Under Resolução BCB nº 520 (Resolução BCB n° 520, de 10 de novembro de 2025), in force since 2 February 2026, virtual-asset firms already serving Brazil have a fixed 270-day window to file for authorization as a sociedade prestadora de serviços de ativos virtuais (SPSAV). That clock runs out on 30 October 2026. From that date, banks and payment institutions authorized by the Banco Central do Brasil (BCB) are generally barred from running virtual-asset operations with counterparties that are neither authorized nor already in the authorization queue, except where the resolution itself carves out a limited exception.
With roughly three months left, the practical question is no longer what the November 2025 package said. It is what happens to platforms, bank rails, and end users when the transitional bar actually bites.
How the 270-day clock works
The framework sits on Lei nº 14.478/2022 (the Virtual Assets Law) and three BCB resolutions published on 10 November 2025:
| Instrument | Role |
|---|---|
| Resolução BCB nº 519 | Authorization process: fitness of controllers and administrators, capital, governance, IT, physical headquarters in Brazil |
| Resolução BCB nº 520 | Constitution and operation of SPSAVs (and virtual-asset services by other BCB-authorized institutions); transitional filing and bank-counterparty rules |
| Resolução BCB nº 521 | How virtual-asset activity sits inside the foreign-exchange perimeter |
All three took effect on 2 February 2026. For pure SPSAVs that were already active that day, Res. 520 starts a non-extendable 270-day period to protocol the authorization request at the BCB. Industry and law-firm timelines map that interval to 30 October 2026 (Mattos Filho, Bichara e Motta, Azify).
The filing date is the hard gate, not the date of a final BCB approval. A timely application generally lets the firm keep operating while the central bank reviews the file. Missing the window is different: secondary summaries of art. 88 of Res. 520 state that firms that do not file must cease activity within 30 days after the deadline, notify clients, and return virtual assets and client funds.
Two phases: what “in the queue” actually means
Incumbent applications are not a single rubber stamp. Secondary analyses of the transitional scheme (and of Instrução Normativa BCB nº 704, which details documentation for the process) describe two phases:
- Phase 1 (adaptation / adequacy). Prove the firm was already active when the regime went live; meet minimum capital and fit-and-proper tests for controllers and qualified holders; show baseline risk management, cybersecurity, AML/CFT, accounting, and audit readiness. Periodic reporting to the BCB starts here, including client registry data and custody totals.
- Phase 2. Full review against Res. 519’s authorization criteria: economic-financial capacity of controllers, lawful origin of resources, business viability, IT infrastructure, corporate governance, technical expertise of management, and a real physical headquarters in Brazil (coworking or virtual offices are out).
If Phase 1 is cleared, firms typically have a short window (on the order of 60 days, with a possible extension under the instructional norm) to open Phase 2. If the BCB archives or denies the request, the same 30-day wind-down logic applies: stop the regulated activity, communicate with clients, and move assets to authorized institutions.
For the bank-counterparty rule that bites on 30 October, the operative status is authorized or in process. Sitting in a complete, accepted queue is not the same as a final license, but it is the difference between remaining a legal counterparty for PIX-connected banks and being cut off.
What changes for banks, payment firms, and foreign platforms
Res. 520 is not only a license form for pure crypto companies. From 30 October 2026, institutions already authorized by the BCB (commercial and investment banks, payment institutions, and the other categories the resolution lists) are prohibited from conducting virtual-asset operations with Brazilian counterparties that lack authorization and are not in the authorization process, subject only to exceptions the text itself lists (Mattos Filho summary).
That is the consolidation lever. Even a well-capitalized offshore exchange that never files a local SPSAV application can lose on-ramps and off-ramps when Brazilian banks refuse to touch its flows.
Foreign operators already serving Brazil face a parallel 270-day obligation: transfer operations and clients to a local SPSAV (or another qualifying BCB-authorized institution) or exit the local virtual-asset market. Continuity of service and client rights must be preserved during the migration.
Already-authorized banks and brokers that want to offer virtual-asset services themselves follow a different track: they communicate intent to the BCB and adjust operations rather than re-chartering as a pure SPSAV, provided they meet the resolution’s eligibility conditions (including minimum time already authorized).
Capital floors are set outside Res. 520 proper, in the joint capital rules the BCB published alongside the package. Public briefings around the November 2025 launch put minimum capital in a band of roughly R$10.8 million to R$37.2 million, depending on the mix of intermediation and custody activities (Mattos Filho).
What it means for everyday users
If you hold crypto on a Brazilian exchange, the near-term risk is operational, not a ban on holding Bitcoin or stablecoins yourself.
- Platform still in the queue. Balances and trading can continue under the transitional regime while the BCB reviews the file. You should still expect more reporting friction: custody segregation, Travel Rule-style originator and beneficiary data, and the FX-side reporting stack already delayed in part under Resolução BCB 574/2026.
- Platform misses the filing window or is denied. Expect a wind-down: withdrawal windows, forced transfers to another authorized venue, and account closures on a short clock. Move assets you control on a schedule you choose, not one dictated by a 30-day notice.
- Bank and payment rails. After 30 October, a local bank or payment institution has a compliance reason to refuse PIX, wire, or account relationships that support an unauthorized VASP. On-ramp friction is the user-facing symptom of the bank-counterparty ban.
- Self-custody. Nothing in Res. 520 outlaws holding keys yourself. The friction concentrates at regulated intermediaries: large exits, cross-border stablecoin legs under Res. 521, and the still-separate 24-hour hold proposal for big transfers abroad or to self-custody (proposal status, not final law as of this writing).
This is analysis of the legal timeline, not a recommendation to buy, sell, or switch platforms.
How this piece fits the rest of Brazil’s 2026 stack
PTYcoin has already walked several layers of the same stack:
- Who may operate and by when. This article: Res. 519/520/521 and the 30 October 2026 incumbent filing deadline.
- How cross-border and FX report. Stablecoin treatment under Res. 521, plus the 574/2026 reporting delay and DeCripto live reporting.
- How large stablecoin exits may be screened. The 24-hour hold proposal.
- What prudential category the intermediary is. Resolução BCB nº 580 (Tipo 3, S5 barred, heavy rulebook from 1 January 2027), which expressly applies even while a firm is still waiting for a final authorization decision.
None of those layers cancel the October filing date. A firm that clears Phase 1 still faces bank-style prudential build-out under 580; a firm that never files never gets that far.
Takeaway
30 October 2026 is the date Brazil’s virtual-asset market stops treating “we were here before the rulebook” as enough. Resolução BCB nº 520 converts that history into a binary status for incumbents: filed and in process, or outside the supervised perimeter and, soon after, offline. For users, the actionable check is simple: confirm that the platform you use has submitted (or already holds) BCB authorization, keep withdrawal paths tested while rails are still open, and prefer self-custody for amounts you are not actively trading. For builders and operators elsewhere in LatAm watching Brazil as a template, the lesson is the same as the text: the hard stop is the filing deadline plus the bank-counterparty cut-off, not a vague “licensing sometime in 2026.”
