Stablecoin card compliance is the set of licensing duties, identity checks, custody rules and monitoring split across the parties that make a stablecoin-funded card work: the issuer and its bank sponsor, the program manager, the wallet or custody provider, and the companies that handle top-up and cash-out. In Brazil and Mexico, each duty attaches to whichever entity performs that leg.
This post maps who carries which duty under Brazil's and Mexico's texts, as written, not what a company must do.
Who is regulated at each layer of a stablecoin card program?
Each party in a card program answers to a different supervisor for a different activity.
The layers of a stablecoin card program and the duty each one carries in Brazil and Mexico, as of November 2026.
Layer | What it does | Duty that attaches in Brazil | Duty that attaches in Mexico |
Card issuer | Issues the card and holds the customer relationship for the card | Payment institution (Law 12.865/2013, Art. 6, item III, d: issuing a payment instrument) or bank, authorized by the Central Bank of Brazil (BCB) under Art. 9, item V | Bank, or an electronic payment fund institution authorized by the CNBV under Articles 22 and 35 of the Fintech Law |
Program manager | Runs onboarding and support for a brand | Set by contract with the issuer; no statutory rule read for this role | Set by contract with the issuer; no statutory rule read for this role |
Stablecoin conversion and custody provider | Converts stablecoin to local currency and holds client balances | Virtual asset service provider (PSAV) authorization, with anti-money-laundering duties under Law 9.613/1998 | Not licensed as such; reached by the anti-money-laundering statute, Article 17 section XVI, when it serves the public from Mexico |
Top-up and cash-out provider | Takes a local deposit and pays out to a bank account | Payment institution activities under Law 12.865/2013, Art. 6, item III, a and b: taking in and paying out funds held in a payment account, and executing transfers | Transfers over SPEI; no statutory rule read for SPEI participation |
The fintech or brand | Owns the cardholder relationship in its own app | Payment-institution duties attach only if it performs one of the Art. 6, item III activities itself | Article 17 section XVI if it habitually exchanges or custodies virtual assets; Fintech Law Articles 22 and 35 if it issues electronic payment funds |
An issuer's licence does not cover the conversion leg, so the regulated entity is a different name per row. The CNBV (Mexico's banking and securities regulator) supervises the Mexican licences, and Pix (Brazil's instant payment system) and SPEI (Mexico's interbank transfer system) carry the local legs.
KYC and KYB: who checks the cardholder, and when
KYC (know your customer, the verification of an individual) is owed before a card is usable, and KYB (know your business, the verification of a company and its owners) is owed before a company holds cards or a program is approved. The issuer verifies a person because the card is a regulated payment instrument, and the stablecoin provider verifies the same person because it holds the balance.
In Brazil the identification duty sits in Law 9.613/1998. Article 9, item XIX, added by Article 12 of Law 14.478/2022, puts virtual asset service providers under the statute, and Article 10 requires them to identify clients and keep records for at least five years after the account closes. Article 11 requires reporting suspicious operations to COAF (Brazil's financial intelligence unit) without tipping off the person.
In Mexico the identification duty for the stablecoin leg comes from the anti-money-laundering statute, not a virtual asset licence: Article 17 section XVI makes habitual exchange or custody of virtual assets by non-financial entities a vulnerable activity, with client identification and reporting. The card leg carries its own duties under the issuer's licence.
Names, tax IDs and ownership must match across the issuer's file and the provider's, because a mismatch produces a hold. Business-side checks are in what KYB is, screening in stablecoin AML compliance.
At Lumx, KYC and KYB run through Sumsub, and every customer completes verification before the wallet is enabled. A business submits formation documents plus those of its representatives, UBOs and shareholders above 25%. When something is inconsistent, the customer moves to an RFI (request for information, a compliance hold that asks for a document) with the reason in the payload, and the platform resubmits.
Custody: who owns the funds behind the card?
The compliance question is who holds the balance a card draws on, and under which authorization: the cardholder through a wallet they control, or a provider in a custodial wallet.
Question | Custodial balance | Wallet the cardholder controls |
Who holds the keys | The provider (Lumx: custodial wallets) | The cardholder |
Brazilian regime for the holder of the balance | Custody is a virtual asset service under Article 5, item IV of Law 14.478/2022, so the provider needs PSAV authorization | A provider that only moves funds to the wallet performs transfers or exchange, which are separate services under the same article |
Mexican regime | A bank or fintech institution cannot offer virtual asset custody directly to its clients (Banxico Circular 4/2019, numeral 3); Article 33 of the Fintech Law bars disposing of custodied virtual assets except on the client's order; a non-licensed custodian is reached by Article 17 section XVI | The custody duty does not arise for the provider; the exchange and transfer legs still do |
Who can freeze the balance | The provider, because it can act on it | No provider has control, but the top-up and cash-out legs can still be held |
A brand that says "the cardholder owns the funds" while a provider holds the keys has described a custodial setup in non-custodial language. See what a custodial wallet is and custodial versus non-custodial wallets.
