With the aim of developing a more robust regulatory framework for Virtual Asset Service Providers (VASPs), Brazil’s Central Bank published, in March, Resolutions No. 552 and 553. These measures address, among other aspects, the integration of VASPs into the governance and compliance rules already applied to other entities operating within the National Financial System.

Resolution No. 552 establishes that VASPs must comply with the following requirements:

• the establishment and operation of an ombudsman function, in accordance with BCB Resolution No. 28, dated October 23, 2020;
• authorization and cancellation procedures for debits from prepaid payment accounts, in accordance with BCB Resolution No. 51, dated December 16, 2020;
• implementation of a compliance policy, in accordance with BCB Resolution No. 65, dated January 26, 2021;
• adoption of a cybersecurity policy and compliance with requirements for contracting cloud services, in accordance with BCB Resolution No. 85, dated April 8, 2021;
• maintenance of an internal audit function, in accordance with BCB Resolution No. 93, dated May 6, 2021;
• adherence to principles and procedures governing relationships with clients and users, in accordance with BCB Resolution No. 155, dated October 14, 2021;
• implementation of internal control systems, in accordance with BCB Resolution No. 260, dated November 22, 2022;
• measures for sharing data and information regarding indications of fraud, in accordance with BCB Resolution No. 343, dated October 4, 2023; and
• adoption of a remuneration policy for management, in accordance with BCB Resolution No. 432, dated November 13, 2024.

In turn, Resolution No. 553 harmonizes and standardizes the accounting practices of VASPs by requiring these entities to adopt the general criteria for the preparation and disclosure of financial statements in accordance with the Accounting Standards for Institutions Regulated by the Central Bank of Brazil (COSIF). At the same time, it amends a number of prior resolutions.

Among the new provisions, VASPs registered as publicly held companies or as the lead entities of prudential conglomerates (i.e., groups of financial and payment institutions controlled by a single parent company) classified within Segments S1, S2, or S3 must prepare consolidated annual financial statements in accordance with IFRS standards (as issued by the IASB and translated by the accredited Brazilian body).

As a result of these changes, VASPs are now subject to the independent audit requirements applicable to regulated institutions and must adopt procedures similar to those of other supervised entities. This strengthens governance and compliance across the sector, enhancing investor protection and confidence.

It is worth recalling, as noted in a previous communication issued by our firm (click here to access it), that BCB Resolutions No. 519, 520, and 521—which established the rules for authorization and operation of VASPs—came into force in February 2026.

Accordingly, entities already operating in Brazil have until October 30, 2026, to apply for authorization to operate in the market, in compliance with the requirements set forth in BCB Resolutions No. 552 and 553. New entrants, in turn, must obtain authorization from the Central Bank of Brazil prior to commencing their activities.