Mentioned in This Article
1. Itaú Unibanco crypto brokerage becomes the first formal filing
Itaú Unibanco, described as Brazil's largest private bank, has formalized its cryptocurrency trading and custody operations with the central bank, becoming the first bank in the country to do so under the new digital-asset framework. The notification was filed on Tuesday, ahead of an October 30 compliance deadline, and it covers a service that the lender has run since December 2023.
The filing matters beyond one institution. It shows how an established bank is choosing to fit an existing crypto line into the regulatory structure Brazil introduced this year, and it offers an early reference point for the other lenders and crypto firms that face the same cutoff in a matter of days.
2. What the new central bank rules require
Brazil's central bank issued Resolution 520, which took effect on February 2, to set out how companies that deal in digital assets must be authorized and supervised. The rulebook sorts firms into two broad routes. Banks and other institutions that the central bank already authorizes can use a notification process to continue offering crypto services, while dedicated virtual-asset service providers, often abbreviated as VASPs, must apply for operating authorization.
The distinction reflects the idea that an institution already under prudential supervision has a track record and a compliance structure the regulator can build on. A standalone crypto exchange or custodian has no such history, so it faces a fuller application. In both cases the aim is the same: to bring the activity inside a licensed perimeter instead of leaving it to operate in a gap between banking and securities law.
For customers, the practical meaning of this structure is a clearer answer to a basic question: who is responsible if something goes wrong. Under a licensed model, the entity holding client assets answers to a named supervisor, must keep records that can be inspected, and can be sanctioned if it fails to meet its obligations. Before such frameworks, many retail users relied on the reputation of the platform alone.
3. How the notification process works
Eligible financial institutions that were already active in crypto when the rules took effect were given 270 days to notify the regulator. Their submissions must include an independent technical certification showing that their systems and procedures comply with the framework. The requirement means a bank cannot simply declare itself ready; a third party has to attest to it.
The penalty for missing the deadline is steep. Institutions that fail to notify the central bank in time must stop providing crypto services within 30 days. For a bank with customers holding assets on its platform, that would mean winding down a product line, so the incentive to file on schedule is strong.
An independent certification is a common tool in financial regulation when a supervisor wants assurance without auditing every firm itself. The outside reviewer examines the technology, security controls and operating procedures, and the regulator then relies on that report as part of its assessment. The cost and effort involved also act as a filter, because a company that has not invested in compliance will find it hard to produce the required document in time.
4. What Itaú offers its customers
According to the bank's own website, Itaú makes 15 cryptoassets available, among them bitcoin (BTC), ether (ETH) and the dollar-pegged stablecoin USDC. The combination of trading and custody is what places the service in the brokerage category under the new rules: the bank executes purchases and sales for clients and also holds the assets on their behalf.
The lender has not disclosed how many customers use the service or how much trading volume it handles. That leaves open how large the business is relative to the bank's overall operations, although the decision to complete a formal filing ahead of the deadline indicates that it intends to keep the offering.
Custody is often the more sensitive half of that pairing. Holding digital assets means protecting the private keys that control them, and a failure in that function can result in permanent losses for clients. Regulators therefore tend to scrutinize how a custodian stores keys, segregates client holdings from its own, and recovers from technical incidents. A bank that has operated a service for nearly three years has accumulated operating experience, which it can draw on when documenting these practices.
5. Why is the timing of the filing significant?
The filing arrives just ahead of the October 30 deadline, which applies not only to banks but also to dedicated crypto providers that were already operating when the rules took effect. Those firms must have their position settled with the regulator by the same date, so the next several days are likely to bring a cluster of announcements from companies in the sector.
Being first does not confer an official approval in itself; it is a notification that the bank considers its operations compliant. Even so, an early move by the country's largest private lender signals to the market that large institutions regard the framework as workable. For smaller banks weighing whether to continue offering crypto, the example lowers the uncertainty about what a filing looks like.
There is also a competitive dimension. Brazilian banks have increasingly treated digital assets as a product that clients expect to find in their existing app, alongside savings, investment funds and foreign exchange. Completing the filing early lets Itaú tell customers that its service sits inside the regulated framework, a message that may carry weight with cautious investors who have hesitated to use unlicensed platforms.
6. How other companies are responding
Mercado Bitcoin, a Brazilian exchange, has said it is seeking authorization to operate as a virtual-asset brokerage. Its situation illustrates the second track of the framework: as a dedicated provider rather than a bank, it must go through the authorization procedure rather than the lighter notification route.
The contrast between the two paths will be one of the features to watch as the deadline passes. Banks that already hold central bank authorization can move quickly, whereas independent providers must satisfy the regulator that their governance, custody arrangements and controls meet the standard. How many ultimately receive authorization will shape which companies continue to serve Brazilian crypto users.
Authorization as a brokerage generally means the firm may execute trades for clients and arrange custody within a defined scope, subject to capital, governance and reporting expectations. For an exchange built around crypto, that status is the foundation of its Brazilian business, so the application is both a legal step and a commercial one. A refusal or long delay would limit what the company can offer local users, while approval would put it on a more equal footing with banks.
7. What changes for firms that stay outside the system
The central bank has also moved to isolate unauthorized providers from the regulated financial system. In September it pushed back to November 6 the date after which banks and other authorized institutions are barred from doing crypto-related business with providers that lack authorization. The delay gave the market additional time, but the end point is now fixed.
The practical consequence is that a crypto company without authorization could lose access to banking relationships, including the accounts and payment channels it uses to move customers' money between local currency and digital assets. For many firms, losing those links would be as disruptive as a formal ban, which is why the prospect of the November 6 cutoff adds pressure on top of the October 30 filing date.
8. Why a bank's crypto desk is a regulatory test case
Brazil has a large retail investor base and an active market for digital assets, and the central bank's framework is among the more detailed efforts by a major economy to place crypto services inside the existing financial structure. Banks are natural first movers because they already have compliance departments, auditors and a supervisory relationship, so they can demonstrate how the rules operate in practice.
For the central bank, a successful first notification also provides evidence that the process is functioning. Regulators writing new frameworks are often judged by whether the largest regulated entities can meet them without disruption, and Itaú's submission, with the independent certification it required, gives supervisors a concrete case to review.
The approach is also part of a wider global pattern. Jurisdictions from Europe to Asia have moved over recent years from tolerating crypto businesses informally to licensing them, usually starting with the requirement that firms register, prove they can protect client assets and meet anti-money-laundering obligations. Brazil's design, with a lighter path for already-supervised banks and a fuller one for newcomers, follows the same principle of matching the burden to the existing level of oversight.
9. What to watch after October 30
The next milestone is the October 30 deadline itself, when banks and already-operating providers must have notified or applied. After that, institutions that missed it have 30 days to stop their crypto services, and on November 6 the restriction on dealings with unauthorized providers takes hold.
Observers will be looking for which other large banks file, how many dedicated providers announce authorization requests, and whether the central bank publishes a list of approved participants. Itaú, for its part, has yet to share user numbers or volumes, and any disclosure from the bank about the scale of its crypto business would help gauge how significant the regulated segment has become.
Market participants will also watch whether the framework changes behavior among customers. A regulated, bank-backed channel may draw users who had avoided crypto because of concerns about platform failures, while firms that cannot qualify may see clients move to authorized rivals. The size of that shift will become clearer once the first full reporting periods under the new regime are available.