Resolução BCB nº 588 and Resolução BCB nº 589, both dated 23 September 2026, split Brazil’s latest virtual-asset update into two jobs. Resolution 588 amends the anti-money-laundering rulebook and makes transfers of at least US$10,000 to or from a self-custody wallet specifically reportable to the Conselho de Controle de Atividades Financeiras (Coaf) from 1 October. Resolution 589 amends the provider framework, adding supervisory data and moving to 6 November the cutoff for dealings with virtual-asset service providers the BCB has not authorized.
The Banco Central do Brasil (BCB) announcement calls the package an adjustment to virtual-asset services and to prevention of money laundering and terrorist financing (PLDFT, in the Portuguese acronym). The key distinction for a wallet owner is simple: a Coaf communication is a report by the regulated institution. It is not a finding that the transfer is illegal, a ban on self-custody, or a US$10,000 transfer limit.
Resolution 588 adds two specific Coaf communications
Resolution 588 amends Circular nº 3.978/2020, the BCB’s PLDFT framework for authorized institutions. Its operative change is in article 49, the section for communications of specific operations.
The amended article adds two US$10,000 lines:
- Foreign-exchange operations involving delivery or receipt of foreign currency in cash, at or above US$10,000 or the equivalent in another currency, become automatic Coaf communications.
- Transfers of virtual assets to or from self-custody wallets, at or above the same dollar equivalent, become specific Coaf communications.
A self-custody wallet is one where the user controls the private keys needed to move the assets. The BCB says those transfers can leave an authorized institution with less information for monitoring and risk assessment than it has when assets remain in custody at a BCB-authorized institution. Resolution 588 responds at the regulated edge: the institution handling the transfer must report the qualifying operation. It does not turn the wallet itself into a BCB-regulated account.
Agência Brasil’s same-day cross-check makes the legal effect explicit. Communication does not mean illegality, and the threshold does not prohibit a larger movement. Coaf receives and analyzes reports so it can identify patterns that may warrant further review. A report may be routine even when the underlying transfer is lawful.
Resolution 588 takes effect on 1 October 2026. Its wording uses “equal to or greater than,” so a transfer at exactly US$10,000 equivalent is inside the reporting line.
Resolution 589 gives the supervisor more custody data
Resolution 589 amends Resolução BCB nº 520/2025, the operating framework for virtual-asset providers. The BCB note uses prestadora de serviços de ativos virtuais (PSAV) as the general provider shorthand; Resolution 520 calls the licensed corporate category a sociedade prestadora de serviços de ativos virtuais (SPSAV).
The new text expands article 88 reporting after an authorization request is filed. Subject to the BCB’s implementing rules, firms must send accounting balances held for clients and users, custody totals by asset and financial value, aggregate quantities and values held for each client, verifiable proof-of-reserves demonstrations, and the total client assets committed to staking when the firm offers it.
New articles 90-A and 90-B extend that data duty to eligible institutions already inside the BCB perimeter and leave the filing format and other conditions to further BCB regulation. These data provisions take effect on 1 January 2027, not on 1 October. The delayed start gives the supervisor and firms time to define and build the reporting channel.
This is a sharper view of intermediary custody, not a claim over assets already held directly by users. Proof of reserves and per-client custody totals let the BCB compare what a platform says it owes with what it can verify it controls. That data layer also sits beside the proposed statutory client-asset protections in PL 1.536/2023. The bill would address whether client assets can answer for a provider’s debts; Resolution 589 addresses what supervised firms must show the BCB.
October filing remains October 30; the counterparty cutoff moves
The BCB announcement says the PLDFT changes arrive in the same month as the final period for operating providers to formalize authorization requests. It does not say the filing deadline is 1 October.
Resolution 520 gave incumbent SPSAVs a 270-day filing window from the framework’s 2 February 2026 start. PTYcoin’s Resolution 520 explainer mapped that window to 30 October 2026 and also cited 30 October as the article 91 cease-relationship date then in the text. Resolution 589 now moves that prohibition date to 6 November 2026. From that date, financial institutions, payment institutions, and the other institutions authorized to operate by the BCB may not conduct or facilitate operations in the virtual-asset market whose counterparties are institutions or entities that provide virtual-asset services and are not authorized to operate in the country by the BCB, except in the forms expressly allowed by Resolution 520.
Article 2 makes the article 91 amendment effective on 1 October, even though the prohibition written into article 91 begins on 6 November.
Neither Resolution 588 nor 589 restates a day-of-month filing deadline. The official note says only that October is the final month for operating PSAVs to formalize their requests, while Resolution 589’s text supplies the new 6 November counterparty cutoff. Article 91 turns on authorization alone; it is the BCB’s press note, not the resolution, that describes the target as entities neither authorized nor in an authorization process. Mateo’s report on Onda Finance and Comunicado nº 45.986 shows what “in process” looks like in public, including the BCB’s review of named directors. That comunicado is not one of the two resolutions and does not grant Onda a final license.
The rest of Brazil’s stack still applies. Resolução BCB nº 580 puts providers into the Tipo 3 prudential framework, with major requirements starting on 1 January 2027. Resolution 589 now adds custody, reserve, and staking data to the same New Year build.
The same number now has two different legal effects
The US$10,000 figure also appears in Resolução BCB nº 584, but the mechanism is different.
| Instrument | Trigger and effect | Start date |
|---|---|---|
| Resolução 588 | A transfer at or above US$10,000 equivalent to or from self-custody is specifically reported to Coaf | 1 Oct 2026 |
| Resolução 584 | An exit above US$10,000 to self-custody or a foreign provider can be held for precautionary review for up to 24 hours, including the client’s same-day total | 1 Jan 2027 |
Reporting records and transmits information. A precautionary hold delays an outbound transfer while the provider reviews risk. One does not substitute for the other, and neither outlaws self-custody. From January, a qualifying withdrawal from a Brazilian intermediary may produce both a Coaf report under Resolution 588 and a temporary review under Resolution 584, depending on the exact amount and the hold rule’s aggregation test.
This distinction matters beyond Brazil because regional payment and stablecoin products often reuse one compliance design across several markets. A system that only asks “is this above US$10,000?” will miss the instrument-specific questions: Is the amount equal to the line or merely above it? Is the wallet the source or destination? Must the firm report, pause, aggregate the client’s day, or do more than one of those things? Brazil is turning a familiar dollar threshold into separate AML, fraud-control, licensing, and supervisory-data workflows.
Takeaway
For users, 1 October brings institution-side Coaf reporting for self-custody transfers at or above the threshold, without banning the transfer or the wallet. 1 January brings the separate possibility of a precautionary hold under Resolution 584. A platform should be able to explain which rule it is applying and whether a transfer is reported, delayed, or both.
For providers, the calendar is now four steps: implement Resolution 588 by 1 October, file the SPSAV request by 30 October if still operating under the transition, complete counterparty controls before 6 November, and have Resolution 589’s supervisory data ready for 1 January 2027. This is a reading of public BCB instruments, not legal or financial advice; verify the normative text and implementing rules for a specific transaction or product.
