BCB Resolution 520 Proof of Reserves: What VASPs Must Build

Video transcript

Brazilian VASPs seeking authorization owe the central bank a verifiable proof of reserves every month. Verifiable is the hard part.

Under Normative Instruction 713, document 5710, the proof of reserves by asset, is due within five business days of month end. Document 5711 covers custody daily.

From 6 November 2026, BCB-authorized institutions may not carry out operations with unauthorized providers, except as the resolution allows. From January 2027, eligible banks, brokers and distributors report too.

Every proof rests on segregation: separate client wallets that house keys cannot touch, a five percent cap on house assets inside them, and an independent audit every two years.

Neither rule prescribes a method. Guardian's test, not the BCB's: a proof is verifiable when someone else can rebuild it from the same inputs and get the same numbers.

A reproducible proof takes four parts: wallet attribution, and control proofs signed from each address. Then ledger liabilities at the same cut off time, and block height snapshots with every input stored.

Only custodians authorized for full custody may stake for clients, after at least 90 days' notice. Count staked assets once, as staked.

Proofs fail on unlabeled house funds, missing addresses and mismatched snapshots. Build one wallet registry, daily onchain reconciliation and a month-end snapshot job.

Guardian assesses segregation and key controls, and pentests the systems moving client assets. Read the full article, or talk to Guardian.

Resolution BCB 520, Brazil's virtual asset rulebook, has applied since 2 February 2026.

Its reporting rule turns asset segregation into a number the Banco Central do Brasil (BCB) can check: what clients are owed, asset by asset, against what the firm holds.

A September 2026 amendment, Resolution BCB 589, rewrote Article 91. From 6 November 2026, BCB-authorized institutions may not carry out or enable virtual asset operations with providers the BCB has not authorized, except as the resolution allows.

This article explains the technical and security side of Resolution BCB 520, as amended by Resolution BCB 589, and Instrução Normativa BCB 713. It is not legal advice; confirm how it applies to you with counsel.

Quotations from the Portuguese texts are our translations.

Where the Rule Comes From

Article 88 of Resolution 520 covers virtual asset service providers (VASPs) that were already operating when it took effect.

Item III lists what they must send the BCB from their authorization filing until phase 1 of the process concludes. Items (b) to (e) are the reporting core. This is their wording until 31 December 2026.

• (b) Daily: accounting balances held for clients.
• (c) Daily: all virtual assets in custody, own or third-party, in Brazil or abroad, plus totals per client.
• (d) Monthly: "verifiable statements, in the form of proofs of reserves," broken down by asset.
• (e) Monthly: verifiable statements of the client assets allocated to staking.

The resolution defines proof of reserves as the "mechanism used to demonstrate" that a VASP holds the virtual assets it declares it holds for its clients (Art. 2, XIII).

What Resolution 589 changes

Resolution BCB 589 of 23 September 2026 rewrites items (b) to (e) from 1 January 2027. Three changes matter:

• Items (b) to (e) lose the words "daily" and "monthly"; timing is left to the specific regulations.
• Item III no longer says reporting runs "until the conclusion of phase 1" of the authorization process.
• New Article 90-A extends the reports to the banks, brokers and distributors eligible under Article 20.

Those institutions report from the day they start services if new to the market, or immediately if already active. Article 90-B leaves the form to a further BCB rule.

Resolution 589's Article 91 rewrite took effect on 1 October 2026. The earlier text set 30 October 2026 and also excepted providers "in the process of authorization"; the new text drops that phrase.

As of 5 November 2026, the BCB's register showed no amendment to IN 713.

Documents 5710 and 5711

Instrução Normativa BCB 713, issued on 27 February 2026 and in force since its publication on 3 March, sets how the reports are sent.

Both go as XML files through the BCB's file transfer system (STA), validated in advance against an XSD schema.

After filing for authorization, the VASP registers in Unicad, the BCB's entity register. That includes third parties "effectively responsible for the custody" of the assets, in Brazil or abroad, "even if indirectly" (IN 713, Art. 6).

It also names a responsible director and an employee to answer the BCB's questions.

Who reports, and until when

• Now: VASPs operating on 2 February 2026, from their authorization filing until phase 1 concludes (IN 713, Art. 5).
• Filing deadline: phase 1 requests were due by 30 October 2026 (IN BCB 704, Art. 9).
• Late filers: must stop providing services within 30 days after the deadline (Art. 88, §7).

What Segregation Requires

Resolution 520 sets the wallet structure behind a proof in Articles 30 and 78.

