Obtaining a VASP (Virtual Asset Service Provider) license has become an essential milestone for companies seeking to operate legally in the virtual asset market in Brazil. With the consolidation of cryptocurrencies, stablecoins, and tokens as financial and technological instruments, the need arises for a regulatory environment that guarantees legal certainty, transparency in operations, and consumer protection.
Brazilian legislation has been evolving to offer this support, and the role of the Central Bank of Brazil is decisive in this context. This article presents the concept of VASP, the current regulations, the procedures required to obtain the license, and the risks associated with operating without the proper authorization.
Content:
- What is a VASP?
- How VASPs operate in the cryptoasset credit market
- Legal Framework and the VASP license in Brazil
- Process and requirements to obtain a VASP license in Brazil
- Risks and penalties for VASPs operating without a Central Bank license
What is a VASP?
VASP is the acronym that identifies Virtual Asset Service Providers, companies responsible for intermediating operations with digital assets, such as buying, selling, custody, transfer, and conversion to fiat currencies. These institutions occupy a strategic position in the infrastructure of the cryptoasset ecosystem, being compared to securities brokers in the traditional financial system.
The operation of VASPs, however, requires increased attention to the prevention of fraud, terrorist financing, and money laundering, since these transactions often occur on decentralized networks with a high degree of anonymity.
The definition established by the FATF (Financial Action Task Force), serves as an international guideline and directly influences Brazilian legislation. Based on this directive, the Central Bank began to regulate these institutions more intensely, requiring standards of governance, risk control, transaction traceability, and compliance programs compatible with the requirements applicable to conventional financial institutions.
How VASPs Operate in the Cryptoasset Credit Market
The operation of VASPs in the credit market represents one of the most innovative frontiers of the sector. This participation occurs through the granting of loans backed by cryptoassets, often without the need for bank intermediation. The most common practice involves the use of cryptoassets as collateral, allowing the client to access credit without disposing of their position in the asset. This provides immediate liquidity while maintaining exposure to the cryptoasset market.
In addition, there is a growing use of decentralized finance (DeFi) platforms for peer-to-peer credit offerings, where contracts are executed automatically through smart contracts. The tokenization of receivables is another mechanism being explored, allowing future credits to be represented digitally and traded instantly, with a significant reduction in operating costs.
However, these operations are not without risks. The model requires a highly qualified compliance policy, with robust internal controls, anti-fraud systems, solvency assessment, credit granting criteria, and continuous monitoring of collateral.
It is important to note that, according to Brazilian legislation, especially Law No. 4,595/1964 and Law No. 14,478/2022, activities with typically financial or banking characteristics, such as the granting of credit, may be considered the exclusive competence of financial institutions, subject to prior authorization from the Central Bank of Brazil. The absence of this authorization, depending on the structure and operations carried out, may characterize the irregular exercise of financial activity, giving rise to relevant legal implications, including criminal and regulatory ones.
Legal Framework and the VASP License in Brazil
The Legal Framework for Cryptoassets, formalized by Law No. 14,478/2022, is the main regulatory norm for the activities of VASPs in Brazil. This legislation brought legal certainty to the sector by defining which activities fall under the provision of services with virtual assets and establishing the requirement of prior authorization to operate, under criteria defined by the competent regulatory body.
The law also defines the due diligence duties of companies regarding user identification, transaction recording, prevention of money laundering (Law No. 9,613/1998, as amended by Law No. 14,478/2022 itself), and evasion of foreign exchange.
The Central Bank was designated as the regulatory body responsible for issuing authorizations and supervising VASPs, as established by Decree No. 11,563/2023. The supervision exercised by the body aims to protect the national financial system, ensure the stable functioning of the market, and ensure that consumers have access to reliable, secure, and transparent services.
The VASP license, therefore, functions as a seal of regulatory compliance, legitimizing the company’s operation and enabling partnerships with traditional financial institutions, in addition to facilitating access to national and international funding.
Process and Requirements to Obtain a VASP License in Brazil
The licensing process is still awaiting specific regulation from the Central Bank, as provided for in Law No. 14,478/2022 and Decree No. 11,563/2023. However, it is expected to begin with the formal incorporation of the company in Brazil, with a corporate purpose directly linked to virtual asset activities. After this stage, the assembly of the technical-regulatory dossier begins, which must include all the elements to be required by the regulation.
The business plan must demonstrate economic viability and operational sustainability, in addition to foreseeing the company’s adherence to the prudential rules of the financial system. Internal policies must be compatible with the risks of operations. This includes guidelines on corporate governance, internal control, prevention of financial crimes, data secrecy, and information technology management.
Although there is no formally published requirement yet, it is likely that the Central Bank will require audited financial statements, especially for companies of significant size or systemic exposure, to reinforce the reliability of the information.
Another central point will be the minimum required capital, which must be fully paid-up and compatible with the scope and volume of projected operations — according to prudential rules to be established. The technological infrastructure, in turn, must guarantee service continuity, data integrity, and interoperability with the Central Bank’s supervision systems. The analysis of the request may involve additional due diligence, and the final decision will rest with the competent body of BACEN (Central Bank of Brazil), based on technical criteria and regulatory convenience.
Risks and Penalties for VASPs Operating Without a Central Bank License
With the entry into force of Law No. 14,478/2022 and the publication of Decree No. 11,563/2023, obtaining prior authorization has become mandatory for VASPs to operate regularly in Brazil. However, as the specific infra-legal regulation has not yet been published by the Central Bank, the sector currently operates under a regulatory transition regime.
In this context, companies that already operate as VASPs and that do not carry out activities exclusive to financial institutions can continue to operate, provided they remain prepared to meet the requirements that will be defined in the regulator’s normative act. The provision of services with cryptoassets outside this scope, especially when involving fundraising, granting credit with third-party funds, or managing funds with a promise of profitability, may be classified as the irregular exercise of a financial institution, under the terms of art. 1 of Law No. 7,492/1986.
Questions about how to open a fintech? Click here to contact Silva Lopes Advogados, who can assist you in this process.
Penalties for irregular operation include administrative, civil, and criminal sanctions, which may involve warnings and fines up to the interruption of activities, asset freezing, and criminal liability of administrators. Among the crimes commonly associated with this type of operation are money laundering (Law No. 9,613/1998), evasion of foreign exchange, fraudulent management, and unauthorized exercise of financial activity.
In addition to legal risks, reputational impact is a critical factor. The absence of formal authorization can compromise negotiations with investors, make partnerships with financial institutions unfeasible, and deter institutional clients who require guarantees of compliance. Therefore, even if the regulatory requirement is still in the regulation phase, preparing for the authorization process should be seen as a strategic measure, and not just a legal one, for any VASP that wishes to consolidate itself in the Brazilian market.
For further information regarding our services, get in touch:
