BCB Resolution No. 520 — Regulates the establishment and operation of virtual asset service providers and the provision of virtual asset services by other institutions authorized by the Central Bank of Brazil

BCB RESOLUTION NO. 520, OF NOVEMBER 10, 2025

Regulates the establishment and operation of virtual asset service providers and the provision of virtual asset services by other institutions authorized to operate by the Central Bank of Brazil.

The Collegiate Board of the Central Bank of Brazil, in a session held on November 6, 2025, based on arts. 9 and 10, caput, items IX and X, of Law No. 4.595, of December 31, 1964, 9º-A of Law No. 4.728, of July 14, 1965, 9º, caput, items II and XIV, of Law No. 12.865, of October 9, 2013, 2º to 5º, 7º, 8º and 9º of Law No. 14.478, of December 21, 2022, and 1º and 2º of Decree No. 11.563, of June 13, 2023,

RESOLVES:

CHAPTER I
ON THE OBJECT AND SCOPE OF APPLICATION

Art. 1º This Resolution regulates the establishment and operation of virtual asset service providers and the provision of virtual asset services by other institutions authorized to operate by the Central Bank of Brazil.

Sole paragraph. For the purposes of the caput, the operation of virtual asset service providers in the country is characterized if the provider:

I - is incorporated in Brazil, in accordance with applicable legislation and regulation; and

II - has its headquarters and administration located in national territory and subject to the Brazilian legal system and authorities.

CHAPTER II
ON DEFINITIONS

Art. 2º For the purposes of this Resolution, the following are considered:

I - airdrop: free distribution of virtual assets to clients or users of products or services of the virtual asset service provider, through a system based on distributed ledger technology (Distributed Ledger Technology – DLT) or similar, generally with the objective of increasing liquidity or fostering the project in its early stages;

II - fiat-referenced virtual asset (stablecoin): the virtual asset backed by reserve assets created with the purpose of maintaining its value linked to the value of a reference fiat currency;

III - asset or assets of a fiat-referenced virtual asset reserve: the fiat currency and public bonds issued by the same governments that issue these currencies;

IV - virtual asset wallet: mechanism that allows accessing, managing, and authorizing transactions with virtual assets in a system based on distributed ledger technology or similar;

V - cold wallet: the virtual asset wallet that is not constantly connected to the worldwide computer network (internet);

VI - hot wallet: the virtual asset wallet kept constantly connected to the worldwide computer network;

VII - warm wallet: the virtual asset wallet that represents an intermediate category between cold and hot wallets, being kept connected to the worldwide computer network with added security layers;

VIII - private key: instrument of control of virtual assets, in the form of a cryptographic signature mechanism, that authenticates transactions with virtual assets and other operations for validation purposes in systems based on distributed ledger technology or similar;

IX - smart contract: program designed and executed through a computational algorithm that promotes the automation of functions associated with predefined conditions in a system based on distributed ledger technology or similar;

X - virtual asset market makers: institutions and entities incorporated as legal entities that act, on their own behalf, under the terms of contracting by a virtual asset service provider, presenting buy and sell offers of virtual assets in the trading environment administered by the contracting virtual asset service provider, in a continuous and frequent manner, as defined in contract, with the purpose of fostering liquidity in the virtual asset market;

XI - virtual asset trading: the purchase, sale, and exchange of virtual assets;

XII - virtual asset service providers: the virtual asset service providers and the institutions authorized to operate by the Central Bank of Brazil that act in the virtual asset market in the manner established by this Resolution;

XIII - proof of reserves: mechanism used to demonstrate that the virtual asset service provider possesses the virtual assets it declares to have on behalf of its clients and users;

XIV - virtual asset market liquidity providers: institutions and entities incorporated as legal entities that act, on their own behalf, under the terms of contracting by a virtual asset service provider, having institutional investors and the virtual asset service providers themselves as main counterparties, with the purpose of providing liquidity to the virtual asset market;

XV - financial resources: values in book or electronic currency, maintained in deposit or payment accounts of clients or users of virtual asset service providers; and

XVI - staking of virtual assets: the process by which a person, natural or legal, allows their virtual assets to be blocked by the virtual asset service provider with the purpose of participating in the validation of transactions occurring in a system based on distributed ledger technology or similar that uses proof of stake as a consensus mechanism, being able to enjoy the receipt of rewards.

CHAPTER III
ON REGULATED VIRTUAL ASSETS

Art. 3º The virtual assets subject to the regime of this Resolution are the virtual assets referred to in art. 3º, caput, of Law No. 14.478, of December 21, 2022, except for the exceptions contained in items I to IV of that article.

CHAPTER IV
ON MODALITIES OF VIRTUAL ASSET SERVICE PROVIDERS

Art. 4º The virtual asset service providers are institutions authorized to operate by the Central Bank of Brazil that execute, on behalf of third parties, the provision of virtual asset services in the modalities provided for in this Resolution.

§ 1º The societies referred to in the caput are classified into the following modalities, according to the virtual asset services provided:

I - virtual asset intermediaries;

II - virtual asset custodians; and

III - virtual asset brokers.

§ 2º It is prohibited for the virtual asset service providers referred to in § 1º, items I and II, to execute combined activities of other modalities of virtual asset service providers.

Art. 5º Virtual asset service providers may only exercise the activities expressly provided for in this Resolution and in other regulations in force.

Section IOn Virtual Asset Intermediaries

Art. 6º Virtual asset intermediaries have as their corporate object the intermediation of virtual assets.

Art. 7º The intermediation of virtual assets, mentioned in art. 6º, comprises the realization, exclusively, of the following activities, on behalf of third parties, individually or cumulatively:

I - subscribe, alone or in consortium with other authorized societies, issuances of virtual assets;

II - buy, sell, and exchange virtual assets;

III - administer virtual asset wallets or wallets composed of virtual assets, securities, financial assets, and other financial instruments admitted in specific regulation;

IV - exercise functions of fiduciary agent in virtual asset market operations;

V - carry out staking operations of virtual assets;

VI - practice operations of providing virtual asset services in the foreign exchange market; and

VII - exercise other activities expressly authorized by the Central Bank of Brazil.

§ 1º In addition to carrying out the activities mentioned in the caput, virtual asset intermediaries may act as:

I - electronic money issuers;

II - virtual asset market liquidity providers;

III - virtual asset market makers; and

IV - financial service providers, in distributed ledger or similar systems, in services:

a) for issuers in the structuring of virtual asset offers; and

b) of financial advice, including analysis of benefits and risks involved in the trading of virtual assets that the virtual asset intermediary does not offer.

§ 2º The activities referred to in items I to VI of the caput and items I and IV of § 1º must, additionally, be carried out in compliance with specific regulations, including authorization rules established by the Central Bank of Brazil and the Securities and Exchange Commission in their respective spheres of competence.

§ 3º The activities referred to in item VI of the caput must, additionally, be carried out in compliance with the regulation that governs the foreign exchange market.

§ 4º The virtual asset service provider that intends to carry out the services mentioned in items II to IV of § 1º must previously communicate to the Central Bank of Brazil its intention to act in these activities.

Section IIOn Virtual Asset Custodians

Art. 8º Virtual asset custodians have as their corporate object the custody of virtual assets.

Art. 9º The custody of virtual assets mentioned in art. 8º comprises the realization, exclusively, of the following activities, individually or cumulatively:

I - the safekeeping and control of the instruments that affect the exercise of rights and benefits related to the virtual asset, such as private keys;

II - the description, timely updated, of the virtual asset position, of each type of asset of the client or user of the custody contract, as well as the timely reconciliation of this position with the pertinent information available in distributed ledger technology or similar systems;

III - the compliance with movement instructions issued by the holder of the virtual asset or the person to whom the power to act in the interest of the holder was delegated, as well as the conservation of these instructions;

IV - the handling of events incident on the virtual asset; and

V - the administration of data and relevant information to the exercise of any of the activities described in items I to IV regarding the holder and their custodied virtual assets.

§ 1º The safekeeping mentioned in item I of the caput includes the adoption of measures that mitigate the risk of violation to the integrity and any other characteristic of the custodied virtual assets whose violation causes or may cause prejudice to the fair exercise of rights by the holder of the virtual assets.

§ 2º The control mentioned in item I of the caput refers to the capacity of the virtual asset custodian to ensure that:

I - the rights and other benefits arising from the virtual asset are timely and opportune available to the client holder for their use and enjoyment; and

II - only the client holder of the virtual asset or their attorney may enjoy the rights and other benefits arising from it.

§ 3º The handling of events incident on the virtual asset mentioned in item IV of the caput refers to the adequate response to events that affect factors such as the quantity, value, and ownership of the virtual asset, rights or benefits, as well as the phenomenon that causes such change.

§ 4º The data and information referred to in item V of the caput comprise, in addition to those listed in this Resolution, the information and data that:

I - affect, or may affect, the adequate enjoyment of the rights or benefits arising from the ownership of the virtual asset; and

II - relate to the compliance with legislation and regulation aimed at preventing and combating money laundering and the financing of terrorism and the proliferation of weapons of mass destruction, as well as the prevention of fraud.

§ 5º Only the virtual asset custodian authorized to perform the set of activities described in items I to IV of the caput may carry out staking operations of virtual assets for its clients or users, as provided in this Resolution.

§ 6º The contracting of a mechanism or technological service by the virtual asset custodian for the performance of its activities is only permitted if the provider attests, in a specific document, that the said mechanism or service does not allow the provider to affect, in any way, the activities listed in items I to IV of the caput or the exercise of rights related to virtual assets.

§ 7º The technological mechanism or service contracted from the provider of this type of service by a virtual asset custodian, mentioned in § 6º, is considered relevant for purposes:

I - of the provision of this Resolution, falling under the provision of art. 33, § 1º, item V; and

II - of application of the current regulation on the contracting of data processing and storage services and cloud computing by financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

Section IIIOn Virtual Asset Brokers

Art. 10. Virtual asset brokers have as their corporate object the intermediation and custody of virtual assets.

Section IVOn Other Applicable Operational Norms

Art. 11. Virtual asset service providers may obtain loans or financing from financial institutions and other institutions authorized to operate by the Central Bank of Brazil, provided that:

I - linked to:

a) the acquisition of assets for own use; or

b) the execution, in a proven manner, of activities provided for in the respective corporate object; and

II - observing the limit of twice the respective Reference Equity for the set of these operations, in accordance with the regulation in force.

Sole paragraph. If the virtual asset service provider is not obliged to calculate the Reference Equity, in accordance with specific regulation, the limit referred to in item II of the caput shall be calculated based on the sum of the balance of the Equity Account, calculated at the end of the last fiscal year, and the Creditor Result Accounts, subtracted from the balances of the Debtor Result Accounts of the period.

Art. 12. It is prohibited for virtual asset service providers:

I - to carry out operations that characterize, in any form, the offering of credit to their clients and users;

II - to capture resources from the public, except through the issuance of shares; and

III - to participate in the capital of other financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

Section VOn Operations and Activities Carried Out on Own Account

Art. 13. In operations and activities carried out on their own account by virtual asset service providers, the standards established by the National Monetary Council and the Central Bank of Brazil for prudential purposes must be met, at a minimum, such as standards related to integrated risk management and capital management.

§ 1º The provision of the caput applies to the activities referred to in art. 7º, § 1º, items II and III, when carried out on their own account.

