Brazil’s central bank will require crypto platforms to hold certain outbound transfers for up to 24 hours before executing them. BCB Resolution No. 584, approved by the Banco Central do Brasil’s board on August 6, 2026, and published the next day, applies to virtual asset service providers (VASPs) operating in Brazil and takes effect on January 1, 2027. The central bank’s rationale is explicit: crypto assets, and stablecoins in particular, are being used to move the proceeds of scams before victims or their banks can recover them.
How the hold works
- Threshold. The hold applies to transfers worth more than the equivalent of US$10,000, measured either per transaction or as the total of transactions made on the same day in the same customer’s name.
- Destinations. It covers transfers to entities incorporated abroad that operate in virtual assets, and transfers to self-hosted wallets, which sit outside any regulated intermediary.
- Duration. The hold lasts 24 hours at most. The provider may release the transfer earlier if its review finds no sign of wrongdoing.
- Documented decisions. An early release requires a reasoned decision based on the risk profile of the customer, the transaction, the counterparty, and the destination jurisdiction, and the decision must be documented. Once the review is complete, the provider either lifts the hold or rejects the transfer.
- Customer notice. The provider must tell the customer that the transfer is on hold, that the measure is precautionary, and how long it lasts.
- Below the threshold. A transfer under US$10,000 can also be held when the provider’s own risk management framework calls for a review.
The scope is broad. The rule covers all virtual assets, including bitcoin and ether, not only stablecoins. That sets it apart from proposals debated in Brazil’s Congress, which targeted stablecoins alone. The central bank can also impose a longer hold, or apply it to smaller transfers, on any institution found not to comply.
Instant payments shrank the window to stop stolen funds
Few markets have adopted account-to-account payments as quickly as Brazil, where they grew up around Pix, the central bank’s instant payment system. Every regulator knows the trade-off: the faster and more irrevocable settlement becomes, the sooner the window for blocking stolen funds closes. A fraudulent instant transfer, converted into a stablecoin and sent to a self-hosted wallet, can be beyond the authorities’ reach within minutes.
Resolution No. 584 targets the exit rather than the payment itself. It adds friction at the last regulated link in the chain, the exchange, at the moment value leaves the jurisdiction. The design is deliberate. Rather than piling checks onto onboarding and deposits, where they would degrade the experience of millions of legitimate users, the regulator concentrates them on a narrow, high-risk flow.
The latest in a string of crypto rules
| Scenario | Treatment |
|---|---|
| A US$15,000 transfer to a foreign exchange | Held for up to 24 hours; early release possible after a documented review |
| Three US$4,000 transfers on the same day by the same customer | US$12,000 in total: the hold applies |
| A US$2,000 transfer the platform considers risky | Can be held under the provider’s internal risk management framework |
| Buying and holding crypto on a Brazilian platform | Out of scope: the rule covers outbound transfers only |
The industry questions the balance of the rule. Regina Pedroso, president of the Brazilian tokenization association Abtoken, argues that it will raise costs for legitimate users and weaken domestic exchanges against their foreign rivals. The argument is a familiar one: any friction imposed on a regulated intermediary widens the gap with unregulated ones.
Three takeaways for European payment firms
- Delay is a compliance tool again. After years of compressing settlement times, several regulators are bringing back targeted verification windows, as the EU did with the payee verification it now requires on credit transfers.
- Checks are moving to the exit. Onboarding checks are now joined by a review at the moment value leaves the regulated system.
- Self-hosted wallets are a risk factor in their own right. Brazil treats them as destinations that warrant closer scrutiny, on the same footing as a platform based outside the country.
Brazilian platforms now have nearly five months to build a review that can separate a legitimate transfer from scam proceeds in under 24 hours, and document the call. European payment institutions already do this work on suspicious credit transfers. Brazil is extending it to a rail its rules did not cover.