On the night of September 23, the Central Bank of Brazil issued two more resolutions—No. 588 and No. 589—formally pulling self-custody wallets into the reporting network.
Let’s clarify the key figures first: any virtual-asset transaction involving transfers into or out of a self-custody wallet—if a single transaction is equal to or exceeds $10,000 (about R$51,700)—requires institutions to report to the Financial Activities Control Committee (Coaf). The deadline is the next business day after the transaction, and it is not conditioned on “suspicion”; if it meets the threshold, it must be reported. “Self-custody” means the wallet where the user holds the private keys themselves, with no intermediary custody of the assets. The central bank’s rationale is straightforward: these operations provide the least monitoring information available, so transparency must be added.
The accompanying Resolution No. 589 is the other side of the coin: it prohibits financial institutions, payment institutions, and authorized crypto businesses from conducting virtual-asset business with entities that have not been authorized by the central bank and are not included in the authorization application process.
Remember three timeline points: the new rules take effect on October 1, at the same time as the deadline for virtual-asset service providers to submit authorization applications; starting November 6, trading with unauthorized entities is officially banned (originally set for October 30, later extended by one week); and on January 1, 2027, partial data-reporting obligations take effect.
What best illustrates the current situation is a comparison: as of September 18, the central bank had received only five authorization applications (four under review and one rejected), while market estimates suggest Brazil has about 120 crypto service companies. The gap between the compliance window and the industry’s actual scale is the biggest source of uncertainty in the coming months.
These rules already had groundwork: Resolution No. 521 issued in May 2026 requires service providers to identify self-custody wallet owners, and in July, the Federal Tax Authority’s DeCripto reporting regime went live. Same action, but investors now face multi-layer reporting.
I don’t think this is “banning self-custody.” What it changes is the attribute of on-chain transfers—from anonymous displacement to identity-based reporting. But there’s an obvious gap: the text does not clearly specify that multiple small transfers split across batches should be aggregated and counted toward the $10,000 threshold, meaning there may still be room to split and evade in theory. So it’s more of a deterrent than an outright interception.
If the market you’re in copies these rules tomorrow, will you first change your withdrawal habits, or will you just split things up? Tell me what you’d do.
#Central Bank of Brazil requires reporting transfers of $10,000 self-custody wallets
Let’s clarify the key figures first: any virtual-asset transaction involving transfers into or out of a self-custody wallet—if a single transaction is equal to or exceeds $10,000 (about R$51,700)—requires institutions to report to the Financial Activities Control Committee (Coaf). The deadline is the next business day after the transaction, and it is not conditioned on “suspicion”; if it meets the threshold, it must be reported. “Self-custody” means the wallet where the user holds the private keys themselves, with no intermediary custody of the assets. The central bank’s rationale is straightforward: these operations provide the least monitoring information available, so transparency must be added.
The accompanying Resolution No. 589 is the other side of the coin: it prohibits financial institutions, payment institutions, and authorized crypto businesses from conducting virtual-asset business with entities that have not been authorized by the central bank and are not included in the authorization application process.
Remember three timeline points: the new rules take effect on October 1, at the same time as the deadline for virtual-asset service providers to submit authorization applications; starting November 6, trading with unauthorized entities is officially banned (originally set for October 30, later extended by one week); and on January 1, 2027, partial data-reporting obligations take effect.
What best illustrates the current situation is a comparison: as of September 18, the central bank had received only five authorization applications (four under review and one rejected), while market estimates suggest Brazil has about 120 crypto service companies. The gap between the compliance window and the industry’s actual scale is the biggest source of uncertainty in the coming months.
These rules already had groundwork: Resolution No. 521 issued in May 2026 requires service providers to identify self-custody wallet owners, and in July, the Federal Tax Authority’s DeCripto reporting regime went live. Same action, but investors now face multi-layer reporting.
I don’t think this is “banning self-custody.” What it changes is the attribute of on-chain transfers—from anonymous displacement to identity-based reporting. But there’s an obvious gap: the text does not clearly specify that multiple small transfers split across batches should be aggregated and counted toward the $10,000 threshold, meaning there may still be room to split and evade in theory. So it’s more of a deterrent than an outright interception.
If the market you’re in copies these rules tomorrow, will you first change your withdrawal habits, or will you just split things up? Tell me what you’d do.
#Central Bank of Brazil requires reporting transfers of $10,000 self-custody wallets