Brazil's central bank has adopted rules requiring covered financial institutions, including virtual-asset service providers, to let individual customers choose which products and services they receive targeted marketing about. The main requirements will take effect on March 31, 2027, under a resolution published in the official gazette on October 26.
Resolution BCB 602, dated October 23, expressly includes virtual-asset services in its scope. It also names virtual-asset service companies among the institutions covered, alongside payment institutions, foreign-exchange brokers and securities intermediaries. The customer protections apply to individuals, including sole proprietors, rather than every category of corporate client.
The rule gives customers control over categories of individually directed offers, but does not require advance permission for all crypto marketing. Under its general provision, an institution may advertise and make individual offers for all products and services if the customer has not specified a selection. A stricter prior-consent provision concerns particular credit offers to customers needing additional protection.
The central bank says the framework is intended to prevent excessive digital marketing. It also provides for information to support the regulator's monitoring and supervision of institutions' conduct.
What counts as an individual offer?
The resolution covers commercial communications initiated by an institution without a specific prior request from the customer. The definition includes attempts to encourage a customer to contract for a product, renew it or expand its use. It applies when the recipient is identified or identifiable, across any channel.
Responsibility also extends to communications made through third parties acting in the institution's name, on its behalf or for its benefit. The text expressly includes Banking as a Service arrangements and banking correspondents. Using an intermediary therefore does not, by itself, place an individual offer outside the definition.
Institutions must prominently offer the customer-selection option in each medium used for targeted advertising and offers. The listed channels extend beyond email and text messages to apps, internet banking, websites, cash machines, push notifications, instant messaging and virtual assistants. Contractual and technological arrangements involving third parties are covered too.
Customers' choices do not prevent products from remaining passively available through an institution's physical or digital channels. The resolution distinguishes those listings from unsolicited approaches: the search must begin and end on the customer's own exclusive initiative, within a digital environment specific to the product or service.
Withdrawal must take effect immediately
A customer will be able to withdraw the selective marketing authorisation at any time, with immediate effect. Institutions must also send alerts every six months reminding customers that they can withdraw it. These provisions establish an ongoing choice, rather than a preference recorded only when an account is opened.
The institution must keep the data, records and documents concerning the authorisation procedures available to the central bank for at least five years. It must also designate a director responsible for meeting the resolution's obligations. The rules therefore reach internal accountability and record-keeping as well as the messages customers see.
The additional protections for vulnerable customers need to be read within their stated scope. Article 5 concerns credit operations and post-paid payment instruments. For customers needing special attention, those offers require specific, unequivocal prior authorisation for each product type, rather than permission covering a bundle.
Such credit offers are restricted to renegotiating, transferring or moving existing balances to better conditions, without offering additional disbursements, subject to the applicable rules. These credit-specific restrictions should not be presented as a general ban on virtual-asset offers or a new requirement to renew permission annually for every crypto service.
Preparation starts before the main commencement date
Institutions have 120 days from publication to adapt their systems, policies, internal controls and customer channels. That preparation provision took effect on publication, together with the central bank's power to issue implementation details and the repeal of Article 6 of BCB Resolution 567. The remaining provisions start on March 31, 2027.
The marketing measure addresses a different regulatory question from Brazil's crypto-provider authorisation timetable and the CVM's tokenised-securities testing programme, previously covered by Dalimss News. Resolution 602 sets rules for institutions' approaches to customers; it does not grant a provider an operating licence or approve a crypto product.
Source material: Banco Central do Brasil. Original English reporting based on the official Portuguese text, reproduced with attribution under the bank's website terms. This is not an official translation.
