A PSAV (Prestadora de Serviços de Ativos Virtuais, Brazil's virtual asset service provider authorization) is the status Brazilian law gives to a legal entity that performs at least one virtual asset service on behalf of third parties, and the authorization it needs before doing so. The definition sits in Article 5 of Law 14.478 of December 21, 2022. The authorization rules sit in a set of resolutions the Central Bank of Brazil (BCB) issued in 2025, of which Resolution 520/2025 is the one that governs who may apply and what happens to companies that were already operating when the rule arrived.
A payments company that collects reais, converts them into USDC and pays a supplier abroad is inside that definition on at least three counts. So the practical questions for a Head of Payments are which entity in the chain holds the authorization, what the transition regime allows in the meantime, and what to ask a provider that says it is covered. This post goes through the law, the executive decree that put the BCB in charge, the 2025 resolutions, the dates, and what the rule does not do.
The law that created the category
Law 14.478/2022 is the statute. It is short, and the parts a payments operator reads are these.
Article 1 sets the scope: guidelines for the provision of virtual asset services and for the regulation of the providers. Article 2 states that virtual asset services may only be provided by legal entities authorized by a federal body, so the authorization requirement is in the law itself, before any resolution.
Article 3 defines the virtual asset as a digital representation of value that can be traded or transferred electronically and used for payments or investment. The exclusions matter for stablecoins. National and foreign currency are out. Electronic money under Law 12.865 of October 9, 2013 is out, which is why a balance in a payment institution's account is regulated elsewhere. Loyalty points are out, and so are representations of assets whose issuance or settlement is already covered by other regulation.
Article 5 is the definition of the provider: a legal entity that performs, on behalf of third parties, at least one of five services. Exchange between virtual assets and currency. Exchange between virtual assets. Transfer of virtual assets. Custody or administration of virtual assets, or of instruments that give control over them. Participation in financial services related to the offer or sale of a virtual asset. The list mirrors the FATF one, which is why a VASP (virtual asset service provider, the FATF term) and a PSAV are the same idea under two names. The VASP explainer covers the international version.
Article 12 adds the providers to the list of entities subject to Law 9.613 of March 3, 1998, Brazil's anti-money-laundering statute. Article 13 applies the consumer protection code to their operations. Article 14 says the law took effect 180 days after publication, which put it in force in June 2023.
The decree that named the regulator
The law did not name the Central Bank. Article 6 left the choice of regulator to an act of the executive branch. That act is Decree 11.563 of June 13, 2023, whose Article 1 gives the Central Bank of Brazil the competence to regulate and supervise virtual asset service providers, and to authorize them, all service providers under Law 14.478/2022.
Article 7 of the law lists what the regulator may do: authorize the operation, the transfer of control and the corporate changes of a provider, set the conditions for management positions, and supervise. Between June 2023 and late 2025 the BCB had that competence and had not yet issued the operating rules, which is the period in which the market ran on the law alone.
The three resolutions of 2025
The BCB issued Resolutions 519, 520 and 521 in 2025, and they divide the subject the way a regulator usually does.
Resolution 519/2025 is the authorization rule. It sets the process for becoming an SPSAV (Sociedade Prestadora de Serviços de Ativos Virtuais, the company type that holds a PSAV authorization), together with the conditions on who may control and administer one.
Resolution 520/2025 is the constitution and functioning rule: how a provider must operate, how client assets are custodied and segregated, and what it owes clients. It also contains the transitional provision that matters most today, Article 88, which covers companies already providing the services when the resolution took effect.
Resolution 521/2025 connects the new category to the foreign exchange framework. It introduced Article 76A into Resolution 277/2022, the BCB's foreign exchange rule, so that payments and transfers with virtual assets are a defined activity operated by PSAVs and SPSAVs, and separate from the eFX regime that fiat payment institutions use.
One caveat on method. The BCB publishes these resolutions on bcb.gov.br, and on September 24, 2026 the normative pages returned a script shell rather than a text body to our checker. We cite the three by number and year without a hyperlink for that reason. The article numbers and the October 30, 2026 filing deadline were checked on September 25, 2026 against the Diário Oficial text of the resolutions and against published analyses by Brazilian firms, which agree on both. Anyone relying on a specific article should still read it on the BCB site directly.
The dates that decide what applies to whom
Several deadlines are already public and worth pinning.
The SPSAV filing deadline is October 30, 2026. A company operating under the transition regime of Article 88 of Resolution 520/2025 files its authorization request by that date. The BCB then has up to 360 days to complete phase one and a further 720 days for phase two, close to three years in all, under the deadline table of Resolution 108/2021 as amended by Resolution 549/2026. A gradual compliance regime applies in the interim, under Article 88 of Resolution 520/2025. We set this out when Resolution 561 was published on April 30, 2026.
Institutions already authorized by the BCB, such as banks, securities dealers and foreign exchange brokers, can take a different route. They can opt for technical certification, with a decision within 90 days, on the condition of full and immediate compliance with Resolution 520/2025, including internal audit, cybersecurity, risk management and anti-money-laundering controls.
Payment institutions that were settling eFX flows with stablecoins have until May 31, 2027 to either migrate to the SPSAV regime or keep their operations on the fiat rail only. That is the date Resolution 561/2026 set, and it is the one most often confused with the SPSAV filing date.
What the rule does not do
It does not license the stablecoin. Brazil authorizes the provider, not the asset. USDC and USDT are virtual assets under Article 3 of Law 14.478/2022, and no Brazilian authority has approved or rejected either. The question a regulator asks is who handles them for clients and under which authorization.
