CMS Expert Guide to Crypto Regulation in Brazil

The Central Bank of Brazil (BCB) is the regulatory agency responsible for regulating the provision of virtual asset service providers (VASPs) and their services, but it has not yet published specific rules for the provision of this service or what the applicable compliance rules may look like. However, it is likely that the existing rules will apply, as set out in Circular BCB No. 3,978, of January 23, 2020. This regulation deals with guidelines that operators must comply with regarding (i) Anti-Money Laundering and Terrorist Financing (AML/FT), (ii) risk assessments, (iii) KYC, KYP and KYE procedures, (iv) registration of operations, (v) monitoring and analysis of suspicious operations, (vi) reporting to the Financial Activities Control Board (COAF), (vii) monitoring mechanisms and (viii) control and evaluation of effectiveness.

In addition, there is the industry association ABCripto (Brazilian Association of Cryptoeconomics) which aims to build a set of best practices for operating in the crypto market as a measure of self-regulation in the sector. Provider membership is not mandatory, but is widely regarded as an indicator of a credible governance practice.

Adherence to ABCripto requires compliance with standards, notably its Self-Regulatory Code and the Manual of Good Practices in the Prevention of Money Laundering and Terrorism Financing (“AML/TF Manual”). Among the obligations withing the Code are those of observing guidelines such as: (i) preventing fraud and money laundering, through the creation of policies and procedures that inhibit this occurrence; (ii) prevention of corruption; and (iii) information control and confidentiality.

There is also a mechanism established by ABCripto consisting of the duty to report suspicious operations and situations to the Financial Activities Control Board (COAF). Although virtual asset service providers are not listed as institutions required to report their transactions to COAF under Law No. 9,613/1998, reporting is seen as a good practice, since virtual asset providers perform activities that are similar to those that are subject to the requirements of that law.

In Brazil, Crypto is regulated according to the Law No. 14,478, of December 21, 2022 (“Virtual Assets Act”).

The Virtual Assets Act deals with guidelines for providing services with virtual assets and for regulating providers of these services. The Act defines virtual assets as a digital representation of value that can be traded or transferred electronically and used for making payments or for investment purposes. It also provides for (i) prior authorization for the provision of services; (ii) the guiding principles of the activity; (iii) the definition of virtual asset service provider services; and (iv) to set new criminal responsibilities in the intermediation of operations involving fraud, in addition to increasing penalties if the practice occurs within the scope of regulations that combat money laundering and organised crime.

The provisions of question 1 apply to this response. In the event that cryptoassets are characterised as securities, Resolution CVM No. 50 of August 31, 2021 applies.

Resolution CVM No. 50 also deals with guidelines that operators must comply with regarding (i) Anti-Money Laundering and Terrorist Financing (AML/FT) policies, (ii) internal risk assessment, (iii) internal procedures and controls, (iv) management responsibilities, (v) KYC procedures, (vi) due diligence by independent auditors, (vii) monitoring, analysis and reporting of suspicious transactions, (viii) file keeping, and (ix) compliance with sanctions imposed by the United Nations Security Council (UNSC).

The Virtual Assets Act lists the services related to virtual assets which will be regulated, including the issuance, exchange, staking, transfer, sale and custody of assets.

However, the regulations that will set out detailed guidance on this issue are currently under Public Consultation by the Central Bank of Brazil (BCB).

Meanwhile, it is noteworthy that the Brazilian Revenue Service Normative Instruction No. 1,888, of 2019 states that any legal entity, even if not financial, that offers services related to operations carried out with cryptoassets, including intermediation, negotiation or custody, and that can accept any means of payment, including other cryptoassets, is subject to some reporting requirements.

Tokenization itself is not subject to prior approval or registration with the Securities and Exchange Commission of Brazil (CVM). CVM has recognised the differentiation of NFTs for fungible assets, but there are still no requirements. However, in relation to the direct sale of tokens by issuers, if these tokens are configured as securities, both the issuers and the public offering of such tokens are subject to the rules established by the securities market and the applicable regulations, in accordance with Guidance Opinion CVM No. 40.

Offshore businesses can provide services to local consumers under certain circumstances. As the regulations for virtual asset service providers (VASPs) have not yet been published by the Central Bank of Brazil (BCB), the requirements to offer services in Brazil, such as a Brazilian license, are not yet applicable. Services currently offered by offshore businesses are not prohibited but must follow certain guidelines.

