Custodial wallet / SaaS in Brazil
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Brazil with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASP authorization under Law 14,478/2022 triggers full AML/CTF obligations, including KYC/CDD on all end users (both the SaaS operator's direct customers and, if the white-label client is a VASP, flow-through obligations may apply via contract).
- Registration with COAF (Financial Activities Control Council) as the AML reporting authority; suspicious transaction reporting (STR) to COAF is mandatory.
- Record-keeping obligations for all transactions and KYC documentation for a minimum of 5 years (standard under Brazilian AML framework).
- Tiered capital requirements: BRL 1M–5M (~$200K–$1M USD) depending on activity scope — this acts as an AML/CTF solvency filter.
- SaaS provider must ensure white-label clients also have independent VASP authorization or contractual AML pass-through provisions; ambiguity persists on allocation of SAR/STR duties between platform and white-label client.
Key Restrictions
- Must establish a local entity with CNPJ registration and appoint a local director in Brazil.
- Asset segregation required under VASP custody rules — customer assets must be legally and operationally segregated from corporate assets.
- Proof-of-reserves and/or audit requirements expected under BCB prudential supervision (Resolutions 519, 520, 521/2025 and Joint Resolution No. 14).
- Stablecoins pegged to BRL may trigger additional payment institution authorization from BCB, increasing licensing burden.
- If any hosted assets qualify as securities tokens (per CVM criteria), dual registration with CVM under Resolution 88/2022 may be required.
- Grandfathering period for existing operators has deadlines extending to 2025; post-grandfathering, unauthorized operation is unlawful.
Key Risks
- Regulatory ambiguity: BCB's comprehensive licensing only launched in February 2026; interim enforcement posture and grandfathering deadlines create transitional risk.
- CVM actively enforcing oversight over cryptoasset securities (token offerings) without waiting for full licensing rules — risk of securities classification for custody assets.
- AML allocation between SaaS platform and white-label client is not explicitly resolved in current regulation — potential for dual liability or enforcement gaps.
- Tiered capital requirements (BRL 1M–5M) represent a meaningful cost barrier for smaller SaaS operations.
- Dynamic regulatory landscape: primary government domains and references are frequently updated, creating compliance monitoring burden.
- Brazil has recently tightened derivatives rules and blocked prediction market platforms, indicating a proactive enforcement posture that could expand to custody products.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BCB — VASP authorization, prudential supervision (designated authority since June 2023)
Law 14,478/2022 (Legal Framework for Virtual Assets) (2022) — VASP authorization and oversight
Decree 11,563/2023 (2023) — BCB designated as supervisory authority
VASP: VASP authorization from BCB under Law 14,478/2022. Tiered capital: BRL 1M-5M (~$200K-$1M USD) depending on activity. 6-12 months timeline. Grandfathering period for existing operators with deadlines extending to 2025. Must establish local entity (CNPJ) with local director.
CUSTODY: Included under VASP authorization; asset segregation required
Central Bank of Brazil (BCB): Authorizes, regulates, and supervises VASPs; launched comprehensive licensing in February 2026; issued Resolutions Nos. 519, 520, 521 (November 2025) and Joint Resolution No. 14.
Securities and Exchange Commission of Brazil (CVM): Oversees cryptoassets qualifying as securities, including public offerings and tokenized assets.
Financial Activities Control Council (COAF): Handles AML reporting for suspicious activities.
Resolution CVM 88/2022 is currently under active revision by CVM via Consulta Pública SDM 05/2025, and CVM has already enforced oversight over cryptoasset securities (e.g., token offerings) without waiting for new licensing rules.
Securities brokers (CTVMs) require licensing from the Central Bank under CMN Resolution 5,008/22 and operate under Laws 4,728/65 and 6,385/76.5
Offering coordinators and public offerings must register with the CVM under Resolutions 160, 161, 162, 163, and 173 (effective January 2023).24
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet/SaaS providers can serve Brazilian residents only after obtaining VASP authorization from BCB (Law 14,478/2022), establishing a local entity with a local director, segregating customer assets, meeting tiered capital requirements (BRL 1M–5M), and complying with COAF AML reporting, with additional CVM registration if custody involves securities tokens.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?