VASP Authorization at Brazil's Central Bank

A company that already exchanges, custodies, or transfers virtual assets in Brazil, and has not yet applied for central bank authorization, is closer to a legal deadline than it may realize. The authorization requirement itself is not new, Lei 14.478/2022 already stated that no virtual asset service provider could operate in Brazil without it. What changed in 2026 is that the actual procedure, what to document, how long it takes, and what happens if a company misses the window, finally has published rules.

At Soulbit Academy we already covered the broader framework Brazil's central bank designed for stablecoins, in Brazil's central bank stablecoin regulation for 2026. This article covers something else: not what the rule says about stablecoins as such, but the procedure that any virtual asset provider, whether or not it deals in stablecoins, must follow to operate with authorization. That is the practical question for a company evaluating a Brazilian counterparty before doing business with it.

Who Must Apply for VASP Authorization at the Central Bank

Authorization is required for any company that regularly provides, for compensation, one of the services Lei 14.478/2022 defines as a virtual asset service: exchanging virtual assets for currency or other virtual assets, transferring them, custodying or administering them, or participating in related financial service offerings. The law assigned authorization and supervisory authority to the central bank through Decreto 11.563/2023, and Resolução BCB 519, published November 10, 2025, spells out the process.

Two practical situations are distinct. A non financial company with no existing central bank authorization must incorporate as a Sociedade Prestadora de Serviços de Ativos Virtuais, a PSAV, headquartered and managed in Brazil, and its corporate name must include the term "Sociedade Prestadora de Serviços de Ativos Virtuais" or its short form. A financial institution already authorized by the central bank, a bank or a securities broker, for instance, that wants to add virtual asset services applies for a complementary authorization under the same framework, without incorporating a new legal entity.

What Documentation Resolução BCB 519 Requires

Resolução BCB 519 requires every PSAV to show, from the earliest stage of review, statutory directors accountable for risk and cybersecurity, a formal anti money laundering policy, compliance with international sanctions, and accounting conformity under the COSIF standard.

The company must appoint statutory officers responsible for specific areas: running the business, preventing money laundering and terrorist financing, internal controls and risk management, and cybersecurity and incident handling. It must also demonstrate a risk management structure proportional to the size of its operation, a formal cybersecurity policy, internal control and anti money laundering policies, compliance with applicable international sanctions, and accounting compliance under the COSIF standard the central bank itself uses to supervise financial institutions.

What changes for a company that already operated before Resolução BCB 519?

A company that was already providing virtual asset services before February 2, 2026 enters a transition regime: it can keep operating while its application is under review, provided it files within the deadline and stays limited to the service it already ran, without expanding scope while the central bank has not decided. During that adjustment period, the PSAV must also report its accounting balances and custody data to the central bank daily, an operational obligation that applies even before authorization is granted.

The Exact Timeline: From Publication to the Filing Deadline

Resolução BCB 519 took effect on 2 February 2026 and sets a 270 day window, closing around 30 October 2026, for every Brazilian PSAV to file its authorization request.

Date	What happens	Regulatory basis
November 10, 2025	Publication of Resoluções BCB 519, 520, and 521	The central bank's virtual asset regulatory package
February 2, 2026	Resolução BCB 519 takes effect	Start of the transition period countdown
Around October 30, 2026	End of the 270 day deadline to apply for authorization	A company that has not filed by this date must stop operating within 30 days
May 4, 2026	Mandatory periodic reporting to the central bank begins	Applies even before the authorization process concludes

The 270 day deadline runs from the effective date, not the publication date, a distinction that matters because the resolution was published nearly three months before it took effect. A company that waits until close to October 2026 to file takes on an added risk: that the central bank flags incomplete documentation with no time left to fix it before the window closes.

How the Authorization Review Process Works

In the first phase of the process, the central bank assesses the PSAV's risk management structure, cybersecurity policy, anti money laundering controls, compliance with international sanctions, and COSIF accounting conformity, before ruling on the service category it may operate under.

That phase examines, together, the risk management structure, the cybersecurity policy, internal controls and anti money laundering policies, compliance with international sanctions, and accounting compliance under the COSIF standard. Resolução BCB 520, published in the same November 10, 2025 package, complements this process by defining how a PSAV is incorporated, how it operates, and the three operating categories it can choose from, intermediary, custodian, or broker, each with its own capital and governance requirements that scale with the activity's risk. This article does not detail those capital figures by category because they belong to Resolução 520, not 519, but a PSAV that already knows which category it will operate under should check that second rule before building its application.

The Transition Regime: What Changes for Companies Already Operating

A company that already provided virtual asset services in Brazil before February 2, 2026 does not have to stop operating while it waits for a decision, as long as it meets three conditions at once.

The first condition is filing the authorization application within the 270 day deadline counted from the effective date. The second is keeping the operation limited to the service line it already ran before the resolution, without expanding into a new service while the process is pending. The third is meeting, from day one, the periodic reporting obligations to the central bank, including the daily submission of accounting balances and custody data during the adjustment period. A PSAV that meets all three conditions operates in good standing throughout the review, even without holding the final authorization yet.

What Happens if a Company Skips Authorization or Is Denied

A PSAV that does not file within the 270 day deadline, or that is denied in a final decision with no administrative appeal left, must stop providing virtual asset services within 30 days.

Company's situation	What it can do	Applicable deadline
Already operating, filed on time	Keep operating under the service line it already ran while the application is reviewed	No shutdown deadline while the process is pending
Already operating, did not file on time	Must stop providing virtual asset services	30 days after the 270 day deadline expires
Application denied with no appeal left	Must stop providing virtual asset services	30 days after notification of the final decision

What happens if the central bank denies a PSAV's authorization?

The company loses the right to keep providing the service and has up to 30 days from notification of the final decision to wind down the operation. That same consequence applies, starting October 30, 2026, to any PSAV that simply never filed an application. From that date, institutions already authorized by the central bank are also barred from intermediating transactions with PSAVs that are unauthorized or outside the process, which closes the channel for an unregistered provider to keep operating through a third party.

What Soulbit's V1 Actually Delivers Today

Soulbit is a payments and treasury rail in stablecoins for businesses, and this article covers an obligation that sits with the Brazilian counterparty exchanging, custodying, or transferring virtual assets, not with Soulbit itself. Every client company completes a KYB verification before operating that confirms its legal registration, its representatives, and its beneficial owners, and every transaction goes through on chain AML/KYT monitoring that analyzes where funds originate and where they end up on the blockchain.

This article does not claim that Soulbit holds, or needs to hold, PSAV authorization in Brazil under Resolução BCB 519: that is an obligation for whoever provides exchange, custody, or transfer services for virtual assets as its own business activity in the country, a different profile from a company that uses stablecoins to pay or collect. For a company evaluating a Brazilian counterparty, checking whether it is authorized, or at least that it filed within the deadline, is a verification to make directly with that counterparty or with local legal counsel, not something Soulbit's own KYB replaces. Soulbit does not offer cards, yield on balances, a native token, or a native app, and its local banking rail exists today only in Colombia. For a full view of the platform, see what Soulbit is and how it works for an SMB.

For a foreign company paying Brazilian suppliers or collecting from clients in Brazil, the operational guide in how to pay international contractors in USDC in Brazil shows how that flow works in practice, and the list of documents any counterparty should be able to produce is detailed in KYB checklist: the documents you will be asked for to open an account. For the broader regulatory picture across the region, the full map is in the LATAM crypto regulation landscape for 2026.