Stablecoin regulation in Brazil: the full 2026 guide

Stablecoin regulation in Brazil is a stack of four layers: a statute that defines virtual assets and requires providers to be authorized, a decree that hands the subject to the Central Bank of Brazil (BCB), three BCB resolutions from 2025 that set the authorization and conduct rules, and the foreign exchange framework that decides how a stablecoin may or may not be used to move money across the border. No layer regulates USDC or USDT as such. Every layer regulates the company that handles them for clients.

That distinction is the one a Head of Payments needs first, because it changes the question from "is USDC legal in Brazil" to "which authorized entity handles the USDC, on which rail, under which rule". This guide goes through each layer with the norm number and the article, says from when each one applies, and lists the deadlines that fall in 2026 and 2027. We covered the basics in regulation and compliance in stablecoin infrastructure; this post is the current version.

The four layers at a glance

The norms that reach a company moving stablecoins in Brazil, and the date each one started to apply.

Laws 12.865/2013 and 9.613/1998 sit underneath, the first because it defines electronic money and excludes it from the virtual asset definition, the second because Law 14.478/2022 puts providers under the anti-money-laundering statute.

Layer one: Law 14.478/2022 defines the asset and the provider

Law 14.478 of December 21, 2022 is the statute. Article 2 makes authorization a legal requirement: virtual asset services may only be provided by legal entities authorized by a federal body.

Article 3 defines a virtual asset as a digital representation of value that can be traded or transferred electronically and used for payments or investment. It then lists what is out: national and foreign currency, electronic money under Law 12.865 of October 9, 2013, loyalty points, and representations of assets whose issuance or settlement is already regulated. A dollar stablecoin is a virtual asset under this article. A real held in a payment institution's account is electronic money and belongs to a different regime.

Article 5 defines the provider as a legal entity performing, for third parties, at least one of five services: exchange with currency, exchange between virtual assets, transfer, custody or administration, and participation in financial services related to an offer or sale. That entity is a PSAV (Prestadora de Serviços de Ativos Virtuais, Brazil's virtual asset service provider authorization), which is the local form of a VASP (virtual asset service provider, the FATF term). The PSAV post covers the authorization in detail and the VASP explainer covers the international definition.

Article 12 amends Law 9.613 of March 3, 1998 to add providers to the entities under anti-money-laundering obligations. Article 13 applies the consumer protection code. Article 14 sets entry into force at 180 days after publication.

Layer two: Decree 11.563/2023 puts the Central Bank in charge

Article 6 of the law left the regulator to an executive act. Decree 11.563 of June 13, 2023 is that act, and Article 1 gives the Central Bank of Brazil the competence to regulate, to authorize and to supervise virtual asset service providers.

The decree did not write the operating rules. For about two and a half years the market had a law, a regulator and no authorization process, which is why companies that started before late 2025 describe themselves as operating under the law rather than under an authorization.

Layer three: BCB Resolutions 519, 520 and 521 of 2025

The three resolutions split the subject. Resolution 519/2025 is the authorization rule: how a company becomes an SPSAV (Sociedade Prestadora de Serviços de Ativos Virtuais, the company type that holds a PSAV authorization), and who may control and administer one. Resolution 520/2025 is the constitution and functioning rule, covering custody and segregation of client assets, and it carries Article 88, under which companies already operating transition. Resolution 521/2025 ties the category into the foreign exchange framework by introducing Article 76A into Resolution 277/2022, so that payments and transfers with virtual assets are a defined activity for PSAVs and SPSAVs.

The dates that follow from the package are these. Companies under the Article 88 transition regime file for authorization by October 30, 2026. The BCB has up to 360 days to complete phase one and a further 720 days for phase two, close to three years in all, under the deadline table of Resolution 108/2021 as amended by Resolution 549/2026, with gradual compliance in the meantime under Article 88 of Resolution 520/2025. Institutions already authorized by the BCB, such as banks and foreign exchange brokers, may seek technical certification instead, with a decision within 90 days, on condition of full and immediate compliance with Resolution 520/2025.

A note on how we checked. On September 24, 2026 the BCB's normative pages served a script shell rather than the text of the resolutions to our checker. We cite the three by number and year without a hyperlink. The article references and the October 30, 2026 filing deadline were checked on September 25, 2026 against the Diário Oficial text and against published analyses by Brazilian firms, which agree on both. Read the text on bcb.gov.br before relying on a specific article.

Layer four: the foreign exchange rule and the border

Law 14.286 of December 29, 2021 is the foreign exchange statute. Article 3 says foreign exchange operations may only be carried out through institutions authorized by the Central Bank to operate in that market. Article 4 makes the authorized institution responsible for identifying its clients and for the lawful processing of the operations. The law took effect one year after publication, at the end of December 2022, and the BCB's implementing rule is Resolution 277 of December 31, 2022.

