CRYPTO LAW PROFILE

Brazil Law No. 9,613/1998 AML Regime for VASPs

Brazil’s AML Law applies customer identification, recordkeeping, internal controls and Coaf reporting duties to VASPs after Law No. 14,478/2022.

BRBrazilEffective§ ActEffective 2023-06-20
IDENTIFIERLei nº 9.613/1998, as amended by Lei nº 14.478/2022
ENACTED1998-03-03
LAST VERIFIED2026-07-07
SUMMARY

At a glance

Status

In force; VASP AML amendments have applied since June 20, 2023.

Scope

Dormancy

Administrator

Banco Central regulates, authorizes and supervises VASPs; CVM authority over securities is preserved.

LEGISLATIVE RECORD

Bill details

Bill number
Session
Chamber
Legislative stageEffective
LATEST ACTION
SPONSOR
SOURCECâmara dos DeputadosLei nº 9.613/1998, as amended by Lei nº 14.478/2022Official bill page ↗
EXPLAINER

Overview

Brazil’s Law No. 9,613/1998 is the country’s core anti-money laundering statute. For virtual asset service providers, the operative AML profile comes from the amendments made by Law No. 14,478/2022, which added “prestadoras de serviços de ativos virtuais” to Article 9 and added “ativos virtuais” to Article 10 recordkeeping language. As of July 7, 2026, the VASP-facing AML provisions are in force, with the virtual-asset amendments effective after Law No. 14,478’s 180-day vacatio legis from its Dec. 22, 2022 official publication.

The regime should be read as an AML layer within Brazil’s broader virtual-assets framework. Law No. 14,478 defines virtual assets, identifies the categories of virtual asset services, and requires VASPs to operate under authorization from the federal body designated by the executive branch. Decree No. 11,563/2023 designated Banco Central do Brasil as the authority to regulate, authorize and supervise VASPs, while preserving the Comissão de Valores Mobiliários’ separate authority over securities.

In practical terms, the AML Law supplies the statutory duties and sanctions, while Law No. 14,478 and Banco Central rules supply the virtual-asset perimeter, authorization path and supervisory architecture. The result is a layered regime: VASPs are expressly brought into the AML Law’s list of covered persons, but their operational status and prudential treatment depend on Banco Central implementation.

Key Provisions of Brazil’s AML Regime for VASPs

  • Covered persons: Article 9 now includes VASPs among persons subject to the AML Law’s customer identification, recordkeeping and reporting duties.
  • Customer identification and records: Article 10 requires covered persons to identify customers, maintain updated registrations and keep records of transactions involving virtual assets above limits set by the competent authority.
  • Internal controls: Covered persons must adopt policies, procedures and internal controls compatible with their size and transaction volume, as disciplined by competent authorities.
  • Coaf reporting: Article 11 requires attention to potentially suspicious transactions and communications to Coaf or the relevant regulator within the statutory framework, including no-tipping-off language.
  • Administrative sanctions: Article 12 provides for warnings, fines, temporary disqualification of administrators, and suspension or cancellation of authorization for covered persons that fail to comply with Articles 10 and 11.

VASP Scope and Regulator Allocation

Law No. 14,478 treats a VASP as a legal entity that performs, on behalf of third parties, at least one virtual asset service, including exchange between virtual assets and fiat currency, exchange between virtual assets, transfers, custody or administration, or services connected to offers or sales of virtual assets. The same law excludes securities-law assets from its general virtual-asset perimeter and states that it does not alter CVM authority.

Banco Central’s implementing framework gives the AML Law practical supervisory context. Resolution BCB No. 519 addresses authorization processes for VASPs and certain financial-market intermediaries. Resolution BCB No. 520 disciplines the constitution and functioning of VASPs, classifying them as intermediaries, custodians or brokers, and includes asset-segregation, proof-of-reserve, outsourcing, information, cybersecurity and monitoring provisions. Resolution BCB No. 521 incorporates specified virtual-asset activities into the foreign-exchange and foreign-capital reporting framework.

