Central Bank of Brazil publishes new normative instruction on certification of virtual asset services

On January 22, 2025, the Central Bank of Brazil (“BC”) published BCB Normative Instruction (“IN”) No. 701. The normative instruction establishes the method of communication and the minimum requirements for the preparation of the technical certification by an independent, qualified company, accompanying the communication of interest in providing virtual asset services in Brazil, in compliance with BCB Resolution No. 520, of November 10, 2025.

BCB IN No. 701 establishes the guidelines for the independent certification required for virtual asset service providers to obtain a license. The measure aims to align the authorization process with clear technical standards, contributing to greater transparency and regulatory certainty.

With this initiative, the BC is strengthening the regulatory framework for the virtual asset sector, aligning Brazil with the practices adopted in other markets. The aim is to create conditions for the segment to develop in an organized way, compatible with the stability of the financial system.

Key points of BCB IN No. 701

1. Communication and registration procedures
   • The communication of interest in providing virtual asset services in the form of intermediation and custody of virtual assets in Brazil by institutions and entities must comply with the following procedures:
     • Registering and updating the information and registration data, integrating the BC’s Information System on Entities of Interest (“UNICAD”), in compliance with BCB Resolution No. 209, of March 22, 2022; and
     • Submitting the technical certification drafted by a qualified independent company through the Integrated Supervisory Support and Communication System (“APS-SISCOM”).
   • Failure to conduct all the procedures defined above will render the communication ineffective before the BC. Thus, the applicant institution will remain prohibited from providing virtual asset services.
   • The procedures for submitting the technical certification are described in the “Relevant Communication Module” Manual.

2. Technical certification required by the BC

• • Qualified independent company

The qualified independent company must include an institutional presentation demonstrating suitability and compatibility with the work to be conducted. The presentation must contain at least:

• • • All existing and valid qualifications and credentials for the exercise of said activity; and
    • A declaration that there are no corporate or business relationships with the contractor that may imply a conflict of interest or impair the independence of the analysis to be conducted. The document must be executed by the director or administrator in charge of the applicant institution and by the certifying entity.
  • Opinion

The independent entity must submit a technical certificate that examines and ensures the suitability of the institution concerned in terms of:

• • Mechanisms and procedures that demonstrate:

1. 1. 1. Effective segregation between the virtual assets held by the institution providing virtual asset services and the virtual assets held by its clients and users; and
      2. Proof of virtual asset reserves, demonstrating that the virtual asset service provider actually owns the virtual assets it claims to have on behalf of its clients and users.

• • Relevant services contracted: Demonstration of adequate contracting of data processing, storage, and cloud computing services by financial institutions and other entities authorized to operate by the BC.
  • Technical and regulatory capacity of contracted third parties: Demonstration that the contracted companies can provide virtual asset services, including in cases involving service providers located abroad.
  • Contingency and recovery plans: Plans for recovering positions and controlling the virtual assets and financial resources of clients and users, as well as those of the institutions providing virtual asset services, in the event of incidents affecting these virtual assets and financial resources involving the contracted institution or entity.
  • Policies and procedures: Policies and procedures related to the governance of the activities entailed in providing the virtual asset services established in Art. 43 of BCB Resolution No. 520.
  • Processes and procedures involving Anti-Money Laundering (AML), Combating the Financing of Terrorism (CFT), and cyber security: In compliance with the specific legislation and regulations applicable to regulating the combat of criminal use of the National Financial System (“SFN”), particularly in relation to preventing and combating money laundering, terrorism financing, and the proliferation of mass destruction weapons. The processes and procedures in question must ensure the security, resilience, and proper functioning of the computing environment used to provide virtual asset services.
  • Policies for the safekeeping and protection of control instruments: Continuous monitoring mechanisms implemented by the provider of virtual institutional security assets and risk assessment services, to detect, prevent, and respond to potential threats and incidents.
  • Regulatory and internal standardization requirements: Specific policies aimed at offering, listing, suspending, and delisting selected virtual assets. The requirements must comply with the provisions of Article 65, items I to IX, of BCB Resolution No. 520, of 2025, as well as the processes for selecting virtual assets referenced in fiat currency for offering or listing activities on their platforms.
  • Internal control systems: Internal control systems consisting of policies and procedures, as well as the necessary mechanisms aimed at: (a) Adequately segregating the roles performed by the governance of the institution or entity that imply a potential or actual conflict of interest; and (b) Controlling and monitoring activities involving intermediation and custody services for virtual assets.
  • Compliance: Risk and capital management structures, compliance, and internal auditing, aligned with the regulations applicable to financial institutions and other entities authorized to operate by the BC.
  • Cyber security policies: Cyber security policies, as well as incident action and response plan, in compliance with current regulations.
  • Verification mechanisms: Internal policies and verification mechanisms implemented to identify, monitor, and prevent illicit practices in the virtual asset market.
  • Custody of virtual assets: Custody contract for virtual assets, as provided for in Articles 73 (VIII), 75, and 78, of BCB Resolution No. 520 of 2025.
  • Plans implemented by virtual asset custodians: Measures and/or plans implemented by the custodian of virtual assets, in compliance with the provisions of Art. 76, items I to XII, of BCB Resolution No. 520, of 2025.
  • Redundancy mechanisms: Redundancy mechanisms adopted for the control instruments over virtual assets, as well as the procedures for recovering the object to which the redundancy mechanism (referred to in item XVI) applies, for BC supervision.

• • Adequate provision, to customers and users, by the virtual service provider, of clear and precise information on:

1. 1. 1. The institution itself and the characteristics of the services it provides, as well as the legislation and regulations applicable to the services offered by the entity or institution.
      2. The communication channels and supporting resources made available by the virtual asset service provider.
      3. The institutions and entities contracted and the services provided, allowing for the understanding of the implications and relevance of these participations for clients and users.
      4. The existence or absence of guarantee funds or insurance coverage for the services performed.
      5. The rights and obligations involved in the relationship between clients, users, virtual asset service providers, and other institutions or entities involved, as well as the existence of any contingencies.
      6. The operation of the processes of safekeeping, custody, and storage of the control instruments of the virtual assets owned by these clients and users, regardless of whether these services are performed directly by the institution or third parties.
      7. The virtual asset and the system based on distributed ledger technology.
      8. The information and risks involved in staking virtual assets.

• • Good practices: Informative content involving good practices and existing risks in operations carried out in the virtual asset market; and
  • Position held: Updated report of the position held in virtual assets by the client or user.

• • General guidelines on the technical opinion
    • The technical certification must address the adequacy referred to in this article specifically for each item mentioned. A consolidated opinion for all items will not be accepted under any circumstances.
    • The BC may request further information on elements of the technical opinion to clarify any doubts or obtain further clarification.
    • The technical certification must take into account, if applicable, the type of operation and activity carried out by the institution interested in providing virtual asset services.
    • As established in Articles 22 and 23 of BCB Resolution No. 20, in the case of an eligible authorized institution operating in the virtual asset market and an entity incorporated abroad operating in the virtual asset market, the technical certification must ensure that the virtual assets service provider effectively and fully complies with the requirements of BCB Resolution No. 20.

3. Retention obligation

The work papers and supporting documentation used by the independent qualified entity to assist in the preparation of its technical certification must remain at BC’s disposal for at least five years and may be requested at any time.

BCB Resolution No. 701 will come into force on February 03, 2026.

Read BCB IN No. 701 in full.

Demarest’s Banking and Finance team is available to provide any further clarifications on the topic that may be necessary.