New Brazil PSAV compliance rules: from policy to proof

Brazil’s virtual asset service providers (PSAVs) have less than a month to file for authorization with the Central Bank of Brazil (BCB). Under Resolution BCB 520, firms already operating must file by October 29, 2026. Firms that do not file must stop operating within 30 days of that date. 

Much of the market’s attention has gone to documents: policies, manuals, and organizational charts. This focus is understandable, but it misses the main change. The new regime not only adds obligations but also changes how compliance is judged. A PSAV must now show, with records, that its controls actually work: who saw an alert, who made the decision, and what happened next. 

This was the clearest message from a recent Crystal Intelligence webinar with specialists in compliance, identity verification, and regulation and explain what this shift means and where PSAVs are most exposed. 

Gianluca Rigobello, Crystal’s Growth Manager for North and Latin America, led the discussion, with the expert panel including Nagel Lisânias Paulino, the Head of Division in the Department of Financial System Regulation at the Central Bank of Brazil (BCB); Georgia Sanches, the Brazil Country Manager at Sumsub; and Patricia Marinho, Cofounder and Co-Chief Executive Officer at Corisma Services. 

Two audience polls conducted during the discussion revealed volumes about who had tuned in, and why: 

Poll #1

Above: VASPs (42%) and financial institutions (32%) made up 74% of attendees, showing that the rules matter to PSAVs and to the banks and fintechs serving them. Source: Crystal Intelligence. 

Key points

• Resolutions BCB 519, 520, and 521 were published on November 10, 2025, and came into force on February 2, 2026. 

• Operating PSAVs must file for authorization by October 29, 2026. The filing itself must show that core controls already work, and supervisors will look for evidence trails, not only well-written policies. 

• The travel rule applies between Brazilian PSAVs from February 2027 and to international transfers from February 2028. The rule’s main practical obstacles are protocol interoperability and identifying which VASP controls a wallet address. 

• Responsibility stays with the PSAV, regardless of which vendors it uses. 

• Crystal polling found that representatives of VASPs and crypto-linked FIs comprised 74% of the audience, illustrating who the incoming rules most affect. 

What do Resolutions 519, 520 and 521 change? 

Before these rules, PSAVs were already subject to legal, tax and anti-money laundering (AML) obligations as well as consumer protection rules where they applied. What they did not have was a specific regime of authorization and continuous supervision by the Central Bank. The three resolutions create that regime, and each has a distinct role. 

Source: Crystal Intelligence.

Resolution 519 governs the authorization process. The BCB reviews controlling shareholders and directors, the lawful origin of capital, financial capacity, and the business plan. It also checks whether technology and governance match the complexity and risks of the planned operations. 

Resolution 520 is the core of the framework. It defines how a PSAV is constituted and how it operates day to day. It classifies providers into three types: intermediaries, custodians, and brokers. It sets rules on segregating client assets, custody, proof of reserves, and independent audit. It also sets requirements for internal controls, risk management, AML, and cybersecurity, and holds management accountable. The travel rule obligations sit here, too. 

Resolution 521 brings certain virtual asset operations into Brazil’s foreign exchange framework. It sets a limit of USD100,000 per international payment or transfer when the counterparty is not an institution authorized to operate in the foreign exchange market. It also requires PSAVs to identify the owners of self-custody wallets and to keep documented processes that verify the origin and destination of assets. 

Why is a well-written policy no longer enough? 

Panelists described the old approach as a “drawer policy”: a document that exists, but that nobody can show working. Under the new regime, this is not sufficient. 

A functional control produces a trail. For transaction monitoring, the trail answers six questions. What alert was generated? Who analyzed it? How long did the analysis take? What decision was made? Who approved it, or who received the escalation? What action followed? 

The same logic applies across the program. Has the incident response plan been tested, and were failures documented? Is there regular reconciliation between internal records, client assets, and proof of reserves? Do the responsible directors receive reports, question exceptions and record their decisions? 

This matters now, not only after authorization. The October deadline is for filing, not for completing the process. At filing, the PSAV must already show that controls work in areas such as risk, cybersecurity, AML, sanctions, accounting and audit. 

A useful test came from Patrícia: If the Central Bank or an auditor asked today for evidence that your controls worked last week, could you provide it quickly, completely and consistently? A strong program lets an auditor reconstruct events without anyone needing to explain them verbally. 

For many firms, this requires a change in governance. Structures that were informal and centered on founders must become formal, with documented responsibilities and controls that can be tested. 

What makes the travel rule hard in practice? 

Poll #2 

Above: Only 33% have travel rule data exchange in place, while more than a quarter (27%) haven’t started. With domestic obligations from February 2027, interoperability and attribution work must start now. Source: Crystal Intelligence. 

Market understanding of the travel rule has improved quickly in 2026. The concept is now well understood. The practical problems are what remain. 

Why does protocol interoperability matter? 