§ 2º The deadlines and conditions for compliance with the provision of the caput will be the subject of treatment in a specific regulation.

CHAPTER V
ON THE ESTABLISHMENT, NAME, AND GOVERNANCE OF VIRTUAL ASSET SERVICE PROVIDERS

Section IOn Establishment

Art. 14. The virtual asset service provider must:

I - be incorporated as a limited liability company or a corporation;

II - have as its main corporate object the activities listed in this Resolution, according to the modality of operation performed; and

III - have at least three directors or administrators responsible to the Central Bank of Brazil for compliance with the regulation regarding:

a) the conduct of the activities and business developed by the institution;

b) the prevention and combating of money laundering and the financing of terrorism and the proliferation of weapons of mass destruction;

c) the institution's internal control systems and compliance with current regulation;

d) the institution's risk management structure, capital management, and information disclosure policy; and

e) the cybersecurity policy and the execution of the action and incident response plan, in accordance with the regulation in force.

§ 1º It is permitted to designate the same director for the responsibilities referred to in item III, letters “a” to “e”, of the caput, except in cases of incompatibility, conflict of interest, or cases not admitted in legal and regulatory norms.

§ 2º It is prohibited the incorporation of a virtual asset service provider as a business society in which a natural person appears as the sole partner.

Section IIOn Name and Minimum Governance

Art. 15. The virtual asset service provider must:

I - possess, in its corporate name, the expression “Virtual Asset Service Provider Society”;

II - inform, through its communication channels and customer and user service, clearly, of its status as a virtual asset service provider society; and

III - clearly and unequivocally disclose, on its website and mobile device applications made available, the modality in which it is classified, as provided in art. 4º, § 1º.

§ 1º The expression “Virtual Asset Service Provider Society” is exclusive to virtual asset service provider societies.

§ 2º It is prohibited for virtual asset service providers to use corporate names that:

I - confuse clients and users of their services regarding their classification in the modalities referred to in art. 4º, § 1º; and

II - include a term or fragment of a term related to unauthorized activity or that suggests such activity, in Portuguese or in a foreign language.

§ 3º The virtual asset service provider that, before the start of the validity of this Resolution, acts in the virtual asset market in a manner different from that indicated in items I to III of the caput, as well as in § 1º, must adjust to the provision of the corresponding devices prior to the protocol of the authorization request for operation.

Art. 16. The virtual asset service provider must implement a governance policy aimed at ensuring compliance with the regulation that governs these institutions.

Sole paragraph. The governance policy referred to in the caput must, at a minimum:

I - contain the definition of duties and responsibilities;

II - be adequately documented and subject to reviews every two years, with this documentation maintained, at any time, available to the Central Bank of Brazil; and

III - be approved:

a) by the board of directors or, in the absence thereof, by the board of the corporation; or

b) by the administrators responsible for the limited company.

Art. 17. The use of the term “director” is exclusive to persons elected or appointed in the manner of the bylaws or articles of association of the virtual asset service provider society.

Section IIIOn Capital

Art. 18. The capital of the virtual asset service provider must be realized in current currency, and it is also permitted that the increase in this capital be fully paid with resources originating from:

I - accumulated profits;

II - capital and profit reserves; or

III - credits to shareholders as remuneration of capital.

§ 1º The subscription of capital in current currency must be carried out through immediate full payment of the total value subscribed.

§ 2º In the case of societies in operation, the provision of this article does not apply to capital payments effected in a period prior to the requirement of authorization for operation.

CHAPTER VI
ON THE AUTHORIZATION FOR OPERATION OF VIRTUAL ASSET SERVICE PROVIDERS

Art. 19. Virtual asset service providers must request authorization from the Central Bank of Brazil to start the provision of virtual asset services in the modalities referred to in this Resolution.

Sole paragraph. Societies that, on the date of entry into force of this Resolution, are carrying out one or more of the activities indicated in art. 7º, caput and items, and in art. 9º, caput and items, must observe the provision of art. 88.

CHAPTER VII
ON THE PROVISION OF VIRTUAL ASSET SERVICES BY OTHER INSTITUTIONS AUTHORIZED TO OPERATE BY THE CENTRAL BANK OF BRAZIL

Art. 20. In addition to virtual asset service providers, only the following financial institutions and other institutions authorized to operate by the Central Bank of Brazil may provide virtual asset intermediation and custody services:

I - commercial banks, foreign exchange banks, investment banks, multiple banks, and the Federal Savings Bank; and

II - securities brokerage firms, securities distribution firms, and foreign exchange brokerage firms.

Sole paragraph. Foreign exchange brokerage firms, to which item II of the caput refers, may only act in the modality of virtual asset intermediation, except for the provision of art. 72, caput.

CHAPTER VIII
ON COMMUNICATION REGARDING THE PROVISION OF VIRTUAL ASSET SERVICES

Section IOn the Eligible Authorized Institution Not Acting in the Virtual Asset Market

Art. 21. The institution referred to in art. 20 interested in providing the virtual asset intermediation and custody services referred to in this Resolution may only start these activities after ninety days counted from the date of formal communication to the Central Bank of Brazil, in the manner and with the certifications required under the terms of specific regulation.

§ 1º The Central Bank of Brazil, during the period mentioned in the caput, may request new information from the institution, and may determine, at its discretion, that the institution's operations are not started due to:

I - the result of a technical certification prepared by a qualified independent entity, under terms to be defined in specific regulation;

II - pending points for regularization arising from an inspection process conducted by the Central Bank of Brazil; or

III - other relevant facts and occurrences to be considered by the Central Bank of Brazil.

§ 2º The Central Bank of Brazil may disregard the points referred to in item II of § 1º, provided that, at its discretion, there is an action plan for regularization duly homologated by the supervision effectively in progress.

§ 3º To carry out the formal communication referred to in the caput, the institution referred to in art. 20 must be:

I - authorized to operate by the Central Bank of Brazil for at least three hundred and sixty-five days, and

II - in regular activity in the segment for which it has been authorized.

Section IIOn the Eligible Authorized Institution Acting in the Virtual Asset Market

---

Art. 22. The institution referred to in Art. 20 that, as of the date of entry into force of this Resolution, performs activities in the virtual assets market must formally communicate with the Central Bank of Brazil, within a period of two hundred and seventy days, counted from said date.

§ 1º The institution referred to in the caput must, from the date of entry into force of this Resolution, adjust its operational processes to fully align its operational policies, considering the performance of activities in the virtual assets market.

§ 2º The formal communication referred to in the caput must be accompanied by a technical certification result prepared by a qualified independent company, in accordance with terms to be defined in specific regulation, which certifies that the institution meets the requirements of this Resolution.

§ 3º The Central Bank of Brazil may request new information to evaluate the operations of the institution referred to in the caput.

§ 4º The Central Bank of Brazil may determine the cessation of the operations of the institution referred to in the caput, within a period of thirty days, counted from the notification of this Autarchy:

I - due to the criteria indicated in Art. 21, § 1º, items I to III, observed the provisions of § 2º of the same article; or

II - due to the inadequate documentation of the formal communication referred to in the caput.

§ 5º The Central Bank of Brazil may establish, in complementary regulation, the duty of observance of specific requirements by the institution referred to in the caput.

§ 6º The institution that does not timely file its formal communication may only continue to exercise the activity of providing virtual asset services for up to thirty days after the end of the period established in the caput.

Section III
Of the entity constituted abroad operating in the virtual assets market in activity

Art. 23. The entity constituted abroad that performs activities in the virtual assets market in the country on the date of entry into force of this Resolution, in any of the activities of the virtual asset service provision modalities referred to in Art. 4º, § 1º, and that intends to operate regularly in the country after the entry into force of this Resolution must transfer, within two hundred and seventy days from said date, its operations and clients to:

I - institution referred to in Art. 20 that meets the provisions of Section II; or

II - virtual asset service provider society in operation or specifically constituted to carry out this transition and operate in the virtual assets market.

§ 1º The entity referred to in the caput must ensure that the process of transfer of operations and clients and the results arising from it satisfy:

I - the principles of continuity, security, transparency, and informed consent of clients or users; and

II - the requirements of asset segregation, governance, internal controls, and data protection provided for in the legislation and this Resolution.

§ 2º During the process of transfer of its operations and clients, the entity referred to in the caput must ensure that the successor institution assumes full responsibility:

I - for the continuity of service provision to its clients, according to the interest of these clients;

II - for the observance of rights and duties related to these clients; and

III - for compliance with all operational, regulatory, and governance requirements provided for in this Resolution.

§ 3º The institution indicated in item I of the caput that succeeds the entity constituted abroad in its operations and clients, observed the terms of this article, must formally communicate to the Central Bank of Brazil, until the end of the period indicated in the caput, about the performance of activities in said market, accompanied by the certification referred to in Art. 22, § 2º, additionally applying the provisions of §§ 3º to 6º of the same article.

§ 4º The institution indicated in item II of the caput must observe the regulation regarding the authorization process of virtual asset service provider societies for the performance of their activities, including regarding their treatment for transition purposes, for the country, of the operation and clients of the entity constituted abroad.

§ 5º The exercise of activities in the virtual assets market in the country, by the entity referred to in the caput, must be terminated as soon as the process of transfer of its operations and clients is completed, in the manner of this Section.

§ 6º If the transfer process does not end within the period stipulated in the caput, the entity referred to therein must terminate the exercise of activities in the virtual assets market in the country at the end of said period.

Section IV
Of the non-compliance with deadlines by eligible institutions

Art. 24. Financial institutions and other institutions authorized to operate by the Central Bank of Brazil that operate in the virtual assets market until the date of entry into force of this Resolution and do not meet, for the purpose of regularizing their activities, the deadlines indicated in this Chapter will be subject to the penalties provided for in specific regulation.

CHAPTER IX
OF THE GENERAL OBLIGATIONS OF VIRTUAL ASSET SERVICE PROVIDERS

Section I
Of the liability of virtual asset service providers

Art. 25. Virtual asset service providers are responsible, in operations carried out with virtual assets with their clients, users, and other institutions that operate in the virtual assets market with which they have operated or are operating, according to the scope of their activities and the services effectively provided:

I - for the settlement of operations carried out in the virtual assets market within the agreed deadlines and conditions;

II - for the legitimacy of the virtual assets offered, traded, or custodied on behalf of their clients, users, and other counterparties;

III - for the confidentiality, integrity, availability, security, and secrecy of data and information regarding transactions involving virtual assets;

IV - for the provision and proof of records of all virtual asset operations carried out in the name of their clients and users, whether these records are maintained in centralized or decentralized systems; and

V - for the legitimacy of power of attorney or documents necessary for the transfer of virtual assets.

Art. 26. Virtual asset service providers must maintain, for each area of activity they develop, a technically qualified person responsible for operations.

Sole Paragraph. It is permitted to accumulate areas of activity under the responsibility of the same director or administrator, except in cases of incompatibility, conflict of interest, or cases not admitted in legal and regulatory norms.

Art. 27. Virtual asset service providers must inform their clients, users, and other interested parties which modalities and activities they are performing, among those specified in this Resolution.

Sole Paragraph. The provision of the information referred to in the caput must meet the following criteria:

I - in the case of clients and users of the virtual asset service provider, this information must be integrated into the service provision contract; and

II - in the case of clients and users and other interested parties, this information must be indicated on the provider's website on the internet or in the applications provided by it for electronic devices.

Section II
Of the asset separation between the provider's financial resources and the virtual assets of its clients and users

Subsection I
Of the separation of financial resources

Art. 28. Virtual asset service providers must keep their own financial resources segregated from the financial resources of their clients and users, through individualized payment or deposit accounts in the name of these clients and users.

§ 1º The payment or deposit account referred to in the caput must be offered:

I - by the virtual asset service provider, if this institution is authorized to operate in the offer of payment or deposit accounts; or

II - through financial institutions or other institutions authorized to operate by the Central Bank of Brazil, on behalf of the clients or users of the virtual asset service provider, which will act as the recipient of these services.

§ 2º The offer of payment or deposit accounts by virtual asset service providers and other institutions authorized to operate by the Central Bank of Brazil, in the terms of § 1º, must be carried out in conformity with the regulation that disciplines the offer of these accounts by institutions authorized to operate by the Central Bank of Brazil.

§ 3º The offer of payment or deposit account for virtual asset service providers, by financial institutions and other institutions authorized to operate by the Central Bank of Brazil, referred to in item II of § 1º, must be carried out in conformity with the regulation that deals with the provision of services carried out between these institutions (Banking as a Service).

Subsection II
Of the separation of virtual assets

Art. 29. Virtual asset service providers must adopt mechanisms and procedures that allow for the separation between their virtual assets and the virtual assets owned by their clients and users.

Art. 30. The mechanisms and procedures adopted for the asset segregation between the virtual assets of the virtual asset service provider and its clients and users, referred to in Art. 29, must be documented in a specific operational policy of the virtual asset service provider that establishes, at minimum:

I - the separation of client and user virtual assets in distinct virtual asset wallets from the virtual asset wallets used by the virtual asset service provider for its own operations;

II - the methods used to carry out proof of reserves;

III - the carrying out of independent audit on the statements of the virtual asset service provider, regarding the virtual assets of this provider and its clients and users, on a biennial basis, with a reasonable level of assurance, in accordance with specific regulation; and

IV - the cases in which it is necessary to transfer the virtual assets of its clients or users to other virtual asset service providers or to the clients and users themselves, due to situations involving the interruption or discontinuity of service provision by this institution.

§ 1º The independent audit report prepared in view of the provision of item III of the caput must be publicly disclosed on the virtual asset service provider's website on the internet.

§ 2º With regard to the provision in the caput, it is admitted that virtual asset service providers keep virtual assets of their ownership in the virtual asset wallets of their clients and users, exclusively for the purpose of covering the immediate liquidity need for the execution of transactions of these clients and users.

§ 3º The virtual assets of ownership of the virtual asset service provider referred to in § 2º must:

I - be free and unencumbered by any block or restriction;

II - be limited to the amount equivalent to 5% (five percent) of the total quantity of virtual assets owned by clients or users registered in the system based on distributed ledger technology or similar; and

III - be identified, clearly and distinctly, in the recording and internal control systems of the virtual asset service provider.

§ 4º The admission provided for in § 2º:

I - cannot imply burdens or charges for the clients or users who enjoy said benefit; and

II - must be included in the service provision contract established between the virtual asset service provider and its client or user.

§ 5º Virtual asset service providers must designate a member of the board of directors or administrator to be responsible for asset segregation in the competent spheres, as well as for the provision of information and data pertinent to it.

§ 6º For the purposes of the provision in § 5º, it is permitted to indicate a director or administrator who has responsibility for other activities in the virtual asset service provider, except in cases of incompatibility, conflict of interest, or cases not admitted in legal and regulatory norms.

Section III
Of prohibitions

Art. 31. It is prohibited for virtual asset service providers to use assets owned by their clients, users, or other business counterparties to carry out their own operations.

§ 1º The prohibition indicated in the caput does not apply to operations:

I - of staking of virtual assets, meeting the recommendations and specific regulation applicable to these operations; and

II - carried out with virtual assets owned by qualified or professional investors, as defined in the regulation of the Securities and Exchange Commission (CVM), with the express consent of these investors.

§ 2º The operations referred to in this article must be preceded by the provision to interested parties of clear, precise, and explicit information regarding the execution conditions and the risks involved.

Section IV
Of the contracting of relevant services

Subsection I
Of relevant services

Art. 32. Virtual asset service providers must observe the provisions of this Resolution as a condition for contracting providers of relevant services in the country and abroad, among other relevant service contracts for their operation.

Art. 33. The relevant services referred to in Art. 32 are those that affect the performance of the activities of the virtual asset service provider or that affect, or may affect, the full exercise of the rights of client or user of the virtual asset service provider.

§ 1º Examples of relevant services for the provision of virtual asset services are:

I - virtual asset custody services;

II - liquidity provider services for operations in the virtual assets market;

III - market maker services for operations in the virtual assets market;

IV - electronic money issuance and offer of payment or deposit account services; and

V - technology services, when specifically related to the provision of virtual asset services by virtual asset service providers.

§ 2º The technology services mentioned in item V of § 1º are considered relevant for the purpose of applying the current regulation on the contracting of data processing and storage services and cloud computing by financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

Subsection II
Of general rules

Art. 34. The virtual asset service provider, in contracting relevant services for its activities, must:

I - preliminarily verify the technical, operational, and compliance capacity with current legislation and regulation by the contracted institution or entity;

II - elaborate and keep updated robust recovery plans for positions and control of virtual assets and financial resources of clients and users, in case of incidents affecting these virtual assets and financial resources, involving the contracted institution or entity;

III - establish, jointly with the contracted institution or entity, internal controls that allow for the monitoring and identification of sanction lists and addresses of sanctioned virtual asset wallets, in the country or abroad, as a fundamental part of the prevention of risks associated with money laundering and terrorist financing and the proliferation of weapons of mass destruction;

IV - comply with the general and specific rules indicated for the modalities and activities disciplined in this Resolution;

V - carry out this contracting in conformity with specific regulation that disciplines the provision of such services (Banking as a Service), in the case of services contracted from other institutions authorized to operate by the Central Bank of Brazil; and

VI - offer to its clients, users, and other business counterparties clear and transparent information regarding the involvement of other contracted institutions or entities in the provision of relevant services, safeguarding the secrecy of confidential and commercially sensitive information and data.

Sole Paragraph. The contracting virtual asset service provider must ensure the compatibility of the plan provided for in item II of the caput with its action and response plan for incidents and with the implementation of its cybersecurity policy, provided for in current regulation.

Art. 35. The institution or entity contracted to provide relevant services must act on behalf and under the guidelines of the contracting virtual asset service provider, which remains, in accordance with regulation, responsible for the services provided to clients, users, and other institutions in the virtual assets market through the contracted entity.

Art. 36. The contracting virtual asset service provider is responsible for the integrity, reliability, security, and secrecy of transactions carried out through the institution or entity contracted for operations carried out under the signed contract, as well as for compliance with legislation and regulation related to these transactions.

Subsection III
Of prohibitions

Art. 37. The contract related to the contracting of relevant service, referred to in Art. 32, must contain a clause prohibiting the contracted institution or entity from charging the clients and users of the contracting virtual asset service provider in the form of tariffs, commissions, or values regarding the reimbursement of services provided in the supply of products or services of responsibility of said contracted institution or entity.

Subsection IV
Of liquidity providers

Art. 38. In contracting liquidity providers for operations in the virtual assets market, the service provision contract signed between the virtual asset service provider and the contracted liquidity provider must provide, at minimum:

I - the business model adopted for negotiations with virtual assets;

II - the form and criteria regarding the definition of negotiated prices for virtual assets;

III - the deadlines to be respected in negotiations, the form of settlement of operations, and the form of transfer of virtual assets; and

IV - the criteria and procedures adopted to ensure that the settlement and custody transfer of virtual assets are carried out in a safe and effective manner.

§ 1º The contract must additionally provide that, in operations carried out in the trading environment administered by the contracting virtual asset service provider, it is prohibited for the contracted liquidity provider to act having as counterparties the other clients and users of the contracting provider.

§ 2º The provision in § 1º does not apply to operations carried out in the form of quote request (request for quote), referred to in Art. 67, § 6º.

§ 3º The contracting virtual asset service provider is responsible to the Central Bank of Brazil for the operations carried out by the contracted liquidity provider, regardless of whether these operations occur in its trading environment or not.

Subsection V
Of market makers

Art. 39. In contracting market makers for operations in the virtual assets market, the service provision contract signed between the virtual asset service provider and the contracted market maker must provide, at minimum:

I - any benefits granted by the contracting virtual asset service provider to the contracted market maker; and

II - the minimum parameters of operation of the contracted market maker in the trading environment of the contracting virtual asset service provider, regarding each virtual asset included in the contract, considering, at minimum:

a) the frequency of operations to be carried out;

b) the minimum quantity of virtual asset offers to be presented; and

c) the maximum price differentials between buy and sell offers to be respected.

§ 1º The contract must provide that the contracted market maker:

I - does not have any type of informational or technical advantage in carrying out operations in the trading environment administered by the contracting virtual asset service provider; and

II - acts under conditions of equality with other participants, clients, or users, so as not to generate distortions in the quantities and prices of virtual assets or not to have other advantages in its favor in negotiations for any of the participants, clients, or users of this environment.

§ 2º The contract must provide that it is prohibited for the contracted market maker to carry out operations in the trading environment administered by the contracting virtual asset service provider having as counterparty the contracting virtual asset service provider or institutions part of its economic conglomerate.

Subsection VI
Of general provisions

Art. 40. The contracting virtual asset service provider must include, in the service provision contract with the institution or entity contracted for the provision of relevant services, a provision that this institution or entity, for the performance of the supervision duties of the Central Bank of Brazil:

I - provides the information and documents necessary for the performance of these duties; and

II - allows access by the Central Bank of Brazil to the documentation and information regarding the products and services provided, as well as to the premises of the contractor.

Art. 41. Virtual asset service providers, at the time of formalizing business with their clients and users, must inform them about the participation of contracted institutions or entities in the scope of the services and operations they offer, highlighting the contracts that may represent risks to the client or user, in addition to indicating the ways to mitigate these risks in the established relationships.

§ 1º With regard to the provision in the caput, contracting virtual asset service providers must additionally offer sufficient information about the contracted institutions and entities and the services provided so that the client or user can understand the implications and relevance of these participations, safeguarding the secrecy of confidential and commercially sensitive information.

§ 2º If the virtual asset service provider, controlled or affiliated institution or entity is the provider of multiple relevant services, or counterparty in virtual assets market operations involving its clients and users, possible conflicts of interest and measures applied for their mitigation must be indicated to the clients and users.

Art. 42. The virtual asset service provider contracting relevant services shall appoint a director or administrator responsible for contracting such relevant service providers, as well as for providing data and information regarding the service provided to the Central Bank of Brazil.

Sole paragraph. For the purposes of the provision in the caput, it is permitted to indicate a director or administrator who has responsibility for other activities in the virtual asset service provider, except in cases of incompatibility, conflict of interest, or cases not admitted in legal and regulatory norms.

