Brazil’s central bank has adopted a rule that will require regulated institutions to delay certain newly funded transfers to foreign crypto businesses or self-custody wallets while they conduct an additional fraud-risk review.
Banco Central do Brasil published Resolution BCB No. 584 on August 7. The measure takes effect on January 1, 2027, and amends the country’s existing payment-fraud controls to cover virtual-asset services.
The rule applies when an institution receives funding in reais or virtual assets and the customer then orders a virtual-asset transfer to an entity established abroad that operates in the crypto market or to a self-custody wallet. The precautionary hold is triggered when a transaction exceeds the equivalent of US$10,000, when a customer’s aggregate transfers exceed that amount in one day, or when the institution’s own risk policies call for additional review.
The central bank explicitly includes fiat-referenced virtual assets, or stablecoins, within the rule’s scope. That makes the measure directly relevant to providers using dollar-linked tokens for cross-border transfers rather than limiting it to unbacked crypto assets.
A risk-review window, not a blanket freeze
The resolution describes the 24-hour delay as precautionary and says it does not make assets permanently unavailable. After the review period, the institution must either end the hold or reject the operation.
An institution may release a transfer before the 24 hours expire, but the exception is not automatic. The decision must be reasoned and must consider at least the risk profiles of the customer, the transaction or service, the counterparty and the jurisdiction where the receiving entity is based. The decision, its basis and the criteria used must be documented.
Institutions must also tell customers when a hold has been applied and explain its precautionary nature and duration. They will be required to keep daily records of fraud and attempted fraud involving payment and virtual-asset services, including the corrective measures taken.
Resolution 584 gives the central bank escalation tools when an institution does not comply. The regulator may require a hold longer than 24 hours, apply the review process below the US$10,000 threshold or restrict the institution’s ability to release transfers early.
Operational consequences for payment providers
The regulation turns fraud review into a defined transaction state for affected crypto transfers. Providers will need controls that connect the original funding event to the subsequent outbound transfer, calculate each customer’s same-day total and identify whether the destination is a foreign provider or a self-custody wallet.
The same-day aggregation requirement is especially important. A transfer below the threshold cannot be assessed only in isolation if earlier transactions by the same customer push the daily total above the equivalent of US$10,000. Providers will also need a consistent method for calculating the currency equivalent and preserving the result in their audit trail.
The early-release provision creates a second control layer. A faster customer experience will depend on a documented risk decision rather than simply letting a timer expire. That places pressure on identity data, counterparty screening, jurisdictional risk signals and case-management systems to produce a review that can be explained later.
For customers, the practical effect will depend on how providers implement their risk policies. The rule does not say that every transfer to a foreign platform or self-custody wallet must remain pending for the full 24 hours. It sets threshold- and risk-based conditions, permits an earlier release after a documented assessment and allows rejection after review.
Stablecoin speed meets fraud controls
The central bank said the change responds to the growing use of virtual assets, including stablecoins, to move proceeds from financial fraud quickly, often abroad or into self-custody. Its approach does not prohibit those destinations. Instead, it inserts time for additional review at the point where recently received funds are about to leave a regulated provider.
For crypto payment companies entering or operating in Brazil, implementation work now has a fixed deadline. The key compliance question is not only whether a transfer crosses the monetary threshold, but whether the provider can connect funding, destination classification, customer-level aggregation, risk assessment, customer notice and the final release or rejection decision in one auditable workflow.