At midnight this Monday, May 4, 2026, the most controversial part of the Central Bank's new regulatory framework on crypto came into force: mandatory monthly reporting of every foreign exchange operation with virtual assets — including those involving self-custodial wallets. The rule is in Annex II-A of BCB Resolution No. 521/2025, integrated into BCB Resolution No. 277. And it is already being questioned legally as the regulatory act that most advances on individual patrimonial privacy since the Banking Secrecy Law.
In practical terms, any Brazilian who enters a Brazilian exchange in the coming weeks to buy, sell, or transfer crypto linked to an international operation will begin to notice some things: more form fields, slowness in withdrawals and deposits, requirement to declare the purpose of the operation, and a new request — to inform the real owner of the self-custodial wallet on the other end. It's not a suggestion. It's an obligation of the service provider (PSAV), which passes the burden up to the PSAV of getting that information from the customer.
The angle nobody said out loud: the technical obligation is on the exchange. The practical obligation is on you. If you want to keep operating, you need to collaborate with the disclosure. If you don't want to disclose, you lose the rail.
What changes in practice starting today
The block of changes that comes into force today covers four categories of operations that are now treated as foreign exchange, under Law 14,286/2021 (New Foreign Exchange Framework):
- International payments or transfers with cryptoassets (from Brazilian customer to counterparty abroad, or vice versa).
- Transfers of virtual assets used to settle credit card obligations or other international payment methods.
- Movements to or from self-custodial wallets (Ledger, MetaMask, Phantom, Trust Wallet, Trezor, any wallet where the user holds the private key).
- Purchase, sale, or exchange of virtual assets referenced in fiat currency — typical case of stablecoins (USDT, USDC, EURC, etc.).
For each of these operations, the PSAV needs to collect from the customer, at the moment of the transaction, the following minimum set of information:
- Purpose of the operation, classified by standardized code (the purpose table is the same used for traditional foreign exchange in BCB Resolution 277, now extended to crypto via Annex II-A).
- Complete identification of the payer or payee abroad: name, document, country of tax residence, relationship with the customer.
- Country of origin or destination of the funds.
- Where applicable, identification of the owner of the self-custodial wallet involved in the operation — even if that wallet belongs to the customer themselves.
- Value in national currency and in reference foreign currency.
Reporting is monthly, with a deadline until the 5th of the following month. Companies authorized to operate in the foreign exchange market already have to send this information via Annex II-A of Resolution 277, now with expanded scope to include the entire virtual assets ecosystem. The prospective analysis we published 10 days ago already anticipated this structure. But it only becomes reality now.
The immediate effect at the counter: more fields in exchanges' checkout, more documents required at withdrawals, more delay between the request and approval. Companies like Mercado Bitcoin, Binance, Foxbit, and Coinbase Brasil are in the process of adapting. Foxbit has already confirmed it is in the authorization phase as a PSAV with the BCB. The others are on the same path — all have 270 days from February 2 to file an authorization request. This deadline expires on October 31, 2026.
Annex II-A: the technical detail that became a constitutional bomb
The most sensitive point of the new regime is not the obligation to report the operation itself — foreign exchange was always reported. It's who needs to have their name reported. Annex II-A requires that the PSAV inform the Central Bank, in each operation involving a self-custodial wallet, the identity of that wallet's owner. When the wallet belongs to the customer themselves, easy — the customer is already identified by the PSAV's KYC. When the wallet belongs to a third party — a friend, partner, supplier, OTC partner — the exchange has to get that information from the customer before processing the order.
That's where the constitutional problem lies. The regulatory obligation falls on the PSAV. But the practical obligation to reveal the owner falls on the user, who needs to deliver personal and patrimonial data of a third party as a condition to perform a lawful operation with their own money. In January 2026, jurists began publicly pointing out that this mechanism constitutes an indirect wealth disclosure — the State obtains, via infra-legal regulation, data it could not directly demand without formal law.