Section V Governance in the provision of services

Art. 43. Virtual asset service providers must keep permanently updated, preferably in electronic format, and available to the Central Bank of Brazil, their policies, measures, procedures, and requirements regarding:

I - the conduct of their collaborators;

II - the collection and analysis of information and data for the purposes of records and monitoring of operations carried out;

III - the combating of fraud and crimes in general;

IV - risk management and business continuity;

V - the management of services provided by third parties;

VI - the custody and protection of private keys and other control instruments of virtual assets;

VII - the prevention and combating of money laundering, terrorist financing, and the proliferation of weapons of mass destruction;

VIII - institutional security;

IX - cybersecurity;

X - the contracting of data processing and storage services and cloud computing; and

XI - the protection of personal data of clients, users, and other related parties.

§ 1º The provisions in items I to XI of the caput must be compatible with the applicable legislation and regulation.

§ 2º To comply with the provision in the caput, virtual asset service providers must, additionally:

I - carry out internal risk assessments with the purpose of mitigating vulnerabilities in the activities performed;

II - carry out regular training for their collaborators with the purpose of dealing appropriately with the general risks of their activity;

III - offer, to their clients, users, suppliers, and other related parties, informative content that favors the dissemination of knowledge about best practices and existing risks in operations carried out in the virtual asset market;

IV - indicate emergency contacts, kept permanently updated to meet demands from the Central Bank of Brazil;

V - reinforce, in accordance with specific legislation and regulation, the sharing of information regarding suspicious lists and restrictive lists of legal and natural persons, national and international, among institutions part of the National Financial System, the Brazilian Payments System, and the virtual asset market;

VI - establish, in line with specific regulation and their internal policies and procedures, as applicable, limits for transactions and withdrawals, as well as temporary blocks in cases of atypical or suspicious transactions and withdrawals; and

VII - keep available to the Central Bank of Brazil records of atypical or suspicious transactions and withdrawals, as the case may be, in accordance with the legislation and regulation governing the combating of the use of the National Financial System for the commission of crimes.

§ 3º The policies referred to in the caput must contain, among other guidelines, clear and direct provisions on the assignment of responsibilities and accountability.

§ 4º The provision in item IV of the caput regarding business continuity must cover the estimated timeframes for:

I - the restart and recovery of activities in case of interruption of the critical business processes of the virtual asset service provider, its suppliers, and other contractors; and

II - the adoption of internal and external communication actions necessary to provide guidance on the restoration of their activities.

§ 5º The suspicious lists referred to in item V of § 2º refer to lists prepared by the Financial Action Task Force – FATF with the purpose of identifying countries with weak measures to combat money laundering, terrorist financing, and the proliferation of weapons of mass destruction.

Section VI Control and monitoring of operations

Art. 44. Virtual asset service providers must, in the development of their activities, comply with the provisions in specific regulation regarding the prevention and combating of money laundering, terrorist financing, and the proliferation of weapons of mass destruction.

Sole paragraph. In addition to the provision in the caput, in operations involving virtual assets, the virtual asset service provider must provide the institution receiving the resources with information regarding:

I - the originator of the operation, including, at a minimum:

a) the name or trade name of the sender;

b) the complete identification of the payment or deposit account, or equivalent international account identification;

c) the residential or domicile address;

d) the number in the Individual Taxpayer Registry – CPF or the National Registry of Legal Entities – CNPJ, or the equivalent international identification number, in the case of persons not required to register in the aforementioned registries; and

e) the identification of the virtual asset wallet of the transaction; and

II - the beneficiary of the operation, including, at a minimum:

a) the name or trade name;

b) the complete identification of the payment or deposit account, or equivalent international account identification; and

c) the identification of the virtual asset wallet of the transaction.

Art. 45. The virtual asset service provider must, additionally:

I - adapt its internal control systems and risk management policies to comply with the determination in arts. 43 and 44 and in specific regulation;

II - keep stored the records of information about the transactions carried out, available to the Central Bank of Brazil for a minimum period of five years; and

III - identify, in accordance with specific legislation, suspicious or irregular operations in accordance with the terms of the legislation and regulation governing the combating of the criminal use of the National Financial System, such as laws and regulations dealing with the prevention and combating of money laundering, terrorist financing, and the proliferation of weapons of mass destruction, and keep records of these operations available to the responsible bodies and other competent authorities, such as the Central Bank of Brazil.

Sole paragraph. The records of the operations referred to in item III of the caput must be kept updated and remain available to the Central Bank of Brazil, preferably in electronic format.

Art. 46. Virtual asset service providers, to comply with the provision in art. 44, must inform the Central Bank of Brazil, in a timely manner, about any difficulties in controlling and monitoring operations with virtual assets resulting from practices adopted by other institutions authorized to operate by the Central Bank of Brazil.

Art. 47. Virtual asset service providers, in procedures intended for the control and monitoring of transactions involving virtual assets, must implement measures for customer and user due diligence, as well as for commercial partners and outsourced service providers, observing the other determinations contained in specific regulation.

Section VII Security measures and procedures

Art. 48. Virtual asset service providers must institute and maintain measures and procedures aimed at ensuring the security, resilience, and adequate functioning of the computational environment used to support the provision of virtual asset services, covering, at a minimum:

I - identity management and logical and physical access control, with a view to preventing unauthorized individuals from accessing resources and sensitive data;

II - mechanisms for continuous security monitoring and incident response, with the objective of detecting and responding to possible threats and incidents;

III - the adoption of preventive measures to mitigate cyber incidents that could compromise their activities, particularly in operations involving operators of the decentralized finance segment;

IV - procedures for granting authorizations, creating passwords, and access controls based on hierarchies, as well as mechanisms for preventive deactivation in suspicious situations;

V - fostering a security culture among their employees, service providers, and other related parties;

VI - the establishment of continuity plans to deal with scenarios that include security breaches or disasters affecting their operation;

VII - the use of best security practices, including in terms of training, technical certifications for the institution and its technical staff, and external qualification processes to reinforce these practices; and

VIII - the testing of computer systems and programs used by the virtual asset service provider, including smart contracts that affect the performance of their activities, which comprise:

a) vulnerability analyses of the systems, programs used, and the institution's computational environment;

b) review of the performance of systems and programs used by independent analysts; and

c) robustness and security tests of the systems and programs used.

Sole paragraph. The security measures and procedures referred to in the caput must:

I - be documented and included, where applicable, in the cybersecurity policy of the virtual asset service provider, provided for in the current regulation; and

II - ensure the confidentiality, integrity, availability, security, and secrecy of information and data, as well as the protection of personal data of clients, users, and other business parties of the virtual asset service provider.

Art. 49. Virtual asset service providers must implement and maintain policies for the custody and protection of the control instruments of the virtual assets of their clients and users, which must include, at a minimum:

I - documented procedures for the generation, custody, and management of these virtual asset control instruments, including the specification of the methods and techniques used to execute transactions;

II - the eventual distribution of virtual assets in different virtual asset wallets, in accordance with the provisions in the specific rules of the virtual asset custody services referred to in this Resolution;

III - the security modules used for such purposes, as applicable;

IV - procedures for granting and deactivating the virtual asset control instruments;

V - procedures for mitigating compromises in the policy for the custody and protection of virtual asset control instruments; and

VI - the rules and conditions for granting access, including hierarchies that consider responsibilities and limits compatible with the degree of access to the virtual asset control instruments.

§ 1º The rules referred to in the caput apply to the private keys of virtual assets held by the virtual asset service provider on behalf of its clients and users.

§ 2º Virtual asset service providers must adopt protocols for the access, storage, and protection of the control instruments referred to in the caput, and may consider the use of encryption and other information security techniques.

§ 3º In the event of the adoption of multiple or segmented private keys, these must be stored in different locations.

§ 4º The policy for the custody and protection of the virtual asset control instruments referred to in the caput must be documented and be compatible, where applicable, with the cybersecurity policy of the virtual asset service provider, provided for in the current regulation.

Art. 50. Virtual asset service providers must implement and maintain mechanisms for continuous monitoring of institutional security and risk assessment, with the objective of detecting, preventing, and responding to possible threats and incidents.

Art. 51. In the case of contracting an institution or company to provide services for the purposes provided for in arts. 48 and 49, the responsibility for observing compliance with the provisions of this Section remains with the virtual asset service provider.

Section VIII Information about the virtual asset service provider

Art. 52. The virtual asset service provider must keep available to clients and users information about its own institution and the characteristics of the services it performs, clearly indicating the legislation and regulation applicable to its activity.

§ 1º The virtual asset service provider must widely disclose, to the general public, on its website and in applications made available by the institution:

I - the information and data regarding the authorization or the pending authorization request at the Central Bank of Brazil for the provision of virtual asset services;

II - regulatory licenses and its status regarding compliance with applicable local and international regulations;

III - the organizational policies referred to in this Resolution;

IV - the terms and conditions of service provision, possibly in the form of a standard service provision contract, highlighting the rights and obligations of the client or user;

V - the list of other institutions or entities occasionally involved in the provision of virtual asset services, with their respective address, contact, and responsible person identification data; and

VI - any existing conflicts of interest and the measures adopted for their mitigation.

§ 2º The information referred to in the caput may be adjusted according to its sensitivity for the purpose of complying with clauses that impose business confidentiality on the parties involved in the contracts signed by the virtual asset service provider.

§ 3º The terms and conditions of service provision referred to in item IV of § 1º must be clear to the clients and users of the virtual asset service provider, who must acknowledge their rights and obligations, as well as any eventual conditions.

§ 4º The obligations mentioned in item IV of § 1º cover the security measures that must be recommended to clients and users.

Art. 53. The virtual asset service provider must provide clear information to its clients and users regarding the existence or absence of coverage, guarantee funds, or insurance for the services performed by it, observing the provision in art. 68, including by entities or institutions contracted by it, highlighting, at a minimum:

I - the scope of covered services;

II - the identification of the institution or entity responsible for the coverage;

III - the conditions that imply the triggering of the coverage;

IV - the available channels and the necessary procedures for triggering coverage; and

V - the exceptions to the relevant guarantee coverage.

Art. 54. The information and data related in arts. 52 and 53 must be presented to the client or user during the registration process, prior to the signing of the service provision contract.

Art. 55. The virtual asset service provider must timely communicate to clients any changes involving the information related in arts. 52 and 53.

Section IX Information about the rights and obligations of clients and users

Art. 56. The virtual asset service provider must inform its clients and users about the rights and obligations involved in the relationship between clients, users, virtual asset service providers, and other institutions or entities involved, as well as the existence of any eventual conditions, considering, at a minimum:

I - the security measures that must be observed by the client or user in carrying out their operations;

II - the deposit and withdrawal policies for financial resources, as well as the limits, timeframes, and other associated procedures;

III - the existence of coverage mechanisms for specific risks involving virtual assets, such as insurance against fraud and cyber risks; and

IV - the methods and timeframes for obtaining reports, statements of custodied positions and transactions carried out, and other documents, in a sufficiently detailed manner, considering, for example, data such as prices, volumes, dates, and times of negotiations.

Section X Procedures for the storage of control instruments

Art. 57. The virtual asset service provider must inform its clients and users, clearly and precisely, about the functioning of the processes for custody, safekeeping, and storage of the control instruments of the virtual assets owned by these clients and users, regardless of whether such services are executed directly by it or by third parties.

§ 1º In the case of service provision by contracted entities or institutions, the responsibilities of each member of the service provision chain and the risks associated with the procedures must be clearly explained to the clients.

