DeFi protocol frontend in Brazil
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Brazil with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Must register as a VASP with BCB if the frontend facilitates virtual asset services (order routing, fee-taking, liquidity aggregation) — Law 14,478/2022
- AML/CFT obligations under COAF supervision including suspicious transaction reporting (COSIS system), customer due diligence, and record-keeping
- COAF reporting threshold for suspicious transactions: no fixed de minimis — any unusual transaction must be reported
- Must implement KYC/AML screening for all users if the frontend exercises control or discretion over transactions
- If the frontend deals in securities tokens (e.g., tokenized assets), must also comply with CVM Resolution 88/2022 securities rules
- If the frontend offers BRL-pegged stablecoins or facilitates BRL on/off ramps, may require payment institution authorization from BCB under complementary rules
Key Restrictions
- Must establish a local legal entity (CNPJ registration) with a local director to apply for VASP authorization
- Tiered minimum capital: BRL 1M–5M (~$200K–$1M USD) depending on activity type and volume
- Geofencing required — must block or restrict access from Brazilian residents unless VASP-authorized
- If the frontend charges fees (spreads, swap fees, routing fees), it is more likely to be classified as a VASP activity under BCB jurisdiction
- Purely non-custodial, read-only interfaces with no fee collection and no user transaction routing may fall outside VASP scope, but this is legally untested
- Stablecoins pegged to BRL may trigger payment institution licensing requirements beyond VASP authorization
Key Risks
- Regulatory ambiguity: The boundary between a 'mere frontend' and a VASP is not clearly defined in law — fee-taking is a strong indicator but control over transactions is a gray area
- Enforcement risk: BCB has not yet issued detailed guidance on DeFi frontends; grandfathering deadlines extend to 2025 but enforcement posture is unclear
- CVM may assert jurisdiction if the frontend facilitates access to tokenized securities or derivatives products
- Recent CVM/BCB actions against prediction markets and derivatives platforms suggest proactive market restriction enforcement
- Tax risk: Even if not a VASP, frontend operators may have tax reporting obligations for Brazilian users
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BCB — VASP authorization, prudential supervision (designated authority since June 2023)
Law 14,478/2022 (Legal Framework for Virtual Assets) (2022) — VASP authorization and oversight
Decree 11,563/2023 (2023) — BCB designated as supervisory authority
VASP: VASP authorization from BCB under Law 14,478/2022. Tiered capital: BRL 1M-5M (~$200K-$1M USD) depending on activity. 6-12 months timeline. Grandfathering period for existing operators with deadlines extending to 2025. Must establish local entity (CNPJ) with local director.
CUSTODY: Included under VASP authorization; asset segregation required
EXCHANGE: VASP authorization from BCB; CVM registration if dealing in securities tokens. Stablecoins pegged to BRL may require payment institution authorization.
Central Bank of Brazil (BCB): Authorizes, regulates, and supervises VASPs; launched comprehensive licensing in February 2026; issued Resolutions Nos. 519, 520, 521 (November 2025) and Joint Resolution No. 14.
Securities and Exchange Commission of Brazil (CVM): Oversees cryptoassets qualifying as securities, including public offerings and tokenized assets.
Financial Activities Control Council (COAF): Handles AML reporting for suspicious activities.
CVM Resolution 88/2022 (2022) — Securities token regulation
Brazil has recently tightened derivatives rules and blocked prediction market platforms, indicating a shift from static licensing toward proactive market restrictions for financial and derivatives market participants.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a DeFi protocol frontend serving Brazilian residents is likely regulated as a VASP under Law 14,478/2022 if it takes fees or controls user transactions, requiring BCB authorization, local entity (CNPJ), BRL 1M–5M capital, and full AML/KYC obligations; a purely passive, non-custodial, fee-free interface may fall outside scope but this is legally untested.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?