Resolução BCB 589: Brazil's 6 November VASP Cutoff

By Owen ThurmPublished November 11, 202611 min read

Quick answer. From 6 November 2026, revised Article 91 bars BCB-authorized banks and payment institutions from carrying out or enabling virtual asset operations with VASPs not authorized in Brazil, including trading, custody, FX, payment accounts and payments used to enable them, unless expressly permitted.

Watch: Resolução BCB 589: Brazil's 6 November VASP Cutoff 1:55

Video transcript

Since 6 November 2026, Brazilian banks and payment institutions may not enable virtual asset operations with VASPs not authorized in Brazil, unless expressly permitted.

Resolution 520 took effect on 2 February 2026. Existing VASPs had to apply by 30 October, the bar applied from 6 November, and BCB lists followed on 9 November.

It covers trading and intermediation, custody, foreign exchange, payment accounts and payment transactions, when used to enable virtual asset operations with unauthorized VASPs. A license elsewhere does not count.

The rewrite dropped the express exception for providers in authorization, and the BCB says its request list is not authorization. Get counsel's written view before treating applicants as permitted.

Late filers must stop virtual asset services within 30 days of the deadline, by 29 November 2026. That window is the VASP's. Banks have been barred from enabling its virtual asset operations since 6 November.

Inventory every customer providing virtual asset services. Match each entity to the authorized list, the request list, or neither, and date it. Map services, then exit unauthorized VASPs.

Onchain, clear the wallet, not just the name. Ask for declared addresses and a signed message from each, and treat analytics labels as a second source.

Keep dated evidence: portal snapshots, counsel's position, wallet records and offboarding notices. This is Guardian's working standard, not a BCB template.

Guardian's compliance assessments review custody and key management, and organise results into an indexed evidence pack. Your counsel decides the legal questions. Read the full article.

Why 6 November Matters

Since 6 November 2026, Brazilian banks and payment institutions may not carry out or enable virtual asset operations with unauthorized VASP counterparties. Banco Central do Brasil

The rule is Article 91 of Resolution BCB 520, as rewritten by Resolution BCB 589 of 23 September 2026.

It turns a licensing question about crypto firms into a standing control for every institution that banks them.

This article explains the cutoff and the screening behind it. It is not legal advice; confirm how it applies to you with counsel.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

Brazil's VASP Authorization Deadline

Resolution BCB 520 governs VASPs and virtual asset services offered by BCB-authorized institutions. It entered into force on 2 February 2026. Banco Central do Brasil

Article 88 gave VASPs already operating 270 days from that date to apply for authorization. The window closed on 30 October 2026.

The counterparty bar applies from 6 November 2026, one week after that window closed.

The BCB's explanatory vote says that week lets it publish an official transition list of providers that applied or notified activity. The BCB began publishing its request and eligibility lists on 9 November 2026, three days after the cutoff.

Date	Event	Rule
10 Nov 2025	Resolution BCB 520 issued	Res. 520
2 Feb 2026	Resolution 520 in force; 270-day window opens	Art. 88
25 Sep 2026	Resolution 589 published in the Diário Oficial da União	Res. 589
1 Oct 2026	Revised Article 91 takes effect	Res. 589
30 Oct 2026	Application deadline for VASPs already operating	Art. 88; IN BCB 704
6 Nov 2026	Article 91 prohibition applies	Art. 91
9 Nov 2026	BCB publishes request and eligibility lists	BCB lists

What Article 91 Prohibits

The revised Article 91 bars BCB-authorized financial, payment and other institutions from carrying out or enabling virtual asset market operations with unauthorized VASPs. Banco Central do Brasil

The only exception covers forms expressly authorized elsewhere in Resolution 520. Article 91 itself lists no permitted activities.

The test is authorization to operate in Brazil; a license elsewhere does not meet it.

Article 91's sole paragraph lists the services it reaches when used to enable those operations.

Negotiation and intermediation of virtual assets
Custody of virtual assets
Foreign exchange operations
Opening and maintaining payment accounts
Payment transactions
Any other act or service that enables these operations

Pending Applicants and Late Filers

The rewrite removed the old express exception for providers still in the authorization process. Carta Circular, Compliasset

Article 88 §6 still lets a VASP that filed on time keep providing existing services until its process concludes. It does not say a bank may remain its counterparty. Banco Central do Brasil

The BCB's 9 November announcement says providers on the request list may operate because they applied, but are not necessarily authorized. It does not mention Article 91 or say banks may remain their counterparty.

How those provisions interact is not expressly resolved. Get Brazilian counsel's written position before treating any pending applicant as permitted.

Under Article 88 §7, late filers must stop providing virtual asset services within 30 days of the 30 October deadline, by 29 November 2026. That window governs the VASP.

A late filer is neither authorized nor in authorization, so Article 91 has barred banks from enabling its virtual asset operations since 6 November.

The resolutions set no universal account-closure date. Ending a payment account can involve separate contractual and regulatory steps.

Finding VASP Counterparties

Screening starts with an inventory of every customer that provides virtual asset services, whatever product it uses with you.

Look past the crypto desk. Payment accounts, FX lines, acquiring and correspondent relationships can all carry a VASP's flows.