§ 2º If the client or user opts for self-custody, the virtual asset service provider must clarify the necessary security measures and the risks related to this mode of custody of the control instruments of their virtual assets.

§ 3º The virtual asset service provider must ensure that the provision of information referred to in the caput is compatible, where applicable, with the mechanisms for disseminating the cybersecurity culture provided for in its cybersecurity policy, in accordance with current regulation.

§ 4º The rules referred to in the caput apply to the private keys of virtual assets held by the virtual asset service provider on behalf of its clients and users.

Section XI Client risk profile assessment

Art. 58. Virtual asset service providers must know the profile of the client or user regarding their level of familiarity with the virtual asset market, their financial interests, and their risk tolerance in the virtual asset market.

Art. 59. In the situation where the client or user wishes to carry out operations incompatible with their profile in the virtual asset market, the virtual asset service provider must request a specific declaration or risk awareness term, in which the client or user assumes responsibility for the risks incurred.

§ 1º In applicable situations, virtual asset service providers must guide their clients or users to obtain independent financial advice, observing the applicable specific regulation.

§ 2º The risk profile assessment of clients or users of the virtual asset market, as well as the declaration or term referred to in this Section, must be documented and remain available to the Central Bank of Brazil, preferably in electronic format.

Section XII Communication channels

Art. 60. Clients and users must be informed about the communication channels and support resources for meeting demands made available by the virtual asset service provider, in accordance with current regulation.

§ 1º The communication channels and support resources mentioned in the caput must include the option of human service.

§ 2º The support resources referred to in the caput must cover assistance and guidance to the client or user in case of security incidents, breaches, or service interruptions by the virtual asset service provider and the institutions or entities contracted by it.

Section XIII Remuneration for the provision of services

Art. 61. Virtual asset service providers, for the purposes of providing services linked to virtual assets in the virtual asset market, may charge remuneration for the provision of services to clients and users, conceptualized as a fee, exclusively for services related to the activities included in the intermediation and custody of virtual assets modalities defined in this Resolution.

Art. 62. The charging of a fee by the virtual asset service provider requires that the conditions for service provision and payment of the respective fee, as well as the corresponding triggering event and the value charged or its estimate, be previously made explicit to the client or user, with subsequent availability of a receipt, statement, or demonstration of the final payment, even in the case of charging with the respective posting of the charged value in the eventual account held at the institution.

Art. 63. Virtual asset service providers must observe, complementarily, the regulation that provides for the charging of fees for the provision of services by financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

CHAPTER X
PROVISION OF SPECIFIC VIRTUAL ASSET SERVICES

Section I Intermediation of virtual assets modality

Subsection I Eligibility of virtual assets offered by intermediaries

Art. 64. The selection of virtual assets offered by virtual asset service providers must be carried out based on clear, justified, transparent, and widely disseminated criteria, regarding the processes of offering, listing, suspension, and delisting of these assets.

§ 1º For the purposes of the provision in the caput, virtual asset service providers must establish specific policies for the offering, listing, suspension, and delisting of their virtual assets, based on decisions by technical committees established for this purpose.

§ 2º The policies referred to in § 1º must cover, at a minimum, the following aspects:

I - categorization of the virtual assets offered, considering their fundamental characteristics regarding their purpose as investment or payment;

II - critical review of available documents regarding the virtual asset to be offered, with emphasis on its intrinsic risks;

III - prohibition of offering virtual assets that contain characteristics of fragility, insecurity, or risks that favor fraud or crimes, such as virtual assets designated to favor practices of money laundering, terrorist financing, and the proliferation of weapons of mass destruction through facilitation of anonymity or difficulty in identifying the holder;

IV - rules for the periodic review of the virtual assets offered by the virtual asset service provider;

---

V - definition of practices preceding suspension or delisting processes, with the purpose of protecting clients who hold the affected virtual assets; and

VI - the information sources related to transactions involving the virtual asset, including those available for obtaining price quotes and financial volumes of the traded virtual assets.

§ 3º For the purpose of complying with the provisions of this article, virtual asset service providers must additionally consider the requirements set forth in the Annex to this Resolution in the virtual asset selection processes.

§ 4º The virtual asset service provider must keep available:

I - to the Central Bank of Brazil, preferably in electronic format, the updated documents related to the process governed by this Section; and

II - to the public, the list of virtual assets offered by it, permanently updated on its website and on the applications made available for electronic devices.

§ 5º The provisions of this article do not imply liability or guarantee by the virtual asset service provider for the results arising from the acquisition and trading of virtual assets by clients or users.

Subsection II
Requirements for the Eligibility of Fiat-Referenced Virtual Assets

Art. 65. In addition to the requirements referred to in Art. 64, in the selection processes of fiat-referenced virtual assets for offering or listing on their platforms, virtual asset service providers must consider, at a minimum:

I - the adequacy and regularity of the fiat-referenced virtual asset in relation to the regulation concerning public offerings in organized markets in the country of origin of the virtual asset issuer, as applicable;

II - public statements by countries and international organizations regarding failures or deviations in purpose in the use of the fiat-referenced virtual asset;

III - the quality of the price stabilization mechanism of the fiat-referenced virtual asset in relation to the aforementioned purpose;

IV - the guidelines established by the issuer of the fiat-referenced virtual asset to select and maintain the reserve assets of the fiat-referenced virtual asset, as well as the risks related to such reserve assets, including in terms of possible restrictions on the formalities adopted to serve as a safeguard for the holder client;

V - the information and data available, from reputable sources, attesting to the correct and total constitution of the reserves of the fiat-referenced virtual asset and the reserve assets linked to it, such as proof of reserves;

VI - the safeguards established by the issuer of the fiat-referenced virtual asset for situations affecting this asset, especially in favor of the holder client;

VII - the audited financial statements of the issuer of the fiat-referenced virtual asset, the custodians of the fiat-referenced virtual asset, and the reserve assets of this virtual asset, in the country or abroad, as available;

VIII - the risk rating of the issuer of the fiat-referenced virtual asset, the custodians of the fiat-referenced virtual asset, and the reserve assets of this virtual asset, in the country or abroad, as available;

IX - the risk rating of the fiat-referenced virtual asset, as available; and

X - the risk rating of the country where the issuer of the fiat-referenced virtual asset and the custodians of the fiat-referenced virtual asset and the reserve assets of the fiat-referenced virtual asset are established, as available.

§ 1º For the purpose of this Resolution, the reserve assets of fiat-referenced virtual assets are the fiat currency and public bonds issued by the same governments that issue these currencies.

§ 2º With regard to the provisions of item IV of the caput, virtual asset service providers must, additionally, in situations of discontinuation of the issuer of the fiat-referenced virtual asset:

I - clearly and unequivocally indicate, in the service provision contract, the rights and possible restrictions of the client or user regarding access to the reserve assets of the fiat-referenced virtual asset, as applicable;

II - indicate the means and method for claiming these assets by the client or user, in applicable situations, whether they are available in the country or abroad; and

III - clarify how the virtual asset service provider will act in situations involving the right of the client or user to claim the redemption of their financial resources or the reserve assets of the fiat-referenced virtual asset.

§ 3º It is prohibited for virtual asset service providers operating in the country to directly offer or in their trading environments fiat-referenced virtual assets whose reserve asset control mechanisms are carried out by algorithms.

§ 4º Virtual asset service providers must publicly disclose the selection criteria for the offering of fiat-referenced virtual assets governed by this Resolution, so that clients and other interested parties can verify the alignment of the method employed with their objectives and interests.

§ 5º The proof of reserves referred to in item V of the caput refers to the mechanism used by the issuer of fiat-referenced virtual assets to demonstrate that it actually possesses the reserve assets of the fiat-referenced virtual asset.

§ 6º The information referred to in items VIII to X of the caput must be accompanied by the identification of the institution responsible for the relevant risk rating.

Subsection III
Suspension of Trading

Art. 66. The Central Bank of Brazil may determine the suspension of admission to trading of virtual assets offered by virtual asset service providers that operate the trading environments or systems, as well as the interruption of intermediation of transactions with virtual assets, as it identifies the use of the virtual asset in situations incompatible with current regulation.

Subsection IV
Provision of Information on Virtual Assets

Art. 67. Virtual asset service providers, in providing information to their clients and users, in compatibility with the eligibility requirements of the virtual assets to be offered, must provide on their website and on the applications of electronic devices provided by them, in a clear and transparent manner, information related to the virtual asset and the technology involved, considering the nature of the asset and the risks involved in its acquisition, as well as, at a minimum:

I - the information and data of the issuer, promoter, or creator of the virtual asset, as well as of the developer of the technology underlying the virtual asset, as applicable;

II - the indication of any related parties to it, which fall under the situations of item I;

III - the description of the technology used by the virtual asset and its functionalities;

IV - the objective, terms, rights, and obligations related to the virtual asset;

V - the details regarding the reserve and stabilization mechanism of the fiat-referenced virtual asset, informed and ensured by the issuers of such assets, if applicable;

VI - the existing market for the virtual asset, considering parameters such as volatility, liquidity, and other relevant characteristics, and the source of obtaining the presented information must be mentioned;

VII - the methods and conditions for trading or redeeming the virtual asset by the virtual asset service provider; and

VIII - the fees, taxes, and other charges and burdens incident on the execution of transactions with virtual assets.

§ 1º The information and data referred to in item I of the caput must include, in the case of fiat-referenced virtual assets, those contained in the documents referred to in Art. 65, caput, items VIII to X, and § 2º, items I to III, even in a synthetic form.

§ 2º The methods and conditions for trading referred to in item VII of the caput, whether by means of mechanisms analogous to order books for assets or by offers of virtual asset quotes (request for quotes), must be transmitted clearly to the client or user, as well as the methodology for obtaining and forming the price of the virtual asset.

§ 3º The virtual asset service provider must inform clients and users of all situations in which it acts as a counterparty, directly, in transactions involving virtual assets, indicating, as applicable, conditions and prices distinct from those offered by it to favor the decision-making by the client or user regarding the purchase or sale of the virtual asset.

§ 4º In situations where the virtual asset service provider uses mechanisms analogous to virtual asset order books, with real-time display of data from different buyers and sellers acting, the offers must:

I - be displayed in a way that the conditions of the order and its execution are clear to the client or user; and

II - follow the "price-time" closing priority, that is, order matching must obey the closing criteria according to the best price for the client and the priority of buy and sell offers according to the registration time, in the case of equal prices.

§ 5º The virtual asset service provider must make available to clients and users, as applicable, the historical performance of the virtual asset over time, including data such as its quote, traded volume, and the time of transactions carried out.

§ 6º In transactions carried out in the format of virtual asset quote offers (request for quote), virtual asset service providers must inform, in a clear and transparent manner, the interested client or user:

I - the available price quotes for the offer to buy or sell the presented virtual asset;

II - the quantities available for the offer to buy or sell the presented virtual asset;

III - the maximum valid tolerance period for acceptance of the buy or sell price of the presented offer;

IV - the valid period and terms for the settlement of the presented transaction;

V - the possible participation of the virtual asset service provider, an entity or institution affiliated with or controlled by it, as a counterparty in the presented offer;

VI - the counterparty and settlement risks related to the quoting counterparty of the presented quote; and

VII - the possible guarantee of the execution of the transaction, in the presented form, by the virtual asset service provider, in case the quoting counterparty does not honor the presented quote within the indicated periods and conditions.

