Brazil central bank requires audits for VASPs after $5B probe

On May 30, 2026, the Central Bank of Brazil issued Normative Instruction No. 739, requiring virtual asset service providers to present an independent audit from a firm registered with the Brazilian Securities and Exchange Commission (CVM) as part of their authorization to operate.

The rule mandates a third-party “reasonable assurance report” be submitted during the licensing process. The reports must be prepared by entities registered with the CVM and cover specific governance and compliance areas.

Auditors must assess legal compliance in institutional policy, organizational structure and employee training. They must evaluate internal risks that could allow a provider’s products or services to be used for money laundering or terrorism financing, and review customer due diligence procedures.

The audits must also assess a provider’s capacity to monitor, select, analyze and report operations suspected of money laundering, terrorism financing and the financing of weapons of mass destruction. Reports must cover how firms detect and analyze evidence of fraud and scams and how they handle administrative asset freezes.

The central bank said the audits aim to “increase the security of decisions in authorization processes, while reinforcing the country’s alignment with international practices and standards for combating these crimes,” and added that “verification by independent audit contributes to greater transparency and reliability in the controls adopted by companies in the sector.”

The instruction follows Operation Hidden Flow, a probe that targeted six fintech companies alleged to have moved more than $5 billion in irregular transactions. Investigators identified the use of digital assets in money‑laundering activity linked to organized crime; authorities have suspected the Primeiro Comando da Capital, which the U.S. government recently designated as Specially Designated Global Terrorists.

The audit requirement joins existing licensing and compliance rules for the crypto sector. Regulators and industry participants said the independent-audit mandate will add an extra layer of scrutiny and is likely to raise the cost and complexity of obtaining authorization to operate in Brazil.

Under Normative Instruction No. 739, virtual asset firms seeking authorization must secure an approved independent audit before their license applications can proceed.