Brazil crypto compliance for offshore service providers

An offshore crypto platform serving Brazil needs to identify the legal entity that contracts with customers, the services it performs, and the entities that move money or hold assets. Article 2 of Law 14,478/2022 requires “prévia autorização” to operate in Brazil. BCB Resolution 520/2025, art. 23, addressed migration of existing offshore operations and clients to an eligible institution in Brazil. Federal tax reporting has a separate test. Under art. 5 of RFB Normative Instruction 2,291/2025, a .br domain, domestic funding arrangements, payment features that evidence targeting, or Brazil-directed advertising can bring the provider within DeCripto. Law 14,478/2022, arts. 2 and 5 · BCB Resolution 520/2025 · RFB Normative Instruction 2,291/2025, art. 5

Regulatory position checked on 14 November 2026.

Who is actually serving the Brazilian customer?

What the group does	What to resolve before launch
Offshore company signs up Brazilian clients, executes trades and holds their crypto	Classify the intermediation and custody functions. Determine which regulated entity can provide those services in Brazil and which entity owes DeCripto.
Brazilian affiliate signs the customer contract and moves funds, while a foreign affiliate holds assets	Confirm each entity’s authorisation or contractual role. Assess foreign custody and the Brazilian firm’s access to balances, records and audit evidence.
Foreign company provides back-end software without holding customer assets or executing orders	Verify the facts against the activity definitions and the relevant outsourcing rules. Examine who controls the product, instructions and customer data.
Customer uses an offshore site without a local product launch	Document how access arose. Test the provider’s Brazilian reporting nexus and the user’s own reporting exposure separately.

Law 14,478/2022, art. 5, covers legal entities performing covered functions “em nome de terceiros”. Map exchange, transfers, custody or control, and services relating to an offer or sale. Under Resolution 520, arts. 4 and 6–11, intermediaries, custodians and brokers have different scopes. The Law’s art. 3 excludes specified assets, including securities. A tokenised security therefore calls for a capital-markets assessment, starting with the rights the token confers. Law 14,478/2022, arts. 3 and 5 · BCB Resolution 520/2025, arts. 4 and 6–11 · CVM Guidance Opinion 40

A local company can perform different roles

Compare the contracts with the product. A local marketing affiliate, a payment provider that receives reais and a firm that intermediates purchases each perform a different role. Identify whose name appears on the wallet and fiat ledgers, who accepts orders, who sets and receives fees, who controls withdrawals and who answers complaints. The entity named in the terms of service must be reconciled with the parties performing these functions and with their actual regulatory permissions.

What changed for BCB authorisation in 2026?

Date	Operational effect
2 February 2026	Resolution 520 entered into force. The date identifies existing operators for the applicable transition.
30 October 2026	Deadline for eligible existing operators’ phase-one filings under art. 88 and IN BCB 704, art. 9. Article 23 also set 270 days for covered offshore incumbents to transfer Brazilian operations and customers under the applicable route.
6 November 2026	Article 91’s counterparty restriction took effect in the wording introduced by Resolution 589, subject to the expressly authorised arrangements.
1 January 2027	The revised wording for specified supervisory submissions under art. 88, III, b–e, begins to apply under Resolution 589.

A new crypto service company requires BCB authorisation before beginning regulated operations. Resolution 519, arts. 2 and 3, sets the operating authorisation requirements, including financial capacity, viability, governance, controllers and the business plan. Resolution 520, arts. 19–23, distinguishes this route from the rules for eligible institutions already authorised by BCB. Under art. 88, § 6, qualifying existing companies that applied on time may continue within the permitted scope while the procedure runs. A company relying on that treatment should be able to identify the applicant, its phase and any conditions on the activity. Resolution 519/2025, original DOU · Resolution 520/2025, arts. 19, 22, 88 and 92 · IN BCB 704/2026, art. 9 · Resolution 589/2026

Existing offshore provider transferring its Brazilian business

Article 23 of Resolution 520 provides a transition for a foreign entity that was already operating in Brazil at commencement and intended to continue regularly. The offshore entity had to “transferir […] as suas operações e clientes” within 270 days to an institution described in art. 20 or to a Brazilian crypto service company operating or formed for the transition. The successor must follow the formal communication or authorisation route applicable to it. The transfer must address service continuity, informed consent, asset segregation, governance, internal controls and data protection under art. 23, §§ 1–4. BCB Resolution 520/2025, art. 23