§ 7º In situations where transactions are carried out through the exchange of virtual assets, the virtual asset service provider must explicitly indicate the prices of the assets involved in these exchanges, in addition to the other conditions set forth in this Subsection, as applicable.

§ 8º The virtual asset service provider must keep available to the Central Bank of Brazil the records related to the transactions carried out in the form of §§ 6º and 7º.

Art. 68. The virtual asset service provider, in offering any virtual asset to its clients or users, must explicitly indicate the absence of coverage for the offered virtual assets:

I - by the Credit Guarantee Fund – FGC;

II - by the Cooperative Credit Guarantee Fund – FGCoop; and

III - by analogous funds for the virtual asset market, as applicable.

Subsection V
Mitigation of Conflicts of Interest in Intermediation

Art. 69. Virtual asset service providers, in combining the virtual asset intermediation activities permitted to them in Art. 7º, must adopt procedures and effective means to separate the functions performed that imply potential or actual conflicts of interest between these activities.

Sole Paragraph. The separation referred to in the caput must consider, at a minimum:

I - the separation of units according to whether their activities are performed on their own account or for their clients and users;

II - the implementation of consistent policies to prevent the use of information that implies any privilege in favor of their technical units, which could compromise their respective objectives and independence;

III - the assurance that the units have qualified technical administrators and adequate and independent monitoring spheres;

IV - the adoption of practices aimed at transparency and relevant disclosures, keeping their clients and users informed about the activities performed and the potential risks of conflicts;

V - the establishment of rules for the responsible units of the virtual asset service provider to handle potential conflicts and prioritize the interest of their clients and users;

VI - measures to disclose information that may affect the price of virtual assets to their clients and users, as soon as such information comes to the knowledge of the virtual asset service provider;

VII - the adoption:

a) of practices that prioritize the best execution of orders, assuming duties regarding the obtaining of the best offers for their clients and users, even if the institution itself or a related party is one of the possible offerors;

b) of independent sources of price identification for the traded virtual assets, ensuring prices independent of any conflict of interest;

c) of practices that privilege fair negotiations, with equitable treatment and in the best interest of their clients and users, regardless of the activity performed; and

d) of practices that avoid privileged treatment, in favor or to the detriment of clients or users, including in the case of benefit for the institution itself or related parties;

VIII - the use of an internal monitoring and verification mechanism with the purpose of preventing conflicts of interest and ensuring compliance with regulation; and

IX - the conduct of processes carried out by specialized consultancies to evaluate the effectiveness of the conflict of interest mitigation mechanisms implemented by the virtual asset service provider.

Art. 70. The virtual asset service provider must establish specific internal policies and verification mechanisms, with the purpose of identifying, monitoring, and avoiding spurious practices in the virtual asset market, such as:

I - pump-and-dump schemes, which aim to increase the price of a virtual asset through the dissemination of rumors or informational manipulation;

II - price manipulation, in which sales and purchases of virtual assets are carried out sequentially, between two or more participants, aiming to create artificial demand to impact the volume of transactions;

III - spoofing, which consists of placing voluminous orders in the virtual asset market, canceling them before they are executed, aiming to manipulate prices;

IV - insider trading, which consists of using information not publicly disclosed about a virtual asset to carry out transactions under advantageous conditions;

V - market manipulation through social networks, to disseminate or induce public opinion regarding the trading conditions of a virtual asset; and

VI - other types of collusion and anti-competitive practices or manipulation identified in the virtual asset market.

§ 1º Virtual asset service providers that identify the occurrence of the practices described in the caput must, diligently, inform the Central Bank of Brazil about the virtual asset, the institutions, and the agents involved in these situations.

§ 2º The Central Bank of Brazil may act by establishing, at any time, specific guidelines for the mitigation of conflicts of interest identified in the performance of virtual asset service providers that operate in the admitted activities of virtual asset intermediation.

Art. 71. The virtual asset service provider, in staking operations of virtual assets carried out with its clients and users, must inform them, clearly, of at least the following risks and information:

I - of the loss of the virtual assets involved in the process of validating transactions in systems based on distributed ledger technology, due to the possibility of operational failures occurring in these systems;

II - of volatility in the value of the virtual asset during the fulfillment of the redemption period of the virtual assets involved in the staking operation;

III - of market and liquidity risks faced by the virtual assets immobilized during the validity period of the staking operation;

IV - of the periods and conditions for the redemption of the virtual assets after the staking operation is carried out; and

V - of the reward method of the staking operation of virtual assets.

§ 1º The contract entered into between the virtual asset service provider and its client or user involving the carrying out of staking operations must present, clearly:

I - the conditions under which the virtual asset service provider may carry out the staking operation; and

II - the situations in which it is considered that the client authorizes in advance the carrying out of this operation by the virtual asset service provider.

§ 2º The contract highlighted in § 1º must indicate, clearly and unequivocally, the form, conditions, limits, and periods admitted for the execution of staking operations by the virtual asset service provider, in the terms indicated in item II of § 1º.

Subsection VI
Margin Account Operations

Art. 72. Except for virtual asset service provider companies and foreign exchange broker companies, virtual asset service providers that operate in virtual asset intermediation may grant financing for the purchase of virtual assets by their clients or users, referred to as virtual asset margin account operation, in spot purchase transactions of virtual assets, provided that:

I - the virtual assets adopted for the purpose of guaranteeing the operation are pledged in favor of the corresponding creditor institution of the virtual assets;

II - the value of the virtual assets in guarantee, plus other guarantees presented by the debtor at the time of contracting the operation, must represent, at a minimum, 200% (two hundred percent) of the value of the financing for the purchase of the virtual assets, on the date of concession; and

III - the total volume of virtual asset margin account operations may not exceed one time the value of the net equity calculated from the data of the balance sheet or trial balance referring to the month immediately preceding the month of concession, in the case of:

a) securities broker company; and

b) securities distributor company.

§ 1º The exceedance of the limit referred to in item III of the caput must be corrected, immediately, with the adjustment of the net equity of the creditor institution.

§ 2º The virtual asset margin account operation referred to in the caput may be made with resources:

I - from the securities broker company or the securities distributor company; or

II - obtained from commercial banks, investment banks, multiple banks, or the Federal Savings Bank.

§ 3º The conditions for carrying out virtual asset margin account operations must be detailed in a specific policy established by the virtual asset service provider, as well as in the internal control and risk management policies, in accordance with current regulation.

§ 4º Virtual asset service providers must:

I - establish mechanisms for regular monitoring and adjustment of the value of the pledged virtual assets; and

II - indicate a director or administrator responsible for carrying out the virtual asset margin account operations referred to in the caput.

§ 5º It is permitted to designate a director or administrator who is indicated for other attributes of the virtual asset service provider before the Central Bank of Brazil, for the purpose of complying with the provisions of item II of § 4º, except in cases of incompatibility, conflict of interest, or cases not admitted in legal and regulatory norms.

§ 6º Commercial banks, investment banks, multiple banks, and the Federal Savings Bank are exempt from the requirements referred to in this article, except for the determinations set forth in §§ 3º and 4º.

Section II
Custody Services

Subsection I
Custody Contract

Art. 73. The provision of virtual asset custody service must be formalized through a virtual asset custody contract entered into between the custodian of the virtual assets and the client or user of the custody service, whose clauses must contain, at a minimum:

I - the identification of the custodian of the virtual assets and the client or user;

II - the duties and rights of the custodian and the client or user, as well as the mechanisms and procedures aimed at implementing these duties and rights;

III - the description of the nature of the virtual asset custody service, the activities that characterize it, and the mechanisms adopted for the execution of the activities, including:

a) the available methods for holding the instrument that enables control over the virtual assets, such as the method of holding encrypted keys; and

b) the types of wallets for holding the virtual asset provided by the custodian of the virtual assets, considering the following:

1. wallets administered by the custodian of the virtual assets, distinguished between those designed for holding virtual assets of a set of clients or users and those designed for holding virtual assets of an individual client or user; and

2. wallets administered by the custodian of the virtual assets, distinguished according to the degree of access to the worldwide computer network, classified as hot wallets, warm wallets, and cold wallets;

IV - the description of the risks related to the custody of virtual assets and the description of the mitigation procedures for each identified risk;

V - the definition of the method of holding the control instrument over the virtual asset and the distribution of the allocation of the custodied assets among the types of wallets referred to in item III, letter “b”;

VI - the means of communication between the virtual asset custodian and the client or user, or their duly appointed representative, including the client or user's authentication system and the method of transmitting the client or user's instructions to the virtual asset custodian;

VII - the indication of the possibility of hiring third parties to provide services to the virtual asset custodian and the identification of third parties already hired by the custodian, including the hiring of entities abroad, and the presentation of the criteria observed by the virtual asset custodian when deciding to hire, in accordance with the rules established in this Resolution, in the legislation, and in the current regulations;

VIII - the description of the fees and charges related to the virtual asset custody service, indicating the factors that justify the charging of each fee and each charge, in accordance with this Resolution and observing the other applicable regulations;

IX - the legislation and other norms applicable to the virtual asset custody service, especially in cases where the custody service is related to operations or entities abroad;

X - the description of the internal control mechanisms adopted by the virtual asset custodian and the independent audit to be carried out on the virtual asset custody service;

XI - the presentation of the duties and responsibilities of the virtual asset custodian in the case of the client or user's participation in virtual asset staking operations and other operations involving virtual assets;

XII - the description of the conditions and procedures for the transfer of custody of virtual assets to another virtual asset custodian chosen by the client or user;

XIII - the statement that all operations and acts to be carried out by the custodian and related to the virtual assets governed by the virtual asset custody contract can only occur under instruction or for the benefit of the client or user of the contract;

XIV - the deadlines for responding to each type of order issued by the client or user;

XV - the events to be treated by the custodian, observing the provisions of Art. 9, § 3;

XVI - the elapsed periods:

a) between the change in the position of each virtual asset of the client or user and the update of this information in the custodian's internal system;

b) between the change in the information regarding the client or user available in the system based on distributed ledger technology or similar and the reconciliation of this information with that recorded in the custodian's internal system; and

c) between the date on which the earnings and other benefits related to virtual assets are confirmed and the moment of their effective availability to the client or user in whose name the assets are held;

XVII - the events that may lead to non-compliance with the deadlines and periods referred to in items XIV and XVI, respectively, as well as the risks that non-compliance with each of these deadlines entails for the client or user;

XVIII - the information source of the data adopted for the assessment of the state of the virtual assets of the clients or users held by the virtual asset custodian, such as sources adopted for pricing virtual assets; and

XIX - the specification of the virtual assets, the systems based on distributed ledger technology or similar, and other technical and operational aspects that are governed by the virtual asset custody contract.

