Brazil’s central bank targets crypto self-custody wallets with new $10,000 reporting rule

The Central Bank of Brazil introduced new reporting requirements for self-custody crypto transfers worth at least $10,000, under two resolutions issued Wednesday, September 23, 2026.

Resolutions 588 and 589 expand anti-money laundering oversight and restrict dealings with unauthorized virtual asset service providers, with the rules taking effect October 1, 2026, the same date the deadline for exchanges to secure central bank authorization expires.

Brazil crypto regulation targets self-custody transfers

Resolution 588 requires institutions authorized by the central bank to report transfers of virtual assets to or from self-custody wallets when the value reaches or exceeds the equivalent of US$10,000.

Self-custody wallets differ from custodial accounts because users control the assets and private keys directly rather than relying on an exchange or another regulated intermediary. The central bank said this structure can make transaction monitoring more difficult because regulated institutions generally have less information about assets held outside their custody.

The bank said self-custody arrangements “can reduce the availability of information for monitoring and risk assessment purposes, unlike cases in which assets are held in custody in an institution authorized by the Central Bank.”

Under the new framework, the relevant transaction data will be submitted to the Council for Financial Activities Control, known as COAF, Brazil’s national money-laundering watchdog. The reporting mechanism could give authorities a broader view of transfers involving self-custody addresses when Brazilian users move assets through authorized centralized exchanges.

For Brazil crypto regulation, the requirement represents a shift toward greater visibility over transactions that move between regulated platforms and wallets controlled directly by users.

Brazil crypto regulation expands information sharing

Resolution 589 addresses another part of the framework by establishing restrictions on dealings with crypto service providers that have not received authorization to operate in Brazil.

The resolution prohibits operations “that have as counterparties institutions or entities that provide virtual asset services and are not authorized to operate in the country.”

That provision places greater responsibility on regulated market participants to ensure that their counterparties meet Brazil’s authorization requirements. It also narrows the ability of unauthorized providers to participate in the regulated domestic crypto market.

Together, the two resolutions broaden the compliance obligations facing VASPs. One focuses on reporting transactions involving self-custody wallets, while the other establishes restrictions around relationships with unauthorized crypto service providers.

The central bank has framed the measures as part of its effort to strengthen AML/TF controls and improve the information available for monitoring and risk assessment. The changes therefore place Brazil crypto regulation more firmly around reporting, authorization and information-sharing requirements.

Brazil crypto regulation raises compliance pressure

The new rules arrive as crypto companies operating in Brazil face a broader authorization process. The deadline for VASPs to obtain central bank authorization is October 1, 2026, the same date on which Resolutions 588 and 589 become effective.

The transition has already been associated with a smaller pool of firms seeking authorization. According to the supplied report, only five VASPs have applied for a license to operate in Brazil. The combination of new compliance obligations and capital requirements has contributed to consolidation across the sector.

For companies that remain active, Brazil crypto regulation will require closer attention to transactions involving external wallets and to the status of counterparties. Exchanges and other authorized institutions will need systems capable of identifying qualifying self-custody transfers and reporting them to COAF.

The reporting threshold is also significant because it establishes a clear point at which transfers involving self-custody addresses enter the formal reporting framework. This does not mean that every self-custody transaction will be reported under the rule; the requirement described in Resolution 588 applies to transfers at or above the US$10,000 equivalent threshold.

Brazil crypto regulation reshapes the local market

The October 1 implementation date gives authorized providers a defined deadline for adapting to the new requirements. From that point, Brazil crypto regulation will operate alongside the authorization rules governing which companies can provide virtual asset services in the country.

The measures also highlight the growing role of centralized exchanges in the regulatory visibility of crypto activity. When users move assets between an authorized exchange and a self-custody wallet, the regulated institution becomes a reporting point for transactions meeting the threshold.

At the same time, Resolution 589 creates a clearer boundary between authorized and unauthorized providers. The central bank’s framework therefore combines transaction reporting with market-access restrictions rather than relying on either measure alone.

The central bank described its approach in terms of monitoring and risk assessment, while the new requirements place additional operational responsibilities on VASPs. For the Brazilian crypto sector, Brazil crypto regulation is consequently becoming more focused on traceability, authorization and compliance as the October 1 deadline approaches.