Financial Integrity Monitor

Brazil BR

Domains (D1–D6)
2
Sources
16
Role actions
8
Jurisdiction profile
Largely CompliantTier ARisk: IncreasingMixed

AML Law 9613/1998 with COAF (FIU) at its centre, coordinated via the ENCCLA inter-agency mechanism; joint FATF/GAFILAT MER (Dec 2023) found improved risk understanding and TF criminalisation but weak DNFBP supervision and unpopulated BO data.

MoreNew BCB Resolutions 519-521 (Nov 2025) create a VASP licensing regime effective Feb 2026.

Key deficiencies
  • Lawyers and several DNFBP categories remain effectively unregulated for AML/CFT/CPF purposes
  • Beneficial ownership database (REDESIM) largely unpopulated despite legal framework
  • Fintech sector historically outside Central Bank reporting/AML perimeter, exploited at scale by organised crime (PCC)
  • COAF resourcing and BO/customs-data access limitations constrain financial intelligence depth
  • Money laundering prosecution results, especially for environmental and organised-crime proceeds, lag behind risk profile
Recent developments (18m)
  • FATF/GAFILAT MER Brazil (Dec 2023) placed Brazil under enhanced follow-up; effectiveness gaps remain live in 2025-26 monitoring
  • BCB Resolutions 519, 520, 521 (Nov 2025) operationalised the 2022 Virtual Assets Law; VASP authorisation regime effective 2 Feb 2026
  • US Treasury/OFAC imposed unprecedented Global Magnitsky sanctions on sitting Supreme Court Justice Alexandre de Moraes (Jul 2025) and his wife (Sep 2025), later reversed (Dec 2025)
  • Federal Police Operations Quasar/Tank/Hidden Carbon and Hydra (Aug-Oct 2025) exposed a ~$9.6bn fuel/fintech laundering network tied to the PCC
  • Banco Master SA liquidated (Nov 2025) amid an alleged $2.4bn+ fraud, triggering Supreme Court and Federal Audit Court scrutiny of Central Bank supervision
  • OFAC designated PCC and Comando Vermelho as Transnational Terrorist Groups (SDGT/FTO) and, by mid-2026, extended designations to PCC-linked Brazilian fintech entities
Weekly brief

Lead signal

Lead Signal

Read full brief

Lead Signal

Brazil's financial integrity architecture recorded material movement this cycle across two of the seven controlled typology domains, driven by the Banco Central do Brasil's completion of a comprehensive VASP authorisation and AML framework and by the deployment of a new financial-sector choke-point against unauthorised betting operators. Resoluções BCB 519, 520 and 521, published 10 November 2025, together establish authorisation processes for entities providing virtual-asset services (Sociedades Prestadoras de Serviços de Ativos Virtuais), operational and governance requirements, and the integration of virtual-asset cross-border FX activity into Brazil's existing exchange-control regime. The rules enter into force 2 February 2026, with a 270-day grandfather window running to 30 October 2026, after which BCB-supervised institutions will be barred from dealing with unauthorised VASP counterparties. This is architecture, not incident: Brazil is building a durable supervisory perimeter around virtual-asset activity rather than reacting to a single enforcement episode, and the framework's design choices, including a phased Crypto Travel Rule running 2026 to 2028 under Resolução BCB 520 Article 89, will shape sanctions-evasion and layering typologies in the region for years.

Other Developments

Anti-Faction Law creates an account-freezing lever. Lei 15.328/2026, framed explicitly as an organised-crime countermeasure, empowers immediate freezing of funds in accounts linked to unauthorised betting operations. Three independent tier-3 outlets corroborate the instrument's number and date, though no planalto.gov.br primary text was reached this cycle, and the finding is assessed at probable confidence.

Joint tax liability extends to payment processors. Decreto 13.033/2026 and Ministério da Fazenda Portaria 1.766/2026 impose joint tax liability, under Complementary Law 224/2025 Article 6, on banks, payment institutions and payment arrangers that continue processing for unauthorised betting operators after notification. Read together with the Anti-Faction Law, this signals a structural pivot toward treating the regulated financial sector as the primary enforcement lever against illegal betting flows, correcting what would otherwise be an AML-enforcement gap in a cash- and app-intensive informal betting economy.

Standing AML/CFT baseline unchanged. Brazil's 2023 FATF mutual evaluation rated the country Compliant on ten and Largely Compliant on nineteen of forty Recommendations, and Substantially Effective on two of eleven Immediate Outcomes; Brazil remains off the FATF grey list. No plenary update to this baseline was found this cycle, and it is carried forward as standing descriptive context rather than a new finding.

