The asset tokenization infrastructure for the regulated financial market in Brazil has entered a new phase.
With the issuance of BCB Resolutions 552 and 553, the Central Bank formalized a legal entity type that structurally changes the game for those operating with virtual assets: the SPSAV (Sociedade Prestadora de Serviços de Ativos Virtuais), or Virtual Asset Service Provider Company.
For those already active in this market or planning to structure an operation in 2026, understanding this new virtual asset regulation is not optional. It is a condition for continuity.
But what exactly is an SPSAV? Who needs to set one up? And what does the new regulation require in practice, beyond what is written in the regulatory text?
These are the questions structurers, compliance officers, asset managers and platforms are asking right now, and we will answer them in this article.
What is an SPSAV and why does this legal entity type represent a regulatory turning point?
The creation of the SPSAV was not a cosmetic move. It formalized an entire segment that had been operating in a gray area, with growing volume, systemic relevance and no clear classification.
The Central Bank did not just create a new license: it created a market role with obligations, limits and supervision consistent with the regulated financial system.
How did the Virtual Asset Service Provider Company emerge in Brazil’s regulatory framework?
The SPSAV derives directly from Law 14.478/2022, which established the legal framework for virtual asset service providers in Brazil.
But it was only recently, with BCB Resolutions 552 and 553, that this entity type took on an operational shape: defined corporate requirements, established minimum capital, and formalized governance, internal control, KYC and AML obligations.
This move did not happen in isolation. It followed a global trend toward formalizing the sector, from the European MiCA regime to FATF guidelines, and reflected domestic pressure from a market that was already moving significant volumes without adequate supervision.
Brazil chose the Central Bank as the central authority for this segment, clearly drawing the line with the CVM regarding assets that qualify as securities.
What is the role of the SPSAV within the regulated financial system?
The SPSAV occupies a specific position in the digital financial services chain. It is not an asset manager, not a traditional brokerage and not an issuer of securities.
It is the entity authorized to provide, exclusively and under supervision, services related to virtual assets that do not qualify as securities, a scope that includes the exchange, transfer, custody and administration of these assets.
In practice, the SPSAV is the agent that provides the institutional backing for an operation with digital assets to be conducted within the standards the financial system requires. Without this entity, any platform performing these functions operates under direct regulatory exposure.
What does the creation of this legal entity type signal about the maturity of the virtual asset market?
The existence of a specific legal entity type for virtual asset service providers is a clear indicator: the Central Bank recognizes the segment as part of the financial system and no longer accepts it operating outside the same requirements that apply to traditional institutions.
This has a direct consequence: those who do not comply are not just outside the law, they are out of the market.
For the asset tokenization market, this regulatory maturity is positive. It creates barriers to entry that protect serious operations and keeps away fragile structures that undermined the credibility of the sector as a whole.
What does the new virtual asset regulation establish for SPSAVs?
BCB Resolutions 552 and 553 leave no room for loose interpretation. They define what an SPSAV is, what it can do and what it needs to have to obtain and keep its authorization. Below are the main sets of requirements:
| Dimension | What the regulation requires |
| Incorporation | A legal entity incorporated in Brazil, with a corporate purpose exclusively for virtual asset services |
| Minimum capital | An amount set by the BCB according to the type of service provided. The BCB has not yet published the final minimum capital amounts for each service category; what the regulation signals is that the amounts will be tiered by size and operational risk. |
| Governance | Internal control structure, compliance policy, risk management and segregation of duties |
| KYC and AML | Customer identification and verification, transaction monitoring and reporting to COAF |
| Asset custody | Segregation between the company’s own assets and client assets |
| Technology and security | Minimum standards for cybersecurity, traceability and business continuity |
| Prior authorization | No activity may begin without formal approval from the Central Bank |
Each of these sets represents a structural investment, not just of financial resources, but of operational architecture.
Those who try to address these requirements piecemeal, stacking disconnected solutions, tend to create more risk than the lack of regulation used to.
The logic that prevails in the BCB’s regulatory model is that compliance is not a checklist, it is a consequence of how the operation was built. This is exactly where choosing tokenization as the operational foundation makes a difference.
What can an SPSAV do and what falls outside its scope?
One of the most common mistakes in the market is treating the SPSAV as a generic license to operate with any type of digital asset. It is not. The scope is defined, and the limits matter functionally.
