Brazil tightens VASP rules with audit mandate

TLDR

Brazil's central bank has introduced a new rule that forces crypto service providers to pass independent audits before they can be licensed.

1. Normative Instruction 739 requires VASPs to obtain reasonable assurance audits by CVM registered firms covering AML, governance, and customer due diligence.
2. The change raises compliance costs and licensing friction, likely favoring larger, better capitalized exchanges while aiming to reduce crypto related crime.
3. Key signals will be how many firms secure licenses, how long audits take, and whether other regulators adopt similar audit mandates.

Deep Dive

1. What Brazil Just Changed

On 30 May 2026, the Central Bank of Brazil issued Normative Instruction 739, adding an independent audit requirement for all virtual asset service providers (VASPs) seeking authorization.

VASPs must now present a reasonable assurance report from an audit firm registered with the securities regulator (CVM). The audit has to cover institutional policies, organizational structure, staff training, internal risk assessments, and customer due diligence.

It also must assess how well the platform monitors and reports suspicious activity tied to money laundering, terrorism financing, weapons of mass destruction, fraud, scams, and asset freezes, aligning Brazil more tightly with global AML standards.

2. How This Hits Exchanges And VASPs

Brazil already had a relatively strict VASP licensing process; the new audit mandate adds another gate that many smaller or lightly capitalized platforms may struggle to pass.

Independent audits are expensive and time consuming, which tends to advantage larger exchanges and custodians that already run bank grade compliance and internal controls.

The move follows the Hidden Flow case, where over 5 billion dollars in irregular digital asset flows were uncovered and crypto seizures reportedly surged 600 percent to 14 million dollars in 2025, prompting tougher oversight.

3. What To Watch Next

First, watch how regulators treat existing operators. If re authorization requires audits on a tight timetable, some local platforms could exit or restrict services until reports are ready.

Second, global exchanges that want an onshore Brazilian license will need a locally compliant structure plus CVM registered auditors, which can delay market entry relative to light touch jurisdictions.

Third, this could become a template for other countries that want to tame crypto risk without banning it, similar in spirit to MiCA style prudential and AML requirements in Europe.

Conclusion

Brazil is tightening crypto oversight by making independent audits a prerequisite for VASP licenses, directly linking market access to demonstrable AML and governance controls. For crypto firms, Brazil now looks more like a high compliance, high trust market where serious players can operate, but only if they are willing to invest in bank grade audit and risk infrastructure.