Cross-Monitor Connections

The BCB's new VASP-AML architecture and the betting-sector financial choke-point both carry direct payments-monitor relevance: the same Resolução BCB 521 that folds virtual-asset FX activity into the exchange-control perimeter, and the same Decreto 13.033/Portaria 1.766 joint-liability regime, surface independently in the payments monitor's corridor and correspondent-banking analysis. The crypto monitor's stablecoin and cross-border-transfer modules track the consumer-facing detail of the same BCB resolutions from a digital-asset-market lens; this brief treats them from an architecture-and-typology-exposure perspective instead. No conflict-finance, extractive-industry, or state-capture signal was identified for Brazil this cycle.

Outlook

The most consequential near-term marker is 30 October 2026, when the BCB grandfather window closes and unauthorised VASPs lose access to BCB-supervised counterparties; this will be a natural test of whether the architecture built this cycle translates into enforceable exclusion in practice. The betting-sector financial-choke apparatus, still short on independently confirmed implementing detail from the Banco Central, is a second item to track as execution mechanics are published.

weekly_brief_draft · JID BR
Domain intelligence (D1–D6)

D1 Sanctions

Not covered

Sanctions is not yet covered for this jurisdiction in this report.

D2 Beneficial Ownership

Not covered

Beneficial Ownership is not yet covered for this jurisdiction in this report.

D3 Enabler Jurisdictions

Not covered

Enabler Jurisdictions is not yet covered for this jurisdiction in this report.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto, Digital Assets, and Financial Innovation

Crypto, Digital Assets, and Financial Innovation

Continue reading

Brazil completed a comprehensive virtual-asset authorisation and AML architecture this cycle. Resoluções BCB 519, 520 and 521, published 10 November 2025, jointly regulate the operation of Sociedades Prestadoras de Serviços de Ativos Virtuais (SPSAVs), establishing authorisation processes, operational and governance requirements, and the integration of virtual-asset cross-border FX activity, including stablecoin transactions and self-hosted-wallet operations, into Brazil's existing exchange-control regime. The rules take effect 2 February 2026, with a 270-day grandfather window running to 30 October 2026; after that date, BCB-supervised institutions will be barred from dealing with unauthorised VASP counterparties for intermediation, custody, FX, or payment-account and transaction services. This is properly read as architecture rather than incident: Brazil is not responding to a single crypto-enabled illicit-finance event but building the durable supervisory perimeter within which future typology exposure will be assessed. Sourcing this cycle rests on corroboration across ANBIMA, BDO, Notabene and a direct text mirror of Resolução 519, rather than a bcb.gov.br-hosted primary URL, and confidence is accordingly assessed as probable rather than confirmed.

A second structural element, Resolução BCB 520 Article 89, establishes a phased Crypto Travel Rule implementation running from 2026 to 2028, aligning Brazil's VASP sector with FATF Recommendation 16 equivalence over a multi-year rollout rather than a single compliance date. This phasing itself carries typology significance: a multi-year Travel Rule build-out creates a window during which layering techniques exploiting incomplete originator/beneficiary information capture remain viable, even as the underlying legal obligation is already in force in principle. A related development, an August 2026 rule reported by The Digital Banker, requires up to a 24-hour hold on virtual-asset transfers above USD 10,000 to overseas VASPs or self-custody wallets, functioning as a friction-based control against rapid cross-border layering pending fuller Travel Rule maturity.

The combination of a new authorisation gate, a phased Travel Rule, and a transfer-hold friction control represents a coherent three-part architecture rather than three unrelated rules, and its coherence is itself worth registering: enabler-jurisdiction and evasion typologies that previously found Brazil's virtual-asset sector permissive by omission now face a closing window, concentrated at the 30 October 2026 grandfather deadline. Enablement as signal cuts the other way here: the absence, until this cycle, of any comprehensive Brazilian VASP-AML perimeter was itself analytically significant, and its closure changes the calculus for any illicit-finance architecture that had been routing through unauthorised Brazilian VASPs during the earlier permissive period.

Outlook

The grandfather deadline of 30 October 2026 is the single most consequential date on the D5 horizon: it is the point at which the architecture built this cycle converts from a registration requirement into an enforceable exclusion of unauthorised counterparties from BCB-supervised dealing. Track whether a bcb.gov.br primary text becomes available to firm up confidence above probable, and whether the phased 2026-2028 Travel Rule timeline holds or slips, which would extend the layering-exposure window this brief flags above.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

AML/CTF Regime

Continue reading

Brazil's standing AML/CTF baseline is unchanged this cycle: the 2023 FATF mutual evaluation rated the country Compliant on ten and Largely Compliant on nineteen of forty Recommendations, with Substantially Effective ratings on two of eleven Immediate Outcomes, and Brazil remains off the FATF grey list. No plenary update to this rating was located this cycle, and it is carried forward as standing descriptive context against which this cycle's new development should be read.

