How to Check If a Crypto Exchange Is Authorised by Brazil's Central Bank

In Brazil, the authority that authorises crypto exchanges and custodians is the Banco Central do Brasil (BCB), not the CVM. A company's claim to be "regulated", a CNPJ or a local Pix key does not prove it is authorised for crypto. This guide covers the four official ways to check, and what each one can and cannot tell you in late 2026, while the first applications are still being processed.

Who Authorises Crypto Exchanges in Brazil

• Lei 14.478/2022 (art. 2) says virtual-asset service providers may operate in Brazil only with prior authorisation from the federal regulator.
• Decreto 11.563/2023 (art. 1) makes the BCB that regulator: it regulates, authorises and supervises these providers.
• The CVM keeps its powers over tokens that are securities. The law does not apply to those assets (Lei 14.478, art. 1, sole paragraph; Decreto 11.563, art. 3). So a "CVM-authorised crypto exchange" is usually the wrong question. The CVM matters for security tokens and investment offers, not for buying bitcoin.

Under Resolução BCB 520, two kinds of company may provide crypto intermediation or custody:

• a Sociedade Prestadora de Serviços de Ativos Virtuais (SPSAV);
• banks, securities and FX brokers and distributors that already hold BCB authorisation and have formally notified the BCB (arts. 20–22).

Check 1: The Company's Legal Name

An SPSAV must carry the words "Sociedade Prestadora de Serviços de Ativos Virtuais" in its legal name. Only SPSAVs may use that expression (Res. 520, art. 15, I and §1). An SPSAV must also state on its website and app which type it is: intermediária, custodiante or corretora (art. 15, III).

Look at the terms of use or the footer for the legal entity and CNPJ. If the crypto services are provided by a foreign company, it is not an SPSAV. The same applies to a local company without that expression, unless it is an authorised bank or broker.

The name alone does not prove authorisation. A company can adopt the name and apply, then still be under review.

Check 2: "Encontre Uma Instituição" and the Official List

• The BCB's Encontre uma instituição tool lets you search an authorised institution by name or CNPJ.
• The same register is published daily as open data: Relação de instituições em funcionamento no país, which includes the institution's segment.

If the company appears there, read the segment. A "Sociedade Corretora de TVM" or a bank is authorised as that type of institution. That is not automatically authorisation for crypto services.

As of 31 October 2026, the BCB's open data on authorisation processes (latest reference date 30 September 2026) shows no company authorised as an SPSAV. In practice, therefore, no crypto-only exchange can yet show a final SPSAV authorisation.

Check 3: The Authorisation-Process Data and the Transition List

Firms that were already operating had to apply by 30 October 2026 (Res. 520, art. 88, I). Those that filed on time may keep operating until the BCB decides (art. 88, §6).

The BCB publishes open authorisation processes monthly in its Processos de autorização dataset. The data comes with a lag: the October filings appear only after the 31 October reference date is released.

For this transition, the BCB moved the art. 91 ban to 6 November 2026 so that it could compile and publish an official list of institutions in transition (Voto 108/2026-BCB, para. 7). The list covers:

• SPSAVs that applied;
• eligible banks and brokers that notified the BCB.

When that list is out, it is the most direct primary source for "is my exchange in the process?".

Check 4: Red Flags the BCB Itself Lists

The BCB's financial-citizenship page on scams (Golpes) lists common patterns, such as promises of guaranteed returns and pressure to transfer quickly. Two things should make you stop:

• A platform you cannot find in any BCB source after 6 November 2026. From that date, BCB-authorised banks and payment firms are barred from enabling its operations (Res. 520, art. 91, as amended by Res. 589).
• A firm that missed the deadline. It had to stop within 30 days of it (art. 88, §7).