Status, Timeline and Implementation Milestones

The original AML Law entered into force on publication in March 1998. The VASP AML amendments were enacted through Law No. 14,478 on Dec. 21, 2022, published on Dec. 22, 2022, and became operative on June 20, 2023. Decree No. 11,563/2023 then allocated supervisory authority to Banco Central. Banco Central’s 2025 implementing resolutions entered largely into force on Feb. 2, 2026, with selected Resolution BCB No. 521 provisions effective May 4, 2026.

For editorial use, this profile should be categorized under Brazil, AML/CFT, Licensing & Registration, Market Structure & Regulatory Perimeter and Custody. It is not a standalone licensing guide or legal advice. It summarizes the public legal framework and should be updated as Banco Central issues or amends implementing regulations, authorization instructions, prudential rules or AML-specific supervisory guidance.

Status and timeline

1998-03-03AML Law enacted
1998-03-04Original AML Law in force
2022-12-21Virtual Assets Framework enacted
2023-06-13BCB designated VASP regulator
2023-06-20VASP AML amendments operative
2025-11-10BCB VASP regulations published
2026-02-02BCB rules largely in force
WHAT IT DOES

Key provisions

VASPs added as covered persons

Article 9 now includes virtual asset service providers among persons subject to the AML Law’s customer identification, recordkeeping and reporting obligations.

AML/CFTEffective 2023-06-20Source ↗

Virtual-asset transaction records

Article 10 requires records for covered transactions involving virtual assets above limits set by the competent authority, alongside customer identification duties.

AML/CFTEffective 2023-06-20Source ↗

Internal controls and Coaf interface

Covered persons must adopt internal controls, keep regulator or Coaf registration current, and respond to Coaf requests under Article 10.

AML/CFTEffective 2023-06-20Source ↗

Suspicious transaction reporting

Article 11 requires attention to suspicious operations and communications to Coaf or the relevant regulator, including no-tipping-off language.

AML/CFTEffective 2023-06-20Source ↗

Administrative sanctions

Article 12 provides warnings, fines, temporary disqualification and authorization suspension or cancellation for failures under Articles 10 and 11.

Enforcement & Asset RecoveryEffective 2023-06-20Source ↗

BCB authorization overlay

Law No. 14,478 and Decree No. 11,563 assign the authorization and supervision perimeter for VASPs to Banco Central, with CVM competence preserved for securities.

Licensing & RegistrationEffective 2023-06-20Source ↗

Custody and asset segregation

Resolution BCB 520 classifies VASP modalities and requires mechanisms separating VASP assets from client and user virtual assets.

CustodyEffective 2026-02-02Source ↗
HISTORY

Status and timeline

AML Law enacted

Brazil enacted Law No. 9,613/1998, creating the AML statute and Coaf framework.

EnactedSource ↗

Original AML Law in force

The original AML Law was published in the Diário Oficial da União and entered into force on publication.

In forceSource ↗

Virtual Assets Framework enacted

Law No. 14,478 amended Law No. 9,613 to add VASPs and virtual-asset recordkeeping language.

EnactedSource ↗

BCB designated VASP regulator

Decree No. 11,563 assigned Banco Central authority to regulate, authorize and supervise VASPs.

EnactedSource ↗

VASP AML amendments operative

Law No. 14,478 entered into force 180 days after official publication, making the VASP AML amendments operative.

In forceSource ↗

BCB VASP regulations published

Banco Central published VASP implementing regulations, including Resolutions BCB 519, 520 and 521.

EnactedSource ↗

BCB rules largely in force

Resolution BCB 519 and Resolution BCB 520 entered into force; Resolution BCB 521 became partly effective.

In forceSource ↗
COVERAGE

Who it affects

Actors

banco-central-do-brasilcomissao-de-valores-mobiliarioscoaf

Asset classes

virtual-assets
PRIMARY REFERENCES

Official sources

RELATED COVERAGE

Coverage

Editorial note

This profile focuses on the VASP-facing AML regime created by the 2022 amendments to Law No. 9,613/1998. The original AML Law entered into force in 1998; the effective date field is set to the VASP amendment operative date.