That new development is the construction of a financial-sector choke-point specifically targeting unauthorised betting operators, assessed as an architectural rather than incidental shift. Lei 15.328/2026, the so-called Anti-Faction Law, empowers immediate freezing of funds in accounts linked to unauthorised betting operations, explicitly framed as an organised-crime countermeasure rather than a conventional AML instrument; this framing itself is analytically notable, since it routes betting-sector financial crime enforcement through an anti-organised-crime statute rather than through the standard AML/CFT reporting chain. Alongside it, Decreto 13.033/2026 and Ministério da Fazenda Portaria 1.766/2026 impose joint tax liability, grounded in Complementary Law 224/2025 Article 6, on banks, payment institutions and payment arrangers that continue processing transactions for unauthorised betting operators after formal notification. Three independent tier-3 outlets corroborate the instrument numbers and dates for both measures, though no planalto.gov.br-hosted primary text was reached for either this cycle, and both findings are assessed at probable rather than confirmed confidence.

Together these two instruments deputise the regulated financial sector as the primary enforcement mechanism against a betting-sector illicit-finance typology that would otherwise sit largely outside conventional AML/CFT reporting channels, given the sector's cash- and app-intensive character. This is a structural correction with three-pillar relevance: it is fundamentally a CTF-adjacent and AML-architecture development, using account-freezing and tax-liability levers rather than traditional STR/CTR-based detection, and it should not be under-weighted simply because it does not generate conventional suspicious-activity-report volume. Implementing detail from the Banco Central on the Anti-Faction Law's execution mechanics, originally due by 25 May 2026, has not been independently confirmed against a primary source this cycle, which leaves a live gap in understanding how the freezing power will actually be operationalised.

Outlook

The principal item to track is whether Banco Central implementing norms on Lei 15.328/2026 execution mechanics surface and can be independently confirmed, which would move both the freezing-power and joint-tax-liability findings from probable toward confirmed confidence. The unresolved beneficial-ownership gap noted in the standing tracker record, under which declaratory BO information remains treated as tax-secret pending a court order for law-enforcement or COAF access, continues to sit as a structural constraint on how effectively either new instrument can be operationalised against complex ownership structures.

Regulatory horizon
No dated horizon items this cycle. 4 items tracked without a confirmed date.
4 pending date · baseline fim-2026-07-09
Role action cards
MLROHigh

Brazil deploys a new financial-choke apparatus against unauthorised betting flows alongside a completed VASP-AML authorisation regime.

The Anti-Faction Law's account-freezing power and the new joint tax liability regime create fresh escalation triggers for betting-linked flows through Brazilian-facing accounts, while the BCB VASP framework's 30 October 2026 grandfather deadline changes the due-diligence posture required toward Brazilian virtual-asset counterparties ahead of that date.

4 evidence refs
ComplianceHigh

New BCB VASP authorisation regime (Res. 519-521) and financial-sector betting choke-point both require policy updates ahead of respective effective dates.

Policies governing dealings with Brazilian virtual-asset counterparties need updating ahead of the 30 October 2026 grandfather deadline, and payment-processing policies should reflect the new joint tax liability exposure for continued processing on behalf of unauthorised betting operators after notification.

3 evidence refs
LegalAssessed

Complementary Law 224/2025 Art. 6 and Lei 15.328/2026 create new statutory liability bases for financial institutions in Brazil.

Joint tax liability under Complementary Law 224/2025 and the account-freezing power under the Anti-Faction Law both introduce statutory exposure for institutions that continue processing for unauthorised betting operators post-notification; both instruments are assessed at probable confidence pending primary-text confirmation.

2 evidence refs
BoardAssessed

Brazil's standing FATF rating is unchanged, but the country is building durable new AML/crypto architecture this cycle.

No grey-list or MER-rating change occurred this cycle, but the BCB's completed VASP-AML framework and the new betting-sector financial choke-point represent structural, not episodic, shifts in Brazil's financial-integrity posture that are material to any Brazil-exposed business line.

2 evidence refs
CTOAssessed

BCB Resolutions 519-521 impose a phased Crypto Travel Rule and a new VASP authorisation gate effective 2 February 2026.

Technical systems supporting virtual-asset transfers to or from Brazilian counterparties need to accommodate the phased 2026-2028 Travel Rule rollout and the new authorisation-gate requirement, with the 30 October 2026 grandfather deadline as the hard cutover point for dealing with unauthorised VASPs.