This is where stablecoins meet the border. A company that collects reais and pays out abroad is either doing a foreign exchange operation under Law 14.286/2021 or a virtual asset transfer under Law 14.478/2022, and the answer depends on the rail. Articles 49 and 50 of Resolution 277/2022 define the eFX cycle for payment institutions, and that cycle ends in a foreign exchange transaction or a deposit into a non-resident account. It never included virtual assets. Article 76A, introduced by Resolution 521/2025, defines the separate activity of payments and transfers with virtual assets, run by PSAVs and SPSAVs.

Resolution 561/2026, published April 30, 2026, wrote the implied prohibition into the text: virtual assets may not be used to close the eFX cycle. It did not touch Article 76A. The press read it as a ban on stablecoins in cross-border payments; we explained at the time why that reading was wrong. Payment institutions that were using stablecoins inside eFX have until May 31, 2027 to migrate to the SPSAV regime or return to fiat only.

So a BRL to USDC conversion that ends in a dollar payout abroad runs on the virtual asset rail, and the entity on the Brazilian leg should hold, or be transitioning to, an SPSAV authorization. The USDC to BRL corridor page shows the inbound version of the same flow.

What the rules do not say

They do not approve a stablecoin. There is no list of authorized stablecoins in Brazil. Article 3 of Law 14.478/2022 defines the asset generically, and the resolutions regulate providers.

They do not make the end client a provider. A company paying suppliers or collecting from customers through an authorized provider is that provider's client. It becomes a provider itself only if it performs one of the Article 5 services for third parties, and that analysis belongs to its counsel.

They do not fix the tax treatment. Tax on virtual assets sits with the Federal Revenue Service under separate rules, and this guide does not cover it.

They do not turn a PSAV into a bank or a payment institution. Those are separate authorizations under separate laws, and a provider should not describe a stablecoin balance as a payment account.

What this looks like for a client running BRL flows with Lumx

Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.

The Brazilian entity is Lumx Sociedade Prestadora de Serviços de Ativos Virtuais Ltda. It acts as a virtual asset service provider and is adapting to the SPSAV regime under Resolution 520/2025, under the Article 88 transition regime. It is not a bank, a financial institution, a payment institution or a custodian of client funds. That is the wording on the supported countries page, and it is the wording a compliance lead should compare against the norms above.

For a client, the practical consequence is that a Pix (Brazil's instant payment system, run by the Central Bank) collection that settles in USDC is a virtual asset service under Law 14.478/2022, and an outbound USDC to BRL payout is the same service in reverse. Neither runs inside eFX, so Resolution 561/2026 does not change the flow. Which entity handles which leg, in Brazil and in the receiving country, is drawn on the operator map. When a transaction is held for review, the client sees an RFI (request for information, a compliance hold that asks for a document before a transaction clears) that names the document, and the transaction status changes only when the document clears.

I put the entity question before the product question, and I hold that position on the whole stack. A provider that cannot say which legal entity is the counterparty on each leg, and what that entity's status is under Resolution 520/2025, is asking the client to carry a risk it has not been shown. We put the entity and the status per corridor into the first technical call for that reason, before anyone opens the API reference.

Methodology and sources

Law 14.478/2022, Law 14.286/2021, Law 12.865/2013, Law 9.613/1998 and Decree 11.563/2023 were read on planalto.gov.br on September 24, 2026, and the article numbers above come from that text. BCB Resolutions 519/2025, 520/2025, 521/2025, 277/2022 and 561/2026 could not be read from a served text body on bcb.gov.br on the same date; they are cited by number and year, and the dates and article references for them come from our own published analysis of Resolution 561/2026. Lumx's regulatory status is stated as it appears on lumx.io on September 24, 2026. This is a description of what the norms say, not advice on what a company must do.

Verified on September 25, 2026. Operational context, not legal, tax, or investment advice. Law 14.478/2022 checked against planalto.gov.br on September 24, 2026. Law 14.286/2021 checked against planalto.gov.br on September 24, 2026. Decree 11.563/2023 checked against planalto.gov.br on September 24, 2026. Law 12.865/2013 checked against planalto.gov.br on September 24, 2026. Law 9.613/1998 checked against planalto.gov.br on September 24, 2026. BCB Resolutions 277/2022, 519/2025, 520/2025, 521/2025, 561/2026 and 549/2026 cited by number; bcb.gov.br did not serve a text body to our checker on September 24, 2026.

Cover photo: Shutter Speed on Unsplash.