It does not turn a client into a PSAV. A company paying suppliers in USDC through an authorized provider is the provider's client. It performs no service on behalf of third parties, so Article 5 does not reach it. Where a client offers balances or conversion to its own end users, the analysis is different, and it is a question for the client's counsel, not for a blog post.
It does not make an authorized PSAV a bank or a payment institution. Those are separate authorizations under separate laws. A PSAV that holds reais for a client is not offering a payment account under Law 12.865/2013 and should not describe itself as if it were.
It is not the same thing as the eFX rule. Resolution 561/2026 barred virtual assets inside the eFX cycle. It did not touch the virtual asset payment rail that Article 76A of Resolution 277/2022 defines. The two regimes sit side by side, and a provider should be able to say which one each corridor runs on.
What to ask a provider that says it is authorized
Which legal entity provides the service in Brazil. The authorization attaches to a CNPJ (the Brazilian company taxpayer ID), not to a brand.
Whether that entity holds a final SPSAV authorization or operates under the Article 88 transition regime of Resolution 520/2025, and in the second case whether the filing was made by October 30, 2026.
Which corridors the entity serves directly and which it serves through a partner, and what that partner's authorization is. This is the question that decides whether the client's money sits with an authorized counterparty on every leg.
How KYB (know your business, the verification of a company and its owners) and KYC (know your customer, the verification of an individual) are run and where the records live, since Article 12 of Law 14.478/2022 puts the provider under the anti-money-laundering statute. The KYB explainer describes what that file contains.
I used to treat the entity question as paperwork that came after the product conversation. A prospect's compliance lead corrected that once by asking, before looking at any endpoint, which entity would be the counterparty on each leg of their flow and what authorization it held in each country. The honest answer included one corridor served through a partner rather than by us directly. We said so, and the deal closed. Now the entity and the authorization per corridor go into the first technical call.
What this looks like for a client using Lumx in Brazil
Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.
In Brazil the entity is Lumx Sociedade Prestadora de Serviços de Ativos Virtuais Ltda. It acts as a virtual asset service provider and is adapting to the SPSAV regime under Resolution 520/2025, operating under the Article 88 transition regime. Lumx is not a bank, a financial institution, a payment institution or a custodian of client funds, and we say so on the supported countries page, which is the page a compliance lead should read before the sales deck.
A client integrating us for a BRL collection that settles in USDC sees the flow as a Pix (Brazil's instant payment system, run by the Central Bank) collection, a conversion, and a stablecoin credit to its custodial wallet. Which regulated entity handles which step is drawn on the operator map, per country and per rail. When a compliance hold applies to a transaction, it surfaces as an RFI (request for information, a compliance hold that asks for a document before a transaction clears) with the document requested, so the client's operations team knows what is pending and why.
We wrote the basics of this framework earlier in regulation and compliance in stablecoin infrastructure. This post supersedes the Brazilian part of it.
Methodology and sources
Law 14.478/2022, Law 12.865/2013, Law 9.613/1998 and Decree 11.563/2023 were read on planalto.gov.br on September 24, 2026, and the article numbers above come from that text. BCB Resolutions 519/2025, 520/2025, 521/2025 and 561/2026 could not be read from a served text body on bcb.gov.br on the same date; they are cited by number and year, and the dates and article references given for them are the ones in our own published analysis of Resolution 561/2026. Lumx's regulatory status in Brazil is stated as it appears on lumx.io on September 24, 2026. Nothing here is legal advice; a company deciding whether it needs an authorization should read the norms and ask its counsel.
Verified on September 25, 2026. Operational context, not legal, tax, or investment advice. Law 14.478/2022 checked against planalto.gov.br on September 24, 2026. Decree 11.563/2023 checked against planalto.gov.br on September 24, 2026. Law 12.865/2013 checked against planalto.gov.br on September 24, 2026. Law 9.613/1998 checked against planalto.gov.br on September 24, 2026. BCB Resolutions 519/2025, 520/2025, 521/2025, 561/2026 and 549/2026 cited by number; bcb.gov.br did not serve a text body to our checker on September 24, 2026.
Cover photo: laura adai on Unsplash.
What is a PSAV in Brazil?
It is the authorization that Law 14.478/2022 requires for a legal entity that performs at least one of five virtual asset services on behalf of third parties. The Central Bank of Brazil is the regulator and authorizing body for providers under Decree 11.563/2023, and set the authorization process in Resolution 520/2025.
Is a stablecoin a virtual asset under Brazilian law?
Yes. Article 3 of Law 14.478/2022 defines a virtual asset as a digital representation of value that can be traded or transferred electronically and used for payment or investment, and USDC and USDT meet that description. The exclusions cover national and foreign currency, electronic money and loyalty points.
Does my company need a PSAV authorization to pay suppliers in USDC?
A company that pays its own suppliers through an authorized provider is that provider's client and performs no service for third parties. A company that lets its own users hold or convert virtual assets may be inside Article 5, and that is a question for its counsel before launch.
What is the deadline for SPSAV authorization?
Companies operating under the Article 88 transition regime of Resolution 520/2025 file their request by October 30, 2026. The Central Bank then has up to 360 days to complete phase one and a further 720 days for phase two, close to three years in all, under the deadline table of Resolution 108/2021 as amended by Resolution 549/2026, with gradual compliance in the interim under Article 88 of Resolution 520/2025. Payment institutions that used stablecoins inside eFX have until May 31, 2027 under Resolution 561/2026 to migrate or adjust.
Does a PSAV authorization make a provider a bank?
No. A PSAV is a separate category from banks and payment institutions, which are authorized under different laws. A provider holding a PSAV authorization does not offer payment accounts under Law 12.865/2013, and a client should expect it to say so.