2 evidence refs
RiskAssessed

Brazil's exposure profile is shifting from a permissive-by-omission VASP environment to an architected supervisory perimeter.

The closing of the pre-existing regulatory gap around Brazilian virtual-asset activity changes the risk-concentration profile for exposure routed through Brazilian VASPs; this is a structural change tracked under the standing Crypto & Digital-Asset Integrity tracker, not an episodic incident.

3 evidence refs
OperationsAssessed

Screening and monitoring workflows touching Brazilian betting-sector payment flows face new joint-liability and account-freezing triggers.

Transaction-monitoring thresholds for payment flows to Brazilian betting operators should account for the notification-triggered joint tax liability regime and the Anti-Faction Law freezing power, both of which change the operational risk profile of continued processing after a notification event.

2 evidence refs
AuditPossible

Sourcing for this cycle's Brazil findings rests predominantly on tier-3 corroboration rather than primary BCB or planalto.gov.br text.

Audit should note that the VASP-AML architecture and the Anti-Faction Law findings both carry a documented sourcing gap this cycle, no bcb.gov.br or planalto.gov.br primary text was reached, which should inform the evidentiary weight assigned to related control-testing conclusions until primary sourcing is obtained.

3 evidence refs
Decision lens
MLRO

Brazil deploys a new financial-choke apparatus against unauthorised betting flows alongside a completed VASP-AML authorisation regime.

Compliance

New BCB VASP authorisation regime (Res.

Legal

Complementary Law 224/2025 Art.

Board

Brazil's standing FATF rating is unchanged, but the country is building durable new AML/crypto architecture this cycle.

CTO

BCB Resolutions 519-521 impose a phased Crypto Travel Rule and a new VASP authorisation gate effective 2 February 2026.

Risk

Brazil's exposure profile is shifting from a permissive-by-omission VASP environment to an architected supervisory perimeter.

Operations

Screening and monitoring workflows touching Brazilian betting-sector payment flows face new joint-liability and account-freezing triggers.

Audit

Sourcing for this cycle's Brazil findings rests predominantly on tier-3 corroboration rather than primary BCB or planalto.gov.br text.

Shared evidence: 4 refs
Scenario sketches

AMLA supervisory transition and cross-border obliged-entity evasion pressure

As the EU AML Package matures, the move from purely national AML supervision toward AMLA direct and indirect supervision of cross-border obliged entities, under the AMLA Regulation (Reg (EU) 2024/1620), alongside the directly-applicable AMLR (Reg 2024/1624) and per-state 6AMLD transposition, could reshape the supervisory and evasion landscape for institutions with EU-facing exposure, including correspondent relationships touching non-EEA jurisdictions such as Brazil. This is illustrative orientation on a structural architecture shift, not a prediction about Brazil-specific outcomes or a statement of observed fact.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion Architectureno_changeNo material Brazil-specific signal surfaced this cycle.
T2 · EU AML Package / AMLAno_changeNot applicable as a supranational binding instrument for Brazil (non-EEA).
T3 · FATF Grey Listno_changeBrazil remains off the FATF grey list; 2023 MER rated Compliant on 10 and Largely Compliant on 19 of 40 Recommendations.
T4 · Beneficial-Ownership Register Statusno_change2023 MER finding that declaratory BO information is tax-secret (court order required for LEA/COAF access) not superseded this cycle.
T5 · Crypto & Digital-Asset Integritymaterial_changeBCB Resolutions 519-521 (in force 2 Feb 2026, grandfather to 30 Oct 2026) establish Brazil's first comprehensive VASP authorisation/AML regime, including a phased Travel Rule (2026-2028) and an August 2026 rule requiring up to a 24-hour hold on virtual-asset transfers above USD 10,000 to overseas VASPs/self-custody wallets.
T6 · Sanctions Regime Divergenceno_changeNo Brazil-specific autonomous-listing divergence signal found this cycle; Brazil not itself subject to international sanctions.
Registers

