Bringing PSAVs into the prudential framework of the National Financial System is not a low-impact technical adjustment.
It is a step change. Anyone who operates or plans to operate as a virtual asset service provider in Brazil needs to understand that the bar for regulatory requirements has been raised, and that the deadlines are already running.
For those closely following the asset tokenization sector, this move was expected. Now it is formal, supervised and has defined dates.
In this article, you will understand what this change means in practice: what the concrete requirements are, how prudential segmentation works, what independent auditing requires in terms of internal controls and what your operation needs to have ready before the deadlines arrive.
What does it mean to bring PSAVs into the prudential framework of the National Financial System?
Until recently, PSAVs (prestadoras de serviços de ativos virtuais, or virtual asset service providers) operated in their own regulatory space, recognized by Law 14.478/2022 and organized by the Central Bank, but still separate from the prudential requirements that govern banks, brokerages and securities distributors. That separation has come to an end.
With the Central Bank’s decision, these companies are now classified as Type 3, under BCB Resolution 436/2024.
This means they are subject to the same set of rules that already applies to securities brokerages and distributors: capital requirements, structured risk management and disclosure obligations.
What is a prudential framework and why does it matter for the virtual asset market?
A prudential framework is the set of rules that ensures the financial and operational soundness of supervised institutions.
It defines how much capital an institution must hold, how it must manage its risks and what it must disclose to the regulator and the market.
For the virtual asset market, this matters for one central reason: without prudential requirements, any company could operate without minimum capital, without a risk structure and without transparency.
The result has already been seen in other markets: institutional collapses that harmed clients and damaged the credibility of the entire sector.
Bringing PSAVs into this framework is not a punishment. It is the recognition that the activity carries real risk, and that real risk requires real governance.
What is the regulatory logic behind treating PSAVs like brokerages and distributors?
The principle is straightforward: equivalent activities should be subject to equivalent risks and regulation.
A PSAV that holds assets in custody, executes orders and intermediates transactions performs functions that are structurally close to those of a brokerage. It therefore makes sense for it to be subject to similar requirements.
This logic is consistent with the international standards adopted by the FATF and by regulators in developed markets.
Brazil is aligning its model with what already exists in other countries, and signaling that the regulated digital asset market will not be a shortcut for those who want to operate without the responsibilities the traditional financial market demands.
What concrete requirements now apply to PSAVs?
Starting January 1, 2027, PSAVs will need to comply with three main sets of prudential requirements:
- Capital requirements: maintaining minimum capital consistent with the size and risk profile of the operation, calculated using methodologies defined by the Central Bank.
- Risk management: a formal structure for identifying, measuring, mitigating and monitoring risks, including operational risk, credit risk and market risk, as applicable.
- Disclosure policies: reporting obligations to the regulator and transparency about the institution’s financial and operational condition.
In practice, this means that a PSAV that previously operated with a basic administrative structure will need to build or outsource functions that today are mandatory only for traditional financial institutions: internal controls, capital management, structured compliance and data governance.
For those still structuring their operation, understanding how this connects to the broader concept of PSAVs in practice is the first step before making any technology or legal decision.
What is Segment 4 and what does it require from PSAVs?
The National Financial System organizes its institutions into prudential segments, from S1 to S5, based on size, complexity and risk profile.
Segment 4 (S4) is intended for smaller institutions that do not meet the criteria for the higher segments, but that still carry out activities of significant complexity.
PSAVs have been placed in S4 and must confirm this classification by June 30, 2028, regardless of their size.
This means that even a small PSAV, with low operating volume, is subject to the same prudential obligations as a mid-sized institution in the financial system.
S4 requires, among other things:
- Minimum capital consistent with the requirements defined for the segment
- A formal risk management structure
- Documented and auditable internal controls
- Minimum governance with segregation of duties
BLOCKBR’s asset tokenization infrastructure for the regulated financial market was built to operate at exactly this level of requirements, with traceability, integrated internal controls and documented governance from the very start of the operation.
Why was Segment 5 ruled out for PSAVs and what does this reveal about the nature of the activity?
Segment 5 (S5) is the simplified regime of the National Financial System, aimed at less complex institutions, with reduced prudential requirements. The Central Bank has explicitly prohibited PSAVs from being classified in it.
This prohibition is not arbitrary. It reflects a clear regulatory understanding: providing virtual asset services involves holding third-party funds in custody, executing transactions in decentralized environments and exposure to operational and market risks that are incompatible with a simplified regime.
In other words, the regulator is saying that there is no such thing as a low-complexity PSAV. Any company that wants to work in this market must accept the level of requirements the activity demands, and structure its operation accordingly.
What are the deadlines and what needs to be ready at each stage?
The regulatory calendar is one of the most critical points for those planning their compliance. There are two key dates and a set of decisions that need to be made before them.
What needs to be in place by January 1, 2027?
By this date, PSAVs need to have the following up and running:
- A documented operational risk management structure
- A capital requirements policy approved by senior management
- Internal controls capable of producing auditable evidence
- A disclosure policy to the regulator in place
This is not just about creating documents. The Central Bank expects these controls to be effectively in operation, with processes, designated owners and records that can be verified in any supervisory review.
What planning does classification in Segment 4 by June 30, 2028 require?
The June 2028 deadline for formal classification in S4 may seem far off, but planning needs to start now.
That is because compliance with S4 is not a declaration. It is the result of a process that includes capital assessment, a review of the governance structure, implementation of controls and, potentially, adjustments to the business model.
PSAVs that leave this process for the last few months before the deadline risk reaching the date without enough capital or with governance gaps that prevent formal classification.
