D1 Sanctions
Sanctions is not yet covered for this jurisdiction in this report.
AML Law 9613/1998 with COAF (FIU) at its centre, coordinated via the ENCCLA inter-agency mechanism; joint FATF/GAFILAT MER (Dec 2023) found improved risk understanding and TF criminalisation but weak DNFBP supervision and unpopulated BO data.
Sanctions is not yet covered for this jurisdiction in this report.
Beneficial Ownership is not yet covered for this jurisdiction in this report.
Enabler Jurisdictions is not yet covered for this jurisdiction in this report.
Conflict Finance is not yet covered for this jurisdiction in this report.
Brazil completed a comprehensive virtual-asset authorisation and AML architecture this cycle. Resoluções BCB 519, 520 and 521, published 10 November 2025, jointly regulate the operation of Sociedades Prestadoras de Serviços de Ativos Virtuais (SPSAVs), establishing authorisation processes, operational and governance requirements, and the integration of virtual-asset cross-border FX activity, including stablecoin transactions and self-hosted-wallet operations, into Brazil's existing exchange-control regime. The rules take effect 2 February 2026, with a 270-day grandfather window running to 30 October 2026; after that date, BCB-supervised institutions will be barred from dealing with unauthorised VASP counterparties for intermediation, custody, FX, or payment-account and transaction services. This is properly read as architecture rather than incident: Brazil is not responding to a single crypto-enabled illicit-finance event but building the durable supervisory perimeter within which future typology exposure will be assessed. Sourcing this cycle rests on corroboration across ANBIMA, BDO, Notabene and a direct text mirror of Resolução 519, rather than a bcb.gov.br-hosted primary URL, and confidence is accordingly assessed as probable rather than confirmed.
A second structural element, Resolução BCB 520 Article 89, establishes a phased Crypto Travel Rule implementation running from 2026 to 2028, aligning Brazil's VASP sector with FATF Recommendation 16 equivalence over a multi-year rollout rather than a single compliance date. This phasing itself carries typology significance: a multi-year Travel Rule build-out creates a window during which layering techniques exploiting incomplete originator/beneficiary information capture remain viable, even as the underlying legal obligation is already in force in principle. A related development, an August 2026 rule reported by The Digital Banker, requires up to a 24-hour hold on virtual-asset transfers above USD 10,000 to overseas VASPs or self-custody wallets, functioning as a friction-based control against rapid cross-border layering pending fuller Travel Rule maturity.
The combination of a new authorisation gate, a phased Travel Rule, and a transfer-hold friction control represents a coherent three-part architecture rather than three unrelated rules, and its coherence is itself worth registering: enabler-jurisdiction and evasion typologies that previously found Brazil's virtual-asset sector permissive by omission now face a closing window, concentrated at the 30 October 2026 grandfather deadline. Enablement as signal cuts the other way here: the absence, until this cycle, of any comprehensive Brazilian VASP-AML perimeter was itself analytically significant, and its closure changes the calculus for any illicit-finance architecture that had been routing through unauthorised Brazilian VASPs during the earlier permissive period.
The grandfather deadline of 30 October 2026 is the single most consequential date on the D5 horizon: it is the point at which the architecture built this cycle converts from a registration requirement into an enforceable exclusion of unauthorised counterparties from BCB-supervised dealing. Track whether a bcb.gov.br primary text becomes available to firm up confidence above probable, and whether the phased 2026-2028 Travel Rule timeline holds or slips, which would extend the layering-exposure window this brief flags above.
Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.
Brazil's standing AML/CTF baseline is unchanged this cycle: the 2023 FATF mutual evaluation rated the country Compliant on ten and Largely Compliant on nineteen of forty Recommendations, with Substantially Effective ratings on two of eleven Immediate Outcomes, and Brazil remains off the FATF grey list. No plenary update to this rating was located this cycle, and it is carried forward as standing descriptive context against which this cycle's new development should be read.
That new development is the construction of a financial-sector choke-point specifically targeting unauthorised betting operators, assessed as an architectural rather than incidental shift. Lei 15.328/2026, the so-called Anti-Faction Law, empowers immediate freezing of funds in accounts linked to unauthorised betting operations, explicitly framed as an organised-crime countermeasure rather than a conventional AML instrument; this framing itself is analytically notable, since it routes betting-sector financial crime enforcement through an anti-organised-crime statute rather than through the standard AML/CFT reporting chain. Alongside it, Decreto 13.033/2026 and Ministério da Fazenda Portaria 1.766/2026 impose joint tax liability, grounded in Complementary Law 224/2025 Article 6, on banks, payment institutions and payment arrangers that continue processing transactions for unauthorised betting operators after formal notification. Three independent tier-3 outlets corroborate the instrument numbers and dates for both measures, though no planalto.gov.br-hosted primary text was reached for either this cycle, and both findings are assessed at probable rather than confirmed confidence.
Together these two instruments deputise the regulated financial sector as the primary enforcement mechanism against a betting-sector illicit-finance typology that would otherwise sit largely outside conventional AML/CFT reporting channels, given the sector's cash- and app-intensive character. This is a structural correction with three-pillar relevance: it is fundamentally a CTF-adjacent and AML-architecture development, using account-freezing and tax-liability levers rather than traditional STR/CTR-based detection, and it should not be under-weighted simply because it does not generate conventional suspicious-activity-report volume. Implementing detail from the Banco Central on the Anti-Faction Law's execution mechanics, originally due by 25 May 2026, has not been independently confirmed against a primary source this cycle, which leaves a live gap in understanding how the freezing power will actually be operationalised.
