Itaú Unibanco, Brazil’s largest private bank, notified the Banco Central do Brasil (BCB) on Tuesday 27 October that it buys and sells crypto for clients and holds those assets in custody, the two services that together make up a crypto brokerage under the central bank’s new rules. Valor Econômico reported the filing, and CoinDesk, citing Valor on 28 October, describes Itaú as the first bank to formalise a crypto brokerage under the framework.
The filing is a notification, not a licence. It puts on record a service Itaú has run since December 2023, three days before 30 October, the date on which the 270-day transition window closes both for banks already active in crypto and for crypto firms that must apply for authorisation.
For the crypto firms the stakes are higher. A bank only has to notify. An exchange has to apply, and if it misses Friday’s date the rules give it 30 days to shut its crypto services. From 6 November, banks and other supervised institutions may no longer deal with unauthorised providers, under an amendment the BCB adopted on 23 September.
What Itaú filed: a crypto brokerage notification, not a licence
According to CoinDesk, Itaú told the central bank about two activities. The first is intermediation, meaning it executes clients’ orders to buy and sell crypto. The second is custody: it keeps the assets for them. A firm that does both falls into the “corretora” category, the Portuguese word for brokerage.
The Brazilian outlet BitNotícias, which links to Valor’s story, ran a headline saying Itaú was asking for a licence. Its own text says something narrower: the bank used the communication procedure open to institutions the BCB already supervises, rather than an authorisation request. TokenPost adds that the rules require the date of the notice and the declared service categories to be recorded in Unicad, the BCB’s register of supervised entities.
Guto Antunes, Itaú Unibanco’s superintendent for digital assets, tied the filing to security and governance. “An environment with clear rules and high standards of security and governance benefits the whole industry and, above all, consumers,” he said, as quoted by BitNotícias (our translation).
Two points are not established. The first is whether the central bank has acknowledged or accepted the notification. Neither Itaú nor the BCB had published a statement that Coindaro could find by midday on 28 October. The second is the claim that Itaú is the first bank to file. It comes from Valor, as relayed by CoinDesk and BitNotícias. Unicad entries were not public in any page we could open, and no source says whether Nubank, Bradesco, Santander, BTG Pactual or Inter has notified.
Itaú crypto trading has run since December 2023
Nothing changes for Itaú customers on the day of the filing. The service went live on 4 December 2023, TokenPost reports, with bitcoin and ether held in the bank’s custody. Its crypto page now lists 15 assets, including bitcoin, ether and the dollar stablecoin USDC, according to CoinDesk; TokenPost names Solana among them.
Itaú does not publish how many customers use the service or how much they trade, CoinDesk and BitNotícias both note. The filing says where the service sits in the rules. It says nothing about its size.
The bank itself is large. TokenPost puts Itaú first among Brazilian banks by total assets in 2025, at R$2.742 trillion, or about 15% of the listed banking sector. Other retail banks have gone the same way: in October Germany’s Sparkassen opened bitcoin trading in their banking app.
One new duty does follow. Resolution BCB 589 adds article 90-A to the rules: from 1 January 2027, banks that were already offering crypto when the framework took effect must send the BCB, straight away, the supervisory data asked of crypto firms. That means client balances, custody totals per client, proof of reserves for each asset and, where the bank offers staking, the assets committed to it. The central bank has yet to set the format.
How Brazil’s central bank crypto rules split banks from crypto firms
The framework rests on three resolutions dated 10 November 2025. Resolution BCB 519 governs the authorisation process, including financial capacity, the lawful origin of funds and governance. Resolution BCB 520 sets up the intermediation, custody and brokerage categories, requires client assets to be kept apart from the firm’s own, and lists which banks and brokers may offer crypto. Resolution BCB 521 amends the foreign-exchange rules to cover virtual assets. The rules came into force on 2 February 2026, and our page on Brazil’s 30 October crypto licence deadline sets out each step.
The key split is between two routes. Banks and the securities and foreign-exchange brokers the BCB already licenses use a notification, backed by an independent technical certification. A bank that starts crypto from scratch must wait 90 days after notifying, a period in which the BCB can block the launch (article 21). One that was already active on 2 February, like Itaú, had 270 days to notify (article 22). Dedicated virtual-asset service providers, known in Brazil as SPSAVs, must apply for authorisation and wait for a decision.
The bar for applicants is high. Minimum capital runs from R$10.8 million to R$37.2 million depending on the activities a firm declares, lawyer Maria Estela de Azevedo Guedes of Cepeda Advogados told Capital Aberto in a 7 October article, and the magazine notes that each firm needs a dedicated board with at least three directors answerable to the central bank. Newcomers who want the basics of what a broker does with client coins can read our guide to how a centralized exchange handles KYC and custody.
