Brazil central bank orders independent crypto audits

TLDR

Brazils central bank has tightened crypto oversight by requiring independent audits before virtual asset firms can obtain licenses to operate in the country.

1. Under Normative Instruction No. 739, all virtual asset service providers (VASPs) need an independent audit from a CVM registered firm to secure an operating license in Brazil.
2. Audits must deliver reasonable assurance on anti money laundering, terrorism financing controls, and customer due diligence, following major crypto laundering scandals and rising seizures.
3. The rules raise compliance costs and barriers to entry, likely favoring larger, well capitalized platforms while increasing regulatory clarity and trust for Brazilian users.

Deep Dive

1. New Audit Requirement

On 30 May 2026, the Central Bank of Brazil issued Normative Instruction No. 739, making independent audits a condition for VASPs to obtain authorization to operate.

Firms must be audited by a third party registered with the Brazilian securities regulator CVM, and present a reasonable assurance report as part of the license process. This is outlined in the central bank focused coverage of the new rule for VASPs in Brazil.

2. Focus On Financial Crime

The audits are not just financial checks. They must assess legal compliance across internal policies, organizational structure, staff training, risk assessments for money laundering and terrorism financing, and customer identification procedures.

They also need to review how VASPs monitor and report suspicious activity related to money laundering, terrorism, weapons of mass destruction, fraud, scams, and asset freezes, according to the detailed description of Instruction No. 739.

This tightening follows Operation Hidden Flow, which uncovered more than 5 billion dollars of irregular digital asset flows involving six fintechs and alleged laundering links to organized crime, and a reported 600 percent jump in Brazilian crypto seizures to 14 million dollars in 2025.

3. Market Impact And What To Watch

For global and local exchanges, the rule increases upfront and ongoing compliance costs, and may slow or deter smaller players from seeking Brazilian licenses. Larger, better capitalized VASPs could consolidate market share.

For Brazilian users, stricter licensing and audit standards can improve confidence that local, regulated platforms follow robust AML and risk controls, even if it means slower approvals and fewer choices in the near term.

Key things to watch are: which major exchanges successfully obtain audited licenses, how quickly audits become standardized, and whether unlicensed offshore platforms face more aggressive enforcement or access restrictions.

Conclusion

Brazil is moving its crypto regime closer to bank like oversight by embedding independent AML focused audits into VASP licensing.

That raises operational hurdles but strengthens trust and aligns Brazil with global efforts to clamp down on crypto enabled crime, which regulators increasingly treat as a prerequisite for allowing broader digital asset adoption.