I recommend drawing the ownership table before any integration work starts, with one named legal entity per row and one named supervisor per entity. I would not launch with an issuer or a stablecoin provider that cannot fill its own row in writing, because the cheapest time to learn that the conversion leg has no accountable entity is before the first card ships.
Lumx wallets are custodial and held with BitGo, which carries insurance. Each customer has separate wallets, with no omnibus account, so balances are never mixed between customers or with Lumx's own. The balance is stablecoin, not a deposit, because Lumx is not a bank.
Brazil: PSAV, COAF and the exchange rule
Law 14.478 of December 21, 2022 says in Article 2 that virtual asset service providers need prior authorization from a federal body, and Article 5 lists the services, including exchange against currency and custody or administration. A stablecoin conversion for a cardholder falls under the first, and a held balance under the last. The authorization is the PSAV (Prestadora de Serviços de Ativos Virtuais), and the company type that holds it is the SPSAV. See the PSAV licence and what a VASP is.
The BCB's Resolution 520/2025 carries the conduct rules, and its Article 88 is the transition regime for companies already operating, which had until October 30, 2026 to file. A diligence file should record whether the provider holds an authorization or is in transition. The Brazil regulation guide has the detail.
For a card that spends abroad, Resolution 561/2026, published April 30, 2026, bars virtual assets from the exchange cycle (eFX) that payment institutions use for cross-border payments, with until May 31, 2027 to adjust. It did not touch the separate virtual asset payments activity created by Resolution 521/2025. Whether a program's settlement runs inside eFX is a question for the issuer's counsel.
Mexico: Fintech Law, Banxico and the AML statute
Mexico has no virtual asset licence: it licenses the fintech and restricts the asset. The Fintech Law of March 9, 2018 says in Articles 22 and 35 that habitually issuing and redeeming electronic payment funds requires authorization from the CNBV as an electronic payment fund institution. Article 30 says institutions may operate only with the virtual assets Banxico determines, with its prior authorization.
Article 30 defines a virtual asset and excludes legal tender, foreign currency and any asset denominated in either. Whether a dollar stablecoin falls inside it is for Mexican counsel; the Mexico regulation guide explains. Article 33 bars an authorized institution from selling, lending or pledging virtual assets it custodies except on the client's order.
Banxico's Circular 4/2019, published in the Diario Oficial on March 8, 2019, is the rule a bank-issued or fintech-issued card meets. Numeral 3 lets banks and fintech institutions operate with virtual assets only in internal operations, with Banxico's prior authorization, and says they must prevent the risk of those operations from passing to clients. It also makes ineligible any operation through which the institution would offer clients exchange, transmission or custody of virtual assets directly. For a stablecoin card, that puts the stablecoin leg outside the issuing institution: it has to sit with a separate provider.
Everyone outside that perimeter is reached by Article 17 section XVI of the anti-money-laundering statute: habitual exchange or custody of virtual assets by non-financial entities is a vulnerable activity. A company building for Mexican cardholders should ask its issuer which authorization it operates under.
Where top-up and cash-out sit in the chain
A cardholder tops up by paying a local account, the deposit converts to stablecoin, and the card spends from that balance. To cash out, the platform runs an off-ramp that pays a bank account the cardholder registered.
A top-up from a named account in the cardholder's own name ties the deposit to the person the issuer verified; a deposit into a shared account ties to no one. That is why Lumx's nested payments rule requires written compliance approval for any structure that moves money for parties Lumx has not onboarded.
Lumx already loads stablecoin cards for a client this way, with a top-up into a named virtual account (a local account number issued in the customer's own name) and a cash-out by off-ramp.
What monitoring runs after the card is live
The issuer watches card behavior. The stablecoin provider watches where funds come from, because a deposit from a sanctioned address changes the account's risk. The Travel Rule (the FATF requirement to pass sender and receiver data with a virtual asset transfer) applies to the transfer leg; see the Travel Rule guidelines.
At Lumx, monitoring of blockchain activity runs through Chainalysis, and every transaction carries a purpose code. A flagged transaction goes on hold as a transaction RFI asking for the sender and receiver relationship, the purpose and the expected outcome, and one left unanswered for 24 hours may be refunded to the sender. The docs list prepaid or gift cards among high-risk activities allowed with disclosure and Enhanced Due Diligence.
