How to tell if a crypto broker or intermediary applied for Central Bank authorization: where to check and red flags
Ten days remain until the October 30 deadline. Before sending money, a client can check a virtual asset provider's regulatory status using what the rule itself requires it to show and the Central Bank's notices.
Historical reference: October 20, 2026. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- BCB Resolution 520 requires virtual asset providers to disclose on their website and app information about their authorization or their application for authorization with the Central Bank.
- The company name alone offers a clue: the expression Virtual Asset Service Provider (Sociedade Prestadora de Serviços de Ativos Virtuais) is reserved for these companies.
- Filing an application is not the same as holding a license. Review has two phases and can take up to three years, and from November 6 Resolution 589 bars banks from enabling operations with unauthorized providers.
- Red flags: no information, an authorization number that does not check out and pressure to pay into an individual's account.
A crypto broker says on its website that it “follows the Central Bank's rules.” The sentence proves nothing. What matters to the client is whether the company already has authorization, whether it applied and when, or whether it has done neither. Ten days remain until October 30, 2026, the end of the 270-day period for companies already operating to apply for authorization, and the check matters both for people who keep a balance and for companies that pay suppliers through an intermediary.
Filed is not authorized
Review of companies already operating has two phases, of 360 and 720 days, according to Estadão Conteúdo, and BCB Resolution 548 set 1,080 days, about three years, as the maximum period for the Central Bank to decide. That is why, for months, there will be companies that have “filed” but are not yet authorized. That is the correct term for the period, and anyone who says “authorized” about a company at this stage is giving wrong information.
Where to check, in five steps
- Read the company's regulatory page. Art. 52, § 1, I, of Resolution 520 requires the provider to disclose on its website and apps information about its authorization or its pending application with the Central Bank. Look for the application date, the category and the company's details.
- Check the company name. The expression “Sociedade Prestadora de Serviços de Ativos Virtuais” (Virtual Asset Service Provider) is reserved for these companies (art. 15), and the company must state its category: intermediary, custodian or broker. A name that suggests it is a bank or an authorized institution when it is not is a red flag.
- Verify the CNPJ (Brazilian company registration number). Check the legal name, opening date and partners with Brazil's Federal Revenue Service (Receita Federal) and compare them with what the website says. A company created weeks ago that promises million-dollar operations deserves caution.
- Consult the Central Bank. The page Encontre uma instituição (Find an institution) lists the institutions authorized, regulated or supervised by the BCB, with registration data, and the certificate service shows whether an institution is authorized and which operations it may carry out. A company that has only filed its application does not appear as authorized. For pending applications, the BCB publishes notices: in Notice 45,986, released on September 21, Onda Finance appeared as an institution in the authorization process, with the list of nominated managers and a 15-day period for objections, according to Letsmoney. The sources consulted do not point to a public BCB list of all applications filed. Banks and brokers already authorized may also provide virtual asset services (art. 20).
- Ask, and keep the answer in writing. Ask for the process number or filing date and what the company will do if the application is denied. A company with a real application answers plainly.
Information found only on the company's website is a claim. The same information in a Central Bank notice, or in a press report based on one, is a confirmation. Use both before sending money.
Red flags
| Sign | Why it matters |
|---|---|
| No information about authorization or an application on the website | The rule requires disclosure. Silence means non-compliance or no application |
| Says “authorized by the BCB” without a number, date or notice | Authorization is a verifiable act of the Central Bank, not a quality |
| Uses only a license from another country as its credential | A foreign license does not replace authorization to operate in Brazil |
| Asks for payment into an individual's or a third party's account | Out of line with a provider that segregates client funds |
| Promises a fixed return, guaranteed timing or no risk | Promising returns is a hallmark of scams; virtual assets are not covered by the FGC, Brazil's deposit guarantee fund |
| Pushes for a quick decision or for contact outside the official channel | Urgency is a classic social engineering technique |
| Contact by message from someone claiming to be “support” or a “recovery agent” | This is the fake support pattern described in the fake support and fake crypto recovery scam |
What changes on November 6
BCB Resolution 589 rewrote art. 91 of Resolution 520: from November 6, 2026, banks, payment institutions and other authorized institutions may not carry out or enable virtual asset market operations with providers that are not authorized to operate in the country. The new wording dropped the exception for those “in the authorization process,” which was in the original text. By the letter of the rule, a company that has only filed its application is not yet authorized and falls within the ban, except in the ways expressly permitted in Resolution 520, although art. 88 still allows it to provide the service until the decision. How banks will apply the rule is not detailed in the sources consulted. The text is in BCB Resolution 589: banks and unauthorized providers.
Anyone deciding where to keep a balance or how to pay a supplier should factor this risk in. What happened with platforms that announced their exit is in Coinext, NovaDAX and Digitra.com end retail crypto.
Frequently asked questions
How can I tell if a crypto broker is authorized by the Central Bank?
Read the company's regulatory page, which must state its authorization or its application for authorization (art. 52 of BCB Resolution 520), check the company name and CNPJ, and look the company up in the Central Bank's Find an institution tool and in the BCB's notices. Be wary of anyone who claims to be authorized without giving details that can be verified.
What is the difference between a filed application and an authorized company?
Filed means the Central Bank received the application and review is under way. A company that filed within the deadline may keep the service until the decision, but it is only authorized after the Central Bank rules in its favor. Review has two phases and can take up to three years.
What happens if the broker did not apply for authorization by October 30?
A company that was already operating and did not file by the deadline must stop virtual asset services within 30 days, under art. 88 of BCB Resolution 520. In addition, from November 6, banks and payment institutions are barred from enabling operations with unauthorized providers.
Can I rely only on the seal or compliance statement on the website?
No. Seals, generic statements and screenshots of documents do not replace verification. Look for the specific detail, such as the category, the application date or the Central Bank notice, and confirm it through a second channel.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- Resolução BCB nº 520, de 10 de novembro de 2025 (arts. 15, 20, 52, 88 e 91) · Banco Central do Brasil, Nov 10, 2025
- Resolução BCB nº 589, de 23 de setembro de 2026 · Banco Central do Brasil, Sep 23, 2026
- Resolução BCB nº 548, de 19 de fevereiro de 2026 (prazos máximos de decisão) · Banco Central do Brasil, Feb 19, 2026
- Encontre uma instituição regulada/supervisionada pelo BC · Banco Central do Brasil
- BC fixa prazo máximo de 3 anos para autorizar exchanges de criptomoedas · InfoMoney, com Estadão Conteúdo, Feb 20, 2026
- Banco Central revela primeira empresa cripto em processo de autorização no Brasil · InvestNews, Sep 22, 2026
- BC revela 1ª empresa cripto em processo de autorização · Letsmoney, Sep 22, 2026
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
