Brazil Published a National Virtual-Asset Framework

Brazil published Law No. 14,478 in its federal official gazette on December 22, 2022, establishing a national framework for businesses that exchange, transfer or safeguard virtual assets for customers. President Jair Bolsonaro had sanctioned the measure on December 21, after Congress approved the underlying legislation.

The publication was consequential because it moved Brazil from sector-specific rules and regulatory interpretation toward an explicit statutory regime for virtual-asset service providers. It did not, however, activate a complete licensing system on December 22. The law deferred major operational decisions to one or more federal agencies that the executive branch had yet to designate, and Article 14 delayed the statute’s entry into force for 180 days after official publication.

What the statute covered

Law No. 14,478 defined a virtual asset as a digital representation of value that can be traded or transferred electronically and used for payments or investment. The definition excluded national and foreign currencies, electronic money governed by existing payments legislation, loyalty points and representations of assets already covered by another legal or regulatory regime, including securities and financial assets.

That boundary preserved the authority of Brazil’s Securities and Exchange Commission, known as the CVM, over instruments qualifying as securities. The new law therefore did not classify every token under one regulator or convert cryptocurrency into sovereign money. Its immediate contribution was a legal perimeter for service providers operating on behalf of third parties.

The covered activities included exchanges between virtual assets and sovereign currency, exchanges among virtual assets, transfers, custody or administration, and participation in financial services connected with an issuer’s offer or sale of virtual assets. Providers would need prior federal authorization to operate in Brazil, although the designated regulator could establish a simplified authorization process in specified cases.

Licensing principles, not finished rules

The statute directed the future regulator to supervise providers, approve specified corporate-control changes and establish operating requirements. It also listed governing principles: free competition, operational transparency, risk-based controls, information security, personal-data protection, consumer protection, operational soundness and measures against money laundering and terrorist financing.

For companies already active, Article 9 required the eventual regulator to provide an adjustment period of at least six months. That minimum transition period was separate from the statute’s own 180-day delay before taking effect. On December 22, neither provision amounted to an issued license, an examination result or regulatory approval for any exchange.

The enacted text also contained no express requirement that providers segregate customer assets from their own property. That omission limited what the framework itself could establish about custody and insolvency protection, an especially important uncertainty after the November 2022 collapse of FTX. Consumer-protection law would apply where appropriate, but implementing rules and enforcement would determine how the broad principles operated in practice.

Financial-crime provisions

Law No. 14,478 added a specific fraud offense covering the organization, management, offering or distribution of portfolios, or the intermediation of transactions involving virtual assets, securities or financial assets, when conducted through deception to obtain an unlawful advantage at another person’s expense. The statutory penalty was four to eight years of imprisonment plus a fine.

The law also brought virtual-asset service providers into provisions of Brazil’s anti-money-laundering framework and increased penalties by one-third to two-thirds for specified money-laundering offenses committed repeatedly, through a criminal organization or using virtual assets.

These provisions made the December 22 publication more than a recognition of crypto payments. Brazil had created a framework combining market authorization, consumer principles and financial-crime controls, while leaving the identity of the principal regulator and detailed compliance standards unresolved.

Later context

Later action should not be projected into the December 22 record. On June 13, 2023, Brazil issued Decree No. 11,563 designating the Central Bank of Brazil to regulate and supervise covered providers, without displacing the CVM’s authority over securities. That later designation resolved an institutional question that remained open when Law No. 14,478 was published.