Brazil's existing crypto service providers face an October 30 deadline to submit the first phase of their applications to operate under the central bank's authorisation framework. With that date approaching, the distinction between filing an application and receiving final approval matters: the rules allow qualifying providers that apply on time to continue services while their authorisation process is completed.
The deadline is set out in Article 9 of BCB Instruction 704, issued on January 29, 2026. It is not a newly announced October measure. The underlying operating framework, Resolution 520, was issued on November 10, 2025 and entered into force on February 2, 2026. Its current consolidated text was checked on October 24.
What existing providers must submit
The October 30 requirement concerns providers already operating when the relevant framework took effect, rather than a general permission for new businesses to start trading. Instruction 704 treats applications from firms not yet operating separately from the two-stage process for incumbents. Existing providers must include a declaration confirming that they were active when the rules entered into force.
The first-phase package also requires declarations concerning controllers and significant shareholders, information concerning control arrangements, and the company's financial statements for the three preceding financial years. Those statements must be audited by an independent auditor registered with Brazil's securities regulator, the CVM. The instruction identifies prescribed document models rather than allowing the deadline to be met with an informal expression of interest.
Filing is accompanied by operating obligations. Under Article 88 of Resolution 520, incumbent firms must demonstrate compliance with requirements covering relevant risk management, cybersecurity and incident response, anti-money-laundering controls, sanctions procedures, accounting and auditing. These are conditions within the transition, not requirements that providers can ignore until final authorisation.
From submission until the conclusion of phase one, the resolution requires specified reporting to the central bank. That includes daily information about customer balances and custody holdings, monthly verifiable proof of reserves broken down by virtual asset, and monthly information on customers' assets allocated to staking where the provider conducts that activity. Further information must be supplied when the central bank requests it.
Timely filing does not mean final approval
Article 88 expressly permits providers that submit their application on time to maintain their virtual-asset services until their authorisation process concludes. They cannot take on another provider modality during that period. By contrast, providers that do not submit on time must cease virtual-asset services within 30 days after the application deadline.
The second phase has its own timetable. Instruction 704 gives an applicant up to 60 days from the central bank's favourable phase-one response to submit the second-phase documents and information. The bank may grant an extension of up to a further 60 days following a justified request. Neither period is a promise that final approval will be issued within that time.
Second-phase requirements include financial-capacity evidence, the origin of capital contributions, an executive summary of the business plan and information about administrators. The current instruction also requires a reasonable-assurance report from an independent auditor registered with the CVM. The scope of that report is set out in an annex, including anti-money-laundering policies and controls.
Resolution 520 separately states that the adjustment period ends when the central bank responds to phase one. Once that period ends, the provider must observe the applicable law and central-bank rules in full, even if a final decision on its operating application has not yet been made.
A separate November banking restriction
The current Article 91 sets November 6, 2026 as the start of a restriction on central-bank-regulated institutions conducting or facilitating virtual-asset operations with unauthorised providers, except in forms expressly permitted by the resolution. It covers activities including trading, custody, foreign exchange, payment accounts and payment transactions when used to enable those operations.
This must be read alongside the express transition for timely applicants. It should not be described as a blanket November 6 banking cutoff for every provider whose final approval remains pending. The consolidated text attributes the revised Article 91 to Resolution 589 of September 23, effective from October 1.
These Brazilian deadlines are separate from Ireland's planned crypto white-paper notification portal and France's proposals for the MiCA review. The immediate Brazilian milestone is the incumbent application deadline, not a declaration that every applicant has already been authorised.