The legal arguments already in circulation, organized:
- Material unconstitutionality: violation of fundamental rights to privacy (art. 5, X, CF), data secrecy (art. 5, XII, CF), and patrimonial autonomy of self-custody asset holders.
- Formal unconstitutionality: excess of regulatory power — the Central Bank does not have legal competence to impose obligations of this intensity without formal law authorizing it. Qualified legal reserve requires Congress law, not administrative resolution.
- Centralization of sensitive data: the Central Bank gains a nominative database linking individuals to self-custodial wallets, with concrete risk of sharing via administrative cooperation with the Federal Revenue Service, COAF, and Federal Police.
- Possibility of ADI: due to the general and autonomous character of the act, Resolution 521 and its Annex II-A are, in theory, susceptible to concentrated constitutional control in the STF via Direct Action of Unconstitutionality.
In practice, what will probably happen: industry associations (ABCripto, ABCD, Parliamentary Front) will begin to articulate entitled parties to file ADI in coming months. In parallel, individual writs of mandamus from individuals trying to exempt themselves from the obligation to reveal a third party's wallet owner will start to appear. The STF will need to define, at some point, the limit between foreign exchange regulation (constitutionally robust) and individual patrimonial monitoring (under strict legal reserve).
It's not the first time Brazil tests this border. Complementary Law 105/2001 — which regulates banking secrecy — went through decades of litigation until the STF concluded, in 2016, that the sharing of bank data between a financial institution and the Federal Revenue Service without judicial authorization was constitutional. The parallel with crypto is direct, but not identical: Resolution 521 goes further, by requiring that the self-custody wallet holder deliver data before any foreign exchange operation materializes. It's preventive, not reactive. This preventive character is the Achilles heel of the unconstitutionality argument.
Market concentration: who survives until November
The second predictable effect of the new regime is structural: market concentration. Resolution 521 and its sister resolutions 519 and 520 raise the compliance level to traditional banking standards — customer patrimonial segregation, technical certification, risk governance, minimum capital, audit, standardized monthly reporting. The big Brazilian and international players with resources to hire top-tier compliance will cross the gate. The small and medium-sized ones won't.
The schedule is tight. Anyone operating in Brazil today — Binance, Mercado Bitcoin, Foxbit, Bybit, BingX, MEXC, Coinbase Brasil, Bitso, NovaDAX, Ripio, and dozens of smaller exchanges — has until October 31, 2026 to file a formal authorization request as a PSAV. Anyone who hasn't filed by that date becomes an irregular operation and is subject to administrative penalties, fines, and shutdown.
The estimated cost of adaptation for a medium-sized exchange ranges between R$ 5 million and R$ 20 million in systems, compliance team, and audit — before becoming an authorized PSAV. For exchanges with less than R$ 100 million in monthly volume, that cost is prohibitive. The probable result by the end of 2026:
- 3 to 5 large exchanges authorized as PSAVs, dominating retail (Mercado Bitcoin, Binance Brasil, Foxbit, possibly Bitso and NovaDAX).
- Exit from the Brazilian market of smaller international exchanges that don't see ROI in creating a local authorized entity (BingX, MEXC, and several others tend to transfer customers to offshore structure).
- Migration of OTC and P2P outside the regulated perimeter — probably to USDT accounts on offshore exchanges, Lightning Bitcoin, and pure decentralized protocols.
It's the same trajectory that happened in Europe after MiCA: the CASP license became mandatory and the result was concentration among players with the balance sheet to bear compliance. Brazil in 2026 is repeating the EU script from 2025, with 6 to 12 months of lag.
What changes for Brazilian retail investors
For those who only buy crypto through an exchange, pay in reais, keep it there, and sometimes sell — almost nothing changes in the very short term, except slight additional friction in withdrawals.
