Due diligence on a Brazilian VASP target follows the same structure as any cross-border crypto acquisition, with three Brazil-specific overlays: Receita Federal IN 1888 reporting history, Banco Central VASP transition status, and the bank-relationship layer that determines operational continuity post-closing. This article is a structured DD checklist organized by workstream.
Visit the BitcoinP2P Investors Page →
Workstream 1 — Corporate and Legal
- CNPJ certificate (Cartão CNPJ) and full corporate registry (Junta Comercial)
- Articles of incorporation and all amendments
- Cap table evolution since founding
- Shareholders’ agreements, drag/tag rights, ROFR
- Active and historical litigation (federal and state courts)
- Labor litigation (TRT regional courts) — a Brazil-specific exposure
- Tax compliance certificates (CND federal, state, municipal)
- FGTS and INSS certificates
- Material contracts: vendors, customers, white-label clients, partners
Workstream 2 — Crypto Regulatory
- IN 1888 monthly reports — sample receipts back to 2019 if applicable
- BCB engagement letters, transition filings, authorization status
- COAF SAR submissions log (count and category, not contents)
- AML manual and policies — version history
- Compliance officer credentials and BCB fit-and-proper readiness
- Privacy/LGPD compliance documentation and DPO designation
- Customer terms of service evolution
| Workstream | Critical Brazil-Specific Item | Failure Mode if Missing |
|---|---|---|
| Corporate / legal | Labor litigation (TRT) | Inherited multi-year claims |
| Crypto regulatory | IN 1888 receipts since 2019 | Cannot rebuild compliance fingerprint |
| Tax | REFIS / installment plans | Hidden balance-sheet liability |
| Banking | PIX fallback rails | Operational shutdown post-closing |
| On-chain | Volume reconciliation | Reported volume cannot be verified |
| Brand | INPI trademark | Brand cannot be defended in Brazil |
Workstream 3 — Financial and Tax
- Audited or compiled financial statements (last 3 years)
- Monthly P&L by product line
- Customer fund segregation evidence (escrow accounts, cold storage)
- Reconciliation of on-chain wallets with reported volume
- Tax exposure assessment (IRPJ, CSLL, PIS, COFINS, ISS on services)
- Cross-border payment exposures (any USD-denominated obligations)
- Outstanding tax assessments or installment plans (REFIS)
Workstream 4 — Banking and Payments
Banking is uniquely critical in Brazilian VASP M&A. Many otherwise attractive targets carry hidden banking risk: PSPs that may exit at change-of-control, escrow accounts that are not fully segregated, or PIX integrations dependent on a single bank.
- List of all bank accounts (operating, escrow, segregated customer)
- Banking history — relationship duration, account closures, denials
- PIX integration architecture and fallback rails
- Card processing relationships (if any)
- Correspondent banking for international flows
Talk to the BitcoinP2P M&A Team →
Workstream 5 — Technology and Security
- Source code repository access (escrowed during DD)
- Architecture diagrams (matching engine, wallet, KYC, accounting)
- Penetration test reports — ideally from external auditors
- Custody architecture (HSM, multi-sig, cold storage)
- Disaster recovery and business continuity plans
- Vendor list (KYC, AML monitoring, infrastructure)
- Open-source license compliance
Brazilian VASP DD Failure Rates
~50%
Deals abort in DD
Top 3
Failure causes: IN 1888, banking, tax
<10%
of targets pass cleanly first time
Workstream 6 — On-Chain Verification
This is where Brazilian VASP DD differs from traditional financial DD. The acquirer’s analyst should independently verify reported volume against on-chain data. Request: full list of operational wallet addresses, sample customer deposit/withdrawal trails, and historical balance proofs. Cross-reference against Receita Federal IN 1888 aggregates.
“We do not lose deals on price. We lose them on documents. The targets with clean records are different from the ones without — and the difference is visible in the first two weeks of DD.”
— Brazilian Crypto M&A Counsel
Workstream 7 — Customer Base and Brand
- Active customer count, churn cohorts, ARPU evolution
- Customer geography distribution within Brazil
- Top-100 customer concentration and individual KYC quality
- Brand assets: domain history, trademark registration (INPI), social media accounts
- SEO equity: organic traffic, ranked keywords, backlink profile
Frequently Asked Questions
What is the most important due diligence document for a Brazilian VASP acquisition?
IN 1888 monthly report receipts going back as far as the target’s compliance history allows. They are the only verifiable proof of regulatory continuity in Brazilian crypto M&A.
How long does due diligence take for a Brazilian crypto acquisition?
A focused, well-organized DD process runs 6–10 weeks for a clean target. Targets with messy records can extend DD by months and frequently abort.
What are the most common Brazil-specific DD risks?
Labor litigation, undocumented tax liabilities, banking relationship fragility, and gaps in IN 1888 reporting are the top four Brazil-specific failure modes.
Should an acquirer use Brazilian or international counsel for DD?
Both. Brazilian counsel for tax, labor, banking, and regulatory diligence; international counsel for SPA structure, escrow, indemnities, and cross-border tax planning.
Schedule an Introductory Call →
Read also: How to Acquire a VASP in Brazil: 2026 M&A Playbook