Brazil took a new step in tightening its regulation on cryptocurrencies by incorporating an independent audit requirement for companies seeking authorization to operate or renew their license from June 1, 2026.
The measure reaches the companies that provide virtual asset services, known as SPSAV, which must submit a reasonable assurance report prepared by an independent auditor registered with the Securities Commission (CVM), the regulatory body of the Brazilian securities market.
With this provision, The Central Bank seeks to verify that applicants have solid compliance structures, control and management before receiving the green light. In practice, the country is moving from a more basic registration scheme towards a much more demanding supervision of the crypto ecosystem, with a model that is increasingly closer to that which governs the traditional financial system.
The new external review requires a third party to evaluate the internal mechanisms of the companies. Among the points that will need to be examined are anti-money laundering controls, prevention of terrorist financing, customer verification, governance, segregation of user assets, risk management, employee compliance programs and escrow schemes. In other words, it will no longer be enough to declare that a company is compliant: it will now have to demonstrate it with audited evidence.
The scope of the requirement may have direct effects on authorizations. If a firm fails to pass the controls, both its initial approval and the renewal of its license could be complicated. This increases the weight of compliance teams within exchanges, custodians and other providers in the sector. In addition, the report must be issued by professionals registered with the CVM, which reduces the group of qualified auditors and links the crypto process with standards similar to those of the capital market.
Brazilian regulation on virtual assets began to take shape in 2022 with Law No. 14,478. One year later, the Central Bank was designated as the primary authority to supervise cryptocurrency service providers. In 2025, the country deepened that path with resolutions who created a specific category for these companies and incorporated rules on custody, corporate governance, anti-money laundering, and stablecoin supervision. Added to this are the Travel Rule and the monitoring of self-custodied wallets, which confirms a control strategy at several layers within the business.
Companies that already operate in the market have until October 2026 to adjust to the new requirements. This margin offers a transition, but also requires reviewing internal processes, custody contracts, client documentation, risk systems and control procedures. The cost of this adaptation will not be uniform: for large international platforms it may be acceptable, but for startups and small exchanges it can become a serious obstacle.
The hardening comes in a market that is not minor. Between mid-2024 and mid-2025, Brazil would have received nearly USD 318.8 billion in cryptocurrency value, a figure that is equivalent to approximately one-third, or 33%, of all cryptocurrency flows in Latin America, according to Chaynalisis. That magnitude explains why the country continues to be a priority for large exchanges. Its size, its level of digital adoption and its financial relevance make it a strategic place for the industry.
The Central Bank maintains that the new requirement seeks to strengthen the security and efficiency of the Brazilian financial systemin addition to supporting the development of the virtual assets market with better standards of governance, transparency and prevention of financial crimes. The logic is similar to banking supervision: before trusting an entity that manages third-party assets, the authority wants to verify that there are processes, managers and controls capable of detecting failures in time.
The new requirement confirms Brazil’s intention to move towards more centralized supervision and rigorous approach to the virtual assets sector. In recent years, the country has been building a regulatory framework that gives the Central Bank an increasingly relevant role in the authorization and supervision of these companies, incorporating additional requirements in terms of compliance, transparency and risk management.
Although the measure does not mean a closure for the industry, it does raise the conditions for operating in one of the most important cryptocurrency markets in Latin America. If this model manages to combine growth of the sector with greater protection for users and investors, it could serve as a reference for future regulations in other countries in the region.