Is my crypto exchange authorized in Brazil? How to check

Until recently, any company could launch a website, call itself an exchange and take deposits in reais to buy crypto. That has changed, and the question is my crypto exchange authorized in Brazil now has an objective answer. This guide explains what the new Central Bank rules require, who needs a license, how to check on the regulator's site and what changes for clients.

What Resolutions 519, 520 and 521 require

On November 10, 2025, Brazil's Central Bank (BCB) published three resolutions that took effect on February 2, 2026. Resolução BCB nº 519 covers the authorization process: a company must prove the financial capacity of its controllers, the lawful origin of its capital, technology proportional to the risk and the good standing of its officers.

Resolução BCB nº 520 defines what a virtual asset service provider may do and how. It creates three categories: intermediary, which buys, sells and swaps assets on behalf of clients; custodian, which holds the keys; and broker, which does both. It requires segregation between company money and client money, forbids using client assets in proprietary trades and obliges the firm to state, on its website and app, which category it belongs to.

Resolução BCB nº 521 pulled international crypto operations into the foreign exchange framework. Sending stablecoins abroad, receiving them from abroad or transferring to a self-custody wallet became identified and reported operations, with the reporting duties in force since May 4, 2026.

Who needs authorization

The rule reaches any company that, in Brazil, intermediates, holds or brokers crypto assets for third parties. The new legal entity is the Sociedade Prestadora de Serviços de Ativos Virtuais, or SPSAV, and the phrase must appear in the corporate name. Banks, securities brokers and dealers already licensed by the BCB may also offer the service after a 90-day prior notice.

Foreign exchanges serving Brazilians had to choose: set up an SPSAV in the country or transfer clients and operations to a licensed institution. According to the law firm Demarest's analysis of the resolutions, minimum capital varies by activity and sits in the tens of millions of reais; a survey by Matera, a banking technology company, puts the range between R$ 10.8 million and R$ 37.2 million. That explains why small exchanges are closing or being acquired.

How to check on the Central Bank's site

The tool is Encontre uma instituição on the BCB portal, which searches by name or CNPJ and shows the type of authorization. One important detail: as of September 30, 2026, the segment list in that search did not yet include a category for virtual asset service providers. The first authorizations will only be granted after the BCB reviews the requests filed by October 30, 2026, and the category should appear from then on. Until then, not finding an exchange in the search means nothing. What you can check today: whether the company states on its own channels that it has filed (ask for the filing number), whether its CNPJ is active with the Receita Federal, and whether the legal name matches the brand. Once the category exists, search by CNPJ rather than brand, because look-alike names are the most common trick.

While the transition period runs, absence from the list does not prove wrongdoing: the company may have filed and be awaiting a decision. In that case it should say so clearly in its channels. If the exchange is not on the list, does not claim to have filed and has no active CNPJ at the Receita Federal, the signal is clear. The most common scripts are described in crypto scams: how to spot them.

The transition deadline

Companies already operating on February 2, 2026 have 270 days to file for authorization, which lands on October 30, 2026. Those that do not file by then must wind down within 30 days. From October 30, 2026, banks and payment institutions are also barred from moving funds for providers without a filed request, which in practice cuts off Pix for anyone left out.

For clients this is a calendar. Before the end of October 2026, ask your exchange whether it has filed. If the answer is vague, consider moving balances and assets before a forced shutdown, withdrawing in batches and testing each destination first.

What changes for the client

The most concrete change is segregation. Client money in reais must sit in an individualized account in the client's name, and crypto assets in a structure separate from the company's own. That does not remove insolvency risk, but it lowers the chance of your balance ending up in a bankruptcy estate.

The second is accountability. The firm must send the BCB daily custody positions, monthly proof of reserves per asset and staking reports, and is subject to independent audit. The third is customer service: as a supervised institution, the SPSAV joins the Central Bank's complaints regime, giving clients a channel beyond Reclame Aqui and consumidor.gov.br.

None of this turns crypto into a guaranteed product. Crypto assets carry high risk, including significant volatility and the possibility of losing the invested capital, and a BCB license covers neither market losses nor liquidity.

Where the CVM comes in

Law 14,478/2022 excludes securities from the definition of virtual asset. A token that represents a fund share, a debt or a share of profits is a security and falls under the CVM, Brazil's securities regulator, which addresses the topic in Parecer de Orientação nº 40/2022. The same exchange may therefore answer to the BCB for bitcoin and stablecoins and to the CVM for fixed-income or receivables tokens, and the CVM's registry of regulated entities shows whether it holds that registration.

Advisory also belongs to the CVM. Vault Capital is a securities advisory firm authorized by the CVM under Resolução CVM nº 19/2021, never takes custody of client assets, and is neither an exchange nor an SPSAV. The registration details are on the compliance and regulation page.

Frequently asked questions

My exchange is not on the BCB list. Should I leave?

It depends on the phase. Until October 30, 2026, it may have a request under review, and it should say so. After that date, with no filing, operations must end within 30 days.

Can a foreign exchange keep serving Brazilians?

Only through an SPSAV incorporated in Brazil or a licensed local institution. Operating directly from abroad without that structure has been outside the rules since February 2026.

Does BCB authorization guarantee my money?

No. It requires segregation, proof of reserves and audits, which reduce the risk of fraud and commingling. There is no deposit insurance and no protection against price drops.

Does a self-custody wallet need authorization?

No. The rule targets services provided to third parties. Holding your own keys remains free, and transfers between an exchange and your own wallet are now identified by the exchange.

Let's talk

Choosing where to hold assets, how much to leave at an exchange and how to exit safely is the kind of decision Vault's crypto advisory works through in a meeting, with your statement and the list of exchanges on the table.