§ 1º Regarding item V of the caput:

I - if there is more than one option for the custody mechanism of the control instrument of the virtual assets and more than one available option for the distribution of the allocation of virtual assets among the various types of wallets referred to in item III, letter “b”, item 2, the virtual asset custody contract must:

a) clearly inform the potential risks related to each custody method of the control instrument of the virtual assets and to each strategy of distribution of the allocation among the types of virtual asset wallets; and

b) contain a clause expressing the client or user's decision regarding the custody mechanism used for the control instrument over the virtual asset or the distribution of the allocation among the types of virtual asset wallets to be contracted, as applicable;

II - if there is only one available option for the custody mechanism of the control instrument of the virtual assets and more than one available option for the distribution of the allocation of virtual assets among the various types of virtual asset wallets, the virtual asset custody contract must contain clauses that:

a) clearly inform the potential risks related to the custody method of the control instrument made available by the virtual asset custodian and to the strategy of distribution of the allocation among the types of virtual asset wallets made available by the virtual asset custodian; and

b) express the client or user's agreement regarding the custody mechanism used for the control instrument over the virtual asset and the distribution of the allocation among the types of virtual asset wallets to be contracted; and

III - the client or user's decision referred to in item I, letter "b", or the agreement referred to in item II, letter “b”, as applicable, must be documented by means that prove their awareness of the risks related to the custody method of the control instrument made available by the virtual asset custodian and to the strategy of distribution of the allocation among the types of wallets to be contracted.

§ 2º The virtual asset custody contract must contain clauses that indicate to the client or user the risks related to operations that affect the custody of their virtual assets, especially regarding virtual asset staking operations.

§ 3º It is prohibited for the virtual asset custodian to adopt control instruments over virtual assets or custody mechanisms for these assets that impose obstacles to the exercise of their duties and activities in accordance with the virtual asset custody contract and to the immediate compliance with judicial orders or demands from competent authorities applicable to the virtual assets under their custody.

§ 4º The internal control mechanisms and independent audit referred to in item X of the caput must consider, among other aspects:

I - the custody of the instrument that enables control over the virtual assets and the wallets used in the custody of the virtual asset;

II - the procedures for mitigating risks related to virtual asset custody services;

III - the functioning of the systems employed by the virtual asset custodian to perform their activities; and

IV - the treatment employed by the custodian in the events referred to in Art. 9, caput, item IV.

§ 5º The independent audit referred to in § 4º must be carried out at least annually.

§ 6º In the case where the client of a virtual asset custody contract is a virtual asset service provider that hires the virtual asset custodian to fulfill a contract entered into by them with the holder of the virtual assets to be held by this custodian:

I - the virtual asset service provider must act strictly as an intermediary for the interests of the holder of the virtual assets held by the virtual asset custodian;

II - the rights and benefits related to the virtual asset held by the contracted custodian listed in this Section are rights and benefits of the holder of the virtual assets and must be attributed to them immediately;

III - the virtual asset service provider shares with the custodian, vis-à-vis the holder of the virtual assets, the same responsibilities attributable to the custodian;

IV - the decisions and acts of the virtual asset service provider in their relationship with the virtual asset custodian and with the holder of the virtual assets must be in consonance with the interests of the virtual asset holder and:

a) be carried out under instruction or guidance of the virtual asset holder; or

b) be carried out meeting conditions described in the contract established with the holder of the virtual assets, including regarding the acceptance of carrying out virtual asset staking operations, observing the provisions of Art. 71;

V - the contracting virtual asset service provider must promptly offer the holder of the virtual asset the information necessary for this holder's decision-making regarding the instructions or guidance referred to in item IV, letter "a";

VI - the virtual asset service provider, in compliance with an express order or instruction from the holder of the virtual assets, must redeem the held virtual assets and transfer them to their holder or hire the custody service for these assets with another virtual asset custodian, in cases of insolvency, declaration of bankruptcy, or resolution regime by a competent authority, applicable to the virtual asset custodian, or other events that imply discontinuity of the regular operations of the virtual asset custodian contracted by the virtual asset service provider;

VII - the virtual asset custodian must comply with the requirements of current regulation and the orders and instructions of competent authorities regarding the virtual assets held by them, in cases of insolvency, declaration of bankruptcy, or resolution regime, or other events that imply discontinuity of the regular operations of the virtual asset service provider; and

VIII - the contract between the virtual asset service provider and the holder of these assets must contain clauses that:

a) ensure the holder of the virtual assets the timely and full exercise of all rights and benefits arising from these assets held by the virtual asset custodian contracted by the virtual asset service provider;

b) inform the holder of the virtual assets about the distribution of responsibilities, defined according to current legislation, between the virtual asset custodian and the virtual asset service provider vis-à-vis the holder of the virtual assets, as well as the instruments available for the virtual asset service provider to request from the virtual asset custodian compensation, on behalf of the holder of the virtual assets, for damages potentially caused to the holder of the virtual assets due to negligence, incompetence, recklessness, or intent of the custodian; and

c) establish the duties and rights of the virtual asset service provider and the holder of these assets, as well as any other relevant elements that characterize the intermediary service referred to in Chapter IV, Section I.

Art. 74. The virtual asset service provider that hires another entity or institution to provide a virtual asset custody service must:

I - establish a minimum quality standard for the asset custody service;

II - continuously verify the technical and operational capabilities of the contracted entity or institution;

III - receive and evaluate a robust action plan prepared by the contracted entity or institution, containing measures regarding:

a) prevention and treatment of security incidents, which are capable of protecting the held virtual assets; and

b) prevention and combating of money laundering and the financing of terrorism and the proliferation of weapons of mass destruction through the use of virtual assets;

IV - continuously monitor the performance of the contracted entity or institution, aiming to ensure compliance with the quality standard referred to in item I;

V - receive and evaluate the stress tests referred to in Art. 82, to be carried out by the contracted entity or institution; and

VI - adopt all measures that induce the contracted virtual asset custodian to comply with the provisions of this Resolution, as well as promptly report to the Central Bank of Brazil any non-compliance by the contracted virtual asset custodian with any provision of this Resolution.

Sole Paragraph. The contract between the virtual asset service provider and the virtual asset custodian must:

I - provide that the virtual asset custodian acts in conformity with the requirements of this Resolution, with the legislation and regulations in force; and

II - establish a mechanism that ensures that the Central Bank of Brazil and the virtual asset service provider can relate the history of positions of each virtual asset held by the virtual asset custodian to its respective holder.

Art. 75. The virtual asset custody service contract referred to in Art. 73 must present the virtual asset custody policy, in which the virtual asset custodian describes their strategies, measures, and procedures for:

I - full compliance with the provisions of this Resolution and other applicable regulations for the provision of custody services as established by the Central Bank of Brazil;

II - governance and internal controls of the business;

III - treatment of risks related to the virtual asset custody service;

IV - proper functioning of their systems;

V - treatment of aspects related to cybersecurity, in accordance with current regulations; and

VI - compliance with orders commanded by the client or user regarding the held virtual assets, within deadlines established in the custody contract for each type of order.

§ 1º The virtual asset service provider that hires an entity or institution for the custody service of virtual assets for their clients or users will be responsible:

I - for the evaluation of the virtual asset custody policy used, which will be prepared by the custodian entity or institution; and

II - for the continuous monitoring of its compliance.

§ 2º The virtual asset custody policy must be adequately documented, updated, and kept available to the Central Bank of Brazil, preferably in electronic format.

§ 3º In the event of hiring the virtual asset custody service abroad, the contracting virtual asset service provider must keep the document referred to in § 2º in Portuguese available to this Central Bank of Brazil.

§ 4º The Central Bank of Brazil may request, at any time, access to the custody policy celebrated between the virtual asset service provider and the entity or institution holding the virtual assets, to clarify specific situations or to determine that adjustments be made to bring it into compliance with the legislation and current regulations, within the deadline stipulated by it.

§ 5º The contracting virtual asset service provider must ensure that the treatment cited in item V of the caput is compatible with its cybersecurity policy, provided for in the current regulations.

Subsection IIDuties of the Custodian

Art. 76. The virtual asset custodian must elaborate, update, document, and implement measures or plans that ensure, in a timely manner:

I - the identification of the client on whose behalf they carry out the custody of virtual assets;

II - the possibility for clients or users to exercise the rights and benefits related to the virtual assets held in their names, observing the provisions of Art. 73;

III - the reconciliation of the position history of each of the clients or users described in a separate record of the custodian with the position history of the client or user as described in systems based on distributed ledger technology, observing the provisions of Art. 73;

IV - the preservation of the confidentiality of information capable of identifying the client or user and the financial operations carried out by them, or in their name, observing the need to comply with specific legislation and regulations;

V - the continuous exercise of their activities with diligence, responsibility, and loyalty regarding the interests of the clients or users, prohibiting the privileging of their own interests or those of persons related to them;

VI - the functional quality of their processes and systems;

VII - the maintenance of a record of errors, failures, and other incidents harmful to their operations, as well as the measurement of their impacts;

VIII - the security of their equipment, systems, and facilities, including the establishment of data and information security standards that protect them from unauthorized or irregular access;

IX - the use of human resources in quantity and qualification levels adequate to the custody of virtual assets, technically capable of executing the processes and operating the systems involved in the provision of the custody service;

X - the continuity of the provision of the virtual asset custody service;

XI - adequate identification:

a) of their clients and users;

b) of their collaborators;

c) of their contracted service providers;

d) of the nature of the business in which they operate;

e) of the properties of the technology with which they relate;

f) of the transactions in which they participate; and

g) of the nature and characteristics of the virtual assets with which they are involved; and

XII - the functioning of a redundancy mechanism that contains all the data and information of the clients and users and the control instruments over the virtual assets, accompanied by recovery procedures for the material to which the redundancy mechanism applies.

§ 1º The redundancy mechanism referred to in item XII of the caput must:

I - be designed so that the administration of its content is subject to the laws and other applicable norms of Brazil;

II - be administered by an institution or entity constituted in Brazil;

III - allow the Central Bank of Brazil access to its content, in the exercise of its supervisory activity; and

IV - be compatible with the cybersecurity policy applicable to virtual asset service providers, in accordance with current regulations.

§ 2º In the case of a virtual asset custodian authorized to operate by the Central Bank of Brazil, the provision of item II of § 1º may be fulfilled by the indication of a technological repository provided and administered by the custodian institution itself.

§ 3º The institution or entity referred to in item II of § 1º is considered a relevant hiring, in accordance with Art. 33, § 1º, item V, for the purposes of the provisions of this Resolution.

Art. 77. The custodian must create and maintain in their systems the record of the position history of each client, for each virtual asset held by them.

§ 1º The record of the position history of each virtual asset of a client or user must be based on a mechanism that ensures that:

I - the client or user, and only they, enjoys the rights related to the assets held in their name, observing the provisions of Art. 73, § 6º;

II - the relationship between the identity of the client or user and the history of movements of the virtual assets held in their name is free from doubts and imprecisions; and

III - the custodian is capable of identifying the origin and destination of the virtual assets for each movement that affects the position of the client or user.

§ 2º The record of each client or user, prepared by the custodian, must reflect the segregation between the virtual assets held in the name of the client or user and the virtual assets of the virtual asset custodian itself, in accordance with this Resolution.

§ 3º The position history of a virtual asset comprises the entire sequence of positions from the original position to the current position, inclusive.

§ 4º In the case where the client referred to in this article is a virtual asset service provider, contracting the virtual asset custodian, and aiming to fulfill a contract with the holders of virtual assets held by this custodian, the virtual asset service provider must maintain a separate record that:

I - ensures that the virtual assets described in the position history administered by the custodian refer to the virtual assets of the effective holders of these assets over which the custody contract exists, identified by the contracting virtual asset service provider, indicating that the latter is merely an intermediary for the interests of the effective holder of the held virtual assets;

II - is consistent with the information on the ownership of the virtual assets as described in the system based on distributed ledger technology;

III - allows the virtual asset service provider to relate, without ambiguity, the position history of each asset held by the custodian with the position history of the respective holder; and

IV - ensures that the information in the custodian's record is consistent with the information in their own record.

