Brazil central bank tightens oversight of VASPs

TLDR

Brazils central bank has introduced stricter licensing rules for crypto VASPs, centered on mandatory independent audits of their compliance and AML controls.

1. Under Normative Instruction 739, all Virtual Asset Service Providers must obtain reasonable assurance audits from CVM?registered firms before they can be licensed to operate in Brazil.
2. The audits focus on anti?money?laundering, terrorism financing risk management, and customer due diligence, responding to recent multi?billion dollar crypto laundering scandals in Brazil.
3. For users, this likely means fewer but more heavily scrutinized platforms, with tighter KYC, higher operating costs, and a gradual shift toward fully regulated exchanges.

Deep Dive

1. What The New Rules Require

On 30 May 2026, the Central Bank of Brazil issued Normative Instruction No. 739, adding a new prerequisite for licensing Virtual Asset Service Providers (VASPs).

To obtain or maintain authorization, VASPs must now commission an independent audit from a third party registered with the Brazilian Securities and Exchange Commission (CVM). The auditors must deliver a reasonable assurance report that the VASP meets detailed regulatory expectations across governance, internal controls, and compliance.

According to coverage of the measure, the central bank says the goal is to improve the quality of authorization decisions and align Brazil more closely with international standards for combating financial crime, using external audits to validate what firms claim about their controls.

2. Why Oversight Is Tightening

The instruction follows Operation Hidden Flow, which exposed over 5 billion dollars in irregular digital asset movements routed through six fintechs and suggested links to organized crime. Brazilian authorities also report a 600% jump in crypto seizures to about 14 million dollars in 2025 as criminal groups adopted digital assets.

In that context, the new audits must assess how each VASP handles:

1. Internal risk assessment for money laundering and terrorism financing.
2. Customer identification and due diligence procedures.
3. Monitoring and reporting of suspicious transactions, including scams and fraud.

The central bank explicitly frames this as a way to prevent future abuse and to bring Brazil in line with global AML and counter?terrorism finance expectations for crypto service providers.

3. Impact On Platforms And Users

For platforms, the obvious impact is higher compliance cost and a tougher licensing hurdle. Smaller or lightly capitalized VASPs may struggle to fund independent audits and to upgrade their systems to pass them, which could drive consolidation toward larger, better resourced players.

For Brazilian users, the immediate effect is likely more stringent KYC and transaction monitoring, but also potentially safer, more transparent venues. Over time, exchanges that pass these audits could become more attractive counterparties to banks and global partners, improving on? and off?ramp reliability.

Conclusion

Brazils central bank is not banning crypto, but it is clearly shifting the sector onto a banking?style regulatory track by forcing VASPs through independent, CVM?registered audits focused on AML and customer protection. That raises the bar for exchanges and service providers, likely weeding out weaker operators while offering users a more supervised, institution?friendly environment over time.