Brazil's securities regulator is accepting proposals for a distributed-ledger pilot that will test how tokenised securities could be issued, traded and settled without using real investors' money. The application period remains open on October 24 under a rule that gives eligible organisations 15 working days from its October 14 publication to submit their networks and provide the regulator with access.
The programme comes from CVM Resolution 249, dated October 13. It is an experimental framework, not permission to launch a commercial exchange or offer investments to the public. The resolution expressly says participation does not amount to regulatory approval, certification or an assurance about a technology or business model.
Who can propose a test network?
Network proposals may come from qualifying market associations and securities-market self-regulatory organisations already participating in the CVM's tokenisation working group. They may apply individually or through a consortium with a designated lead organisation. This is not a general application window for members of the public.
Each proposal must describe its distributed-ledger architecture, security controls, permissions and interoperability arrangements. It must also identify the proposed participants, test cases, timetable and technical lead. A plan separating the experiment from production systems is required, together with working access for the CVM, rather than merely a promise to supply that access later.
The resolution provides for automatic admission without a numerical cap when its requirements are met. The managing committee checks eligibility, timeliness, the proposal's contents and the regulator's access arrangements. Remediable defects can be given up to three working days to be corrected; a network cannot enter if its access arrangements still fail the minimum requirements.
Participation is voluntary, unpaid and at the participants' own expense. The framework covers functions including securities bookkeeping, custody, market operation and intermediation. It also allows exceptional, reasoned admission of entities without CVM registration when they work jointly under the responsibility of an admitted participant or network manager.
Fictitious tokens, with direct regulatory oversight
The pilot can simulate several stages of a security's life, including issuance, primary and secondary distribution, trading, custody and settlement. It can also test payments, redemptions and conversions. One permitted scenario combines several functions within a single distributed-ledger environment, with or without a central depository or intermediary.
Those simulations must remain separate from real financial activity. The rule prohibits actually issued securities, real money and investors' or customers' personal data, while allowing anonymised or synthetic data subject to Brazil's data-protection law. Test tokens have no economic value or legal effect outside the experiment.
That separation also limits the regulatory exemptions. Certain ordinary CVM requirements concerning securities offerings and market services are set aside only for experimental operations conducted in the test networks while the resolution applies. The provision is not a blanket exemption for a participant's normal business.
The regulator must be able to read the complete experimental records in real time, including transaction data, smart-contract states and related metadata. Records must be extractable in structured, machine-readable form, with timestamped audit trails. The CVM's connection cannot depend on an intermediary, but its access is read-only: it cannot insert, change or validate transactions.
Network managers must maintain that access throughout testing and submit reports every 15 days. Security incidents, significant failures and events that could compromise the experiment or escape its segregated environment must be reported immediately, along with the response and containment measures.
Testing comes before any wider rule change
The resolution sets a 60-day testing period beginning on the first working day after the proposal window ends, not on the October 14 publication date. The managing committee may extend testing by up to 30 days within the programme's governing timetable. It may also suspend tests or exclude a network or participant when requirements are breached or safety is compromised.
Final reports are due within 10 working days after testing ends. They must assess results, risks and limitations, describe activities performed outside the ledger and may propose legal or regulatory changes. The CVM is to publish a public version of its consolidated assessment, excluding protected confidential information.
The pilot is separate from Brazil's October 30 filing deadline for existing crypto service providers. It addresses securities-market experiments rather than that central-bank authorisation process. It also differs from Japan's review of DeFi interfaces and tokenised finance, which is examining policy questions through a study group.
Participants cannot publicly release test results or conclusions without the committee's prior consent, or use the pilot to advertise supposed CVM endorsement to customers. For now, the immediate step is submission of qualifying test networks, not the launch of investment products carrying the regulator's approval.
