Brazil Tightens Crypto Regulations With New Audit Requirements And Stricter Licensing Rules For Exchanges

Brazil Tightens Crypto Rules With Mandatory Audits And Stricter Licensing Standards

Brazil is raising the compliance threshold for cryptocurrency businesses, introducing mandatory independent audits and tougher licensing requirements as regulators tighten oversight of one of Latin America's largest digital asset markets.

The new measures, issued by the Banco Central do Brasil under Instrucao Normativa BCB No. 739, require virtual asset service providers (VASPs) to undergo independent financial audits before obtaining or renewing authorisation to operate.

The rules came into force on 1 June 2026 and apply to both new applicants and firms already licensed in the country.

Independent Audits Become A Core Licensing Requirement

Under the updated framework, cryptocurrency exchanges, brokerage platforms and digital asset custodians must submit audit reports prepared by independent auditors registered with Brazil's securities regulator before they can receive or maintain operating approval.

The audits extend beyond financial statements.

Auditors are required to assess whether firms comply with anti-money laundering (AML) and counter-terrorism financing (CTF) requirements, review risk management controls, evaluate employee training programmes and verify whether customer assets are properly segregated from company funds.

By making audits a condition of licensing rather than a standalone reporting obligation, the central bank has effectively linked market access to financial transparency and operational compliance.

The move places crypto firms under a level of scrutiny closer to that faced by traditional financial institutions, increasing the documentation and governance standards expected from operators in the sector.

Why Brazil Is Tightening Oversight

The latest rules build on a regulatory framework that has been developing over several years.

Brazil's crypto legislation, introduced in 2022, formally recognised virtual asset services and laid the foundation for sector-specific regulation.

A presidential decree in 2023 designated the central bank as the authority responsible for supervising virtual asset service providers, while a licensing regime for the sector was established in November 2025.

The audit requirement adds another layer to that framework, giving regulators an independent mechanism to verify the information submitted by crypto companies and monitor compliance with financial crime controls.

Rather than relying primarily on company disclosures, authorities will now have third-party assessments of how firms manage risks, handle customer assets and implement internal controls.

Higher Barriers For New And Existing Firms

The revised licensing framework is expected to make operating in Brazil more demanding for crypto businesses.

Companies seeking approval for the first time must satisfy the audit requirements from the beginning of the authorisation process.

Existing licence holders are also required to undergo independent audits when renewing their licences, ensuring that the rules apply across the entire regulated market.

For smaller operators, the cost of engaging securities-registered auditors and maintaining the necessary compliance infrastructure could prove significant.

Larger firms with established governance and compliance teams may find it easier to absorb the additional requirements.

The changes also signal that regulators are moving away from lighter registration-based models towards ongoing supervision of crypto businesses, a trend increasingly seen in major jurisdictions worldwide.

Part Of A Wider Regulatory Push

The audit rules arrive as Brazil continues to tighten oversight across digital asset and online trading markets.

Authorities recently prohibited 28 betting and prediction market platforms, including Polymarket and Kalshi, citing failures to comply with local derivatives trading regulations.

Separately, electronic foreign exchange providers in Brazil will be barred from using cryptocurrencies for international remittance services from 1 October 2026.

Together, the measures point to a regulatory strategy focused on bringing crypto-related activities under closer supervision while requiring firms to demonstrate stronger compliance controls before serving Brazilian customers.