Brazil central bank mandates audits for VASPs

TLDR

Brazil's central bank has introduced a new rule requiring independent audits for all crypto service providers seeking a license, tightening anti-money-laundering controls in its digital asset sector.

1. Under Normative Instruction 739, virtual asset service providers must obtain a CVM-registered independent audit to receive operating authorization.
2. Audits focus on AML and compliance systems, raising costs and barriers for VASPs but likely improving trust and regulatory alignment.
3. The move follows a major laundering scandal and fits a broader international crackdown, so firms should expect more coordinated, data driven oversight.

Deep Dive

1. What The New Rule Requires

On 30 May 2026, the Central Bank of Brazil issued Normative Instruction No. 739, requiring all virtual asset service providers (VASPs) to submit an independent audit before obtaining an operating license. The audit must be performed by a third party registered with the Brazilian Securities and Exchange Commission (CVM) and delivered as a reasonable assurance report that the VASP meets regulatory expectations.

According to coverage of Instruction 739, auditors must assess institutional policies, organizational structure, staff training, internal risk assessments, and customer due diligence procedures. They also check how well a VASP monitors, analyzes, and reports suspicious activity related to money laundering, terrorism financing, weapons proliferation, fraud, scams, and asset freezes.

2. Impact On VASPs And Users

For exchanges, brokers, OTC desks, and custodians operating as VASPs, this adds a significant upfront compliance step to the already strict Brazilian licensing process. Smaller startups may find the cost and complexity of a CVM-grade audit particularly heavy, which could slow new market entries or accelerate consolidation toward larger players.

For users, the regulation aims to make licensed platforms safer by hardening AML and KYC controls and forcing external verification rather than relying solely on self attestation. Over time, this can support institutional participation and banking relationships, although some costs are likely to be passed through in fees or slower onboarding.

3. Part Of A Wider AML Crackdown

The rule follows Operation Hidden Flow, which uncovered more than 5 billion dollars in irregular digital asset flows through six fintech firms and revealed the use of crypto for laundering tied to major Brazilian gangs. Authorities have also reported a 600 percent jump in crypto seizures to 14 million dollars in 2025, underscoring the perceived threat from illicit use of digital assets.

Regional reporting notes that these audits are explicitly intended to align Brazil with international standards for combating money laundering and terrorism financing, and to increase the security of decisions in authorization processes. Similar moves are occurring across Latin America and in the US and EU, pointing to a world where AML and compliance audits become a baseline expectation for serious crypto service providers.

Conclusion

Brazils central bank is tightening the gate at the licensing stage so that only VASPs with independently verified AML and compliance frameworks can operate. That raises barriers and costs for providers, but it also strengthens the credibility of licensed platforms and aligns Brazil more closely with global standards, which could matter for both institutional participation and cross border cooperation in crypto markets.