Brazil BCB Resolution 580: VASPs as Type 3

On 1 July 2026, Brazil’s Central Bank (Banco Central do Brasil, or BCB) issued Resolução BCB nº 580 (Resolução BCB n° 580, de 1º de julho de 2026), published in the Diário Oficial da União on 3 July. The resolution does three concrete things: it classifies sociedades prestadoras de serviços de ativos virtuais (SPSAVs / VASPs) as Tipo 3 institutions; it bars virtual-asset services as a condition for the simplified Segmento 5 (S5) track; and it sets 1 January 2027 as the date when a long list of bank-style prudential circulars and resolutions applies to those providers. By 30 June 2028, pure SPSAVs must sit in Segmento 4 (S4) regardless of size.

That is not a new licensing law. It is the next brick in the stack that began with Lei nº 14.478/2022 (the Virtual Assets Law) and the November 2025 BCB package (Resoluções 519, 520, and 521, in force from 2 February 2026). Authorization and FX rules were already live; 580 answers a different question: what kind of supervised entity is a crypto intermediary, and how heavy is the prudential load?

What “Tipo 3” and S4 / S5 mean in plain language

Brazil’s BCB sorts authorized institutions into tipos and, for some tipos, into segments (S1–S5) so capital, risk management, and reporting scale with complexity. Resolução BCB nº 436/2024 is the classification map; Resolução BCB nº 201/2022 sets conditions for the lightest S5 option.

Tipo 3, after 580, expressly includes SPSAVs alongside securities brokers, securities distributors, and FX brokers. In BCB terms, a pure crypto platform is no longer an awkward outsider; it is a nonbank intermediary in the same supervisory family as traditional brokers.

S5 is the simplified prudential segment for smaller, lower-complexity authorized entities. Resolution 580 amends Res. 201 so that providing virtual-asset services disqualifies an institution from electing S5. The message is explicit: the BCB does not treat VASP activity as a low-risk, light-touch line of business.

S4 is the next rung up. Article 6 of 580 says that until 30 June 2028, singular SPSAVs and prudential conglomerates led by an SPSAV must be placed in S4 regardless of size. The BCB can reclassify under Res. 436’s existing tools, but the default is fixed. That ends any hope that a tiny exchange stays forever on a micro-regime simply because its balance sheet is small.

What the text actually requires (and when)

Classification and S5 ban (in force on publication). Articles 2–4 rewrite Res. 436 and Res. 201: SPSAVs are Tipo 3; virtual-asset service is incompatible with the S5 election criteria.

Full prudential rulebook from 1 January 2027. Article 5 lists more than thirty circulars and BCB resolutions that SPSAVs and SPSAV-led conglomerates must observe from that date. The set covers risk-weighted assets, capital composition, liquidity and market-risk frameworks, internal controls, and related reporting obligations that already apply to other authorized institutions. Compliance must follow the segment the firm sits in under Res. 436, with any phase-in already written into those underlying norms.

S4 holding period through mid-2028. Until 30 June 2028, pure SPSAVs stay in S4 by default. After that date, ordinary size-and-complexity segmentation can reassert itself unless the BCB has already moved the firm.

Applicants still waiting for a final license. Article 7 is operationally important: for the purposes of Res. 520’s authorization and transitional rules, 580 applies to an SPSAV even before the BCB has issued a final authorization decision. Firms in the licensing queue cannot argue that prudential classification only starts after the stamp is dry.

Legacy S5 players already offering virtual assets. Article 8 targets institutions that, under Res. 520’s transitional provisions, were already providing virtual-asset services while sitting in S5. They must respect the new “no virtual assets if you want S5” restriction from 1 January 2027.

The official BCB note on the measure frames the same point: virtual-asset activity is incompatible with the S5 risk profile, so firms need a segment with fuller prudential scaffolding. Secondary legal summaries (for example M.PUPPE & Associados and industry digests of the DOU text) walk through the same article structure.

How this sits next to licensing, FX, and the 24-hour hold proposal

Think of Brazil’s 2025–2026 stack as layers:

1. Who may operate. Res. 519/520/521: authorization as an SPSAV (or virtual-asset services by other already-authorized institutions), capital floors, governance, custody segregation, and the 30 October 2026 deadline for incumbents to file authorization applications. After that date, authorized banks and payment institutions are generally barred from dealing with unauthorized VASPs.
2. How cross-border and FX report. Stablecoin and virtual-asset FX treatment, plus Resolução BCB 574/2026 delaying some reporting build-out.
3. How large exits are screened. The BCB’s recent proposal for up to a 24-hour hold on large stablecoin transfers abroad or to self-custody (comments closed early July; not yet a final rule as of this writing).
4. What prudential category the intermediary is. Resolution 580 (this piece).

None of these cancel the others. A platform still needs an authorization path by late October; it will also need capital, risk, and reporting systems that look increasingly like those of a securities or FX broker; and product features (especially large stablecoin withdrawals) may face extra operational friction if the hold rule is finalized.

Practical delta for users and builders

For everyday holders. Your keys and self-custody wallet are still outside the SPSAV licensing perimeter. What changes is the intermediary layer: the exchange, broker, or fintech that holds balances, does on/off ramps, or intermediates trades. Expect fewer lightly capitalized platforms, more bank-like onboarding and documentation, and product menus shaped by what a Tipo 3 / S4 firm can support economically. When a platform exits or tightens limits, the exit that does not depend on a support ticket remains a wallet you control.

For platforms already in Brazil. October 2026 is still the hard filing gate. January 2027 is the hard prudential gate for the bulk of bank-style rules. Mid-2028 is the S4 holding-period end. Budget for risk systems, capital methodology, and reporting (not only for a one-time license application). Article 7 means you should plan as if 580 already applies while your file sits in the BCB queue.

For foreign brands serving Brazilians. Local authorization, physical and governance substance under Res. 520, and now Tipo 3 / S4-style costs raise the bar for “remote only” models. Some will partner, white-label under a licensed SPSAV, or shrink product scope rather than carry a full Brazilian prudential stack.

For the region. Brazil is Latin America’s deepest crypto market by volume, with stablecoins carrying a large share of flows for savings buffers, remittances, and commercial settlement. When the region’s largest market forces intermediaries into broker-class prudential supervision, multi-country apps and liquidity routes reprice Brazilian access. Other supervisors watching LatAm adoption will treat 580 as a template of how far a central bank can go after the first VASP license law: not only “register,” but “sit in our capital-and-risk taxonomy.”

Self-custody and peer-to-peer transfers without a Brazilian intermediary remain outside this classification exercise. Policy pressure still concentrates on who stands between the user and the chain.

Timeline at a glance

Takeaway

Resolução BCB nº 580/2026 is the BCB saying, in classification language, that a virtual-asset service provider is a Tipo 3 intermediary, not a low-risk S5 experiment. The practical sequence for the market is already set: license applications by late October 2026, full prudential observance from 1 January 2027, and S4 as the default home for pure SPSAVs through mid-2028.

If you use Brazilian platforms, prefer clear segregation of client assets, documented authorization status, and an exit path into self-custody. If you build or operate one, treat 580 as binding architecture for capital and risk systems, not optional polish after the license stamp. This is analysis of public BCB texts and secondary legal commentary, not legal, tax, compliance, or investment advice; verify the current DOU and BCB normative pages before you act.