Instrução Normativa BCB 701: What the Certification Covers
Quick answer. Instrução Normativa BCB 701, in force since 2 February 2026, requires an independent qualified firm's conclusive opinion on at least 17 items. Each must be addressed separately, from proof of reserves to key custody and security controls.
Video transcript
Brazilian banks and brokers can offer crypto without a separate VASP company. First, they need a technical certification from an independent qualified firm, and Instrução Normativa BCB 701 sets what it must cover.
Without the certification, the communication to the Banco Central has no effect. The BCB can even stop a new entrant from starting because of the certification's result.
The opinion must address at least 17 items, from proof of reserves to listing policies, custody contracts and client disclosures.
A consolidated general opinion is not accepted in any case. The certifier must reach a conclusive opinion on each item separately.
The technical core covers asset segregation and proof of reserves, cloud and other outsourced services, the Article 48 security controls, key custody, continuous monitoring, and redundancy of control instruments.
Article 48 reaches past a usual pentest. It requires independent testing of smart contracts that affect the institution's activities, so agree the scope with the certifier and counsel early.
To prepare, fix your modality. Engage an independent certifier early. Organize evidence item by item. Close out pentests and smart contract retests. Then run and record your recovery drills.
Guardian prepares the evidence but does not sign the certification. Guardian provides smart contract audits, pentests of systems holding client assets, custody design advice, and monitoring around the clock.
Read the full article for every item and the evidence behind it, or talk to Guardian at guardian.security.
Brazil lets banks, securities brokers and distributors, and FX brokers offer crypto services without a separate VASP company.
First they must file a formal communication with the Banco Central do Brasil (BCB), backed by a technical certification from an independent qualified firm.
Instrução Normativa BCB 701, issued on 22 January 2026, sets how that filing is made and the minimum the certification must cover.
The certification carries weight. A filing without it has no effect, and the BCB can stop a new entrant from starting because of its result.
This article explains the technical and security side of Instrução Normativa BCB 701 and Resolution BCB 520. It is not legal advice; confirm how it applies to you with counsel.
Who Needs It
IN 701 applies to institutions in Article 20, items I and II, and Article 23, §3, of Resolução BCB 520 of 10 November 2025 (IN 701, Art. 1).
Item I covers commercial, exchange, investment and multiple banks, and Caixa Econômica Federal.
Item II covers securities brokers (CTVM), securities distributors (DTVM) and FX brokers. FX brokers may only intermediate, not provide custody.
| Res. 520 | Case | Timing |
|---|---|---|
| Art. 21 | New entrant, not active in virtual assets | May start 90 days after the communication; must have been authorized at least 365 days |
| Art. 22 | Active in virtual assets on 2 February 2026 | Communication within 270 days; a late filer may continue up to 30 days past the deadline |
| Art. 23, §3 | Successor to a foreign entity active in Brazil | By the end of the same 270-day period |
The 270-day window for active institutions closed in late October 2026. New entrants can still file under Article 21.
Dedicated VASP companies follow a separate authorization process (Art. 19).
Who May Sign It
The certifier must be an “empresa qualificada independente” (Res. 520, Art. 22, §2). IN 701, Article 3, sets the terms.
It must submit an institutional presentation containing at least:
- existing and valid qualifications and credentials for the activity; and
- a declaration, signed by the institution's responsible director and the certifier, of no relationship that creates a conflict or prejudices independence.
Under IN BCB 712, from 9 March 2026 the institution records the certifier's name and CNPJ in Unicad.
Neither IN 701 nor Resolution 520 names a required accreditation, license or list of approved firms.
That leaves two tests. The signer must be able to defend a conclusion on every item, and must have no conflicting business relationship.
Plan for a certifier separate from the firm that designs or fixes the controls, and confirm the line with counsel.
The 17 Items
IN 701, Article 4, requires a conclusive opinion on the institution's adequacy for at least these items.
Each must be addressed specifically. A consolidated general opinion is not accepted “em qualquer hipótese” (Art. 4, §2).
| Item | What the opinion must cover |
|---|---|
| I | Segregation of the institution's virtual assets from clients'; proof of reserves |
| II | Relevant contracted services, including data processing, storage and cloud |
| III | Capability of those providers, including providers abroad |
| IV | Plans to recover positions and control of client assets after provider incidents |
| V | Governance policies, from conduct and fraud to cybersecurity and data protection |
| VI | (a) AML/CFT processes; (b) security of the computing environment (Art. 48) |
| VII | Custody and protection of control instruments (private keys and similar) |
| VIII | Continuous monitoring of institutional security and risk assessment |
| IX | Offer, listing, suspension and delisting policies; stablecoin selection |
| X | Segregating conflicting functions; controlling intermediation and custody |
| XI | Risk and capital management, compliance and internal audit |
| XII | Cybersecurity policy and incident response plan |
| XIII | Policies and checks against spurious market practices |
| XIV | The virtual asset custody contract |
| XV | Custodian measures and plans |
| XVI | Redundancy mechanisms for control instruments |
| XVII | Recovery procedures for the redundant material, for BCB supervision |
Article 4, §1, adds a review of client disclosures, from support channels and custody terms to staking risks and position reports.