The principal item to track is whether Banco Central implementing norms on Lei 15.328/2026 execution mechanics surface and can be independently confirmed, which would move both the freezing-power and joint-tax-liability findings from probable toward confirmed confidence. The unresolved beneficial-ownership gap noted in the standing tracker record, under which declaratory BO information remains treated as tax-secret pending a court order for law-enforcement or COAF access, continues to sit as a structural constraint on how effectively either new instrument can be operationalised against complex ownership structures.
The Anti-Faction Law's account-freezing power and the new joint tax liability regime create fresh escalation triggers for betting-linked flows through Brazilian-facing accounts, while the BCB VASP framework's 30 October 2026 grandfather deadline changes the due-diligence posture required toward Brazilian virtual-asset counterparties ahead of that date.
Policies governing dealings with Brazilian virtual-asset counterparties need updating ahead of the 30 October 2026 grandfather deadline, and payment-processing policies should reflect the new joint tax liability exposure for continued processing on behalf of unauthorised betting operators after notification.
Joint tax liability under Complementary Law 224/2025 and the account-freezing power under the Anti-Faction Law both introduce statutory exposure for institutions that continue processing for unauthorised betting operators post-notification; both instruments are assessed at probable confidence pending primary-text confirmation.
No grey-list or MER-rating change occurred this cycle, but the BCB's completed VASP-AML framework and the new betting-sector financial choke-point represent structural, not episodic, shifts in Brazil's financial-integrity posture that are material to any Brazil-exposed business line.
Technical systems supporting virtual-asset transfers to or from Brazilian counterparties need to accommodate the phased 2026-2028 Travel Rule rollout and the new authorisation-gate requirement, with the 30 October 2026 grandfather deadline as the hard cutover point for dealing with unauthorised VASPs.
The closing of the pre-existing regulatory gap around Brazilian virtual-asset activity changes the risk-concentration profile for exposure routed through Brazilian VASPs; this is a structural change tracked under the standing Crypto & Digital-Asset Integrity tracker, not an episodic incident.
Transaction-monitoring thresholds for payment flows to Brazilian betting operators should account for the notification-triggered joint tax liability regime and the Anti-Faction Law freezing power, both of which change the operational risk profile of continued processing after a notification event.
Audit should note that the VASP-AML architecture and the Anti-Faction Law findings both carry a documented sourcing gap this cycle, no bcb.gov.br or planalto.gov.br primary text was reached, which should inform the evidentiary weight assigned to related control-testing conclusions until primary sourcing is obtained.
Brazil deploys a new financial-choke apparatus against unauthorised betting flows alongside a completed VASP-AML authorisation regime.
New BCB VASP authorisation regime (Res.
Complementary Law 224/2025 Art.
Brazil's standing FATF rating is unchanged, but the country is building durable new AML/crypto architecture this cycle.
BCB Resolutions 519-521 impose a phased Crypto Travel Rule and a new VASP authorisation gate effective 2 February 2026.
Brazil's exposure profile is shifting from a permissive-by-omission VASP environment to an architected supervisory perimeter.
Screening and monitoring workflows touching Brazilian betting-sector payment flows face new joint-liability and account-freezing triggers.
Sourcing for this cycle's Brazil findings rests predominantly on tier-3 corroboration rather than primary BCB or planalto.gov.br text.
As the EU AML Package matures, the move from purely national AML supervision toward AMLA direct and indirect supervision of cross-border obliged entities, under the AMLA Regulation (Reg (EU) 2024/1620), alongside the directly-applicable AMLR (Reg 2024/1624) and per-state 6AMLD transposition, could reshape the supervisory and evasion landscape for institutions with EU-facing exposure, including correspondent relationships touching non-EEA jurisdictions such as Brazil. This is illustrative orientation on a structural architecture shift, not a prediction about Brazil-specific outcomes or a statement of observed fact.
Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.
| Tracker | Status | Note |
|---|---|---|
| T1 · Russian Sanctions-Evasion Architecture | no_change | No material Brazil-specific signal surfaced this cycle. |
| T2 · EU AML Package / AMLA | no_change | Not applicable as a supranational binding instrument for Brazil (non-EEA). |
| T3 · FATF Grey List | no_change | Brazil remains off the FATF grey list; 2023 MER rated Compliant on 10 and Largely Compliant on 19 of 40 Recommendations. |
| T4 · Beneficial-Ownership Register Status | no_change | 2023 MER finding that declaratory BO information is tax-secret (court order required for LEA/COAF access) not superseded this cycle. |
| T5 · Crypto & Digital-Asset Integrity | material_change | BCB Resolutions 519-521 (in force 2 Feb 2026, grandfather to 30 Oct 2026) establish Brazil's first comprehensive VASP authorisation/AML regime, including a phased Travel Rule (2026-2028) and an August 2026 rule requiring up to a 24-hour hold on virtual-asset transfers above USD 10,000 to overseas VASPs/self-custody wallets. |
| T6 · Sanctions Regime Divergence | no_change | No Brazil-specific autonomous-listing divergence signal found this cycle; Brazil not itself subject to international sanctions. |