Self-custodial wallet / non-custodial software in Brazil
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Brazil with a local entity, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- If the wallet publisher is classified as a VASP (e.g., it intermediates or facilitates transfer of virtual assets beyond mere software provision), it must register with BCB and comply with COAF suspicious transaction reporting (Law 14,478/2022).
- If the software is purely non-custodial — the publisher never holds, controls, or has access to user funds — then AML obligations under Law 14,478/2022 likely do not attach because the publisher is not a 'virtual asset service provider' as defined.
- Should the wallet incorporate features such as an integrated swap/aggregator (beyond mere software provision), the publisher may cross the VASP threshold and trigger AML obligations including user KYC, transaction monitoring, and COAF suspicious activity reporting.
Key Restrictions
- Local entity (CNPJ) with local director required if the publisher is deemed a VASP.
- If the wallet facilitates transactions in tokens classified as securities (under CVM criteria), the publisher may need CVM registration — though for pure non-custodial software this is unlikely.
- Integration with on-chain swap/aggregator functionality may cause the publisher to be treated as a VASP, even though they never hold custody.
- Public offerings of tokens through the wallet interface may trigger CVM prospectus and registration requirements (Resolutions 160, 161, 162, 163, 173).
Key Risks
- ["Ambiguity: Law 14,478/2022 defines VASP broadly enough that a court or regulator could attempt to classify non-custodial wallet publishers as VASPs based on facilitated transactions.", "Regulatory creep: BCB's comprehensive licensing regime (effective Feb 2026) may expand definitions to capture non-custodial software if seen as facilitating virtual asset services.", "Enforcement risk: CVM has taken proactive enforcement actions against crypto activities (prediction markets, token offerings); similar scrutiny could extend to wallet software with integrated financial features.", "Grandfathering deadlines for existing VASPs (extending to 2025) create regulatory timeline risk for publishers who might retroactively be classified as VASPs."]
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BCB — VASP authorization, prudential supervision (designated authority since June 2023)
Law 14,478/2022 (Legal Framework for Virtual Assets) (2022) — VASP authorization and oversight
Decree 11,563/2023 (2023) — BCB designated as supervisory authority
VASP: VASP authorization from BCB under Law 14,478/2022. Tiered capital: BRL 1M-5M (~$200K-$1M USD) depending on activity. 6-12 months timeline. Grandfathering period for existing operators with deadlines extending to 2025. Must establish local entity (CNPJ) with local director.
CUSTODY: Included under VASP authorization; asset segregation required
Financial Activities Control Council (COAF): Handles AML reporting for suspicious activities.
Central Bank of Brazil (BCB): Authorizes, regulates, and supervises VASPs; launched comprehensive licensing in February 2026; issued Resolutions Nos. 519, 520, 521 (November 2025) and Joint Resolution No. 14.
Securities and Exchange Commission of Brazil (CVM): Oversees cryptoassets qualifying as securities, including public offerings and tokenized assets.
Resolution CVM 88/2022 is currently under active revision by CVM via Consulta Pública SDM 05/2025, and CVM has already enforced oversight over cryptoasset securities (e.g., token offerings) without waiting for new licensing rules.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — publishing purely non-custodial wallet software in Brazil likely does not trigger VASP classification or AML obligations, but integrated transactional features (swaps, on-chain aggregation) could cause the publisher to be deemed a VASP under Law 14,478/2022, requiring BCB authorization, local entity/CNPJ, and COAF AML compliance.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?