Brazil's central bank will require virtual asset service providers (VASPs) to place precautionary holds of up to 24 hours on certain cryptocurrency transfers destined for foreign platforms or self-custody wallets, as part of a new fraud-prevention framework.

On Friday, the Banco Central do Brasil (BCB) announced that the hold requirement will apply to inbound funds exceeding $10,000, whether received through a single transaction or accumulated across a customer's total daily activity. VASPs must also retain other transfers that warrant additional scrutiny under their internal risk-management policies.

The new rules are scheduled to take effect on January 1, 2027, giving licensed providers a multi-year window to build the compliance infrastructure needed to screen flagged transfers within the permitted assessment window. Under the framework, providers are obligated to notify customers whenever a hold is placed and to maintain detailed records of fraud incidents, attempted fraud, and corrective measures taken. A VASP may conclude its assessment and release a transfer before the full 24-hour period elapses, provided it adheres to parameters established by the central bank.

The measures build on Brazil's 2022 legal framework for virtual assets (Law 14.478/2022), which designated the BCB as the primary supervisory authority for VASPs and laid the groundwork for a formal licensing regime currently under development. Brazil ranks among the world's largest cryptocurrency markets by adoption, according to Chainalysis, making the BCB's anti-fraud approach a reference point for other emerging-market regulators balancing consumer protection with sector growth.

The policy positions Brazil alongside a growing roster of jurisdictions strengthening cryptocurrency safeguards as regulators worldwide confront fraudulent schemes that exploit the speed and cross-border nature of digital assets.

Brazil Joins Global Effort Against Crypto Fraud

Brazil's measures echo anti-scam initiatives adopted in other regions. In Japan, the Financial Services Agency and the National Police Agency requested that cryptocurrency exchanges restrict withdrawals immediately after customers deposit fiat currency or purchase digital assets.

Japanese authorities also urged platforms to mandate that customers pre-register withdrawal addresses and to enforce a waiting period before newly added addresses can be utilized. Additional proposed safeguards include customer-specific withdrawal limits, enhanced transaction monitoring, phishing-resistant multifactor authentication, and verification that the name of a bank remitter corresponds to the crypto account holder.

Unlike Brazil's regulation, the Japanese measures are not legally binding. Japanese exchanges retain discretion over implementation, tailoring their approaches based on operational considerations and their respective exposure to misuse.

European regulators have separately warned about criminals impersonating regulatory watchdogs and cryptocurrency firms, targeting users searching for licensed service providers following the EU's Markets in Crypto-Assets licensing deadline. France's financial regulator has documented cases involving fraudulent websites, while the European Securities and Markets Authority reported that scammers misused its identity and logo in falsified documents.

Source: Banco Central do Brasil