Within the SPSAV’s scope:
- Exchange of virtual assets for national or foreign currency
- Exchange between different virtual assets
- Transfer of virtual assets
- Custody and administration of virtual assets
- Participation in financial services related to the offering of virtual assets
Outside the SPSAV’s scope:
- Issuance or intermediation of tokenized securities (under the CVM’s authority)
- Third-party asset management (requires CVM authorization as an asset manager)
- Lending and deposit-taking (under the authority of financial institutions authorized by the BCB in other categories)
- Distribution of products that qualify as securities
This distinction has direct implications for real estate tokenization platforms and for operations such as FIDC tokenization, where the asset may be of interest to both the SPSAV and the CVM, depending on how the structure was designed. Defining the applicable regime before structuring is a condition for legal certainty, not a secondary detail.
Who needs to set up an SPSAV and who does not?
This is one of the most frequently asked, and most poorly answered, questions in the market. The answer is not binary: it depends on the actual nature of the services provided.
You need to set up an SPSAV if you:
- Operate a virtual asset exchange (crypto-to-fiat conversion or between cryptocurrencies)
- Provide virtual asset custody services to third parties
- Carry out virtual asset transfers as a service
- Participate in virtual asset offerings as a regular, paid service provider
You do not need to set up an SPSAV if you:
- Only issue tokens that are securities (subject to the CVM, not to the BCB as an SPSAV)
- Operate exclusively as an asset manager (requires CVM authorization as an asset manager)
- Act as an asset originator without providing custody or transfer services
- Provide technology for operations without taking part in providing the virtual asset service
The critical point lies in functional classification, not in the label the company uses to describe itself.
A platform that presents itself as a “tokenization fintech” but carries out exchange and custody of virtual assets is providing services typical of an SPSAV, regardless of its name.
What is the risk of providing typical SPSAV services without Central Bank authorization?
The regulation leaves no ambiguity on this point. Operating without BCB authorization when the activity qualifies as a virtual asset service subject to the SPSAV regime constitutes the unauthorized conduct of financial activity, with consequences that include:
- Mandatory shutdown of the operation by order of the BCB
- Civil and criminal liability for managers
- Inability to maintain bank accounts and relationships with regulated financial institutions
- Exposure to enforcement actions and administrative fines
- Loss of institutional credibility with partners, investors and clients
The implicit tolerance period that existed due to the lack of regulation is over. The entry into force of the BCB resolutions creates a clear dividing line: before and after.
Operating without compliance after this point is an active choice to take on risk, not a neutral omission.
New virtual asset regulation and the CVM: how are responsibilities divided and where do they overlap?
The overlap between the BCB and the CVM is one of the most complex points in the digital asset regulatory framework, and one of the biggest sources of doubt among structurers and platforms.
The central criterion for dividing responsibilities is the nature of the asset: if it is a security, the CVM prevails; if not, the BCB regulates it through the SPSAV.
In practice, however, the problem arises because many digital assets do not have an obvious classification. A token representing a share of revenue, for example, may be classified as a security by the CVM, even if it was structured as a simple virtual asset. Banking innovation and technology is moving faster than regulatory clarity in some cases.
The table below summarizes the main overlap scenarios:
| Type of operation | Competent regulator | Special attention |
| Cryptocurrency exchange (BTC, ETH, stablecoins) | BCB (SPSAV) | — |
| Issuance of a revenue-sharing token | CVM (may be a security) | Legal analysis required before structuring |
| Custody of tokens that are securities | CVM + BCB (overlap) | Requires a combined assessment of both regimes |
| Tokenized CRI | CVM (security) | The distribution platform may need CVM authorization |
| Real-backed stablecoin | BCB (under specific review) | May have an additional layer of payments regulation |
For those structuring operations such as tokenized CRIs, the analysis of the applicable regulatory regime needs to happen before the structure is defined, not after.
A classification error at this stage leads to structural rework and legal exposure that is rarely cheap to fix.
What does an operation need to function within the new SPSAV regulatory environment?
Having the right corporate registration (CNPJ) is not enough. Compliance with the SPSAV framework requires the entire operation, from technology to legal, from KYC to relationships with regulated agents, to be integrated into a model that works as a system, not as a set of separate pieces.
In practice, an operation that intends to work within the regulatory environment of the new virtual asset regulation needs:
- An adequate corporate structure: an SPSAV incorporated with the correct corporate purpose and paid-in minimum capital
- Technology with traceability: blockchain or an equivalent system that allows full auditing of transactions
- Operational KYC and AML: not just documented policies, but processes that work in real time
- Segregated custody: a clear separation between the company’s own assets and client assets
- Integration with regulated agents: DTVM, qualified custody, asset registration and other financial system participants
- Governance and internal controls: an active compliance structure, with an identified person in charge and auditable processes
Each of these layers needs to be built coherently. This is where infrastructure becomes a differentiator, not in a marketing sense, but in a technical and operational sense.
