Brazil’s largest private bank, Itaú Unibanco, notified the central bank on October 27 that it provides cryptocurrency intermediation and custody, Valor Econômico reported. Under Brazil’s new rules, providing both services together qualifies as virtual-asset brokerage.

Itaú submitted a notification rather than applying for a new license. The bank has not disclosed how many customers hold crypto through its platform or how much they trade. The notification allows Itaú to continue operating its existing service while the central bank reviews the operation.

A filing for a service launched in 2023

Itaú began offering Bitcoin and Ether trading in December 2023 through its íon investment platform, while retaining custody of the coins itself. The service has since expanded to 15 assets, including Solana, XRP, USDC and the gold-backed Pax Gold, according to a customer guide published by the bank on October 26. Purchases start at R$10.

The bank’s initial cryptocurrency launch was announced by Itaú, and the platform provides buying and selling, statements, quotes, and crypto and real balances around the clock.

The filing was required under Resolution BCB 520, which took effect on February 2. Firms that were already providing crypto services received 270 days, until October 30, to formalize their status. Itaú’s October 27 filing came three days before that deadline.

Specialist exchanges must apply for a license and undergo a two-phase review covering their finances, cybersecurity and internal controls. Banks that already hold a central-bank license have a shorter process: they notify the regulator.

That shorter process still includes requirements. The notification must contain an independent technical certification confirming that the bank’s crypto operation meets the resolution’s standards. The central bank may request additional information and, in specified circumstances, order the activity to stop. Itaú’s October 27 filing therefore gave it permission to keep operating its existing service while the regulator examines it; it did not represent final approval of every aspect of the operation.

What sits behind the balance in the app

Itaú describes its model as institutional custody. In its October guide, the bank tells customers that they do not need to manage digital wallets or private keys. Itaú controls the keys, and its systems sign every movement of the underlying coins.

For customers, this means there is no recovery phrase to lose and no wallet software to secure. Cryptocurrency holdings appear alongside savings and investments in a single app. The trade-off is that the customer must rely on the bank’s records and internal controls. The balance displayed in the app represents Itaú’s record of what the customer owns.

Some banks have entered the cryptocurrency market through custody alone, as Deutsche Bank’s plan illustrates. Itaú combines custody with execution, making it responsible both for carrying out the trade and for the coins held afterward.

Brazil’s rules address that custody relationship directly. Providers must keep customer assets separate from their own, document the separation process, prove their reserves and submit to independent audits whose reports are made public.

A September amendment, Resolution BCB 589, adds a reporting requirement. Starting January 1, 2027, providers must send the central bank information on customer balances, the total coins in custody, verifiable reserves by asset and any staking positions.

The information will go to the supervisor, while customers will continue to see their holdings through account statements. The change will allow the central bank to compare the total shown in those statements with the coins Itaú reports holding. That January 1, 2027 start is the next fixed date for providers after the October 30 formalization deadline.

Whether customers can move coins out of Itaú

Itaú’s íon product page lists buying and selling, statements, quotes, and crypto and real balances as available services. It does not state that customers can send coins to an outside wallet or receive them from one.

At the service’s 2023 launch, the head of Itaú Digital Assets told Tecnoblog that transfers in both directions would initially be unavailable. This distinction matters to customers who may later want to move Bitcoin to a hardware wallet. An Itaú position can be closed by selling it for reais, but whether it can leave the bank as cryptocurrency is a detail customers need to confirm in the app before buying.

Transfers involving self-custodied wallets are also more visible to Brazilian authorities than they previously were. Since October 1, regulated providers have been required to report transfers to or from a self-custodied wallet worth US$10,000 or more to Coaf, Brazil’s financial intelligence unit, as Capital Aberto explained. The rule does not prohibit self-custody and applies to every regulated provider in Brazil, not only Itaú.

What bank custody covers—and what it does not

Bank custody covers the safekeeping of private keys, the separation of customer coins from the bank’s own holdings, audits and central-bank reporting on reserves.

It does not provide protection from the Fundo Garantidor de Créditos (FGC), the guarantee fund that compensates eligible depositors when a bank fails. Itaú’s own FAQ states that cryptocurrency investments fall outside FGC coverage.

Custody also does not protect customers from a decline in the market price of the asset itself.

The cost of a round trip

Itaú charges an intermediation fee on every completed purchase and sale. The rate declines as the order size increases, according to the íon fee schedule. Round-trip calculations assume that the sale is the same size as the purchase. For small orders, round-trip fees can reach 3.9%.

A customer who buys R$1,000 of Bitcoin pays R$18.50 on the purchase. Selling the position at the same value costs another R$18.50, producing a total of R$37 before any change in the asset’s price.

According to the íon FAQ, orders can take up to 10 minutes to execute. The final execution price may therefore differ from the quote displayed when the order is placed.

The fee schedule favors larger orders. A customer who builds a position through many small purchases pays the highest rate on each transaction, while a larger order may qualify for a lower fee band. For customers who buy small amounts frequently, the transaction fee is the largest cost under their direct control.

Questions to consider before using a bank’s crypto service

Itaú’s filing makes its service more accountable to the regulator, but it does not replace the customer’s own checks. Before buying, customers need to know which assets are available and whether those assets can be transferred out as coins rather than sold for reais. They also need to understand the fee band that applies to each order and that their cryptocurrency balance has no FGC protection.

For larger holdings, customers should also know that a future transfer to a private wallet above US$10,000 will be reported to Coaf.

Itaú must now support under regulatory supervision the custody promise it has made to customers since 2023. Customers still have to determine whether holding a bank-controlled cryptocurrency balance meets their needs.

This article is provided for informational purposes only and does not constitute financial or investment advice. Cryptocurrency investments involve market and custody risks, and fees and service terms may change.

Original report: https://coindoo.com/bitcoin-at-a-brazilian-bank-what-the-new-rules-change