The asset tokenization infrastructure for the regulated financial market now operates in a regulatory environment that is moving faster than many compliance teams can keep up with.
The publication of Joint Resolution 17/2025 by the Central Bank of Brazil is a direct example: what at first glance looks like a rule about naming is, in practice, an expansion of the regulatory compliance perimeter across the entire operational chain of fintechs and financial platforms.
For those working with compliance regulation in the sector, understanding the real scope of this decision is the starting point for an adjustment that goes far beyond changing a name.
This article analyzes what Resolution 17 establishes, what it requires from a compliance standpoint, what the deadlines are and what this rule reveals about the new regulatory standard the digital financial market needs to incorporate structurally.
What did the Central Bank establish and what is the regulatory logic behind the decision?
The Central Bank does not act on regulatory impulse. Every resolution it publishes is part of a regulatory agenda built consistently over time.
Joint Resolution 17/2025 is no exception: it puts into practice a position the Central Bank has been signaling for years, that commercial identity and regulatory structure must be consistent.
What is Joint Resolution 17/2025 and what does it prohibit?
Joint Resolution 17/2025, issued jointly by the Central Bank of Brazil and the National Monetary Council, prohibits institutions that are not authorized to operate as a bank from using the term “bank”, in any language or variation, in their corporate names, trade names, brands, domains, apps and communication materials.
The rule is objective: if the institution does not hold authorization as a multiple-service bank, commercial bank or equivalent institution, it cannot publicly identify itself with a term that, for the average consumer, refers directly to that regulatory category.
The scope of the prohibition covers the company’s entire identity surface, not just its corporate registration (CNPJ).
Why is the “bank” prohibition a compliance decision?
The logic behind the rule is about aligning activity, responsibility and representation. When a fintech without a banking license uses the term “bank” in its brand, it creates a perception among users that does not match its actual regulatory structure.
This is a compliance problem because it creates expectations the institution is not legally authorized to meet.
From a regulatory standpoint, a mismatch between name and license is not just an image problem, it is a compliance problem.
The Central Bank treats it as a failure of transparency toward the public and the financial system, which places the issue squarely within the scope of the role of financial compliance within organizations.
How does this rule fit into the Central Bank’s broader regulatory agenda?
Resolution 17 did not come out of nowhere. It is part of a regulatory sequence that includes BCB Resolutions 552 and 553 on digital assets, minimum capital rules for fintechs, the Banking as a Service regulatory framework and cybersecurity rules.
The pattern is consistent: the Central Bank is systematically aligning regulated activity, risk level and institutional responsibility.
For fintechs and financial platforms, this means Resolution 17 is not the end of a cycle, but one more step in a direction that will keep advancing.
What changes in compliance regulation for fintechs and financial platforms?
The most visible change is the name change. But the real scope of the adjustment goes much further. The compliance regulation imposed by Resolution 17 requires a systematic review of the company’s entire identity surface and, more importantly, an honest assessment of whether the license the institution holds matches the activities it actually carries out.
The compliance inventory each fintech needs to carry out covers, at a minimum, the following elements:
- Registered corporate name and trade name.
- Active domains and subdomains.
- Apps published in app stores.
- Corporate email addresses and communication domains.
- Physical and digital marketing materials.
- Contracts with clients, partners and correspondents.
- Social media profiles and handles.
- Regulatory communications with the Central Bank and other authorities.
Adjusting only external communications without reviewing contracts, registrations and the substance of the operation is insufficient from a regulatory standpoint. The Central Bank assesses compliance as a whole, not just what is visible in the shop window.
In addition, the rule requires institutions to review the scope of their activities. A fintech that operates under a BaaS model or that intermediates typically banking products needs to check whether its license properly covers what it does, because the prohibited term was often a symptom of a deeper mismatch between operation and authorization.
What are the deadlines and what does compliance need to deliver at each stage?
Joint Resolution 17/2025 sets an adjustment schedule that divides the process into two phases. The compliance team needs to structure specific deliverables for each of them.
Phase 1, 120 days from publication: within this period, the institution must complete a full mapping of every occurrence of the prohibited term in its identity and formally begin the adjustment process. This includes filing the necessary corporate changes, notifying partners and correspondents about the change and starting to update all public touchpoints. Compliance must document the adjustment plan with a schedule, owners and verification milestones.
Phase 2, up to 12 months from publication (ESTÁ CHEGANDO): the full transition must be completed. No institutional, digital, physical or contractual touchpoint may retain the prohibited term. Compliance needs to produce evidence of completion: updated registrations, revised contracts, republished apps, redirected or shut-down domains and confirmation that relevant partners have also adjusted.
The compliance structure must treat these deadlines as formal regulatory milestones, not internal targets.
Non-compliance exposes the institution to administrative proceedings by the Central Bank, which has already shown its willingness to impose sanctions in cases of persistent regulatory non-compliance.
What does this regulation reveal about the new compliance standard required of the market?
Resolution 17 reveals something beyond its specific subject: the regulator is signaling that regulatory clarity has become a criterion for operating, not just a matter of image. This has direct implications for how compliance is structured within fintechs and financial platforms.
The new standard emerging from this and other recent rules connects four dimensions that need to be aligned at the same time: the activity carried out, the license obtained, the capital maintained and the identity communicated.
When any of these dimensions is out of line, regulatory risk exists, regardless of whether the company intends to mislead the market.
This alignment is part of a broader regulatory agenda that includes the new virtual asset regulation, minimum capital requirements differentiated by type of institution and third-party governance requirements in the context of BaaS.
The market emerging from this process is one where real compliance is a verifiable competitive differentiator, not just something declared in an internal policy.
For those following the CVM’s tokenization agenda, this move is consistent: both the Central Bank and the CVM are building an environment where each agent’s authorization and responsibility are clear, traceable and match its actual role in the market.
