The crypto regulatory landscape in Brazil
Brazil has one of the most advanced regulatory frameworks in Latin America for cryptocurrencies. Law 14,478/2022 (Crypto Assets Legal Framework) established the foundations, and BCB Resolutions 519, 520 and 521 of 2025 created the PSAV (Virtual Asset Service Provider) framework that specifically regulates crypto service providers.
For users and platforms operating with crypto payments in Brazil, understanding this regulatory landscape is essential. Regulation doesn't exist to make access to cryptocurrencies difficult -- it exists to protect consumers, prevent fraud, and create a predictable business environment.
In this guide, we'll explain what PSAV is, how the new Central Bank resolutions impact off-ramp platforms like PagFinance, and what changes for the end user.
What is PSAV and how it works
PSAV stands for Prestador de Servicos de Ativos Virtuais (Virtual Asset Service Provider). It is the regulatory category created by Brazil's Central Bank (BCB) for companies offering services involving cryptocurrencies. The framework was established by three complementary resolutions published in 2025:
BCB Resolution 519: Definitions and general requirements
Resolution 519 defines what virtual assets are in the Brazilian regulatory context, establishes which activities require PSAV authorization, and determines general operating requirements. Regulated activities include: intermediation of crypto asset buying and selling, virtual asset custody, conversion between crypto and fiat currency (off-ramp), and virtual asset transfers.
BCB Resolution 520: Prudential requirements
Resolution 520 addresses financial and prudential requirements. It establishes minimum capital that a PSAV must maintain, rules for operational and financial risk management, corporate governance requirements, and compliance obligations. These rules ensure crypto platforms have sufficient financial strength to operate safely.
BCB Resolution 521: Operational rules
Resolution 521 details day-to-day operational rules. It includes obligations for asset segregation (client funds separated from company funds), BCB reporting requirements, anti-money laundering (AML/CFT) rules, and compliance deadlines. Companies that were already operating before the publication of the resolutions have a defined deadline to comply and obtain formal authorization.
The authorization process involves submitting documentation to the BCB, evaluation of technical and financial capacity, and formal approval. Companies that do not obtain authorization within the deadline will not be able to continue operating legally.
PSAV vs VASP: what's the difference?
PSAV is the Brazilian designation for what is internationally known as VASP (Virtual Asset Service Provider). The term VASP was coined by the FATF (Financial Action Task Force), the international body that defines anti-money laundering standards.
In practice, both terms refer to the same type of entity: companies that offer services with virtual assets. The difference lies in the regulatory context. VASP is the term used in international recommendations and by regulators in other countries. PSAV is the term specifically adopted by Brazil's Central Bank, with its own rules and requirements defined by BCB Resolutions 519-521.
In Brazil, exchanges, off-ramp platforms, crypto custodians, and any company that intermediates transactions with crypto assets needs PSAV authorization. This includes platforms like PagFinance, which convert crypto to BRL for bill payments.
Brazil's adoption of the PSAV term aligns the country with international best practices, while adapting the requirements to Brazil's regulatory and economic reality.
DeCripto and IN 2291: reporting obligations
DeCripto is the electronic system of Brazil's Federal Revenue Service for reporting cryptocurrency operations. Created by Normative Instruction (IN) 2291, the system requires platforms that intermediate crypto operations to report transactions to tax authorities.
Who needs to report via DeCripto?
Brazilian platforms that intermediate buying, selling, or conversion of crypto assets are required to report all operations. This includes exchanges, off-ramp platforms, and custodians. Reported information includes: transaction amount, type of crypto asset, user identity (CPF/CNPJ), and transaction date.
What about end users?
Users who conduct operations through Brazilian platforms don't need to worry about DeCripto directly -- the platform handles the reporting. However, in the annual income tax return, crypto asset holdings above established limits must be declared in the Assets and Rights section.
Operations conducted directly between wallets (peer-to-peer), without intermediation by a Brazilian platform, must be reported by the user themselves when they exceed monthly limits established by the Federal Revenue Service. The responsibility is individual.
What PSAV means for the user
PSAV regulation brings concrete benefits for those using crypto payment platforms in Brazil:
Asset segregation: One of the most important rules is the mandatory asset segregation. This means client funds must be kept in accounts separate from the company's operational funds. In case of financial problems at the platform, user funds are legally protected and cannot be used to pay the company's debts.
AML/KYC monitoring: PSAV platforms are required to implement robust anti-money laundering (AML) and know-your-customer (KYC) programs. While this requires user identity verification, it protects the ecosystem against fraud and illicit activities, making the environment safer for everyone.
Regulatory reporting: PSAVs must report regularly to the Central Bank, ensuring transparency and oversight. This creates an environment where problems can be detected and corrected before they harm users.
Consumer protection: The PSAV framework establishes clear operating rules, including requirements for price and fee transparency, customer service channels, and dispute resolution procedures. Users have more clarity about their rights and how to exercise them.
PagFinance regulatory status
PagFinance operates in compliance with Law 14,478/2022 and is in the process of obtaining PSAV authorization from Brazil's Central Bank, in accordance with BCB Resolutions 519, 520, and 521. The authorization process is expected to be completed by October 2026.
Since the beginning of its operations, PagFinance has adopted practices aligned with regulatory requirements: user identity verification (KYC), transaction monitoring for anti-money laundering, client fund segregation, and transparency in prices and fees.
The PSAV authorization process involves submitting detailed documentation to the BCB, including demonstration of financial capacity, risk management plans, compliance policies, and technology infrastructure. PagFinance is actively working to meet all requirements within the regulatory deadline.
Stablecoins and Drex: the future of digital payments
Drex is the digital real (CBDC -- Central Bank Digital Currency) under development by Brazil's Central Bank. Unlike private stablecoins such as USDC and USDT, which are issued by private companies and backed by reserves, Drex will be issued directly by the BCB and will have the same legal value as physical real.
How do private stablecoins coexist with Drex?
Stablecoins like USDC and USDT continue to be widely used for international payments, remittances, and as a stable store of value in the crypto ecosystem. Drex does not replace these stablecoins -- it creates a complementary infrastructure focused on domestic transactions and integrations with the Brazilian financial system.
Impact on crypto-to-fiat payments
For platforms like PagFinance, Drex represents a future opportunity. Integrating Drex as a settlement option could reduce costs and processing times. A user could, for example, convert USDC to Drex directly, which would in turn be used to settle a PIX payment.
The ecosystem tends to become more interoperable, with private stablecoins and Drex coexisting and serving complementary purposes. Off-ramp platforms like PagFinance are positioned to integrate these multiple settlement options as they become available.
Frequently asked questions about crypto regulation in Brazil
Is PagFinance regulated?+
PagFinance operates in compliance with Law 14,478/2022 and is in the process of obtaining PSAV authorization from the BCB, with expected completion in October 2026.
What is PSAV?+
PSAV stands for Prestador de Servicos de Ativos Virtuais (Virtual Asset Service Provider). It is the regulatory category created by Brazil's Central Bank for companies offering services with cryptocurrencies.
Do I need to report crypto operations in Brazil?+
Yes. Crypto asset operations must be reported via DeCripto when intermediated by Brazilian platforms. Users must also declare holdings above limits in their annual income tax return.
What is asset segregation?+
It means client funds are kept separate from company funds. In case of financial problems at the platform, user funds are protected.
How does Drex affect crypto payments?+
Drex is the digital real (CBDC) from the Central Bank. It does not replace private stablecoins, but creates a complementary infrastructure. Platforms like PagFinance may integrate Drex as another settlement option in the future.