Brazil Central Bank Demands Independent Audits for Crypto Licenses

The Central Bank of Brazil has added a new gatekeeping step for any virtual asset service provider (VASP) seeking an operating license. Under Normative Instruction No. 739, issued on Friday, applicants must now submit an independent audit from an entity registered with the Brazilian Securities and Exchange Commission (CVM) before the central bank will approve their authorization.

The requirement targets the audit itself, not just the applicant's internal controls. The bank wants a third-party “reasonable assurance report” that verifies compliance across several specific areas. This is not a one-time checkbox. The audit must assess the VASP's institutional policy, organizational structure, employee training, and internal risk assessment regarding the use of its products for money laundering and terrorism financing. It also must evaluate the company's procedures for customer due diligence, transaction monitoring, and reporting of suspicious activity.

Why the Central Bank Tightened the Screws

The regulatory push follows Operation Hidden Flow, a high-stakes operation that targeted six fintech companies moving over $5 billion irregularly. Authorities detected the use of digital assets for money laundering in those cases. The Primeiro Comando da Capital, a drug trafficking organization recently designated by the Trump Administration as Specially Designated Global Terrorists (SDGT), is suspected to be behind these operations.

According to local media, the use of cryptocurrency for illicit purposes has skyrocketed in Brazil, with criminal groups leveraging digital assets to move funds. The central bank stated that the new audit measures aim to “increase the security of decisions in authorization processes, while reinforcing the country’s alignment with international practices and standards for combating these crimes.” It also reinforced that “verification by independent audit contributes to greater transparency and reliability in the controls adopted by companies in the sector.”

The Specific Audit Requirements

The independent audit must cover five distinct areas:

• Institutional policy, organizational structure, and employee training related to anti-money laundering (AML) and counter-terrorism financing (CTF).
• Internal risk assessment regarding the use of the company’s products and services in the commission of money laundering and terrorism financing crimes.
• Know Your Customer (KYC) procedures and their effectiveness.
• Monitoring, selection, analysis, and reporting of operations and situations suspected of money laundering and the financing of terrorism and weapons of mass destruction.
• Monitoring and analysis of evidence of the occurrence or attempted occurrence of fraud and scams, plus administrative asset freezes.

The Read-Through for Crypto Exchanges and VASPs

For any exchange or VASP targeting the Brazilian market, the new rule raises the cost and timeline of entry. The audit must come from an entity registered with the CVM, which limits the pool of approved auditors. The report itself must be a “reasonable assurance” engagement, a higher standard than a simple review. This means the auditor tests the controls, not just checks that a policy document exists.

Which VASPs Are Most Exposed

Larger, already-regulated international exchanges with established compliance teams in Brazil have a head start. They likely already maintain the documentation and controls the audit will test. The burden falls hardest on smaller fintechs and startups that lack dedicated AML/CTF compliance staff. For them, the cost of hiring a CVM-registered auditor and building the required control framework could delay or block their license application entirely.