The ideal timeline starts with a full assessment of the current operation, and that assessment needs to happen now.
What do PSAVs still going through the authorization process need to consider now?
For those still going through the authorization process with the Central Bank, the new framework adds a layer of requirements that must already be addressed in the documentation submitted to the regulator.
This includes demonstrating that the proposed operating structure is compatible with S4 requirements, that AML/CFT controls are ready for an independent audit and that the available capital meets the minimum requirements.
Submitting an authorization application without this evidence significantly increases the risk of follow-up questions or rejection.
BLOCKBR Station was developed for exactly this context: connecting PSAVs that are being structured to the necessary regulatory integration layers (DTVM, custody, registration and legal) within an operational architecture that is born compatible with the level of requirements the Central Bank is formalizing.
What does the independent audit requirement add to the authorization process?
Since BCB Normative Instruction 739, of May 2026, the PSAV authorization process requires the submission of a reasonable assurance report issued by an independent auditor registered with the CVM.
This report is not a formality. It represents a technical opinion from an independent third party on the internal procedures the company has adopted to identify and prevent suspicious transactions, especially those related to money laundering and terrorist financing, under Law 9.613/1998.
In practice, this means that:
- It is not enough to state that AML/CFT controls exist; an external auditor must confirm that they work
- Internal documentation must be of sufficient quality to support a formal audit
- Processes must be traceable, with evidence that the auditor can verify and test
The Central Bank is explicit about the goal: to bring greater certainty to authorization decisions, align Brazil with international AML/CFT practices and strengthen the transparency of PSAVs’ internal controls.
For those structuring operations involving FIDC tokenization or other regulated digital assets, the logic is the same: internal controls must be verifiable, not just declared.
This standard is already the baseline for operating in more mature markets, and it is now formally required in Brazil.
BLOCKBR’s infrastructure was built with traceability and documented governance from the start, which means PSAVs that operate on it enter the audit process with structured evidence, not with documentation put together in a rush to satisfy the regulator.
What does this regulatory move reveal about the direction of the virtual asset market?
Taken together, the prudential classification of PSAVs and the independent audit requirement point in a clear direction: the virtual asset market in Brazil is being built on the same pillars as the traditional regulated financial market.
This has direct implications for those who operate or plan to operate in this space:
- The barrier to entry has risen. Operating as a PSAV now requires adequate capital, structured governance and auditable internal controls. Those without them will not obtain authorization, or will not survive supervision.
- Differentiation has shifted. In the new environment, the competitive advantage does not lie in being more agile in the absence of rules. It lies in having the right structure to operate efficiently within the rules.
- Investors gain more protection. Prudential requirements mean PSAVs must be financially sound, which reduces the risk of institutional collapses that harm clients.
For those following the debate on the future of the capital market, this move confirms what had already been signaled: digital asset regulation in Brazil will not converge toward a more permissive model.
It will converge toward a more robust one.
The prudential framework is not the obstacle. It is the new baseline. Those who already operate with real governance, adequate capital and auditable internal controls do not need to reinvent themselves, they need to document what they already do.
Those who do not yet have this structure need to build it before the deadlines arrive. If you want to understand how to structure your operation within this new standard, explore BLOCKBR’s infrastructure and assess what your operation needs to have ready before 2027.
Frequently asked questions about the prudential framework for PSAVs
What are PSAVs and why were they brought into the National Financial System’s prudential framework?
PSAVs are virtual asset service providers: companies authorized by the Central Bank to provide custody, intermediation and other services related to crypto assets and digital assets.
They were brought into the prudential framework because the activity they carry out is equivalent, in terms of risk and complexity, to that of securities brokerages and distributors. The regulatory principle applied is straightforward: equivalent activities require equivalent regulation.
What is the Type 3 classification for PSAVs?
The Type 3 classification, defined by BCB Resolution 436/2024, identifies institutions subject to direct regulation by the Central Bank. For PSAVs, this classification means they are subject to the same set of prudential rules applied to other categories of institutions supervised by the regulator, including capital, risk management and disclosure requirements.
What capital requirements will PSAVs need to meet?
PSAVs will need to maintain minimum capital consistent with Segment 4 of the National Financial System, calculated using methodologies defined by the Central Bank. The requirements include minimum base capital and additional amounts calculated according to the operation’s risk profile.
Formal classification in S4 must be completed by June 30, 2028, but the initial requirements take effect on January 1, 2027.
What is Segment 4 and how does it apply to PSAVs?
Segment 4 (S4) is a category in the National Financial System’s prudential segmentation intended for mid-sized institutions with activities of significant complexity.
PSAVs have been placed in this segment regardless of their size, which means that even smaller companies are subject to the same capital, governance and internal control requirements.
The prohibition on Segment 5 reinforces that the regulator does not recognize a simplified version of this activity.
Why does the Central Bank require an independent audit in the PSAV authorization process?
The requirement for a reasonable assurance report issued by an independent auditor registered with the CVM was introduced by BCB Normative Instruction 739/2026.
The goal is to replace self-declaration with external technical verification: the independent auditor confirms that controls to prevent money laundering and terrorist financing are effectively implemented and working. This raises the compliance standard from something declared to something verified.
What are the deadlines for PSAVs to comply with the new prudential framework?
There are two main milestones: January 1, 2027, when the prudential requirements (risk management, capital requirements and disclosure policies) take effect; and June 30, 2028, the deadline for formal classification in Segment 4.
PSAVs still going through the authorization process need to demonstrate, already in the documentation submitted to the Central Bank, that their structure is compatible with these requirements.