BLOCKBR was built to operate at exactly this level. As an asset tokenization infrastructure for the regulated financial market, it integrates the SPSAV requirements (compliance, KYC, AML, traceability and internal controls) within an operational architecture where compliance is a consequence of the structure, not a parallel effort.
BLOCKBR Station is the hub that connects all these pieces within the institutional environment: DTVM, qualified custody, asset registration and other regulated agents.
For an SPSAV that needs to demonstrate real integration with the financial system, not just state its intention, Station is the most concrete evidence of integrated regulatory infrastructure compatible with what the BCB requires.
The BLOCKBR Whitelabel Platform, in turn, solves a problem many platforms face when trying to set up an SPSAV: how to have integrated legal and technological infrastructure without building each layer from scratch?
Whitelabel delivers exactly that: a foundation that is born at the required regulatory level, ready to plug into a DTVM, KYC/AML and banking services, with separate environments for issuers and investors.
The difference between building each compliance layer separately and operating on a foundation that already incorporates these standards is, in most cases, the difference between an operation that gets through BCB authorization and one that gets stuck in cycles of review and rework.
FAQ: Frequently asked questions about SPSAVs and the new virtual asset regulation
What is an SPSAV?
SPSAV stands for Sociedade Prestadora de Serviços de Ativos Virtuais, or Virtual Asset Service Provider Company. It is the legal entity type created by Brazil’s regulatory framework, specifically by BCB Resolutions 552 and 553, to formalize and supervise companies that provide services related to virtual assets in Brazil.
To exist and operate legally, an SPSAV must obtain prior authorization from the Central Bank of Brazil.
Does every company that operates with virtual assets need to be an SPSAV?
No. Whether a company must set up an SPSAV depends on the nature of the services it provides. Companies that only issue tokens that qualify as securities, for example, are subject to CVM regulation, not to the BCB’s SPSAV regime.
The deciding criterion is functional: if the company carries out exchange, transfer, custody or administration of virtual assets on a regular and paid basis, it falls within the SPSAV’s scope.
What is the difference between an SPSAV and a VASP?
VASP (Virtual Asset Service Provider) is the term used internationally by the FATF (Financial Action Task Force) to refer to virtual asset service providers. The SPSAV is the Brazilian equivalent of this concept, with the specific features of the national regulatory framework.
Functionally, the obligations are similar, especially regarding KYC, AML and reporting of suspicious transactions, but the formal requirements follow Central Bank of Brazil regulation.
What are the requirements to obtain Central Bank authorization as an SPSAV?
The main requirements include: incorporation in Brazil with an exclusive corporate purpose, paid-in minimum capital according to the type of service, a governance structure with formalized internal controls, an active compliance policy, operational KYC and AML processes, segregation between the company’s own assets and client assets, and minimum standards for cybersecurity and business continuity.
Authorization must be obtained in advance: no activity may begin before BCB approval.
Can an SPSAV issue tokens that are securities?
Not within the SPSAV’s scope. The issuance or intermediation of tokens that qualify as securities falls under the regulatory authority of the CVM, not the BCB in the SPSAV context.
A company that wants to both provide virtual asset services and operate with tokenized securities will need to deal with both regulatory regimes, which requires careful legal analysis of each asset and each service provided.
What happens to platforms that provide virtual asset services without BCB authorization?
Operating without proper authorization constitutes the unauthorized conduct of financial activity. The consequences include mandatory shutdown of the operation by order of the BCB, civil and criminal liability for managers, loss of access to bank accounts and relationships with regulated financial institutions, as well as enforcement actions and administrative fines.
The implicit tolerance period that existed due to the lack of clear regulation ended with the entry into force of the BCB resolutions.
For platforms and structurers that want to operate within the required regulatory environment without building each compliance layer from scratch, BLOCKBR is the most direct path.
Explore BLOCKBR’s infrastructure and see how your operation can be structured within the new SPSAV regulatory environment with real efficiency, not just formal compliance.
The new virtual asset regulation did not create new problems for those who have always operated seriously.
It made the difference between those who built a real structure and those who bet on the lack of oversight visible and consequential. The SPSAV is not bureaucracy: it is what separates a sustainable operation from a risk with an expiration date.
