For any foreign group planning to operate a regulated crypto business in Brazil, the gatekeeper is the Central Bank of Brazil (Banco Central do Brasil — BCB). Under Law 14.478/2022, all Virtual Asset Service Providers must obtain authorization from the BCB before operating. This article breaks down the licensing process — timeline, capital requirements, fit-and-proper review, and the strategic shortcuts available to acquirers.
Visit the BitcoinP2P Investors Page →
What the BCB Actually Authorizes
The BCB does not issue a single uniform license. It authorizes specific service categories under Law 14.478/2022: virtual asset exchange, virtual asset transfer, virtual asset custody and administration, and virtual asset financial services. An acquirer should map the target’s authorization scope precisely against the buyer’s strategic plan — an exchange-only authorization will not legally support a custody-as-a-service product without an extension request.
The BCB also distinguishes between full VASPs and entities that perform virtual asset services as ancillary activities. Banks, fintechs, and PSPs holding existing BCB authorizations may extend their scope through simpler procedures, while pure-play VASPs follow the full authorization path.
Timeline of a Fresh BCB VASP Authorization
The standard fresh-application timeline runs in six phases. Each phase has a regulatory minimum and a practical median observed across recent applications. Acquirers evaluating greenfield versus M&A should benchmark against these numbers.
| Phase | Description | Median Time |
|---|---|---|
| 1. Pre-application | Capital structuring, compliance build-out, internal pre-audit | 3–6 months |
| 2. Filing | Submission of full application package to BCB | — |
| 3. BCB completeness review | Initial review and request for missing items | 1–3 months |
| 4. Substantive review | Compliance, technology, fit-and-proper analysis | 6–12 months |
| 5. Public consultation (if applicable) | Larger applications may require public input | 1–2 months |
| 6. Authorization decision | Granting, conditional granting, or rejection | 1–2 months |
Capital Requirements and Operational Costs
Minimum capital under the BCB rollout depends on service category and risk classification. Pure-play VASPs face capital floors that scale with operational risk score, customer count, and asset class scope. Beyond minimum capital, applicants must fund a fully built compliance program before authorization — not after.
Operational costs during application include external legal counsel (USD 150K–500K), compliance consultancy (USD 100K–300K), independent technology audit (USD 80K–200K), and dedicated personnel (a Compliance Officer, a Risk Officer, and an Internal Audit lead — all subject to BCB fit-and-proper review).
Fit-and-Proper Review for Controllers and Managers
The BCB conducts fit-and-proper review on the ultimate beneficial owners, board members, and key executives. Reviewable elements include criminal record (federal and state), tax compliance, civil litigation history, and prior regulatory sanctions in any jurisdiction. Foreign acquirers should run a parallel mock fit-and-proper exercise on their UBO structure before initiating the BCB process — surprises at this stage are expensive.
Talk to the BitcoinP2P M&A Team →
Three Strategic Shortcuts for Acquirers
Shortcut 1 — Acquire a target already in the BCB transition queue
Operators who started transition early have lower regulatory friction. A change-of-control filing typically completes faster than a fresh application.
Shortcut 2 — Acquire a Brazilian PJ that holds an adjacent BCB authorization
SCDs (sociedades de crédito direto), payment institutions, and fintech IPs have established BCB relationships. Adding a VASP scope is procedurally lighter than applying from zero.
Shortcut 3 — Use a perpetual white-label license with an acquired entity
Combine a small acquired Brazilian PJ (clean cap table, no operating history but already incorporated) with a white-label crypto platform license. The combined cost is typically lower than either pure path.
BCB VASP Authorization: Build vs. Acquire
12–24mo
Fresh application
3–6mo
Change-of-control on existing target
$500K–2M
Build cost (legal + capital)
“The BCB does not punish ambition. It punishes incompleteness. The single biggest determinant of authorization speed is the quality of the day-one filing.”
— Brazilian Banking Counsel
Risks and Failure Modes
- Application rejection: Incomplete AML programs, weak segregation-of-funds documentation, or unverifiable source-of-wealth filings are the most common rejection grounds.
- Bank account freezes during application: Brazilian banks sometimes restrict crypto-adjacent accounts mid-application. Multiple banking relationships are essential.
- Change-of-control objection: The BCB can object to fit-and-proper concerns at the controller level even on transition-stage targets.
- Regulatory drift: The BCB rulebook is still evolving. Acquirers should price tail risk explicitly.
Frequently Asked Questions
How long does a BCB VASP license take?
Median fresh-application timeline is 12–24 months from filing to authorization. Change-of-control filings on existing or transition-stage targets typically resolve in 3–6 months.
What is the minimum capital for a Brazilian VASP license?
Minimum capital varies by service category and risk classification under the BCB rollout. Acquirers should run an early conversation with Brazilian banking counsel for an exact figure tied to their proposed scope.
Can a foreign company own 100% of a BCB-authorized VASP?
Yes. Law 14.478 imposes no foreign ownership cap. Standard fit-and-proper review applies to ultimate beneficial owners regardless of nationality.
What is the fastest way to get a BCB VASP authorization?
Acquiring an existing target in advanced BCB transition or with an adjacent authorization (SCD, payment institution) compresses timing by 70–90% versus a fresh application.
Schedule an Introductory Call →
Read also: Brazil Crypto Regulation 2026 — Law 14.478 for Acquirers