Brazil’s crypto rules make authorisation, monitoring, and resilience part of the same governance conversation, not separate workstreams.
• The biggest compliance pressure point is the link between customer identity and live wallet activity, especially for stablecoins and cross-border transfers.
• Firms that can evidence access segregation, auditability, and incident readiness will be better positioned than those still operating with informal controls.

Key terms

• Virtual Asset Service Provider: A virtual asset service provider is a business that offers services involving crypto assets, such as exchange, transfer, custody, or related intermediated activity. In practice, VASP classification matters because it determines who must participate in regulated information exchange and which controls govern transfer approval.
• Travel Rule: A Travel Rule is a regulated requirement for financial platforms to exchange originator and beneficiary information during qualifying transfers. In crypto, it turns transfer handling into an identity and compliance workflow, where the platform must know which counterparties can receive data and how that exchange is recorded.
• Client asset segregation: Client asset segregation means customer assets are kept separate from the firm’s own holdings and cannot be reused for the firm’s purposes. In regulated crypto markets, it is a core protection for customer funds and a key audit point for proving responsible custody.
• Transaction Monitoring: Transaction monitoring is the process of detecting, reviewing, and escalating activity that may indicate fraud, money laundering, or other financial crime. It combines rules, investigation workflows, and documentation so organisations can explain why a case was flagged and what was done next.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management for practitioners who need to evidence control ownership and operating discipline. It helps security and compliance teams align identity governance with the broader assurance demands of regulated environments.