Hold-up: Brazil's central bank orders a 24-hour delay on outbound crypto transfers

The Banco Central do Brasil (BCB) has published rule requiring virtual asset service providers (VASPs) in Brazil to hold-up certain crypto transfers for up to 24 hours before they execute the transfer. It amends an earlier Resolução BCB nº 142, the BCB's existing fraud-prevention rule for payment services, and brings VASPs directly within that rule for the first time. The BCB states the change targets the fast movement of funds obtained through financial scams. The rule takes effect on 1 January 2027.

What the rule covers

The hold applies to transfers of virtual assets, including stablecoins, under Brazil's Marco Legal dos Criptoativos (Law 14.478/2023). It captures two types of transfers out: those to an entity established abroad that operates in the virtual asset market, and those to a self-custody wallet controlled by the client of the VASP. The clock starts when the VASP receives the client's funding deposit into the wallet, in reais or in virtual assets.

Who must comply

The rule applies to VASPs already authorised by the BCB, and to VASPs still working through the authorisation process set up under Resolução BCB nº 520/2025, the November 2025 instrument that created Brazil's VASP licensing regime. From 30 October 2026, separately, authorised financial institutions will be restricted from dealing with a VASP that has not obtained or applied for authorisation in Brazil .

The 24-hour hold

VASPs within scope of the rule must:-

• hold transfer above US$10,000, whether this is in one transaction or as several transactions for the same client on the same day, effectively placing a ceiling on instant withdrawals;

• apply the same hold to a smaller transfer where the VASP's own risk controls flag a need for further review based on their AML/CTF Policy;

• assess that risk by reference to the client, the transaction, the counterparty, and the jurisdiction of the destination entity;

• release a transfer before the 24 hours end only on a documented, reasoned decision, based on the risk criteria set out (which VASPs are not likely to do);

• notify the client when a hold applies, and state clearly that the hold is precautionary and give the applicable time frame; and

• keep daily records of fraud and attempted fraud connected to payment and virtual asset services, and of any corrective steps taken.

  
  

Centralized Penalties

Where the BCB finds a VASP has not complied with the rule, it can direct that VASP, or a group of VASPs, must apply a longer hold hold payments below the US$10,000 threshold, or stop using the early-release option. These directions apply only to VASPs found to be non-compliant.

How has the industry responded?

Regina Pedroso, Executive Director of ABToken (translated from the original Portuguese), in comments to Cointelegraph Brasil.

The expansion of these rules represents a setback for the development of Brazil's virtual asset market. Combating fraud and money laundering is a legitimate and shared objective across the sector, but the imposition of automatic precautionary holds, particularly on transactions involving self-custody wallets and foreign platforms, creates disproportionate barriers to the use of a technology designed precisely to expand efficiency, autonomy and financial inclusion.

These are valid points, part of the benefit of crypto payments is their speed, and introducing friction into payments, particularly where a user is transferring funds to their own self-custody wallet, will impose significant costs on VASPs and create confusion with customers.

What VASPs must do now

VASPs operating in Brazil, and VASPs elsewhere that handle transfers to or from Brazilian clients or counterparties, should:

• map transfer flows to identify when a transaction is inbound to a self-custody wallet or an entity established abroad, and therefore falls within scope of the rule

• build the 24-hour hold, and the same-day transaction aggregation check for the US$10,000 threshold, into transaction-monitoring systems ahead of 1 January 2027

• set clear internal risk criteria for early release, and build a process to document each reasoned decision made under those criteria

• update customer communications so that a hold, once applied, is disclosed to the client with a clear statement of its precautionary nature and time frame

• align fraud and attempted-fraud record-keeping with a daily standard, pending further BCB guidance on the frequency and content of these records

• confirm authorisation status, or progress in the authorisation process, under Resolução BCB nº 520/2025 before 30 October 2026

Brazil's approach differs from the travel rule model used elsewhere in the world, including the Cayman Islands, Australia and under the EU's proposed framework. VASPs collect and pass on payer and payee information with a transfer under the travel rule and EU framework, rather than delay it. Brazil's time-based hold on top of existing due diligence duties seems a heavy handed move and places quite a burden on industry.

Whether this makes any difference to fraud rather than legitimate transfers remains to be seen but it may encourage more self-custody of crypto as users could be concerned at delays at being paid by exchanges.

By Michael Bacina