Brazil's $319B Crypto Market Faces October Licensing Deadline: CertiK

🇧🇷 Brazil's crypto market is entering a new era.

With the October 30, 2026 authorization deadline approaching, VASPs face a fundamental shift: compliance is no longer about promises—it's about proving security, governance, and operational readiness.

Any company that lets customers trade, hold, or send crypto—a virtual asset service provider, or VASP—must file for authorization by October 30, 2026. The application has to include a "reasonable assurance report" from an audit firm registered with the securities regulator, attesting that the firm's anti-money-laundering and sanctions controls actually work. Saying you're compliant is no longer enough; an independent party has to confirm it.

The entry costs are not small. Minimum capital runs from roughly R$10.8 million to R$37.2 million (about $2 million to $6.7 million), depending on the license category, and the BCB bars operators from using co-working spaces as their registered office. The report estimates about 120 providers currently serve the market—most without a formal license.

Foreign firms that served Brazil from offshore shells now have to bring operations onshore within 270 days. The perimeter is precise, and the report is blunt about its purpose: to end the era of a Portuguese-language website, global liquidity, and no local presence.

And this reliance, direct or indirect, in foreign money is the reason why the Central Bank is more involved with crypto than any other regulator. “When four out of every five reais in crypto pass through an instrument pegged to a foreign currency, the phenomenon ceases to be a matter of consumer protection and becomes a matter of monetary policy,” CertiK argues. “That single fact explains much of what follows in this report: why it is the Central Bank, and not the capital markets regulator, that leads the regime; why foreign exchange and cross-border flows are at the heart of the rules; and why stablecoins head the next regulatory wave.”

Marcos Rocha from Veirano Advogados, a law firm that advised on the filings, told CertiK that the market underestimated the work. "The most common issue we have observed is the underestimation of the complexity and timing involved in preparing an authorization application," he said. He added that "the review will be thorough, detailed, and highly technical."

Antônio Neto, Head of Growth LATAM at the Solana Foundation, described a growing swing toward licensed operators. "What we're seeing as the first real wave is projects choosing to operate under an authorized PSAV rather than pursue their own license," he said. Later in the report he argued the "Brazilian market is structurally moving onto the regulated rail."

The capital floor and the assurance bottleneck will reshape the field. The report's thesis is that a license becomes an asset, and acquisition of an already-authorized local operator becomes the fast route in for foreign entrants. It points to the same pattern after Europe's MiCA and Dubai's VARA regimes, where unlicensed volume migrated to the survivors.

There are gray zones the report flags plainly, including non-custodial wallets, DeFi front-ends, and tokenized securities, which the securities regulator (the CVM) says remain its territory regardless of the blockchain underneath. A tokenized share, the CVM has stated, is still a share.

The report's verdict explains that Brazil's market is "in which the ability to prove replaces the ability to promise."

For the roughly 120 providers now serving Brazilian users, the application must reach the Central Bank by October 30, 2026, carrying an independent assurance report.