Cryptoassets that are characterized as securities must follow the rules established by the securities market and the Brazilian Securities and Exchange Commission (CVM), both in relation to their issuance and distribution.

CVM understands, in accordance with Guidance Opinions CVM No. 32 and 33, that foreign VASPs securities offering operations do not constitute an irregularity if (i) the investor prospecting activity has been carried out abroad and (ii) the operation is not characterized as a public offering to residents in Brazil.

Therefore, for the time being, VASPs outside Brazil can offer services freely as long as the cryptoassets offered are not characterized as securities. If this is the case, they cannot act on active solicitation basis, but only on reverse solicitation basis under the aforementioned guidelines.

Operators must, , in order not to be perceived as irregular offerors, take effective measures to prevent the general public from having access, indicate that the investments were not created for the general public, and not have texts to attract Brazilian investors, even if they are in a foreign language.

Virtual asset service providers (VASPs) will need a license to act as crypto exchanges, in addition to formally registering as a company in Brazil and reporting to the Financial Activities Control Board (COAF), as well as to Central Bank of Brazil (BCB) and the Securities and Exchange Commission of Brazil (CVM), depending on the provided activities.

As the regulations for the Virtual Assets Act, which are the responsibility of the BCB, are still in the process of Public Consultation, there are no further details on how to obtain the license, its costs or the estimated time of this process. As soon as the regulations are published, which is expected to be at some point in 2024 according to the regulator's priority list, the BCB will publish the licensing rules and will not be able to set a deadline of less than 6 months for VASPs to comply with these rules.

Using the existing licensing process of the BCB as a proxy, one can expected that a new license would take approximately a year to be used.

When the final regulations are published by the Brazilian Central Bank (BCB), companies may find it easier and quicker to obtain a VASP licence if they are already based in Brazil or have active operations within Brazilian territory. To meet this criterion, it is essential that the company is already reporting its activities to the Brazilian Federal Revenue Service. For companies without prior local operations, we estimate the VASP licence process could take between one and two years once the regulations are published.

For now, all VASPs can operate without a specific license, unless they are required to have a license because their activities fall under traditional banking, payments or securities regulation.

Using the existing licensing process of the BCB as a proxy, one can expected that a new license would demand an initial capital investment of at least around 2 million BRL.

For now, all VASPs can operate without a specific license, unless they are required to have a license because their activities fall under traditional banking, payments or securities regulation.

If the virtual asset service provider (VASP) provides services that are characterized as payment, credit or investment, it may need to comply with the rules of the Central Bank of Brazil (BCB) or the Securities and Exchange Commission (CVM).

The Anti-Money Laundering rules in relation to entities regulated by the BCB are set out in Circular BCB No. 3,978, of January 23, 2020. This regulation deals with guidelines that operators must comply with regarding (i) Anti-Money Laundering and Terrorist Financing (AML/FT) policies, (ii) risk assessments, (iii) KYC, KYP and KYE procedures, (iv) registration of operations, (v) monitoring and analysis of suspicious operations, (vi) reporting to the Financial Activities Control Board (COAF), (vii) monitoring mechanisms and (viii) control and evaluation of effectiveness.

The Anti-Money Laundering rules in relation to entities regulated by the CVM are set out in Resolution CVM No. 50 of August 31, 2021. This regulation deals with guidelines that operators must comply with regarding (i) Anti-Money Laundering and Terrorist Financing (AML/FT) policies, (ii) internal risk assessment, (iii) internal procedures and controls, (iv) management responsibilities, (v) KYC procedures, (vi) due diligence by independent auditors, (vii) monitoring, analysis and reporting of suspicious transactions, (viii) file keeping, and (ix) compliance with sanctions imposed by the United Nations Security Council (UNSC).

Some services related to cryptoassets can be mistaken with payment, credit or investment services, which may require a license from the Central Bank of Brazil (BCB) or the Securities and Exchange Commission (CVM). In these cases, setting up a cryptoasset business in Brazil may be more costly.

Future regulations to be issued by the BCB may cover certain services that are currently regulated separately. Thus, setting up a cryptoasset business after the new regulation has been issued could generate greater scalability and efficiency gains compared to the current regulation.