Two PSAVs may both be willing to share originator and beneficiary data, but use different messaging protocols that cannot communicate with each other. When this happens, the transfer cannot be completed in a compliant way. 

There are three ways to address this: 

• A PSAV can integrate several protocols directly; 

• Use a protocol-agnostic travel rule provider that connects to multiple protocols via a single integration; 

• Or it can rely on bridges between protocols, although this option is less mature today. 

Georgia noted that a setup built on a single protocol limits the number of counterparties a PSAV can reach. 

How does a PSAV know who controls a wallet address? 

An IBAN identifies a bank. A crypto address does not identify the service that controls it. Before any travel rule message is sent, the PSAV must attribute the destination address to a VASP. Only then can it know which protocol to use. 

Attribution depends on blockchain data: historical transaction patterns and known entity clusters. This is why blockchain analytics is part of travel rule readiness, not a separate topic. 

Why must the travel rule and analytics teams work together? 

Early travel rule implementations in other markets showed a common weakness. The analytics function, which assesses transaction risk, and the travel rule function, which identifies the parties, often worked in isolation. Neither had the full picture.

The travel rule identifies who is sending and receiving. On-chain analytics show what risk the funds carry. A compliance decision needs both. Many firms now combine know-your-transaction (KYT) monitoring, address screening, and travel rule data into a single workflow. Crystal, for example, integrates with travel rule providers so that this information can be reviewed together.

Source: Crystal Intelligence. 

The phased timeline gives the market time to build this. But the international phase depends on factors outside Brazil’s control, especially the pace of regulation in counterpart jurisdictions. Identifying and assessing a foreign counterparty with no defined regulator will remain difficult after 2028. 

Does using a vendor transfer the risk? 

It does not. The regulated entity remains responsible for its controls, regardless of which provider it chooses. A strong vendor cannot compensate for a weak compliance team, and a weak vendor can still harm a strong one. 

Vendor choice still matters, and panelists identified concrete criteria: 

• Interoperability: Does the provider connect to multiple protocols or require one? 

• Data portability: can configurations, histories and records be exported in a usable form if the PSAV changes provider? 

• Continuity: Is there redundancy, a contingency procedure and a clear service level during a protocol outage? 

• Sub-supplier dependencies: which critical services, such as analytics or VASP identification, does the provider rely on? 

Concentration is a further concern. If the travel rule infrastructure consolidates into a few providers, those providers gain systemic importance. Conflicts of interest can also arise when a service provider is related to a PSAV. 

Tools produce signals, not decisions. A counterparty risk rating of red, amber or green requires the PSAV’s compliance team to decide what level of risk it accepts and why. 

How did PSAVs manage cross-border flows until now?

Brazil’s crypto market has long facilitated large volumes of trading with international partners. Compliance practices varied widely. Some firms built strong controls in anticipation of regulation. Others did not. 

Gaps in other jurisdictions also limited what was possible, since many counterparts had no travel rule obligations to respond to. The authorization process will now make these differences visible. Firms that are prepared will move through it with less friction. Some others are likely to leave the market. 

What should PSAVs prioritize next? 

The direction is clear: Virtual asset activity is joining markets that the Central Bank already supervises, including foreign exchange and payments, where the travel rule is an established practice. Supervisory expectations will move toward those standards, not away from them. 

We see four priorities for the months ahead: 

1. Test your evidence, not your documents. Pick a recent alert and try to reconstruct its full history from records alone. 

1. Connect identity, travel rule, and on-chain data so that compliance decisions draw on all three. 

1. Map international counterparties by jurisdiction and travel rule readiness well before February 2028. 

1. Review vendor contracts for portability, continuity, and conflicts of interest. 

Frequently asked questions 

When is the deadline for PSAV authorization in Brazil? 

PSAVs already operating must file by October 29, 2026, 270 days after the rules came into force. Firms that file on time may keep operating while the BCB reviews the application. Firms that do not file must stop within 30 days. 

When does the travel rule apply in Brazil? 

It applies to transfers between PSAVs established in Brazil as of February 2027, and to international transfers as of February 2028. 

Is using a travel rule provider enough to be compliant? 

No. Providers supply tools and data. The PSAV remains responsible for its own controls, risk decisions and accountability to the regulator. 

What does Resolution 521 require for self-custody wallets? 

PSAVs must identify the owner of a self-custody wallet and keep documented processes to verify the origin and destination of the assets. 

What types of PSAV does Resolution 520 define? 

It defines three types: intermediaries, custodians, and brokers of virtual assets. Each carry specific rules.

Conclusion

Brazil’s framework brings virtual asset services into the same supervisory logic that applies to banks and foreign exchange institutions. The question for PSAVs is no longer whether they have the right policies, but whether they can prove that those policies work in daily operations and under review. 

Firms that build evidence trails, connect their data, and maintain clear ownership of risk decisions will be well-placed for authorization and the travel rule phases that follow. For the market as a whole, this is a step toward greater maturity and trust.