• Client assets sit in wallets separate from the VASP's own (Art. 30, I).
• Control instruments over house wallets, such as keys, must be "incapable of exercising any effect" on client wallets (Art. 78).
• Operations on client wallets and house wallets stay independent (Art. 78).
• House assets may sit in client wallets only to cover immediate liquidity, up to 5% of client holdings.
• Those house assets must be unencumbered and clearly identified in the records (Art. 30, §3).
• A written segregation policy states the proof of reserves methods used (Art. 30, II).
• An independent audit every two years, at reasonable assurance, published on the VASP's website (Art. 30, III).

For custody abroad, the contract must keep Brazilian clients' assets in specific wallets, with segregation legally effective in the custodian's country (Art. 83).

A custodian must also reconcile each client's position history in its own records with the history on the blockchain (Art. 76, III).

What Makes a Proof Verifiable

Neither Resolution 520 nor IN 713 prescribes a method. The resolution leaves it to the VASP's policy.

Our working test, not the BCB's: a proof is verifiable when someone else can rebuild it from the same inputs and get the same numbers. That takes four parts.

1. Wallet attribution

A dated list of every address counted, by chain and asset, marked client or house.

Deposit addresses, cold storage, staking accounts and wallets at foreign custodians all belong on it.

2. Control proofs

Evidence the VASP controls each key, such as a dated message signed from every address. A balance nobody can sign for proves little.

3. Liabilities

Client balances from the ledger at the same 23:59 cut-off, per asset. They should match the per-client totals in that day's 5711 report.

4. Snapshots

The block height read on each chain, so anyone can query the same balances later. Store the inputs and the script that produced the totals.

Staking

Staking is reported separately under item (e). Only a custodian authorized for the full set of custody activities may stake for clients (Art. 9, §5).

It must notify the BCB at least 90 days before offering staking (Art. 82, §5).

Count staked assets once, as staked, with the validator or protocol position that proves them.

What to Build Before Month End

1. One wallet registry, shared by the ledger, the custody system and both reports.
2. A daily reconciliation of ledger positions to onchain balances, with every break explained.
3. A month-end job that snapshots every chain at the 23:59 cut-off and stores the inputs.
4. Control proofs refreshed each month for every address in the registry.
5. A staking subledger mapping each client's staked amount to a position onchain.
6. Balance confirmations from each foreign custodian, matched to its addresses.

Where proofs fail

• House funds in omnibus client wallets above the 5% buffer, or unlabeled.
• Addresses missing from the registry: new chains, retired wallets, change addresses.
• Ledger and chain snapshots taken at different times.
• Custodian statements with no addresses behind them.

For a stricter version of the daily check, see Korea's five-minute reconciliation rule.

Where Guardian Fits

Segregation and proof of reserves are also item I of the technical certification banks and brokers file under IN BCB 701. Our IN BCB 701 guide covers it.

Guardian's regulatory assessments test segregation, key generation and storage, signing thresholds, cold storage ratios and recovery against the custody rules a license carries.

Guardian also pentests the infrastructure, web apps and APIs that hold and move client assets, and audits the smart contracts involved.

Guardian prepares technical evidence. The Article 30 audit and the IN 701 certification come from independent firms.

Frequently Asked Questions

How often must Brazilian VASPs report proof of reserves to the BCB?

Monthly. Document 5710 carries a verifiable proof of reserves by asset and the client total in staking. It is measured at 23:59 Brasília time on each month's last day and due within five business days.

Does Resolution 520 prescribe a proof of reserves method?

No. It defines proof of reserves and requires each VASP's segregation policy to document the methods it uses (Art. 30, II). IN BCB 713 sets the report format through the BCB's published XML layout.

Do Brazilian banks have to report proof of reserves?

Banks offering virtual asset services do, from 1 January 2027. Resolution BCB 589's new Article 90-A extends the reports to banks, brokers and distributors eligible under Article 20. A further BCB rule will set the form (Article 90-B).

Sources

• Banco Central do Brasil: Resolução BCB n° 520 (10 November 2025, consolidated text)
• Banco Central do Brasil: Resolução BCB n° 589 (23 September 2026)
• Banco Central do Brasil: Instrução Normativa BCB n° 713 (27 February 2026)
• Banco Central do Brasil: Instrução Normativa BCB n° 704 (29 January 2026, as amended)
• Guardian: Instrução Normativa BCB 701, What the Certification Covers
• Guardian: Regulatory and Compliance Assessment