Brazil Crypto Regulation: Private Sector Perspectives on VASP, DeFi, and Implementation

Brazil Crypto Regulation: Private Sector Perspectives on VASP, DeFi, and Implementation

Hook

Brazil is implementing VASP (Virtual Asset Service Provider) regulation in 2024-2025, supervised by the Central Bank. Unlike Argentina and Uruguay with more experimental frameworks, Brazil chose centralized supervision but emphasizing proportionality and industry-regulator collaboration. According to CBB 2025 data, Brazil's VASP regulation will be a model for LATAM, with 145+ platforms registered in initial phase. But critical challenges remain: how to regulate DeFi, how to prevent power concentration, and how to accelerate adoption without sacrificing protection.

What You'll Learn

• VASP regulation in Brazil: Authorization structure, capital requirements, mandatory AML/CFT, external audit, and client asset segregation under CBB supervision.
• Proportionate regulation in practice: How startups with USD 100K AUM are treated differently from systemic platforms with USD 1B+, with scaled costs and requirements.
• Crypto-fiat integration: How crypto platforms connect to Pix for onboarding and fiat exit, creating synergy between banking and crypto.
• DeFi regulatory gap: Why non-custodial decentralized protocols create regulatory void—no "provider" to supervise, just open-source code.
• Systemic risk identification: How CBB monitors liquidity concentration, platform contagion, and stablecoin "bank run" risk.
• Timeline and roadmap: Implementation phases (initial authorization, operational phase, systemic integration) and expected 2025-2026 schedule.

Session Summary

Brazil's VASP Framework: Centralized but Collaborative - Julia Rossi, moderator, presented the panel as private sector perspective on regulatory implementation. Fábio Araújo from the Central Bank of Brazil (CBB) explained that Brazil's VASP framework is not a "soft sandbox"—it is hard regulation with continuous technical supervision. Any platform holding client assets or executing transactions must be authorized VASP. According to CBB 2025 data, two categories exist: (1) Full VASP, requiring USD 5 million capital, for platforms executing trades; (2) Light VASP, requiring USD 500K, for non-custodial wallets and interfaces. Araújo emphasized that CBB responds to technical inquiries in days, not weeks, thus accelerating approval cycles.

Proportionality in Action: Scaled Regulatory Requirements - Daniel Mangabeira from Circo, a Brazilian crypto payments platform, described how proportionality works in practice. Circo required USD 500K capital to operate as Light VASP (doesn't require custody). Requirements include: (1) basic AML/CFT (similar to banks), (2) annual independent audit, (3) client asset segregation, (4) private key safeguarding. For larger platforms like Bitstamp, requirements scale: USD 5M capital, quarterly audit, real-time transaction monitoring, resilience testing. Bruno Samora from Matera (payment infrastructure provider) added that proportionality also means proportional infrastructure: startups can use third-party APIs; systemic platforms must have 99.99% redundancy. This enables innovation without sacrificing system safety.

Crypto-Fiat Integration: Pix as Onramp/Offramp - Samora detailed how Pix (Brazil's instant payment system) becomes a bridge between crypto and fiat. Historically, Pix only allowed traditional money; now crypto platforms connect directly to Pix, enabling users to convert BRL to Bitcoin/Ethereum in seconds. According to Matera 2024 data, 40% of crypto onramps in Brazil now use Pix. Daily volume in crypto-Pix reached USD 500 million in Q4 2024. Samora noted this creates positive friction: no more informal money changers swapping dollars for crypto on street corners; everything is transparent, regulated, and auditable. CBB can see flows in real-time.

DeFi: The Regulatory Void Nobody Knows How to Fill - Fábio Sendão, legal advisor for a major Brazilian exchange, addressed the elephant in the room: how to regulate DeFi? If a user interacts with Uniswap (decentralized protocol on Ethereum), there is no "provider" to supervise. No custodian, no intermediary, just open-source code. Sendão explained CBB's current position: if a Brazilian user accesses DeFi through a Brazilian platform (like centralized exchange offering Uniswap link), that platform is responsible for AML/CFT at the interface. But if user directly accesses through Infura or Alchemy (non-Brazilian node providers), void exists. CBB is studying whether it could supervise "crypto bridges" (MEV-resistant mixers and privacy-centric DeFi) as AML risk. Sendão concluded that global DeFi regulation remains uncertain—Brazil is in dialogue with FATF and global regulators for consensus.

Systemic Risks: Contagion, Liquidity, Stablecoin Bank Runs - Araújo from CBB described risk surveillance. After FTX collapse 2022, CBB learned lessons: (1) liquidity concentration in few DEXs, (2) cross-platform exposure (if Bitstamp falls, how many derivatives hang?), (3) stablecoin runs (if USDT loses confidence, does capital flow to RLUSD?). CBB now requires "stress tests" from platforms: if Bitcoin price drops 50%, what happens to margin calls? If Uniswap liquidity vanishes, can the platform rebalance positions without 10%+ slippage? Araújo noted these tests occur quarterly. According to CBB 2024 data, 3 platforms failed initial stress tests; were remediated before authorization.

Watch the Full Panel

Recording available on YouTube - MERGE Madrid 2025: Panel on crypto regulation in Brazil with private sector perspectives (Circo, Matera), Central Bank, and legal counsel.

Frequently Asked Questions

How long does VASP authorization take in Brazil?
According to Daniel Mangabeira (Circo), application process takes 2-3 months with complete documentation. CBB responds to technical inquiries in days. After initial approval, there is a "supervised operational period" of 3-6 months where platform operates under intensive monitoring (weekly transaction audit) before permanent authorization. Total: 6-9 months from application to full go-live. However, if red flags exist (opaque ownership, weak AML, inadequate infrastructure), review can take 12+ months.

What happens if an authorized platform experiences a security breach?
Fábio Sendão explained: if breach affects less than USD 1M of client funds, platform must reimburse within 48 hours from own capital. If USD 1M-10M, CBB authorizes reimbursement with extended timeline (up to 30 days) but under supervision. If breach is USD 10M+, it's considered "systemic insolvency"—CBB may intervene, freeze funds for investigation, initiate orderly liquidation. According to CBB 2024 data, 1 platform experienced USD 2.5M breach; was reimbursed in 15 days without CBB intervention.

What is the future of DeFi in Brazil?
Bruno Samora was optimistic but cautious: DeFi will continue growing, but likely under "regulated DeFi"—protocols with clear developer identity, contract audit, and fiat identification integration. Sendão added that emerging models like DAOs (Decentralized Autonomous Organizations) with human legal entity could help: DAO elects "legal person" (like Foundation) to be regulatory interlocutor. This isn't pure DeFi, but pragmatic. Araújo from CBB was clear: if DeFi wants to operate in Brazil, there must be a locally registered entity responsible for compliance. If not, access will be blocked.