Brazil will require regulated financial institutions to report virtual-asset transfers worth at least the equivalent of $10,000 when funds move to or from self-custody wallets, extending the country's automatic anti-money-laundering reporting regime to transactions that cross between supervised platforms and user-controlled addresses.

Under Resolution BCB No. 588, issued on September 23, transfers of virtual assets to or from self-custodied wallets valued at $10,000 or more are added to the operations that must be specifically communicated to the Conselho de Controle de Atividades Financeiras, or Coaf, the country's financial intelligence unit. The rule takes effect on October 1, 2026.

The reporting obligation applies in both directions. A qualifying withdrawal from a regulated institution to a wallet controlled by the customer falls within the rule, as does a qualifying deposit arriving from a self-custody address. The Banco Central said the measure targets situations in which users control their own private keys, meaning less information may be available to regulated institutions for monitoring and risk assessment.

Self-Custody Remains Available Under New Reporting Rule

The measure does not create a $10,000 transfer ceiling, nor does it prohibit users from controlling their own wallets. Instead, it places a mandatory reporting requirement on institutions when qualifying transfers cross the boundary between a regulated provider and self-custody. The filing duty falls on the institutions rather than on wallet holders.

Brazil has been building toward tighter controls at that boundary for months. A June proposal introduced a 24-hour hold for larger moving toward self-custody or overseas crypto firms, while earlier rules restricted the use of crypto inside regulated cross-border payments infrastructure.

That 24-hour mechanism was later adopted separately under Resolution BCB No. 584. From January 1, 2027, virtual-asset service providers must apply a cautionary review period to certain transfers destined for foreign crypto businesses or self-custody wallets when the operation exceeds $10,000, individually or through the customer's same-day total. The Banco Central's final framework allows an institution to release the transfer before the full 24 hours have elapsed when its risk assessment supports doing so.

Brazil Joins Wider Push Around Self-Hosted Wallet Transfers

Brazil's approach follows a broader regulatory focus on what happens when crypto leaves regulated custody, without banning private wallets themselves.

Thailand recently finalized a self-hosted wallet rule requiring licensed digital-asset businesses to verify ownership or control of private wallets when customers send or receive crypto through their platforms. Thailand's Travel Rule framework takes effect on February 27, 2027, and also requires originator and beneficiary information, counterparty checks, transaction monitoring and record retention.

The two systems rely on different controls. Thailand requires wallet ownership verification at regulated transfer points, while Brazil's Resolution 588 creates automatic Coaf reporting once transfers involving self-custody reach the $10,000 threshold.

Brazil's new requirement forms part of a wider September regulatory package covering virtual-asset service providers. The Banco Central said the anti-money-laundering changes take effect on October 1, the same month in which existing crypto service providers must formalize their authorization applications under the country's developing virtual-asset framework, according to an official announcement.