Brazil is about to start watching the exits. From October 1, every regulated crypto firm in the country will have to flag transfers of $10,000 or more that move between its platform and a self-custody wallet, sending a report to Coaf, Brazil’s financial intelligence unit. The Central Bank of Brazil set the requirement in Resolution BCB 588, published in late September as part of a new anti-money-laundering and counter-terrorist-financing package for virtual asset service providers.
The rule doesn’t cap anything. Brazilians can still hold crypto in wallets where they control their own keys, and they can still move more than $10,000 in or out. What changes is visibility: a transfer that previously left a regulated exchange with no special flag will now generate a report to the state within a day.
How the reporting works
The trigger runs in both directions. A $12,000 withdrawal from a Brazilian exchange into a customer’s hardware wallet must be reported. So must a qualifying deposit coming the other way, from a self-hosted wallet into a regulated platform. Providers are expected to file by the next business day after the transaction.
The obligation sits entirely with institutions supervised by the central bank. Individual wallet holders take on no new filing duties under Resolution 588, and the rule creates no new tax, fee or transaction limit. Unlike another part of Brazil’s framework (more on that below), the reporting resolution does not include same-day aggregation language, so the automatic trigger is tied to the size of the individual transfer.
The $10,000 figure is not arbitrary. It mirrors the threshold already applied to physical foreign-currency transactions, which puts self-custody crypto movements on the same footing as a traveler carrying dollars across a border.
The central bank was blunt about its motive. It described self-custody wallets as an information gap, saying they “can reduce the availability of information for monitoring and risk assessment purposes,” in contrast to assets held by an institution the central bank has authorized.
Related: White House Blames Big Banks for Sinking Crypto's Clarity Act
A second, stricter rule arrives in January
Reporting is only the first layer. A separate, earlier measure, Resolution BCB 584, takes effect on January 1, 2027, and goes a step further. It lets providers impose a precautionary hold of up to 24 hours on transfers above $10,000 that are headed to self-custody wallets or to foreign virtual asset providers.
That rule is built differently. Its threshold can be met by a single transaction or by a customer’s aggregate activity over the same day, closing the obvious workaround of splitting a large withdrawal into smaller pieces. Providers can release funds before the 24 hours are up once they complete a documented risk assessment, and they are allowed to apply heightened scrutiny to smaller transfers when they suspect fraud.
Put the two together and the direction is clear. Starting next week, large movements to self-custody get reported. From January, they can also be paused.
Who the rules squeeze
A companion measure, Resolution 589, bars licensed providers from dealing with unlicensed virtual asset service providers, including foreign exchanges and peer-to-peer desks that lack central bank authorization. That matters in a market where most operators have yet to secure a license. Roughly 120 crypto providers operate in Brazil, but only five had applied for central bank licensing at last count, and one application has already been denied. Minimum capital requirements range from R$10.8 million to R$37.2 million, a bar many smaller firms will struggle to clear.
The regulations also land in one of the world’s most active crypto markets. Brazil climbed to fifth in global crypto adoption rankings in 2025, up from tenth a year earlier, and stablecoins account for the large majority of declared transaction volume, according to data from the country’s tax authority. Stablecoins are covered by the new framework. That puts the dollar-pegged tokens many Brazilians use for payments and remittances squarely inside the reporting net, even as big tech is gearing up to push stablecoins further into mainstream payments.
The Receita Federal has been tightening its own grip in parallel. Its DeCripto monthly reporting system, which began rolling out in July, is designed to align Brazil with the OECD’s Crypto-Asset Reporting Framework, enabling automatic cross-border exchange of crypto tax data. Coaf reporting on self-custody flows adds an anti-money-laundering lens on top of that tax lens.
Part of a global squeeze on self-custody gaps
Brazil’s approach reflects a broader pattern. Regulators increasingly accept that they can’t police self-hosted wallets directly, so they focus on the regulated on-ramps and off-ramps where identity is already known. Enforcement agencies have leaned on exchange data in a string of recent cases, from pig-butchering laundering prosecutions to sanctions probes targeting major exchanges, and Brazil’s rules effectively formalize that choke point.
For privacy advocates, the concern is less the report itself than the precedent. A flagged withdrawal to one’s own wallet now sits in a financial intelligence database, and from January it can also be held. For compliance teams, the immediate task is operational: they have days, not months, to wire next-business-day Coaf reporting into their withdrawal and deposit flows before October 1.
FAQ
Does Brazil’s new rule ban self-custody wallets?
No. Resolution BCB 588 is a reporting trigger only, so Brazilians can still hold crypto in self-custody and move amounts above $10,000.
Do individual crypto holders in Brazil have to file anything?
No. The obligation falls on regulated crypto service providers, which must report qualifying transfers to Coaf by the next business day.
When can Brazilian exchanges hold a crypto withdrawal for 24 hours?
From January 1, 2027, under Resolution BCB 584, providers may hold transfers above $10,000 bound for self-custody wallets or foreign providers for up to 24 hours, releasing them earlier after a documented risk assessment.
