Brazil BCB Resolution 520/2025: Virtual Asset Service Provider Operations

The resolution applies to SPSAVs and to other financial or payment institutions already authorized by the Central Bank when they provide covered virtual asset services. It treats a provider as operating in Brazil where it is constituted in Brazil and has its seat and administration in Brazilian territory, subject to Brazilian law and authorities.

The rule classifies SPSAVs into three operating categories. Virtual asset intermediaries may conduct activities such as subscription, purchase, sale, exchange, portfolio administration, fiduciary functions, staking, virtual asset services in the foreign exchange market and other BCB-authorized activities. Virtual asset custodians focus on safekeeping, control and movement of private keys and related instruments. Virtual asset brokers combine intermediation and custody. Intermediaries and custodians are barred from combining other SPSAV modalities unless operating as brokers.

Resolution 520 makes Central Bank authorization central to the SPSAV model. A society must request authorization before beginning covered services, while entities already operating when the rule entered into force must follow a transition route. Existing operators have 270 days from Feb. 2, 2026, to file an authorization request, setting an Oct. 30, 2026 practical deadline.

• Client asset segregation: providers must separate their own virtual assets from client and user assets, document the segregation policy, use proof-of-reserve methods, commission biennial independent assurance and appoint a responsible director or administrator.
• Restrictions on use of client assets: the rule generally prohibits using client, user or counterparty assets for proprietary operations, with stated exceptions for regulated staking and express consent by qualified or professional investors.
• Governance and controls: SPSAVs must maintain policies for risk management, business continuity, relevant third-party services, private-key protection, AML/CFT, cybersecurity, cloud and data-processing outsourcing, and personal data protection.
• Customer disclosures: providers must disclose authorization status, licenses, policies, terms, involved third parties, conflicts of interest, coverage or insurance arrangements, custody arrangements, fees, risk-profile procedures and support channels.
• Asset listing standards: intermediaries must use clear and public criteria for listing, suspension and delisting, including heightened checks for fiat-referenced virtual assets and reserve arrangements.

The rule is operative, but several implementation points remain relevant. Firms that file authorization requests on time may continue providing services until the Central Bank concludes the process, but may not assume another modality during the transition. Those that miss the filing deadline must cease covered services within 30 days after the deadline.

Information-transfer and monitoring procedures under Article 44 phase in over two 365-day periods: first for Brazil’s domestic virtual asset market by Feb. 2, 2027, then for international coverage by Feb. 2, 2028. The resolution also makes Article 44 compliance mandatory for all authorized SPSAVs from Feb. 2, 2028.

Resolution 520 should be read together with Resolution BCB No. 519/2025, which addresses authorization processes, and Resolution BCB No. 521/2025, which addresses foreign exchange treatment of certain virtual asset services. Subsequent prudential rules, including Resolution BCB No. 580/2026, may affect SPSAV capital and risk-management treatment but should be profiled separately.