Navigating Brazil’s Dual-Track Regulation of Virtual and Crypto-Assets

Brazil operates with two overlapping terms that carry distinct regulatory consequences. Under Laws 14.478/2022 and 14.754/2023 the statutory category is “virtual asset,” a label that drives licensing by the Central Bank of Brazil (14.478/2022) and the natural person income-tax rules for virtual assets equated to financial investments located abroad (14.754/2023). By contrast, the Securities and Exchange Commission (CVM) and the Federal Revenue Service (RFB) still rely on “crypto-asset,” the legacy expression embedded in CVM Guidance Opinion 40/22 and in Normative Instruction RFB 1.888/2019. Companies and practitioners must therefore navigate a dual lexicon: the virtual-asset framework and the crypto-asset rubric.

At the center of this architecture stands Law 14 478/2022, the Legal Framework for Virtual Asset Service Providers (VASP). Article 3 adopts a purpose-driven concept: a “virtual asset” is a digital representation of value that can be transferred electronically and used either for payment or investment. The law then excludes (i) national or foreign fiat, (ii) e-money under Law 12.865/2013, (iii) instruments that provide their holder with access to specified products or services or to benefits arising from such products or services, such as loyalty program points and rewards; and – most relevant – (iv) digital representations of assets “whose issuance is already regulated,” notably securities.

Law 14.478/2022 is not self-executing; it expressly awaits infra-legal rules to spell out licensing, capital and conduct duties for VASP. The Central Bank of Brasil has therefore staged a phased consultation process – beginning with Public Consultation 97/2023, and followed by Consultations 109, 110 and 111/2024, which refined details and present drafts of the proposed rules.

Draft of Public Consultation 109 frames the new infra-legal regime around VASP and divides it into two species. The first comprises entities already regulated under Article 9 – such as securities brokers – which will file a 12-month prior notice before adding virtual-asset activities. The second species is the “Sociedade Prestadora de Serviços de Ativos Virtuais” (SPSAV), a purpose-built corporate form that must undergo a full licensing process. Three licensable business lines are identified: (i) intermediation, (ii) custody, and (iii) combined brokerage (where both services coexist). The draft sets minimum capital, mandates at least three executive directors, enforces strict segregation of client tokens, and details listing rules, Travel-Rule compliance and ongoing disclosures. Consultation 110 complements this by spelling out organisational, governance and management standards. Consultation 111 deals with the foreign-exchange perimeter, controversially deeming three classes of virtual-asset transactions to be “included in the FX market”: (i) any cross-border payment or transfer in virtual assets; (ii) the purchase, sale, swap or custody of BRL-denominated “stable virtual assets” held by non-residents; and (iii) the purchase, sale, swap, transfer or custody of foreign-currency-denominated stablecoins regardless user’s residence. Because Law 14.478/2022 expressly states that a virtual asset is neither domestic nor foreign currency, this draft of Consultation 111 risks sweeping even on-shore stable-to-stable trades between Brazilian residents into FX oversight damaging what the market has come to call the global order book. Another controversial prediction concerns the prohibition of withdrawal of stablecoin denominated in foreign currency to the User's self-custodial wallet (articles 76-F and 76-N).

In parallel, the CVM had been applying the Howey-style investment-contract test to ICOs and tokenised receivables. Guidance Opinion No. 40/2022 consolidates that practice. Under it, a crypto-asset is a security when it is either (a) the digital representation of an instrument already enumerated in article 2 of Law 6.385/1976 – shares, certificates of receivables, derivatives, etc. – or (b) a publicly offered collective investment contract generating a right to participation, partnership or remuneration from the efforts of others.

Still in Guidance Opinion No. 40/2022, the SEC adopted a functional taxonomy of tokens: payment, utility, and asset-backed. Through Circular Letters SSE/CVM 04/2023 and 06/2023, Brazil’s SEC directed issuers of receivables-backed tokens—popularly branded as “fixed-income tokens” – to leverage the regulated infrastructure of investment-based crowdfunding platforms governed by CVM Resolution 88/2022. The letters also reaffirm that the primary test for determining whether a crypto-asset constitutes a security remains the functional Howey analysis, yet they add a second lens: the possibility that such tokens qualify as securities because they amount to a securitisation of credit rights.

With the comment periods on Central Bank Consultations 109, 110 and 111 now closed, Brazilian crypto-market stakeholders have pivoted back to Congress, where the spotlight is on Bill 4.932/2023, which would impose a formal asset-segregation duty on all VASPs. In parallel, the Chamber is deliberating Bill 4.308/2024, a sector-specific framework for stablecoins that would define “payment-stable virtual assets,” set reserve and disclosure standards.

Regarding taxes, Normative Instruction 1.888/2019 obliges domestic exchanges to report, by the last business day of the following month, each trade, deposit, withdrawal, hard-fork allocation or airdrop, identifying the client, hash, quantity and value in reais. When operations occur offshore or peer-to-peer (with no intermediaries), the resident individual or entity must self-report whenever the monthly total exceeds R$30,000, and keep records for five years.

Normative Instruction 1.888/2019 establishes a reporting regime keyed to the location of the intermediary. When a Brazilian resident buys, sells or holds digital assets exclusively through a domestic VASP, that entity must transmit the detailed monthly files and the annual end-of-year position statement directly to the Federal Revenue Service. By contrast, if the resident trades via a foreign platform or uses a self-custodied wallet, the obligation shifts to the user: whenever the value of all crypto transactions in a given month—individually or combined—exceeds R$ 30,000.00, the resident must submit the declaration.

Law 14.754/2023, the so-called “Offshore Law,” superimposes a dual regime for the taxation of virtual assets from the perspective of a natural person. The Law is regulated by RFB Normative Instruction 2.180/2024. The decisive marker is where the negotiating or custodial company is based: if that entity is incorporated in Brazil, the tokens are deemed situated domestically; if the intermediary or custodian sits abroad, the tokens are treated as foreign property. For self-custodied holdings, where no intermediary exists and trades may occur on DEXs (decentralized exchanges), the default is the residence of the holder—so a Brazilian resident’s wallet is presumed domestic. The distinction matters because the tax treatments diverge. For natural persons, domestic-source gains are subject to progressive capital-gain brackets of 15 % to 22.5 %, with a monthly de minimis exemption for total disposals below R$ 35,000 and no offset for losses. Foreign-source gains are taxed at a flat 15 %, yet loss carry-forward is permitted. Moreover, regardless of whether the VASP’s location is national or foreign, Brazil taxes crypto-to-crypto swaps as realisation events, and the RFB classifies the temporary transfer of tokens as akin to an interest-bearing loan, requiring a Brazilian platform that arranges the loan to withhold income tax on the yield at source.

At last, Brazil’s new consumption-tax reform (Constitutional Amendment 132/2023 and Complementary Law 214) scraps PIS, Cofins, IPI, ICMS and ISS, replacing them with a dual VAT: the federal CBS and the sub-national IBS. A special regime for financial activities – including VASPs – was created for the sector.

The Central Bank intends to publish the final rules arising from the three consultations in the second half of 2025. Once the rules are enacted, there will be a vacation of the law, and after that a grace (grandfathering) period of at least six months will run. Importantly, only providers that can prove they were already operating before the final rules are published may rely on the grandfathering, so international players eyeing Brazil should establish a verifiable track record now to secure the transitional relief.