Itaú Unibanco, the largest private bank in Brazil, has formally registered as a cryptocurrency service provider with the Central Bank of Brazil. The filing covers the intermediation and custody of crypto assets—the same activities the regulator assigns to brokerage firms—according to local reports. The news arrives as the country's crypto sector faces a compressed timeline to obtain licenses, with the licensing window now closing.

The move places Brazil's biggest private lender inside a licensing framework that did not exist a year ago. The central bank requires every company that holds, moves, or trades crypto for customers to register as a regulated provider. By filing, Itaú tells the market that it intends to be one of them.

The scope of the filing lines up with how Itaú already operates: intermediation and custody are the same two functions the bank performs through íon, where it facilitates client trades and holds the resulting assets itself. Registration turns that existing operational role into a formally supervised one.

For Brazilian users, the change matters most for custody. A provider that holds crypto for clients must keep those assets separate from the firm's own money, meet minimum capital requirements, and follow the same governance and anti-money laundering standards that apply to securities brokers. Clients of an authorized bank gain a clearer legal footing than clients of an unregulated app or an offshore exchange.

For the bank, the filing is a commitment. A regulated crypto operation carries compliance costs, audit obligations, and reporting duties that smaller competitors may struggle to meet. The move also signals that Brazil's biggest lenders plan to keep crypto inside the domestic financial system rather than leave it to foreign platforms.

Itaú's Embrace of Bitcoin and Crypto

Itaú's crypto story started before the new rules. The bank announced plans for crypto custody in 2022, when it was building a tokenization platform. In late 2025, it began letting retail clients buy and sell bitcoin through its investment app, íon. The crypto assets traded on íon are held in custody by Itaú itself, which made the bank's position an operational one long before it became a regulatory one.

The regulatory backdrop took shape in 2025 and early 2026, when the central bank published Resolutions 519, 520, and 521. They created a new license category called Sociedades Prestadoras de Serviços de Ativos Virtuais, or SPSAVs, and the rules took effect on February 2, 2026.

The framework sorts providers into three categories: intermediaries, custodians, and brokers. It requires formal segregation of client and company assets, sets minimum capital levels, and extends the customer protection, governance, internal control, security, and anti-money laundering rules that already govern banks and brokers.

Resolution 521 brought crypto transactions into the foreign-exchange regime. Transfers with unauthorized counterparties face a $100,000 cap, which limits how crypto moves across borders outside regulated channels. Companies already operating when the regime took effect had to file for authorization within a transition period. That timing is why Itaú's filing reads as a response to a pressure point, not a routine update.

Stricter standards follow. On July 1, 2026, the central bank approved tighter rules. Beginning in 2027, providers must meet financial security requirements similar to those for securities brokers and distributors. The regulator also barred institutions in Segment 5, the simplified-rules category for smaller banks, from offering virtual asset services. That decision pushes crypto activity toward larger, better-capitalized players—the group Itaú belongs to.

The rules themselves set the checkpoints worth watching from here: the transition window for incumbent operators is closing now, and the 2027 financial-security requirements give registered firms a fixed deadline to meet broker-grade standards. Registry status is what separates participants under this framework—holding, moving, or trading crypto for Brazilian customers requires appearing among the central bank's authorized providers—and Itaú's filing places the country's largest private bank inside that perimeter.

The filing confirms that the bank intends to continue offering crypto services under the new regime as the transition period winds down.