Brazil's $319B Crypto Market Faces October Licensing Deadline: CertiK

Brazil is one of the world's largest crypto markets, and its regulator has just set a hard date for pulling it under formal supervision. A new report from blockchain security firm CertiK lays out what the rules require and why they matter for the companies—and the users—inside that market.

Brazil ranks fifth globally for real crypto adoption, according to Chainalysis data cited in the report, and received $318.8 billion in on-chain value over the twelve months to June 2025. Nearly a third of all Latin American activity flowed through Brazilian wallets and platforms—roughly double the next two markets, Argentina and Mexico, combined.

The regime is built on Law 14,478/2022, the Legal Framework for Virtual Assets, and came into focus on November 10, 2025, when the Central Bank of Brazil (BCB) published three resolutions at once. Together they define who must be licensed, set capital floors, and connect crypto to the country's foreign-exchange rules.

What the rules actually require

Any company that lets customers trade, hold, or send crypto—a virtual asset service provider, or VASP—must file for authorization by October 30, 2026. The application has to include a "reasonable assurance report" from an audit firm registered with the securities regulator, attesting that the firm's anti-money-laundering and sanctions controls actually work. Saying you're compliant is no longer enough; an independent party has to confirm it.

The entry costs are not small. Minimum capital runs from roughly R$10.8 million to R$37.2 million (about $2 million to $6.7 million), depending on the license category, and the BCB bars operators from using co-working spaces as their registered office. The report estimates about 120 providers currently serve the market—most without a formal license.

Foreign firms that served Brazil from offshore shells now have to bring operations onshore within 270 days. The perimeter is precise, and the report is blunt about its purpose: to end the era of a Portuguese-language website, global liquidity, and no local presence.

Why the Central Bank is moving now

Brazil is, in the report's phrase, a "Stablecoin Nation." About 80% of declared crypto volume moves through dollar-pegged tokens; USDT alone accounts for 88.7% of that flow, and total stablecoin activity reached R$1.13 trillion between 2019 and 2025. As Decrypt previously reported, Tether's USDT is already cashable at 24,000 ATMs across the country, even as the country's regulatory tightening has been going on for years, from exchange closures to ATM rollouts.

And this reliance, direct or indirect, in foreign money is the reason why the Central Bank is more involved with crypto than any other regulator. “When four out of every five reais in crypto pass through an instrument pegged to a foreign currency, the phenomenon ceases to be a matter of consumer protection and becomes a matter of monetary policy,” CertiK argues. “That single fact explains much of what follows in this report: why it is the Central Bank, and not the capital markets regulator, that leads the regime; why foreign exchange and cross-border flows are at the heart of the rules; and why stablecoins head the next regulatory wave.”

Per CertiK's own Hack3d tracking, which Decrypt has covered, $1.32 billion left the industry to hacks and exploits across 344 incidents in the first half of 2026. Wallet compromises drove $444.5 million of that; phishing took $366.3 million. The two largest hits—Kelp DAO at $291 million and Drift Protocol at $285 million—came from operational and infrastructure failures, rather than broken smart contracts.

Marcos Rocha from Veirano Advogados, a law firm that advised on the filings, told CertiK that the market underestimated the work. "The most common issue we have observed is the underestimation of the complexity and timing involved in preparing an authorization application," he said. He added that "the review will be thorough, detailed, and highly technical."

Antônio Neto, Head of Growth LATAM at the Solana Foundation, described a growing swing toward licensed operators. "What we're seeing as the first real wave is projects choosing to operate under an authorized PSAV rather than pursue their own license," he said. Later in the report he argued the "Brazilian market is structurally moving onto the regulated rail."

The capital floor and the assurance bottleneck will reshape the field. The report's thesis is that a license becomes an asset, and acquisition of an already-authorized local operator becomes the fast route in for foreign entrants. It points to the same pattern after Europe's MiCA and Dubai's VARA regimes, where unlicensed volume migrated to the survivors.

There are gray zones the report flags plainly, including non-custodial wallets, DeFi front-ends, and tokenized securities, which the securities regulator (the CVM) says remain its territory regardless of the blockchain underneath. A tokenized share, the CVM has stated, is still a share.

The report's verdict explains that Brazil's market is "in which the ability to prove replaces the ability to promise."

For the roughly 120 providers now serving Brazilian users, the application must reach the Central Bank by October 30, 2026, carrying an independent assurance report.