What to verify after the deadline

Match the local successor’s company name and CNPJ to the BCB lists and to the customer-facing terms. Trace opening balances to the offshore closing ledger and reconcile them by asset and customer. Keep records of effective dates, customer communications, consent, pending withdrawals and balances disputed at cutover. If an offshore affiliate remains in the flow, document its continuing role and review the legal basis for each service and each partner relationship. BCB’s published lists and explanation · BCB authorisation portal

Example with a Brazilian payments partner

An offshore exchange kept the customer contract and delegated only the collection of reais to a Brazilian payment institution. On 14 November 2026 the group checks whether the partner can still enable the product. Article 91 reaches activities such as payment accounts and payment transactions when used to enable covered crypto operations with counterparties outside the permitted arrangements. The group must establish the status and legal role of the offshore counterparty, and whether an express permitted route actually applies. Resolution 520/2025, art. 91, as amended by Resolution 589/2026

When custody can be performed offshore

A Brazilian provider may contract a foreign custodian on the terms of Resolution 520, arts. 83 and 84. Check home-jurisdiction authorisation and supervision, a legal representative in Brazil, qualifying local assets or callable financial guarantees, segregation enforceable in the custody jurisdiction, specific wallets for Brazilian customers and access to data by the Brazilian provider and BCB. The Brazilian provider needs an enforceable contract and the ability to produce records. An offshore outsourcing agreement and a contract under which the offshore provider directly serves Brazilian users have different parties and obligations. BCB Resolution 520/2025, arts. 83–84

When Receita Federal expects DeCripto from the platform

Connection to Brazil	How art. 5 treats it
Brazilian tax residence, qualifying Brazilian formation, management or regular place of business	Test the provider nexus under art. 5, I, a–d.
Offshore provider uses a .br domain for its operations or directs advertising at Brazilian residents	Each is a separate test of service in Brazil under art. 5, I, e, and § 1, I and IV.
Agreement with a Brazilian party or group entity enables local receipts from Brazilian residents	Test the specific arrangement under art. 5, § 1, II.
Service is presented to Brazilian residents with a local withdrawal intermediary or local payment means such as Pix	Test targeting under art. 5, § 1, III.
Trades through a Brazilian branch	Article 5, § 2, expressly covers those transactions.
Operations through a foreign provider, a decentralised platform or outside a provider	Brazilian users assess their own reporting under art. 5, II and § 3. The monthly amount must exceed BRL 35,000, alone or in aggregate.

Article 5, I, e, includes a provider that “presta serviço de criptoativo no Brasil”. An offshore app running Portuguese-language advertisements specifically targeted to Brazilian residents should assess provider filing under § 1, IV even when customers pay abroad. A website merely accessible from Brazil calls for a factual review of the four targeting indicators and the other art. 5 provider connections. Portuguese interface language alone is an input to that review. The BRL 35,000 threshold applies to the user rule in art. 5, II and § 3. The provider and the user require separate analysis under the text, including when a foreign provider has a Brazilian reporting nexus. RFB Normative Instruction 2,291/2025, art. 5

Put two DeCripto schedules in the filing calendar

The instructions set a deadline on the last business day of the following month for the monthly filing, applicable from the July 2026 reporting period. Article 8’s annual provider information applies from 1 January 2026, with a deadline on the last business day of January of the following year under art. 12. Test the annual exceptions in art. 8, §§ 1–2, against the annual obligation. The procedural layout defines the records, software interfaces and validations. For the user-side examples and international comparison, see the DeCripto, CARF and DAC8 guide. RFB Normative Instruction 2,291/2025, arts. 7–9, 12 and 19 · Receita Federal, DeCripto layout manual

Which flows require exchange-market and AML reporting?

Product feature	Separate control
Customer pays a non-resident using crypto, or sends the same owner’s crypto across borders	Apply the definition and exceptions in Resolution 277, art. 76-B, and gather the purpose, foreign party and relationship data under art. 76-C.
Platform offers covered stablecoin trades, relevant international card transfers or transfers to or from self-hosted wallets	Test the relevant provision of Resolution 277, art. 76-A, including its definitions and restrictions.
Exchange-authorised institution handles a covered crypto service operation from 3 November 2026	Prepare the Annex II-A submission to BCB under art. 82-A by day five of the next month.
An institution subject to Circular 3,978 handles a qualifying self-hosted-wallet transfer	Apply the specific COAF communication rule in art. 49, V, at the USD 10,000 equivalent threshold, and review the applicable date.