30 October filing, then a 6 November ban on unauthorised counterparties
Friday 30 October is the last day for crypto firms already operating in Brazil to file the first phase of their authorisation request, under Normative Instruction BCB 704, Capital Aberto reports. A firm that files on time may keep serving clients until its process is decided, but may not add another category meanwhile (article 88 of Resolution 520). A firm that does not file must stop its crypto services within 30 days, as CoinDesk reports and the same article states, which by our count means 29 November.
The second date binds the banks, Itaú included. On 23 September the BCB adopted Resolution BCB 589, which moved the start of the counterparty ban in article 91 of Resolution 520 from 30 October to 6 November 2026. From that day, banks, payment institutions and other institutions the central bank authorises may not carry out or facilitate virtual-asset operations with providers that are not authorised to operate in Brazil, except in the ways the resolution expressly allows.
Whether that ban reaches firms still awaiting a decision depends on which BCB text you read. The original article 91 spared providers “in the process of authorisation”. The new wording drops those words. Yet the central bank’s announcement of 23 September still describes the target as entities that are neither authorised nor in the authorisation process. Capital Aberto repeats the new wording without addressing pending files, and our deadline page reads the change, taken literally, as narrowing protection for applicants. Coindaro found no BCB clarification by 28 October.
The same September package carried more obligations. Since 1 October, under Resolution BCB 588, transfers of US$10,000 or more to or from self-custody wallets are reported to Coaf, Brazil’s financial intelligence unit. From 1 January 2027, crypto firms that have filed must send the BCB extra supervisory data, including balances, custody totals per client, proof of reserves and assets held for staking, under Resolution 589.
| Date | What happens | Source |
|---|---|---|
| 10 November 2025 | Resolutions BCB 519, 520 and 521 published | BCB |
| 2 February 2026 | Rules in force; 270-day window opens for firms and banks already active | Res. BCB 520 |
| 23 September 2026 | Resolution BCB 589 moves the counterparty ban to 6 November | BCB |
| 1 October 2026 | Self-custody transfers of US$10,000 or more reported to Coaf | Res. BCB 588 |
| 27 October 2026 | Itaú notifies the BCB of its crypto brokerage | Valor via CoinDesk, BitNotícias |
| 30 October 2026 | End of the 270-day window; phase 1 filing deadline for crypto firms already operating | Res. BCB 520, Capital Aberto (IN BCB 704) |
| 6 November 2026 | Supervised institutions barred from dealing with unauthorised providers | Res. BCB 589 |
| 29 November 2026 | Firms that did not file must have stopped crypto services (30 days) | Res. BCB 520 art. 88, CoinDesk |
| 1 January 2027 | Extra supervisory data due from firms that filed and from banks already active | Res. BCB 589 |
Who else is applying, and who is leaving
Crypto-only firms face the harder route, and some are taking it while others give up.
Mercado Bitcoin told CoinDesk it is seeking authorisation as a virtual-asset brokerage. BitNotícias, in separate stories linked from its Itaú article, reported that Mercado Bitcoin has asked the BCB for a licence and that Ripio has filed to operate as a brokerage and foreign-exchange business. It also cites a monitor run by Cainvest that counts 17 firms with formal requests. Coindaro has not seen that list, and the BCB publishes no count.
At least 11 crypto platforms had announced they were closing or scaling back in Brazil by September, Victor Guilhamat, head of regulatory affairs at Binance in Brazil, told Capital Aberto. He did not name them, and the central bank has published no figure. “The reduction in competition is worrying,” he said (our translation), because competition is what brings innovation and lower fees.
Guedes warned against reading too much into Friday. “30 October is the first filter of the licensing marathon, and it is far from the last,” she told Capital Aberto (our translation). No public database shows how many providers were active on 2 February, she said, so the first reliable count of filings and closures should come in late November or early December.
What the Itaú filing does not settle
The central bank has not said whether Itaú’s notification is complete, or whether other banks have filed. It has not published a list of the crypto firms that applied.
For Brazilian users, the practical questions come after Friday. A platform that did not file has until about 29 November to stop. From 6 November, banks will have to check which crypto firms they can keep working with, and the treatment of pending applicants is unsettled. The country’s currency was already in focus this week, after the real was priced about 10% lower in Sunday futures following Lula’s win, while USDT reached R$5.42 as the spot market was shut.
Next on the calendar: the filings close on 30 October, the counterparty ban starts on 6 November, and the first count of who filed and who left is expected in late November or early December. On 1 January 2027 the new reporting duties start, for crypto firms and for banks such as Itaú.