Brazil Sets $10K Self-Custody Crypto Reporting Rule

Brazil Mandates Reporting for High-Value Self-Custody Crypto Transfers

Brazil’s central bank has formally extended its anti-money-laundering and counter-terrorist-financing framework to cover significant virtual-asset movements involving user-controlled wallets. On September 23, 2026, the Banco Central do Brasil published Resolution BCB No. 588, amending Circular No. 3,978 to require that institutions under its supervision report any transfer of virtual assets to or from a self-custody wallet when the value equals or exceeds the equivalent of $10,000. The requirement takes effect on October 1, 2026.

Scope and Mechanics of the New Reporting Obligation

The amended Article 49 of Circular 3,978 now lists “transfers of virtual assets to or from self-custodied wallets” valued at $10,000 or more among the specific operations that covered institutions must communicate to the Conselho de Controle de Atividades Financeiras (Coaf), Brazil’s financial intelligence unit. The rule applies bidirectionally—covering both outbound transfers sent to a self-custody wallet and inbound transfers received from one. According to the central bank, the measure addresses the reduced visibility that arises when users hold private keys directly, stating that self-custody can reduce the availability of information for monitoring and risk assessment purposes. The statement distinguishes user-controlled wallets from assets held by authorized institutions where customer and transaction records remain inside a supervised entity.

Importantly, Resolution 588 does not prohibit self-custody, impose a cap on transfer amounts, or mandate that qualifying transactions be blocked. The $10,000 threshold functions strictly as a mandatory reporting trigger, not a transaction limit. Covered institutions must file the required Coaf communication by the next business day after the transaction occurs, integrating the new category into an existing compliance workflow. The circular also prohibits institutions from informing customers or third parties that a Coaf communication has been made. The reporting duty falls on the supervised institution handling the transfer, not on the individual wallet holder directly.

Distinction from the 24-Hour Hold Rule (Resolution BCB No. 584)

The October 1 reporting requirement operates separately from Resolution BCB No. 584, an anti-fraud measure published in August 2026. Resolution 584 covers certain outbound virtual-asset transfers to foreign service providers or self-custody wallets and permits a temporary retention period of up to 24 hours under defined risk controls, effective January 1, 2027. A critical technical difference lies in threshold calculation: Resolution 584 expressly aggregates same-day transfers by the same customer, meaning the $10,000 threshold can be reached through multiple smaller transfers in one day. Resolution 588, by contrast, refers to a single transfer with a value equal to or above $10,000 and contains no equivalent automatic aggregation language.

Brazilian regulatory analyses published after the September rules confirm this distinction. However, the absence of an automatic aggregation clause in Resolution 588 does not eliminate institutions’ separate obligations to monitor for suspicious activity. Circular 3,978 continues to require covered entities to assess transactions or situations that may indicate money laundering or terrorist financing, with suspicious cases subject to a distinct reporting process.

Broader Regulatory Context and Companion Measures

Resolution 588 arrives amid a staged rollout of virtual-asset supervision in Brazil. Since 2025, the central bank has introduced capital requirements, licensing, governance, security, and compliance mandates for crypto service providers. A separate 2026 rule restricted virtual assets from settling payments inside regulated cross-border electronic foreign-exchange (eFX) channels, targeting the supervised eFX system without banning ordinary crypto transfers outside that channel.

On the same day as Resolution 588, the central bank issued Resolution BCB No. 589, which modifies rules for virtual-asset service providers (VASPs). Resolution 589 mandates supervisory information submissions covering customer balances, custody positions, proof of reserves, and customer assets committed to staking, with those data submissions taking effect on January 1, 2027. It also sets a November 6, 2026 deadline restricting financial institutions, payment institutions, and other central-bank-authorized entities from carrying out or facilitating virtual-asset market operations with counterparties not authorized to operate in Brazil, subject to regulatory exceptions.

Resolution 588 itself does not create a new crypto tax rate, fee, or transaction levy. Crypto taxation in Brazil operates under separate tax rules, including provisions affecting gains from assets held in self-custody, which have been previously detailed by the finance ministry and tax authorities.

Why This Matters

Brazil’s move signals a maturing regulatory approach that targets information gaps rather than restricting self-custody outright. By folding high-value self-custody transfers into the existing Coaf reporting infrastructure—alongside large cash and foreign-currency operations—the central bank is leveraging a proven AML/CFT pipeline instead of building a parallel crypto-specific regime. The clear separation between Resolution 588 (reporting) and Resolution 584 (temporary hold with aggregation) gives compliance teams distinct operational playbooks: one for next-business-day filing on single large transfers, another for potential 24-hour risk reviews on aggregated outbound flows. For VASPs and traditional financial institutions bridging fiat and crypto, the November 6 counterparty-authorization deadline under Resolution 589 adds urgency to onboarding and due-diligence processes. Collectively, these rules shape a compliance landscape where self-custody remains legal but becomes significantly more visible to regulators at scale, aligning Brazil with Financial Action Task Force (FATF) travel-rule expectations while preserving the operational integrity of its payments and foreign-exchange systems.

Frequently Asked Questions

Does Resolution BCB No. 588 ban or limit self-custody wallet usage in Brazil?

No. The resolution does not prohibit self-custody, cap the amount a user can transfer, or require that qualifying transactions be blocked. The $10,000 figure is a mandatory reporting threshold for covered institutions, not a transaction limit on individuals.

How does the reporting trigger in Resolution 588 differ from the 24-hour hold rule in Resolution 584?

Resolution 588 applies per individual transfer valued at $10,000 or more, without automatic same-day aggregation. Resolution 584, effective January 1, 2027, aggregates a customer’s outbound transfers over a single day to determine if the $10,000 threshold is met and permits a temporary retention of up to 24 hours for risk review.

Who is responsible for filing the Coaf report—the wallet holder or the institution?

The reporting duty falls on the covered institution (e.g., a crypto exchange, payment institution, or bank) that handles the qualifying transfer and is supervised under the central bank’s AML/CFT framework. The individual controlling the self-custody wallet does not have a direct filing obligation under Resolution 588.