Enforcement actions

  • OFAC imposed Global Magnitsky sanctions on sitting Brazilian Supreme Court Justice Alexandre de Moraes, over his oversight of prosecutions against former President Jair Bolsonaro, blocking his US assets and those of a linked holding company. 30 Jul 2025
  • OFAC extended Global Magnitsky sanctions to Viviane Barci de Moraes, wife of Justice Alexandre de Moraes and owner of a São Paulo law firm, escalating pressure days after Bolsonaro's coup-plot conviction. 22 Sep 2025
  • Operation Hydra targeted fintechs allegedly used by the PCC to launder illicit proceeds; a police officer who owned one of the fintechs was arrested, following whistleblower testimony from a businessman later murdered at Guarulhos airport. 14 Oct 2025
  • Operations Quasar, Tank and Hidden Carbon exposed illicit transactions totalling at least 52 billion reais ($9.6bn) across Brazil's fuel supply chain and fintech industry, with PCC members implicated. 28 Aug 2025
  • The Central Bank moved to liquidate Banco Master SA after fraud allegations tied to opaque assets and fabricated credit instruments; CEO Daniel Vorcaro was arrested attempting to board a private jet to Dubai. 18 Nov 2025
  • OFAC updated its counter-terrorism/counter-narcotics designations to include Brazilian fintech and construction entities linked to an individual (de Oliveira Shimada) laundering PCC drug proceeds via crypto back into Brazil. 1 Jul 2026

Sanctions changes

  • OFAC listed sitting Brazilian Supreme Court Justice Alexandre de Moraes under Global Magnitsky sanctions, an unprecedented unilateral US action against a senior judicial officer of a major G20 economy over his handling of the Bolsonaro coup-plot prosecution. 30 Jul 2025
  • OFAC removed Alexandre de Moraes, his wife Viviane Barci de Moraes, and the linked LEX law firm from the Global Magnitsky sanctions list as US-Brazil relations began to normalise. 12 Dec 2025
  • OFAC progressively expanded Transnational Terrorist Group (SDGT/FTO) designations covering PCC and Comando Vermelho to include Brazilian fintech and corporate front entities used to launder cross-border drug proceeds via cryptocurrency. 1 Jul 2026
  • The European Commission's December 2025 update to its AML/CFT high-risk third-country list added Bolivia and the British Virgin Islands and delisted six African/other jurisdictions, while Brazil remained absent from the list, consistent with its FATF-clean status. 4 Dec 2025

Regulatory horizon (register)

  • SPSAV VASP authorisation deadline for existing crypto firms
  • CVM ruling on crypto-asset securities classification
  • FATF/GAFILAT enhanced follow-up report on Brazil's MER action plan
  • Central Bank supervisory/deposit-insurance reform following Banco Master collapse

Active schemes

  • [CRITICAL] PCC fintech/fuel-sector laundering infrastructure
  • [CRITICAL] PCC/Comando Vermelho crypto-enabled cross-border laundering
  • [HIGH] Illegal Amazon gold laundering via shell companies
  • [HIGH] Crypto-to-fiat laundering pipeline via Brazilian VASPs
  • [CRITICAL] Banco Master opaque-asset structuring and fabricated credit
Sources
  1. FATF/GAFILAT
  2. FATF
  3. US Treasury OFAC
  4. US Treasury OFAC
  5. US Treasury OFAC
  6. US Treasury OFAC
  7. European Commission
  8. HM Treasury (UK)
  9. Bloomberg
  10. Bloomberg
  11. Bloomberg
  12. OCCRP
  13. Chainalysis
  14. TRM Labs
  15. Global Witness / Amazon Underworld
  16. UNODC Brazil / Aurum Project
Coverage gaps
Lawyers and several DNFBP categories remain effectively unre…
Lawyers and several DNFBP categories remain effectively unregulated for AML/CFT/CPF purposes in Brazil, per the FATF/GAFILAT MER, leaving a professional-enablement gap for structuring and gatekeeping services.
Despite the REDESIM initiative to detect misuse of companies…
Despite the REDESIM initiative to detect misuse of companies, Brazil's beneficial ownership database remains largely unpopulated, undermining transparency of legal entities used in laundering schemes.
Fintechs were historically outside the Central Bank's mandat…
Fintechs were historically outside the Central Bank's mandatory reporting perimeter to the Federal Revenue Service, a loophole prosecutors say allowed PCC-linked laundering to scale to over 1,500 fintech platforms nationally before the 2025-26 crackdown.
The Central Bank was reportedly warned for years about Banco…
The Central Bank was reportedly warned for years about Banco Master's alarming asset growth and opacity without escalating supervisory action, until a $2.4bn+ fraud allegation forced liquidation.
Precious-metals sector oversight relies on a self-declaratio…
Precious-metals sector oversight relies on a self-declaration certification for gold origin, enabling an estimated 30 tonnes/year of illegally-mined Amazon gold (~$1.86bn) to be laundered into the legal supply chain despite growing seizure volumes.
COAF faces an insufficient number of analysts and limited ac…
COAF faces an insufficient number of analysts and limited access to BO information, customs cash declarations, and reporting-entity data, constraining the depth and timeliness of financial intelligence produced.

Evidence

Confidence-tiered claims

No structured claims published for this jurisdiction yet.