How does the new regulatory environment reshape the market for fintechs and financial platforms?
Every rule that raises the level of regulatory requirements reshapes the market.
Resolution 17 is no different: it draws a line between those with a real regulatory structure and those that operated with ambiguity, whether intentional or not.
Who is best positioned in the new compliance environment and why?
The best-positioned institutions are those whose regulatory structure already matched their activity before the rule. For them, the adjustment is operational: an identity review without the need for deep strategic repositioning.
For institutions that used the term “bank” as part of a positioning strategy without equivalent regulatory backing, the process is more complex: it requires not only changing the name, but also reviewing the scope of the operation and possibly obtaining new authorizations.
In this sense, the new environment favors those who invested in regulatory infrastructure before investing in branding, which is exactly the opposite of the path part of the fintech market followed over the last decade.
How does the prohibition affect B2B relationships, due diligence and the sales cycle?
In the B2B context, the rule has immediate effects on the regulatory due diligence cycle. Platforms, asset managers and structurers that contract services from fintechs will need to check, in their partner onboarding and renewal processes, whether their counterparties comply with Resolution 17.
This adds a new item to the regulatory due diligence checklist and raises the standard required of those who want to be recognized as trustworthy partners in the market.
On the commercial side, fintechs going through the adjustment may face friction in ongoing negotiations, especially with institutional counterparties that have already built the rule into their compliance processes.
The sales cycle tends to be longer until the adjustment is completed and documented.
What do partners and infrastructure providers need to demonstrate in this new context?
Partners and infrastructure providers, especially those that serve as the technological and regulatory foundation for fintechs and platforms, need to demonstrate that their architecture is already aligned with the new regulatory standard.
This includes documenting the compatibility between the infrastructure’s license, the activities it enables and the internal controls it provides to its clients.
It is in this context that BlockBR Station acts as a regulatory integration hub: by connecting regulated agents, such as DTVMs, custodians and registrars, to BlockBR’s infrastructure, Station ensures that the compliance chain does not end at the main platform, but extends to every participant in the ecosystem that needs to be governed within the scope of current regulation.
Compliance regulation is what defines who operates with credibility in the long term.
There is a recurring temptation in the fintech market: to treat compliance as a cost and regulation as an obstacle. Joint Resolution 17/2025 is further evidence that this model cannot sustain a long-term operation.
The regulator is not creating arbitrary barriers; it is establishing that regulatory responsibility and commercial identity must match.
For fintechs and platforms that want to operate with credibility in the new environment, the key point is to ensure that the structure behind the name (license, capital, internal controls and third-party governance) lives up to what the regulated market requires.
And this is the argument that defines the difference between compliance as a formality and compliance as an operational foundation.
BlockBR’s infrastructure was built to integrate exactly these layers: a license compatible with the activity, adequate capital, real internal controls and third-party governance within an architecture that makes compliance a consequence of the structure, not an additional effort on top of it.
For platforms that want to operate in the new regulatory environment without building each compliance layer separately, BlockBR Whitelabel offers an integrated legal and technological foundation, already calibrated to the level of requirements the Central Bank is increasingly signaling.
The question the market needs to answer now is whether your regulatory structure supports what you operate. Those who answer this question honestly and act on the answer are the ones who will operate with credibility as the future of the capital market consolidates on more solid regulatory foundations.
Assess with BlockBR what your corporate structure needs in order to operate with a brand aligned with your license.
Get in touch and talk to our team specialized in regulatory infrastructure for financial platforms.
Frequently asked questions about compliance regulation for fintechs and financial platforms
What is Joint Resolution 17/2025 and how does it affect fintech compliance?
Joint Resolution 17/2025 is a rule issued by the Central Bank of Brazil and the National Monetary Council that prohibits institutions not authorized to operate as a bank from using the term “bank” anywhere in their identity. For fintech compliance, it expands the compliance perimeter beyond the operation itself: it covers names, domains, apps, contracts and marketing materials, requiring a structural review of the institutional identity.
Does the “bank” prohibition apply only to the corporate name, or also to domains and apps?
The prohibition applies to the institution’s entire identity surface: corporate name, trade name, domains, subdomains, apps, corporate emails, communication materials and contracts. The Central Bank assesses compliance as a whole, not just the formal registration with the Commercial Registry.
What is the deadline for compliance with Joint Resolution 17?
The rule sets two milestones: within the first 120 days, the institution must complete the mapping and formally begin the adjustment process. The full transition must be completed within 12 months of the resolution’s publication. Both deadlines should be treated as formal regulatory milestones, with documented evidence.
What does the compliance inventory need to cover for the adjustment to be complete?
The inventory needs to cover: corporate name, trade name, domains and subdomains, apps, email addresses, physical and digital marketing materials, contracts with clients and partners, social media profiles and regulatory communications. Adjusting only one of these elements without reviewing the others is insufficient from a regulatory standpoint.
What happens to fintechs that do not adjust their compliance within the deadline?
Fintechs that do not complete the adjustment within the deadlines set by Resolution 17 are subject to administrative proceedings by the Central Bank, which may impose regulatory sanctions. In addition, non-compliance creates friction in B2B relationships and due diligence processes with institutional counterparties that have already added the rule to their compliance checklists.
How does the “bank” prohibition affect the compliance of partners and correspondents?
Partners and correspondents of fintechs affected by the rule need to check whether joint contracts and communication materials contain the prohibited term and, if so, adjust them within the deadline. In addition, platforms and structurers that contract services from fintechs should include verification of compliance with Resolution 17 in their regulatory due diligence processes for partner onboarding and renewal. Asset tokenization within a structured regulatory environment requires the entire partner chain to be aligned with the same compliance standard.
