According to the published rules, Brazil now requires crypto firms seeking new or renewed licenses to submit independent audit reports, adding another compliance layer to an already expanding regulatory framework.
Brazil’s central bank has made independent audit reports mandatory for crypto firms seeking new licenses or renewing existing ones, with audits to be conducted by professionals registered with the Comissão de Valores Mobiliários (CVM). The reviews must assess anti-money laundering and counter-terrorism financing controls, customer asset segregation, internal risk management, and employee compliance programs. The update builds on Brazil’s virtual asset framework approved in 2022, the central bank’s appointment as primary regulator in 2023, and additional 2025 licensing rules covering custody standards, AML controls, stablecoin oversight, and corporate governance, with existing providers given until October 2026 to comply. The report also notes that audit costs could be significant for smaller firms, while Brazil remains a major crypto market with about $318 billion in transactions across 2024 and 2025, according to Chainalysis.