For those who use crypto as an international payment rail — freelancer receiving from abroad, importer paying foreign supplier in USDT, Brazilian living in self-custodial wallet and moving between domestic and international exchanges — everything changes:
- Purchase of USDT to send abroad (typical reverse-freelancer case): the exchange now asks for purpose ("foreign supplier payment", "personal transfer", "investment", etc.), CPF/CNPJ of the counterparty if identifiable, and destination country. Operation falls under foreign exchange purpose code.
- Receipt of USDT in own wallet from foreign client: when trying to convert it to reais in a Brazilian exchange, the exchange will ask for source, purpose, identification of sender. If you can't prove it, the operation may be blocked or reported as a "suspicious operation".
- Transfer between personal Ledger and Brazilian exchange: reportable, with identification of Ledger owner (you yourself, so easy — as long as it's your wallet under your CPF).
- Transfer to third-party wallet (payment, donation, investment): exchange will require identification of recipient. If it's a partner without exchange registration, you need to convince them to provide CPF/passport to proceed, or the operation won't go through.
The type of operation most impacted is OTC P2P — those buying USDT on third-party accounts to escape the exchange. This market was already gray; now it gets grayer, because the regulated counterparty (the Brazilian exchange at the exit/entry point of reais) will demand everything. And Brazil's recent history of personal data breaches gives the user legitimate reason to worry about the centralization of these registries.
The good news for pure retail: the domestic side of Brazil's regulatory regime is, ironically, among the most advanced in the world. The integration of USDC into PIX already allows real/dollar conversion in real time within the regulated banking system. B3 launched a tokenized real stablecoin. PL 4,308 prepares legal ground for private tokenized real to coexist with Selic and compete against USDT in yield. The Brazilian who accepts operating within the authorized perimeter has competitive rails. Whoever wants to stay outside pays the price of legal uncertainty.
International comparison: Brazil accelerates faster than EU and US
To contextualize Brazilian speed, it's worth comparing with the two major regulatory regimes in maturation:
- EU (MiCA): reporting of stablecoin operations to the competent authority of the member state, with similar KYC and purpose requirements. But does not require identification of self-custodial wallet owner of the counterparty — topic explicitly excluded from parliamentary debate in 2024.
- US (GENIUS Act + FinCEN/OFAC): the joint rule published in April creates federal supervision over stablecoin issuers, but targets the issuer, not the holder. Self-custody remains, in theory, outside the reportable scope (in practice, there is a mechanism via Travel Rule and BSA, but with more procedural safeguards).
- Brazil (Resolutions 519/520/521 + 561): covers the issuer (PSAV), covers the self-custodial wallet holder via PSAV, covers stablecoin in foreign exchange (and bans stablecoin in eFX from October). It's the most granular regime of the three.
Brazil, in other words, chose a supervision approach deeper than the main global regimes. This can be a virtue (protection against tax evasion and laundering) or a vice (regulatory cost that stifles innovation) — depends on the outcome of constitutional challenges that will start appearing in the STF.
The ON3X perspective
Three takeaways from the day Brazilian crypto foreign exchange supervision goes live:
- Annex II-A is a legal bet by the Central Bank. The qualified legal reserve for restrictions on fundamental rights is solid ground in STF jurisprudence. The BCB knows this. It's betting that: (a) no one will file ADI soon, (b) if they do, the STF takes time, (c) in the meantime, the infrastructure for data collection consolidates, and (d) when judgment comes, it's unlikely the STF will require return of what was already reported. It's a reasonable probability calculation. But from the perspective of the self-custody wallet holder, it's prudent to keep reporting — or stay outside the regulated perimeter, if that's your patrimonial choice. There's no third way in the short term.
- Concentration is not an implementation flaw. It's a feature. The regulatory regime that comes into force today presupposes — and induces — market concentration among half a dozen authorized PSAVs. This is not by accident. Central banks prefer to supervise ten authorized institutions rather than a thousand informal intermediaries. B3 launching its own stablecoin, PIX integrating USDC, and the BCB dictating who can do crypto foreign exchange are part of the same institutional design: recentralization of financial infrastructure under direct supervision. Whoever understands this logic stops treating regulation as an avoidable cost and starts treating it as a competitive environment in which incumbents win.
