KYC for Crypto Exchanges in Brazil: The Banco Central VASP Rules

Introduction

Crypto exchanges serving Brazilian customers now operate under the Banco Central do Brasil (Brazil's central bank). Since February 2, 2026, its rules for virtual asset service providers (VASPs) require authorization, anti-money laundering controls and customer identification, the same family of duties that applies to banks and payment companies. For KYC, that means every Brazilian customer has to be identified by their CPF (Brazil's individual taxpayer ID), verified, monitored and kept on record.

This guide summarizes what the rules say about KYC, what changes for foreign platforms, and how a Brazilian crypto onboarding flow is usually built. It is a practical overview, not legal advice: confirm your obligations with Brazilian counsel, because these rules are new and have already been amended.

The legal framework in three layers

The law: 14,478/2022

Law 14,478/2022 is Brazil's legal framework for virtual assets. It defines virtual asset service providers, requires them to be authorized by a federal regulator, and brings them under Brazil's anti-money laundering law. A 2023 decree named the Banco Central do Brasil as that regulator.

The Central Bank resolutions (November 2025)

On November 10, 2025, the Central Bank published three resolutions, in force since February 2, 2026:

Resolution 520 creates three types of VASP (intermediaries, custodians and brokers) and requires each to have a director responsible for anti-money laundering and counter-terrorist financing.

The AML rules

Resolution 520 does not write a new KYC rulebook. It tells VASPs to follow the specific AML/CFT regulation, which for institutions authorized by the Central Bank is Circular 3,978/2020: customer identification and qualification, a risk-based approach, transaction monitoring and suspicious activity reports to COAF, Brazil's financial intelligence unit. Transaction records have to be kept for at least five years.

What the rules mean for foreign exchanges

Resolution 520 defines operating in Brazil as being incorporated in Brazil, with headquarters and management in the country. In practice, a foreign exchange that wants to serve Brazilian customers needs a Brazilian entity that is authorized, or has applied for authorization, or has to work through one.

Companies that were already operating when the rules took effect had 270 days to apply for authorization, and while the application is under review they must send customer and balance information to the Central Bank. If you are a foreign platform still serving Brazilian users without a local entity, this is a question for counsel, not for your KYC vendor.

The travel rule

Resolution 520 also brings the travel rule to Brazil. When a VASP transfers virtual assets, it must send the receiving institution data about:

• The originator: name, account or wallet identification, address, and the CPF or CNPJ (Brazil's company taxpayer ID), or an equivalent foreign ID for people who do not have one.
• The beneficiary: name and account or wallet identification.

Implementation runs in two stages: first between VASPs in Brazil, then for transfers with entities abroad. Until each stage is in place, VASPs may rely on customer self-declarations and risk-based analysis, and the full rule is mandatory for all authorized VASPs from February 2, 2028.

The consequence for KYC is direct: if the CPF on file is wrong, every transfer you send carries wrong originator data.

What a Brazilian crypto KYC flow looks like

The rules set outcomes, not a checklist of screens. Most exchanges serving Brazil build onboarding in layers, escalating with risk:

Steps 2 to 4 are where most identity fraud is stopped. A borrowed CPF usually fails the name or date of birth match. A deceased person's CPF fails the status check. A stolen identity with correct data fails the selfie.

How CPFHub.io fits

CPFHub.io covers steps 2 to 4 with one API key:

• Simple Lookup (GET /cpf/{cpf}) returns the holder's name, gender and date of birth for comparison with what the user typed. A CPF that is not found returns 404 and does not use a credit.
• Real-Time Lookup (POST /cpf/realtime) returns the registration status at the Receita Federal (Brazil's federal tax authority), the year of death when there is one, and the proof issued by the Receita Federal, which is useful for your audit trail. It requires the CPF and the date of birth. See the Real-Time Lookup.
• Identity Verification runs liveness, face match between selfie and document, and document reading for the RG, CNH (driver's license) and passport.

A signup check on your backend:

curl --max-time 10 \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  https://api.cpfhub.io/cpf/00000000000

And the status check before the first withdrawal:

curl --max-time 60 -X POST https://api.cpfhub.io/cpf/realtime \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"cpf": "00000000000", "birthDate": "15/06/1990"}'

Keep the API key on the server. Your app calls your own backend route, which calls the API. Fields and errors are in the documentation.

For corporate accounts, the CNPJ Lookup returns the company's registration status and partner list, the starting point for KYB.

Data protection

Identity checks on Brazilian users fall under the LGPD (Brazil's data protection law), wherever your company is based. Compliance with a legal or regulatory obligation is the usual basis for KYC data. Selfies and face matching involve biometric data, which is sensitive data under the LGPD and needs its own legal basis, such as fraud prevention in identification. Tell users what you check and why, and define how long you keep each item.

Frequently asked questions

Do crypto exchanges in Brazil have to do KYC?

Yes. Under Law 14,478/2022 and Resolution BCB 520, VASPs must follow the Central Bank's AML/CFT regulation, which requires customer identification, risk assessment, monitoring and reporting to COAF.

Can a foreign exchange serve Brazilian customers without a local entity?

The Central Bank rules define operating in Brazil as being incorporated and managed in Brazil, and require authorization. Foreign platforms typically need an authorized local entity or a local partner. Confirm your situation with Brazilian counsel.

What identity data does the travel rule require in Brazil?

For the originator: name, account or wallet identification, address and CPF or CNPJ (or an equivalent foreign ID). For the beneficiary: name and account or wallet identification. The rule phases in until February 2, 2028.

Is a CPF lookup enough for crypto KYC?

It is the base layer, not the whole flow. A CPF lookup confirms that the identity exists and matches the user. Most exchanges add the Receita Federal status, document and selfie checks, and PEP and sanctions screening according to their risk policy.

Read also

• Brazil KYC Requirements in 2026: What Foreign Companies Need to Know
• How to Verify a Brazilian CPF Number
• Brazil Identity Verification API: What Data You Can Get from a CPF
• CPF vs CNPJ: Brazil's Individual and Company Tax IDs Explained

Conclusion

Brazil's VASP rules turned crypto exchanges into regulated institutions with the same KYC expectations as other Central Bank institutions: identify every customer by CPF, verify the identity, monitor activity and share originator data on transfers. A layered flow, with a CPF lookup at signup and stronger checks before money leaves the platform, covers the identity part of that work.

Test the CPF lookups and Identity Verification with 50 free credits and no credit card at cpfhub.io.