Notifications
Clear all
Topic starter
12/07/2026 12:23 pm
TL;DR: Brazil’s Banco Central do Brasil has published resolutions that bring custodians, exchanges, intermediaries, and cross-border stablecoin activity into a formal authorisation and supervision framework, with capital thresholds, AML obligations, cybersecurity safeguards, and a February 2026 deadline, according to Chainalysis. The practical shift is that crypto firms now have to operate like regulated financial institutions, not adjacent technology businesses.
NHIMG editorial — based on content published by Chainalysis: Brazil's crypto regulation framework and what it means for firms
By the numbers:
- In 2024, $2.2 billion was stolen from cryptocurrency services.
Questions worth separating out
Q: How should firms align crypto onboarding with transaction monitoring under new regulation?
A: They should treat onboarding as the first control point, not the only one.
Q: Why do stablecoins create more compliance complexity than traditional transfers?
A: Stablecoins combine real-time settlement with cross-border reach, so compliance must keep pace with the transfer itself.
Q: What control failures matter most in regulated crypto operations?
A: The most common failure is fragmentation between compliance, security, and operations.
Practitioner guidance
- Map SPSAV authorisation requirements Build a control inventory that maps every crypto activity to the SPSAV authorisation pathway, supervising authority, and local operating structure before February 2026.
- Align client identity and transaction monitoring Connect onboarding, Travel Rule screening, and transaction monitoring so high-risk transfers can be traced back to a verified customer identity and documented decision path.
- Document cybersecurity and continuity evidence Create auditable records for incident response, continuity, access control, and sensitive-data protection so operational security can be demonstrated during supervision.
What's in the full article
Chainalysis's full analysis covers the operational detail this post intentionally leaves for the source:
- Detailed resolution breakdown for SPSAV authorisation, supervision, and cross-border operating requirements
- Specific AML, reporting, and Travel Rule obligations for virtual asset and stablecoin transactions
- Capital threshold treatment by activity type and the practical implications for market entry
- Chainalysis commentary on how banks, custodians, and issuers may adjust their operating models
👉 Read Chainalysis’ analysis of Brazil’s new crypto regulation and compliance requirements →
Brazil's crypto rules: what do they mean for compliance teams?
Explore further
12/07/2026 12:37 pm
Regulated crypto is becoming an identity and controls problem, not just a payments problem. Brazil’s framework makes client identification, monitoring, and recordkeeping part of the operating baseline for virtual assets. That pulls identity governance, transaction surveillance, and compliance evidence into one operating model. For practitioners, the operational lesson is that crypto services now need the same discipline applied to access, assurance, and auditability as other financial systems.
A question worth separating out:
Q: Who is accountable when a crypto firm’s controls fail under supervision?
A: Accountability sits with the licensed entity and its designated control owners, not with the regulator or the technology stack. Firms need named responsibility for each activity, documented policies, and clear escalation paths for incidents, audits, and third-party dependencies. That is what turns supervision into an enforceable operating model.
👉 Read our full editorial: Brazil's crypto framework raises the bar for banks and exchanges