- Brazilian OTC and P2P will survive, but will migrate. Balcão and P2P market in USDT keep existing in places where regulation doesn't reach — offshore wallets, exchanges without Brazilian entity, closed Telegram communities. There will be erosion of tax compliance and growth of parallel market, exactly as the attempt against foreign exchange remittance via cable dollar taught in past decades. The difference is that now the BCB has a new tool: the possibility of coordination with Tether/Circle to freeze wallets flagged as suspicious. If the BCB starts using that channel — and there's no reason to believe it won't — the Brazilian parallel market becomes much more risky for participants. The "anonymity" of USDT is zero when the issuer cooperates with States.
Brazil, on May 4, 2026, became one of four countries in the world with granular supervision over crypto foreign exchange at national scale. It's no longer a regulatory promise — it's an active regime. Whoever operates needs to understand the design. Whoever doesn't will discover, at some point in the next 18 months, that non-compliance got expensive.
Frequently Asked Questions about Day D of Resolution 521
What exactly changes on May 4, 2026?
The monthly obligation comes into force for virtual asset service providers (PSAVs) to report to the Central Bank, via Annex II-A of Resolution 277, all foreign exchange operations with crypto: international payments, credit card settlement, movements to/from self-custodial wallets, and trading of fiat-referenced stablecoins. Monthly reporting is delivered by the 5th of the following month.
Will withdrawals and deposits of crypto be delayed?
Probably yes, especially in operations involving counterparties abroad or movement to self-custodial wallets of third parties. Exchanges now need to collect operation purpose, complete counterparty identification, and country of origin/destination before processing. Delay depends on operation complexity and exchange maturity — large players (Mercado Bitcoin, Binance, Foxbit) have the team for this; smaller ones may take longer.
Will I be forced to reveal who owns a third party's wallet to make a transfer?
Yes, if the operation characterizes foreign exchange (international involvement, card, fiat-referenced stablecoin). The exchange will ask for CPF/CNPJ or passport of the counterparty as a condition to process. This specific point is what motivates the unconstitutionality arguments for Annex II-A — it's where the PSAV's technical obligation becomes the user's practical obligation, without formal law authorizing.
Are wallets like Ledger and MetaMask now "under supervision"?
Not directly. Ledger or MetaMask itself has no obligation. But any interaction of these wallets with a Brazilian PSAV (when depositing, withdrawing, or converting) generates the PSAV's reporting obligation to the BCB, with identification of the wallet owner. Wallets that never touch a regulated Brazilian exchange remain outside the direct reporting perimeter — but are subject to other rules (Federal Revenue Service, COAF) in cases of transactional use.
Can the STF strike down Annex II-A?
There are relevant legal grounds for challenge, especially regarding qualified legal reserve. But the procedural path via Direct Action of Unconstitutionality typically takes 3 to 5 years in the STF, and does not automatically suspend the norm's validity. Individual writs of mandamus can bring faster decisions in specific cases. The base scenario is: regime continues in force while the matter is debated judicially.
For those who only use Brazilian exchanges to buy and sell crypto, does much change?
Little in the very short term, except slight additional friction in withdrawals and more declaration fields. Impact is greater for those who use crypto as an international payment rail, receive from abroad, pay suppliers there, or move between Brazilian exchange and self-custodial wallet for third parties.
Will international exchanges like BingX, MEXC, Bybit exit Brazil?
Those that don't create a local entity authorized as PSAV by October 31, 2026 will no longer be able to legally offer services to Brazilian customers. Some will file for authorization (Binance and Bybit already signaled); others will prefer to migrate customers to offshore structure and lose the regulated Brazilian market. Expected consolidation leaves 3 to 5 large authorized players.