Item IX includes stablecoin selection. Stablecoins whose reserve control mechanisms are run by algorithms may not be offered (Art. 65, §3). Our stablecoin due diligence checklist covers the contract checks.
Article 48: Security and Smart Contracts
Item VI(b) pulls in Article 48 of Resolution 520, items I to VIII. Most of the technical evidence sits here.
| Art. 48 | Requirement | Evidence a reviewer will test |
|---|---|---|
| I | Identity management; logical and physical access control | Identity provider exports, privileged access lists, MFA coverage, access reviews |
| II | Continuous security monitoring and incident response | Monitoring coverage, alert records, incident tickets |
| III | Preventive measures, “em particular” with DeFi operators | Threat model and controls for any DeFi interaction |
| IV | Approval levels, passwords, preventive deactivation | Approval matrices, credential policy, account lock procedures |
| V | Security culture among staff and providers | Training records |
| VI | Plans for security breaches and disasters | Continuity plans and exercise results |
| VII | Training, technical certifications, external qualification | Staff certifications, external assessments |
| VIII | Systems and programs, including smart contracts | Pentest and smart contract reports, reviewer independence, retest |
The measures must be documented in the cybersecurity policy (Art. 48, sole paragraph). Outsourcing them does not move responsibility away (Art. 51).
Article 48, VIII reaches past the usual pentest scope. It names smart contracts that affect the institution's activities.
It requires vulnerability analysis, review of their performance by independent analysts, and robustness and security tests.
A token the institution issues, a custody or settlement contract, or a DeFi protocol it routes client activity through can all fall within that wording.
So agree the testing scope with the certifier and counsel early.
Key Custody and Recovery
Resolution 520 defines a private key as an instrument of control (Art. 2, VIII). Items VII and XIV to XVII test how these are held:
- Key policy (Art. 49): procedures to generate, hold, grant, revoke and protect keys. Multiple or segmented keys must be stored in different places.
- Segregation (Art. 78): client wallets separate from the custodian's, and house keys unable to affect client wallets.
- Redundancy (Art. 76, XII): a mechanism holding all client data and control instruments, under Brazilian law, with BCB access.
Evidence: key ceremony records, wallet architecture, a test showing house keys cannot move client funds, and dated recovery drills.
For another regulator's custody standards, see the SFC custody circular.
Preparing the Evidence Pack
- Fix the modality (intermediation, custody or both) and mark which items apply.
- Engage the certifier early, and check its credentials and independence.
- Organize evidence item by item, since a consolidated opinion will not be accepted.
- Document wallet and key architecture, segregation, and the proof of reserves method.
- Commission independent testing for Article 48, VIII, with remediation and retest closed out.
- Show continuous monitoring in operation: coverage, on-call arrangements and incident records.
- Run and record recovery and redundancy drills (items IV, XVI and XVII).
Where Guardian Fits
Guardian prepares the evidence. It does not sign or issue the certification.
The opinion spans AML, internal controls and disclosures that sit outside a security firm's remit.
Guardian supplies independent technical evidence for the security items, starting with smart contract audits of the contracts an institution uses.
Guardian also pentests the infrastructure, web apps, APIs, SDKs and browser extensions that hold and move client assets (Art. 48, VIII).
Through its institutional advisory, Guardian helps design custody, signing and key controls before they are built.
Managed Security adds onchain and offchain monitoring around the clock, with an engineer on every alert.
Frequently Asked Questions
Who may issue the IN BCB 701 technical certification?
An independent qualified firm. It must present valid credentials and a declaration that no relationship with the institution creates a conflict of interest. IN 701 names no specific accreditation or list of approved firms.
Does the IN BCB 701 certification cover smart contracts?
Yes, through item VI(b) and Article 48, VIII of Resolution BCB 520. It requires testing of smart contracts that affect the institution's activities, including vulnerability analysis, independent review, and robustness and security tests.
What happens if the certification is incomplete or weak?
An incomplete filing has no effect, and the institution stays barred from the services. The BCB may also stop a new entrant, or order an active institution to cease operations, because of the certification's result.
Sources
- Banco Central do Brasil: Instrução Normativa BCB n° 701 (22 January 2026)
- Banco Central do Brasil: Resolução BCB n° 520 (10 November 2025, as amended)
- Banco Central do Brasil: Instrução Normativa BCB n° 712 (27 February 2026)
- Guardian: Institutional
- Guardian: Smart contract audits
- Guardian: Managed Security
Get the security evidence ready before the certifier asks
Guardian tests the smart contracts, infrastructure and key controls behind the Article 48 items, so your certifier reviews closed findings rather than open questions.