When this map is the wrong one to follow
Use a different source if the card is issued and settled in the US or the EU. The Brazilian and Mexican layers drop out there, and other regimes decide.
Use a different source for consumer protection, chargebacks or tax: this map covers who checks whom and who holds the balance.
Do not follow this map if the fintech plans to hold the stablecoin float itself for cardholders it has not onboarded with its provider. That pooled structure needs written compliance approval from a provider such as Lumx under its nested payments rule, and may be an unlicensed activity in Brazil and Mexico, so it belongs with counsel before any card is designed.
What a card program's stablecoin leg looks like with Lumx
Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, Bre-B, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.
Lumx does not issue cards. Its place is the stablecoin leg on both sides of the card: the local-currency top-up into a named account and wallet, and the cash-out to a local bank. A cardholder is an onboarded customer, verified through Sumsub before the wallet is enabled. A US entity, Lumx US OP LLC (Wyoming), is a FinCEN-registered money services business. In Brazil, Lumx Sociedade Prestadora de Serviços de Ativos Virtuais Ltda filed for SPSAV authorization and operates under the Resolution 520/2025 Article 88 transition regime. The supported countries page holds the exact wording, and the operator map shows which entity runs which leg. For the issuing side, see Lumx vs Rain, and for the asset, what a stablecoin is.
Methodology and sources
The Brazilian laws and the Fintech Law (with the Article 17 amendment) were read on planalto.gov.br and dof.gob.mx on November 1, 2026. Resolutions 520/2025, 521/2025 and 561/2026 link to the BCB's official normative pages, which serve their text through a script, so the October 30, 2026 and May 31, 2027 dates come from our earlier regulation guide. Banxico Circular 4/2019 links to its text on banxico.org.mx. Lumx statements come from docs.lumx.io, read on November 1, 2026. It does not cover card-network rules, and applying an article to a program is a question for counsel.
Verified on November 1, 2026. Operational context, not legal, tax, or investment advice. Law 14.478/2022 checked against planalto.gov.br on November 1, 2026. Law 12.865/2013 checked against planalto.gov.br on November 1, 2026. Law 9.613/1998 checked against planalto.gov.br on November 1, 2026. Fintech Law and the Article 17 section XVI amendment checked against dof.gob.mx on November 1, 2026. Banxico Circular 4/2019 (March 8, 2019) is on banxico.org.mx.
Cover photo: Pawel Czerwinski on Unsplash.
What is stablecoin card compliance?
It is the duties of licensing, identity checks and monitoring, plus custody rules, split across the issuer, program manager, custody provider and top-up and cash-out providers, each attached to the entity performing the leg. At Lumx, the stablecoin leg carries KYC and KYB through Sumsub, blockchain monitoring through Chainalysis and RFI holds, while the card itself is issued by a separate issuer.
Do stablecoin cards require KYC?
Yes. The issuer verifies the cardholder because the card is a regulated payment instrument, and the stablecoin provider verifies the same person because it holds or converts the balance. In Brazil the duty comes from Law 9.613/1998, and in Mexico from the issuer's licence and the anti-money-laundering statute. At Lumx, every customer completes KYC or KYB before the wallet is enabled, and a business also submits its representatives, UBOs and shareholders above 25%.
Who owns the funds behind a stablecoin card?
It depends on custody. With a custodial balance the provider holds the keys and needs the matching authorization, a PSAV in Brazil. With a wallet the cardholder controls, the provider's duties sit on the conversion and transfer legs. Lumx wallets are custodial, held with BitGo and segregated per customer, with no omnibus account.
Is spending stablecoin on a card legal in Brazil and Mexico?
The texts read for this post do not ban a stablecoin card as such, but each country leaves one point open. In Brazil, Resolution 561/2026 bars virtual assets from the eFX exchange cycle, with until May 31, 2027 to adjust, so whether a program's cross-border settlement runs inside eFX is a question for the issuer's counsel. In Mexico, Circular 4/2019 keeps banks and fintech institutions from offering virtual asset exchange, transmission or custody directly to clients, and whether a dollar stablecoin is a virtual asset under Article 30 of the Fintech Law is open. Lumx does not issue cards: it runs the stablecoin leg, a custodial wallet funded by a local deposit and cashed out to a registered bank account.
How are sanctions screening and the Travel Rule handled in a stablecoin card program?
The stablecoin provider screens deposit sources and the issuer watches card behavior; the Travel Rule applies to the transfer leg. At Lumx, blockchain monitoring runs through Chainalysis, every transaction carries a purpose code, and a flagged transaction goes on hold as a transaction RFI that asks for the sender and receiver relationship and the purpose.
