Brazil’s Central Bank Makes Independent Audits Mandatory for Crypto Firms

BRAZIL · CRYPTO

A new Brazil crypto audit rule takes effect on June 1, requiring every virtual-asset firm to submit an independent audit report, signed by an auditor registered with the country’s securities regulator, before it can be authorized to operate. The Central Bank says the step deepens an already strict licensing regime and brings Brazil into line with global anti-money-laundering standards for one of the world’s fastest-growing crypto markets.

What the Brazil crypto audit rule requires

Under Normative Instruction 739, any company that provides virtual-asset services, including exchanges, brokerages and custody platforms, must present a report from an independent auditor before the Central Bank will grant or maintain authorization. The auditor must be registered with the country’s securities and exchange commission.

The external auditor’s task is to validate the structures each firm has built to prevent money laundering and the financing of terrorism. That includes reviewing how a platform separates the interests of its owners from its risk-control functions, the training programmes it gives staff to handle irregular situations, and how it classifies and verifies the profile of each registered client.

The rule was published on Friday and enters force on June 1. New applicants must comply from the start of their authorization process, while firms that already hold a licence must bring their operations into line by the stipulated date.

How the Brazil crypto audit rule fits the wider framework

The audit requirement is the latest layer in a regulatory build-out that began with the 2022 crypto legal framework, the law that first defined virtual-asset services in Brazil and handed the Central Bank authority to regulate them.

In November 2025, the Central Bank published the first operating rules for the market, formally creating the licensed virtual-asset service-provider category and setting criteria for governance, anti-money-laundering compliance and activity in the foreign-exchange market. The new audit demand sits on top of that structure rather than replacing it.

The regulator frames the sequence as a deliberate tightening: each step is meant to balance innovation against security, narrowing the space for the fraud and scams that have historically marked unregulated crypto markets.

Why it matters for a fast-growing market

Latin America is among the world’s quickest-expanding crypto regions, and Brazil is its largest single market. Mandatory third-party verification raises the cost and complexity of obtaining a Brazilian licence, a barrier that may consolidate the sector around larger, better-capitalized operators able to absorb compliance costs.

The Central Bank argues that independent auditing increases the transparency and reliability of the information firms submit, strengthening trust in a market that has drawn millions of retail users. For international platforms eyeing Brazil, the rule signals that market entry now hinges on demonstrable compliance infrastructure, not just registration.

What changes for firms already licensed

Companies that already hold authorization are not exempt. They must commission an independent audit and submit the resulting report to remain in good standing, meaning the rule reaches across the entire authorized market rather than applying only to newcomers.

For smaller domestic exchanges, the added expense of engaging a securities-registered auditor could prove material, reinforcing the consolidation pressure already building in the sector. The Central Bank has positioned the measure as protective of users rather than punitive toward operators.