DeCripto Brazil: the Receita Federal crypto-asset declaration
DeCripto is the crypto-asset declaration created by Brazil's tax authority through IN RFB 2.291/2025. Since July 1, 2026 filing is monthly and covers service providers as well as Brazilian-resident companies that trade through foreign platforms, decentralized platforms or without an intermediary.
A Brazilian company that pays suppliers or developers abroad in stablecoins can no longer treat those operations as an internal treasury matter. The Receita Federal created a dedicated declaration and set July 1, 2026 as the start of monthly filing. As of October 2026, that obligation is already running.
In Soulbit Academy we follow the crypto-asset regulation that affects Latin American companies. This guide explains what DeCripto is, who must file it, what is reported, what deadlines and fines the rule sets, and how it compares with the Colombian equivalent, DIAN Resolution 000240.
What DeCripto is and what changes with IN RFB 2.291/2025
DeCripto is the Crypto-Asset Declaration created by Normative Instruction RFB 2.291 of November 14, 2025, published in the Diário Oficial da União on November 17. The Receita Federal gathers the acts of the declaration on its official DeCripto page, together with the layout manual.
The rule replaces the earlier model. Article 18 revokes INs RFB 1.888 and 1.899, both from 2019, and article 19 sets two effective dates: the aggregate report required by the international standard applies from January 1, 2026, and the rest of the declaration, including per-operation filing and the revocations, from July 1, 2026.
DeCripto adopts the OECD Crypto-Asset Reporting Framework, or CARF. Brazil thus aligns its local declaration with the standard that foresees the first automatic exchange between countries in 2027. According to the Receita itself, the rule governs data collection and does not change how crypto-assets are taxed.
| Aspect | Previous model (INs 1.888 and 1.899, 2019) | DeCripto (IN 2.291/2025) |
|---|---|---|
| Legal basis | Two normative instructions from 2019 | A single rule, IN RFB 2.291/2025, expressly revoking both |
| International standard | Not aligned with CARF | Aligned with the OECD CARF |
| Monthly threshold for individuals and companies | R$ 30,000, according to the Receita | R$ 35,000, according to the Ministry of Finance |
| Monthly filing under the new model | Not applicable | Mandatory since July 1, 2026 |
Why does this matter to a company that is not a crypto platform?
It matters because DeCripto is not limited to providers. The rule also binds Brazilian-resident individuals and entities that trade outside a Brazilian provider, so a treasury moving USDC with a foreign counterparty may fall within scope.
Who must file DeCripto and what is reported
Two groups must file DeCripto: crypto-asset service providers with a link to Brazil, and individuals or entities resident or domiciled in Brazil that trade without a Brazilian provider. Article 5 of IN RFB 2.291/2025 sets this out, and the Receita Federal publishes it on its official page.
The first group includes the provider resident in Brazil, the one with a regular place of business in the country and the one that provides crypto-asset services in Brazil. The rule lists signs of local activity, such as using a ".br" domain or advertising aimed at residents. A foreign platform with a commercial presence in Brazil therefore also reports.
The second group is the one closest to treasury. The Brazilian-resident individual or entity declares on its own in three cases:
- The first is trading through a service provider established abroad.
- The second is trading through a decentralized platform.
- The third is trading with no provider at all, for example peer to peer or from a self-held wallet.
In the first two cases, filing depends on the monthly value of the operations, alone or combined, exceeding R$ 35,000, under article 5. For the third, the Receita summarizes the criterion with the same threshold, but the exact scope should be confirmed with a Brazilian tax advisor. A Brazilian provider reports every month with no threshold.
What information must the declaration contain?
The declaration contains the data of each operation: date, type, counterparty identification, crypto-asset, quantity, value in reais, fees and, where one exists, the identifier of the provider or platform. For smart contracts, the rule allows identifying the transaction by its hash.
Covered operations include purchases and sales, swaps between crypto-assets and transfers in or out of an account or wallet. A stablecoin is a crypto-asset and, in principle, its swaps and transfers fall in that catalogue. Providers also report each user's balances at December 31.
DeCripto deadlines: the calendar running since July 2026
The monthly DeCripto deadline falls on the last business day of the month after the operations took place, until 23:59:59 Brasília time. Mandatory filing began on July 1, 2026, so the first one, for July operations, was due on August 31, 2026.
The calendar has three fixed dates and a recurring monthly deadline; providers add an annual one. Year-end balance data is due by the last business day of January of the following year. As of October 20, 2026, the July and August filings are past due; September's is due on the last business day of October.
- November 14, 2025: IN RFB 2.291/2025 signed.
- January 1, 2026: aggregate CARF-aligned report takes effect.
- July 1, 2026: per-operation monthly filing starts and INs 1.888 and 1.899 are revoked.
- Last business day of each month: due date for the previous month's operations.
These dates come from the text of the rule. The earlier model stayed in force until June 30, 2026, according to the Ministry of Finance, and filing is done through the e-CAC portal.
Fines for not filing DeCripto or filing it wrong
Article 13 of IN RFB 2.291/2025 sets fines for late filing and for incorrect data. According to the text of the rule reproduced by legal repositories, filing late costs R$ 100 per month or fraction for an individual and R$ 1,500 for most entities, with R$ 500 for other categories.
Inaccurate or incomplete data is fined, for individuals, at 1.5% of the operation value. Ignoring a Receita summons costs R$ 500 per calendar month. The late-filing fine is halved if the obligation is met before any ex officio procedure.
These amounts come from the text of the IN as published by a regulatory repository, not from an official Receita publication that we could open. Confirm them against the current text before estimating an exposure, because the rule may be amended.
DeCripto, CARF and DIAN Resolution 000240: how they compare
DeCripto and DIAN Resolution 000240 share the same origin, the OECD CARF, but allocate the obligation differently. In Colombia the provider reports once a year. In Brazil the provider reports every month and, in addition, so does the resident company that trades outside a Brazilian provider.
CARF has been in force since January 1, 2026 and foresees the first exchange between authorities in 2027. Resolution 000240 develops it in Colombia through an annual provider report due by the last business day of May and a fine under article 651 of the Tax Statute of 0.5% to 1% of the information not supplied.
| Aspect | DeCripto (Brazil) | Resolution 000240 (Colombia) |
|---|---|---|
| Authority | Receita Federal | DIAN |
| Rule | IN RFB 2.291/2025 | Resolution 000240 of December 24, 2025 |
| Who reports | Providers with a link to Brazil and resident companies or individuals trading without a Brazilian provider | Crypto-asset service providers; the client company does not send the report |
| Frequency | Monthly per operation since July 1, 2026 | Annual, from tax year 2026 |
| Deadline | Last business day of the following month | Last business day of May of the following year |
| Threshold | R$ 35,000 per month for individuals and entities in the cases described | No equivalent threshold applies to the client company |
A company operating in both countries therefore sits under two logics. The Brazilian one must prepare its own data every month. The Colombian one depends mostly on its provider's report and on its own records to explain any difference to the DIAN.
What a company using stablecoins to pay suppliers should do
A Brazilian-resident company that pays suppliers in stablecoins should first identify which channel it uses and then calculate the monthly value of those operations in reais. Those two facts determine whether DeCripto is its own obligation or whether a Brazilian provider files in its place.
An illustrative assumption, not a Soulbit figure: a Brazilian company pays developers in Colombia in USDC through a foreign platform and moves the equivalent of R$ 42,000 in a month. That exceeds the R$ 35,000 threshold, so monthly filing would be its own. At R$ 18,000 it would not exceed it and, in principle, would not need to file for that reason.
Four practical steps organize the work.
- Map the channels: Brazilian provider, foreign provider, decentralized platform or direct operation.
- Record, in reais and per operation, the date, counterparty, crypto-asset quantity, value and fees.
- Schedule the monthly filing with a margin before the last business day.
- Reconcile those records with the books, as we describe in reconciling stablecoin payments with accounting.
Does DeCripto change the tax on foreign-exchange operations?
No. DeCripto is an information rule and does not change taxation. The treatment of IOF on foreign exchange and the rules of BCB Resolution 561 on international payments follow their own regimes. DeCripto only makes the operation visible to the Receita.
For a concrete flow between the two countries, see the case of a Brazilian company that pays developers in Colombia.
What Soulbit delivers regarding DeCripto and what it does not
Soulbit offers institutional MPC custody of stablecoin balances, bulk payroll payouts in stablecoin, eOTC conversion by quote, local bank rails in Colombia, payment links and collection QR codes, plus human support. Each movement leaves a record with date, amount and counterparty.
That record can feed a company's internal documentation, but it does not replace a declaration. Soulbit does not file DeCripto or generate tax reports for its clients, does not operate Brazilian rails and does not decide whether a company must file in Brazil. Nor do we state whether its service fits the provider categories of the rule.
Reading IN RFB 2.291/2025, calculating the threshold and choosing the filing format belong to the company's tax advisor in Brazil. If the company also operates in Colombia, that advisor should coordinate with the team handling DIAN obligations.
Frequently asked questions
What is DeCripto in Brazil?
DeCripto is the Crypto-Asset Declaration created by the Receita Federal through IN RFB 2.291/2025, signed on November 14, 2025. It collects crypto-asset operations reported by service providers and, in some cases, by Brazilian-resident individuals and companies. It replaces the declarations of INs 1.888 and 1.899 of 2019 and follows the OECD CARF standard.
Does a company that pays suppliers in stablecoins have to file DeCripto?
A Brazilian-resident company files DeCripto when it trades through a provider established abroad, through a decentralized platform or without an intermediary, and the monthly value of those operations exceeds the threshold set by the rule. If it trades only through a Brazilian provider, that provider reports. Each case needs confirmation from a tax advisor.
When is DeCripto due?
Monthly filing has been mandatory since July 1, 2026. The deadline falls on the last business day of the month after the operations took place, so the first filing, for July, was due on August 31, 2026. Providers submit annual balance data by the last business day of January.
What are the DeCripto fines?
According to the text of the rule as reproduced by legal repositories, late filing costs R$ 100 per month or fraction for an individual and R$ 1,500 for most entities. Incorrect or incomplete data is fined, for individuals, at 1.5% of the operation value. Check the amounts in the official text before deciding.
Does Soulbit file DeCripto for a company?
No. Soulbit does not file DeCripto or generate tax reports for its clients. It offers institutional custody with MPC, bulk payroll payouts in stablecoin, eOTC conversion and local bank rails in Colombia only. A Brazilian-resident company must handle its obligation with its own advisor and its own transaction records.
Want your company to add stablecoins to its operations?
Join the Soulbit waitlist and start paying payroll, collecting and managing treasury without SWIFT.
Join the waitlist