Brazil's Crypto Licence Deadline Looms as Providers Face Audit Challenges
As Brazil's crypto licence deadline approaches on October 30th, 2026, providers must file their first phase of complete authorisation requests to the Banco Central do Brasil. This filing is not a simple registration form and requires a report from an independent audit firm registered with Brazil's securities regulator, the CVM, covering the effectiveness of anti-money-laundering, counter-terrorist-financing, and sanctions controls.
The report must follow the NBC TO 3000 assurance standard and provide reasonable assurance on whether the firm's controls are effective. An auditor must be able to test how customer due diligence, transaction monitoring, suspicious-activity escalation, sanctions screening, and related governance operate in practice, rather than merely confirm that written policies exist.
The BCB has not published a live total of Phase 1 applications, so there is no verified basis for saying how many firms have filed or that most are unable to file. However, CertiK estimates that about 120 providers fall within the transition and argues that the pool of CVM-registered audit firms able to perform this specialised work is narrow.
The new capital and net-worth requirements run from R$10.8 million to R$37.2 million, depending on the activities and risk components in a provider's model. Custody, intermediation, and brokerage or exchange functions carry different components, so a platform combining several services can face the upper end of the range rather than one flat threshold.