The BCB publishes one list of VASPs with authorization requests and another of authorized institutions eligible to provide virtual asset services. Banco Central do Brasil

The BCB says it will update both lists periodically, so screen against dated snapshots and re-check before material activity.

Watch for undeclared VASPs too: payment descriptors naming crypto services, or deposits arriving from known exchange wallets.

Tag every customer whose business includes trading, custody, transfer or exchange of virtual assets.
Record the legal entity, CNPJ or foreign registration, group parent and beneficial owners.
Match each entity to the authorized list, the request list, or neither, and date the check.
List the services each receives: accounts, FX, payments, custody or intermediation.
For entities on neither list, confirm status directly with the BCB. If unauthorized, stop services that enable their virtual asset operations and record the exit.

Wallet Attribution Onchain

Institutions that custody or trade virtual assets also meet counterparties onchain, by address rather than by account.

Attribution links each address to a legal entity. It supports legal-entity verification; it does not replace it.

Ask each VASP counterparty for its deposit addresses and known custody wallets, by chain, and keep the list current.

Ask for a signed message from each declared address. It shows the VASP controls the key, not only that it named it.

Treat analytics labels as a second source. Record which provider labeled each address, and when.

For screening several hops out, see our guide to the FATF stablecoins and unhosted wallets report.

Guardian's Tenor Morpho integration review shows a similar gap in smart contract code. Guardian

In finding I-04 (Informational, acknowledged), a router checked the taker's authorization but paid from its own token balance, not the taker's.

The Brazilian analogue: clear the named VASP, then confirm the wallet that actually sends or receives the funds.

Evidence for Supervision

The record below is our working standard for showing the bar is applied. It is not a BCB template.

Circular BCB 3.978 Article 67 requires KYC and transaction records to be kept for at least ten years. Keep screening records for at least the longest period that applies. Banco Central do Brasil

VASPs in authorization already file daily custody reports (document 5711) and monthly proof of reserves reports (document 5710) under IN BCB 713.

From 1 January 2027, banks, brokers and distributors eligible under Article 20 report the same data, in a form a further BCB rule will set. Imprensa Nacional, archived by Ministério Público Federal

Check	Evidence to keep	Red flag
Counterparty inventory	Dated list of VASP customers, CNPJs and services received	Crypto flows from customers missing from the list
BCB status	Dated portal snapshot for each entity	Request list entry treated as authorization
Pending applicants	Counsel's written position and dated request list entry	Reliance on Article 88 §6 with no opinion
Late filers	Dated record that enabling services stopped from 6 November	Using the VASP's 30-day wind-down as the bank's deadline
Wallet attribution	Declared addresses, signed messages, label source and date	Unattributed addresses in settlement flows
Reconciliation	Ledger-to-wallet reconciliations with each break explained	Recurring breaks with no explanation
Offboarding	Termination notices, dates and final flows	Activity after the offboarding decision

What Foreign VASPs Should Do

Article 91 bars counterparties not authorized to operate in Brazil. Whether your offshore service to Brazilian residents counts as operating there is a question for counsel. Banco Central do Brasil

Article 23 covers foreign entities already active in Brazil on 2 February 2026. To continue, they had 270 days to move operations and clients to an eligible institution or an SPSAV. Banco Central do Brasil, reproduced by Migalhas

Once the transfer completes, the foreign entity must end its Brazilian activity.

The BCB's 2025 explanatory vote says a foreign custodian acting directly in Brazil must request authorization.

Article 83 lets a Brazilian VASP contract a foreign custodian, subject to conditions including home supervision, a Brazilian legal representative and identifiable client wallets.

Expect Brazilian banks and payment firms to ask for your BCB status before keeping accounts, FX lines or payment rails open.

Ask Brazilian counsel whether your Brazil activity requires BCB authorization and which exceptions, if any, apply.
If you filed by 30 October 2026, keep proof of filing and your request list entry.
If Article 23 applied and your transfer was incomplete on 30 October 2026, you had to cease Brazilian activity then.
If Article 23 applied to you, keep records of the client transfer and the date Brazilian activity ended.
Prepare a pack: legal entity, group structure, services, and deposit and custody addresses by chain.
Tell partner institutions promptly when your BCB status changes.

Frequently Asked Questions

What do Resolution 589's 2027 changes alter?

Amended Article 88 III drops the fixed daily and monthly frequencies for balance, custody, proof of reserves and staking reports, and no longer ends them at the conclusion of phase 1. New Article 90-B leaves the form and other conditions to further BCB rules. Imprensa Nacional, archived by Ministério Público Federal

Does Article 91 require banks to use blockchain analytics?

No. It sets the prohibition, not a screening method. Because each institution designs its own screening, it should document why that design fits its products and flows. Banco Central do Brasil

What must a Brazilian bank file to offer crypto custody?

Banks, brokers and DTVMs file a technical certification from an independent qualified firm under IN BCB 701. It must address 17 control areas separately, from segregation and reserves to key custody and incident response. Banco Central do Brasil

Sources

Turn Article 91 Screening Into Evidence

Guardian's compliance assessments review custody and key management, deliver a wallet and signer inventory, and organise test results into an indexed evidence pack. Your counsel decides the legal questions.

Talk to Guardian Explore the service