Brazil central bank orders independent VASP audits

TLDR

Brazils central bank is tightening crypto oversight by requiring independent audits before virtual asset service providers can be licensed.

1. Brazils Central Bank issued Normative Instruction 739 mandating CVM?registered third?party audits for all VASPs seeking authorization to operate.
2. The audits focus on anti?money?laundering and terrorism?financing controls, reacting to a multi?billion dollar laundering scandal involving digital assets.
3. VASPs face higher compliance costs and longer licensing timelines, while users get more protection but may see consolidation or exits among smaller platforms.

Deep Dive

1. What The New Audit Rule Requires

On 30 May 2026, the Central Bank of Brazil issued Normative Instruction No. 739, which makes independent audits a formal condition for approving any virtual asset service provider (VASP) license in the country.

VASPs must now obtain a reasonable assurance report from an audit firm registered with the Brazilian Securities and Exchange Commission (CVM) before receiving authorization to operate. The rule applies across the board to crypto exchanges and other VASPs seeking a Central Bank license, and it adds to Brazils already strict licensing framework.

According to the official summary, these reports must cover institutional policy, organizational structure, staff training, internal risk assessments, and customer due diligence, with the regulator emphasizing that independent verification should increase transparency and reliability in VASP controls.New rules for crypto in Brazil

2. Why Brazil Is Doing This

The move comes directly after Operation Hidden Flow, which uncovered over 5 billion dollars in irregular digital asset flows through six fintechs and alleged crypto?based laundering tied to major Brazilian criminal gangs.Latam Insights on Brazils VASP audits

Authorities also report a sharp rise in crypto seizures, reinforcing the narrative that digital assets are increasingly used in organized crime and terrorism financing. Instruction 739 explicitly targets these risks, requiring audits to assess how well VASPs can monitor, flag, and report suspicious transactions and respond to fraud and scam patterns.

From a global perspective, this aligns Brazil more closely with FATF recommendations and broader international efforts to clamp down on crypto money laundering.

3. Impact On VASPs And Users

For VASPs, the practical impact is heavier compliance spend and slower, more complex licensing. Only firms able to work with CVM?registered auditors and implement robust AML, KYC, and risk frameworks will pass.

Smaller or lightly capitalized platforms may find the new hurdles prohibitive, leading to consolidation around better funded exchanges or pushing some offshore platforms to serve Brazilians without local licenses, at higher legal risk.

For users, the upside is stronger oversight of licensed venues, which should reduce outright fraud and poor controls. The trade?off is potential loss of choice in the short term if some services exit or delay Brazilian operations.

Conclusion

Brazils new independent audit mandate signals a shift toward bank?grade regulation for local crypto platforms, driven by high profile laundering cases and rising enforcement pressure. In the near term it raises costs and barriers for VASPs, but it also pushes the market toward more institutional?style risk controls, which could make licensed Brazilian crypto venues safer and more durable over time.