Brazil’s central bank requires every institution it has authorized to report crypto transfers of $10,000 or more to and from self-custody wallets, starting today. Resolution BCB 588, issued in late September, introduces a blanket reporting obligation that does not require anyone to suspect wrongdoing first. Brazil’s three-dimensional crypto market, worth about $252 billion by CryptoSlate’s count, now faces a reporting layer similar to what US money transmitters have operated under for years.
The rule is one of two Brazil issued on September 24. Resolution 589 expands ongoing compliance requirements for licensed service providers, with some provisions taking effect on January 1, 2027. Together they reshape how Brazil’s 120 or so crypto companies will handle transfers, records and customer due diligence.
What triggers the report
Resolution 588 sets a single threshold: $10,000 equivalent on any transfer between a self-custody wallet and an authorized institution, in either direction. A Brazilian exchange sending $12,000 in Bitcoin to a customer’s hardware wallet must file. An institution receiving $10,000 or more from a private wallet must also file. Reports go to Coaf by the next business day, the country’s financial intelligence unit.
The reporting obligation does not depend on suspicion. A customer开辟 a legitimate withdrawal above the threshold and enters Coaf’s database purely because of the amount and the transaction type. Institutions do not need to flag anything as unusual before filing. Coaf separately runs suspicious-activity reporting under its broader AML framework, and evaluation of flagged behavior remains outside the scope of this rule.
| Rule | Effective date | Applies to |
|---|---|---|
| Resolution BCB 588 | October 1, 2026 | BCB-authorized institutions, self-custody transfers of $10,000+ |
| Resolution BCB 589 | Staged from October 1, 2026 | Holding outbound transfers for review, plus AML amendments |
| Resolution BCB 589 (partial) | January 1, 2027 | Expanded reporting and unauthorized VASP measures |
Who is in scope
The rule covers any institution authorized by the Banco Central do Brasil that handles virtual assets: banks, exchanges, and other covered providers. Crypto companies already operating in the market face a transition deadline of October 30, 2026 to complete their compliance implementation, according to AIBC’s summary of the regulations. By January 2027, some will also need processes that can hold outbound transfers for further review before they hit the chain.
The $10,000 threshold is nominal and not indexed to inflation. That means the rule will capture an expanding slice of Brazilian crypto activity as the currency and the market grow. Bitcoin spent years moving upward through Brazil’s retail market with limited cross-border reporting. Threshold-based reporting, once switched on, tends to become part of the normal cost of doing business rather than a temporary squeeze.
What this means for users
For a Brazilian retail user moving small amounts, nothing changes. For high-value users, businesses, and anyone who runs a treasury through self-custody, the privacy of large transfers is gone. Every withdrawal of $10,000 or more now generates a record at Brazil’s financial intelligence unit, attached to the customer’s identity and the transaction hash.
Brazil’s rule follows a pattern seen in other markets. Spain introduced Model 721 self-custody reporting in earlier 2026 with its own thresholds and exemptions, and the EU has similar provisions in the MiCA package. Japan’s Financial Services Agency has studied self-custody reporting as part of a broader stablecoin framework. Brazil, at $252 billion in total market exposure, is one of the larger markets to adopt this tool.
Why it matters for the broader market
The self-custody rule signals that regulators no longer treat transactions to personal wallets as outside the AML perimeter. The old assumption, that once crypto left an exchange the institution’s compliance duty ended, is being reversed. What an institution does not know about its customer’s withdrawals still matters, but the fact of a large withdrawal is now a data point in its own right.
That shift has consequences for privacy tools. A self-custody database built from withdrawal reports could, over time, start mapping which Brazilian exchange customers hold which coins on-chain, as TFTC’s analysis points out. That kind of data does not require access to a customer’s personal wallet, only to the exchange’s own records. Aggregated across institutions, it sketches a picture of who moved what and when.
Institutions do not need to determine that a transaction is suspicious before filing, meaning legitimate transfers can enter Coaf’s reporting system solely because they meet the amount and transaction-type criteria.
Implementation friction
Getting systems ready in weeks is the hard part. Exchanges need to identify self-custody counterparties, calculate transaction values at the correct market rate, and integrate automatic filing into monitoring systems before the October deadline. Outbound holding procedures, required for some institutions by January, will change the user experience of a large withdrawal, turning an instant transfer into one that may be delayed pending review.
Coaf has signaled it will publish guidance on filing formats. Institutions that already process crypto transfers for institutional clients have more mature compliance stacks. Smaller consumer exchanges will feel the deadline more sharply.
Brazil’s crypto market remains one of the most active in the world, with stablecoins, derivatives and DeFi all seeing high local adoption. The BCB has treated crypto as a compliance topic for years, and these two resolutions formalize the reporting side. Whether the data leads to specific enforcement, or mostly to background risk analysis, will come out over time.
The read-through
Brazil now joins a group of large markets treating self-custody as a reporting event instead of a private activity. Exchanges in the United States, under FinCEN’s Travel Rule, already handle similar recordkeeping. Regulation in Brazil is not happening in a vacuum, and the transition deadlines suggest regulators expect institutions to be ready quickly.
For Brazilian crypto users the lesson is direct. Transfers to or from personal wallets above $10,000 now generate permanent records held by the financial intelligence unit. That does not make the transactions illegal, but it ends the assumption that moving funds off-chain leaves no trace. Traders, businesses and anyone running a treasury should assume their large withdrawals are visible even after they leave the exchange.