For payments involving an overseas provider, art. 76-B, § 2, requires verification of whether that provider undergoes effective prudential and conduct supervision or belongs to an effectively supervised consolidated group. The article calls for a documented risk assessment when the offshore jurisdiction lacks such requirements. Article 76-A, § 5, requires identification of the self-hosted wallet owner and documented source and destination verification processes. The underlying authorisation scope and transaction limits are in Resolution 277, art. 29, including the specific limit for an SPSAV when the counterparty lacks authorisation to operate in the exchange market. BCB Resolution 277/2022, arts. 29 and 76-A–76-C

BCB Resolution 574/2026 sets the exchange reporting cutover at “3 de novembro de 2026”. The BCB submission has a different recipient and deadline from DeCripto. Resolution 591/2026 replaced Resolution 588 and amended Circular 3,978, art. 49, V and § 2. The covered COAF communications for qualifying transfers contracted from 1 October through 31 December 2026 are due on the first business day of January 2027. Review suspicious-activity monitoring alongside that specific communication. BCB Resolution 277/2022, art. 82-A · BCB Resolution 591/2026

Which authority receives the offshore platform’s data?

Data flow	Who owns the decision
Provider filing in Brazil	Brazilian tax compliance lead determines the reporting entity, DeCripto records, submission dates and receipts.
Prudential, AML and exchange-market reporting in Brazil	The regulated institution assigns requests and filings by activity and authority. Its partners must be able to provide supporting data.
Home-country crypto tax reporting	Tax lead for the offshore entity verifies the local legislation, filing entity, customers’ tax residences and reportable period.
CARF exchange involving Brazil	Tax team verifies activated relationships and direction, reporting period and evidence available for actual exchange.

CARF is the OECD’s Crypto-Asset Reporting Framework for tax information. Brazil is listed for first exchanges by 2027. HMRC lists “Brazil” as a UK reportable jurisdiction for 2026. A UK reporting entity should evaluate its duty to HMRC under UK rules and review any separate DeCripto duty created by its Brazilian nexus. A jurisdiction’s commitment, the local provider’s record and a transmission between tax authorities represent three different stages. OECD Global Forum, CARF commitments · OECD, exchange relationships · HMRC International Exchange of Information Manual, IEIM8000720

Build the contract around access to data

Assign an accountable entity and individual for each filing. Map customer residence evidence and controlling persons where relevant, order and wallet records, local receipts, valuation inputs and report acknowledgements. Establish which party may verify balances or produce raw data, how errors are corrected, how records survive a migration, and how records are shared under the applicable privacy rules. A hash joins an on-chain event to your ledger. The customer record, contract and pricing records supply the parties, business reason and value needed for reporting. RFB Normative Instruction 2,291/2025, art. 2 and Annex II · DeCripto manual, record 0980

Questions from offshore crypto providers

Can a platform launch in Brazil straight after filing its application?

A new entrant should establish the applicable prior authorisation under Law 14,478/2022, art. 2, and Resolution 520, art. 19. Article 88’s conditional continuation applies to eligible existing companies that filed on time within their existing scope. An eligible bank or other institution must assess its separate route under arts. 20–22. Law 14,478/2022, art. 2 · BCB Resolution 520/2025, arts. 19–22 and 88

Does processing Pix through a local partner cover the regulatory requirements?

A local payments arrangement can bring the platform within DeCripto’s own nexus rules and requires separate review under BCB’s activity and counterparty rules. Follow the contract and money flows through the partner. Verify who delivers the regulated service, which entity holds the authorisation and which one makes each filing. IN RFB 2,291/2025, art. 5, § 1 · BCB Resolution 520/2025, arts. 19 and 91

Can our Brazilian subsidiary rely on an overseas custodian’s records for reporting?

A Brazilian provider must have access to relevant records under Resolution 520, arts. 83–84. Check that the contract gives the provider and BCB the required access and that operations can retrieve balances by client and asset as of a given date. Include failed transactions, transfers between the provider’s own wallets and records of crypto credited internally. BCB Resolution 520/2025, arts. 83–84

Does reporting a stablecoin payment determine how much tax is due?

The regulatory and tax reporting rules classify the events their recipients need to see. A tax assessment starts with the relevant taxable event, the role of each participant and the facts of each leg, including any settlement in reais or foreign currency. For the cash and crypto legs, see the stablecoin payments and IOF analysis.