§ 5º The position history of a client, referred to in the caput, consists of that formed by the positions developed under the validity of the custody contract celebrated between the client and the custodian.

§ 6º The consistency referred to in item II of § 4º must be ensured in a timely manner.

§ 7º The custodian must register in their system the information that identifies the legal or natural person from whom the virtual assets currently under their custody originated.

Art. 78. The custodian must segregate the virtual assets they hold from their own virtual assets.

§ 1º The segregation referred to in the caput must be implemented meeting, at a minimum, the following factors:

I - client virtual assets must be allocated in wallets distinct from the wallets containing the custodian's virtual assets, except for the situation mentioned in Art. 30, § 2º;

II - the control instruments over wallets containing the custodian's virtual assets must be incapable of exerting any effect on the wallets containing client virtual assets; and

III - the independence between operations affecting wallets containing client virtual assets and operations affecting wallets containing the custodian's virtual assets.

§ 2º The segregation referred to in the caput must be implemented without prejudice to compliance with the asset separation provided for in Chapter IX, Section II.

§ 3º It is admitted that virtual assets that originally belong to the virtual asset custodian are not segregated from client or user assets, provided that, in addition to the provisions of Art. 30, § 2º, the following conditions are met:

I - improve the custodian's operations, so that they generate, demonstrably, benefits to these clients or users; and

II - ensure the operational viability of the virtual asset custody service provided to these clients or users.

§ 4º The virtual asset custody contract entered into with the client or user must establish under what conditions the custodian's virtual assets are considered to belong to the client or user, in the event of discontinuation of the service provided by the custodian of virtual assets, observing the provisions of Art. 73, § 6º, if the client is a provider of virtual asset services.

§ 5º In the case where the virtual assets of the custodian of virtual assets and of various clients or users are held in the same virtual asset wallet, compliance with the provisions of § 4º must be based on the proportion in which the virtual assets of each client or user participate in the virtual asset wallet.

Art. 79. The custodian must keep available to its clients or users a timely updated report on the client's or user's position in virtual assets.

§ 1º The content of the report referred to in the caput must faithfully reflect the position registered in the custodian's virtual asset system on the date the report is made available to the client or user and must present the dates on which the last change in the client's or user's position and the most recent publication of the report occurred, respectively.

§ 2º The report referred to in the caput must contain information on:

I - the financial balance of each virtual asset related to the client or user and the source used for the quotation of the virtual asset;

II - the quantity of each type of virtual asset related to the client or user; and

III - the history of movements that occurred since the last report made available to the client or user.

§ 3º Access to the report referred to in the caput must:

I - be made available electronically to the client or user who has signed the virtual asset custody contract to which it refers; and

II - follow the procedures described in the virtual asset custody contract.

§ 4º In the case where the client referred to in this article is a provider of virtual asset services hired by the holder of the virtual assets custodied in the custodian, the provider of virtual asset services must:

I - take measures to ensure that the report issued by the custodian complies with the provisions of § 1º;

II - use the report referred to in this article as a basis for preparing a document to be made available to the respective holder of the virtual assets to which it refers, informing the holder, at least, about the information referred to in § 2º; and

III - allow the holder of the virtual assets to which the document referred to in item II refers to access the document electronically, in accordance with the contract between the provider of virtual asset services and the holder of the assets.

Art. 80. Any event that creates, annuls, modifies or otherwise significantly affects the rights related to the virtual assets to which the custody contract applies must be timely communicated by the custodian to the client or user affected by the event, in accordance with the custody contract.

Sole Paragraph. In the case where the client is a provider of virtual asset services hiring the custodian of virtual assets, for the purpose of complying with contracts entered into with the holders of virtual assets custodied in this custodian, the provider of virtual asset services must immediately forward the communication referred to in the caput to the holders of the virtual assets affected.

Art. 81. The custodian is liable to its client or user for losses and damages suffered with the virtual assets custodied by it, resulting from action or omission that represents negligence, incompetence, recklessness or intent on the part of the custodian, including in the event of difficulty or impediment to the client's or user's access to the assets to which the virtual asset custody contract applies.

Sole Paragraph. In the case where the client is a provider of virtual asset services hiring the custodian of virtual assets, for the purpose of complying with contracts entered into with the holders of virtual assets custodied in this custodian, the same liability attributed to the custodian vis-à-vis the provider of virtual asset services is attributed to the provider of virtual asset services vis-à-vis the holders of the virtual assets who suffer the damage referred to in the caput.

Art. 82. The custodian of virtual assets must conduct stress tests to assess the capacity of its systems to ensure the security of the virtual assets custodied therein.

§ 1º Stress tests must be conducted with a minimum frequency of once a year.

§ 2º The method and results of the stress test must be documented and archived, for the purposes of supervision by the Central Bank of Brazil, for at least five years.

§ 3º The custodian of virtual assets may hire an entity of recognized technical capacity to conduct the stress tests referred to in this article, observing that:

I - the entity to be hired must provide the hiring custodian with a document presenting the factors that attest to its technical qualification; and

II - the hiring custodian is responsible for the effects resulting from the hiring of the entity.

§ 4º The conduct of staking operations by the custodian of virtual assets is permitted, observing the provisions of Art. 9º, § 5º.

§ 5º The offer of staking operations by the custodian of virtual assets must be communicated to the Central Bank of Brazil at least ninety days in advance.

Subsection III - Outsourcing of Custody Services Abroad

Art. 83. The contract regarding the hiring, by the provider of virtual asset services constituted in Brazil, of an entity constituted abroad to provide the virtual asset custody service must contain clauses that provide for compliance with the legislation and regulation of the country where the hired entity is constituted, which must:

I - be compatible with the legislation and regulation of Brazil, including regarding the protection and privacy of personal data, as assessed by the provider of virtual asset services; and

II - ensure that the custodian of virtual assets meets the requirements contained in this Chapter.

Sole Paragraph. The hiring of a custodian of virtual assets constituted abroad by the provider of virtual asset services, through a custody service contract signed between the parties, must meet the following conditions:

I - the custodian of virtual assets must:

a) be authorized to operate and be supervised by competent authorities of the country where it is constituted;

b) have a legal representative constituted in Brazil; and

c) have assets and rights established in Brazil or, as contractually defined, financial guarantees, in the country where it is constituted or in Brazil, that can be promptly invoked in case of failures in the provision of the custody service that affect clients and users in Brazil; and

II - the custody service contract must, additionally, contain clauses that:

a) ensure the hiring provider of virtual asset services the possibility of monitoring position records and access to all relevant data and information regarding the virtual assets to which the virtual asset custody contract established by them applies;

b) grant the Central Bank of Brazil access to the data and information contained in the records and other relevant systems of the entity, relating to the custody of the virtual assets to which the virtual asset custody contract applies and which are pertinent to the exercise of the Central Bank of Brazil's supervisory activity, observing the provisions of Art. 73;

c) adopt the formalization, with full legal effect in the country of the hired entity, of the segregation between the client's or user's virtual assets and any resources of the entity or institution, so as to ensure the timely availability of the virtual assets to the holder of these assets in the event of insolvency or declaration of bankruptcy or resolution regime by a competent authority; and

d) determine that the assets of clients and users in Brazil be registered in specific virtual asset wallets, with their own identification and controls and with the constitution of rights, in the country of the custodian of virtual assets, in favor of these clients and users.

Art. 84. For the purposes of the provisions of this Subsection, the provider of virtual asset services, with respect to its respective authorization or communication process to provide virtual asset services referred to in this Resolution, must:

I - keep the virtual asset custody service contract signed with the entity constituted abroad duly formalized and updated and permanently available to the Central Bank of Brazil, preferably in electronic format, for consultation on a website informed by the institution; and

II - indicate, to answer regarding aspects related to the virtual asset custody service contract hired abroad and the other requirements set forth in this Chapter, whenever requested, a director or administrator:

a) of the institution responsible for hiring the entity constituted abroad; and

b) of the entity constituted abroad duly authorized to answer regarding the contract referred to in item I.

§ 1º The custody contract established between the hiring provider of virtual asset services and the custodian of virtual assets constituted abroad must be formalized in a manner to obtain full legal effect in all countries in which it must or may produce effects.

§ 2º The virtual asset custody service referred to in this Subsection is considered relevant, additionally, for the purposes of applying the current regulation on the hiring of data processing and storage and cloud computing services by financial institutions, payment institutions and other institutions authorized to operate by the Central Bank of Brazil.

Section III - Mitigation of Conflicts in Virtual Asset Intermediation and Custody Modalities

Art. 85. Providers of virtual asset services must adopt specific internal control systems, with a view to mitigating conflicts of interest arising from the performance of virtual asset intermediation and custody services, in accordance with the regulation regarding internal controls of financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

§ 1º For the purposes of the provisions of the caput, providers of virtual asset services must, at a minimum:

I - establish clear separations between the activities performed, by creating distinct units, distinguishing aspects related to activities involving virtual asset intermediation and custody services, between independent and autonomous teams with internal rules of operation defined to deal with potential conflicts;

II - implement an independent monitoring system, with dedicated mechanisms to verify operational compliance and promote corrections in potential conflicts and risks;

III - establish policies for the prevention or elimination of conflicts of interest that consider:

a) explicit guidelines, with clear and effective procedures to manage conflicts; and

b) disclosure requirements for the communication of potential conflicts or identified situations that require action or correction by decision-making bodies and regular reviews to ensure that policies are followed;

IV - hire a process for verifying the adequacy of its structure and performance, on a biennial basis, to be conducted by a qualified independent entity:

a) for the review of the activities performed by the provider of virtual asset services regarding potential conflicts;

b) for the review of monitoring actions executed by the provider of virtual asset services regarding its contractors regarding potential conflicts; and

c) to provide reinforcement in its governance, risk management and internal control policies for the mitigation of conflicts;

V - observe the determinations regarding systems dedicated to the management and control of resources and virtual assets custodied, with a view to reducing the risks of fraud and human error;

VI - establish access control mechanisms with limitations aimed at preserving assets and records;

VII - promote training on conduct, ethics and compliance, as well as periodic updates on the current regulatory framework;

VIII - rely on efficient practices of transparency and communication, maintaining transparency practices to inform clients and business counterparties about potential conflicts of interest and how the provider acts to mitigate them;

IX - act, together with other providers of virtual asset services, to establish practices that favor the culture of conflict mitigation in the virtual asset market; and

X - keep the Central Bank of Brazil informed about transgressions identified in the virtual asset market that require immediate corrective and disciplinary action.

§ 2º The Central Bank of Brazil may, at any time, establish specific guidelines for the mitigation of conflicts of interest identified in the performance of providers of virtual asset services that perform intermediation and custody services cumulatively.

CHAPTER XI

GENERAL AND TRANSITIONAL PROVISIONS

Art. 86. The institutions referred to in Art. 20, with respect to the provisions of Art. 22, must, from the entry into force of this Resolution, make the necessary adjustments to align the provision of services in the virtual asset market with the set of regulations established for financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

Sole Paragraph. The compatibility process referred to in the caput must be concluded by the presentation of the formal communication referred to in Art. 22.

Section I - Applicable Norms to Virtual Asset Service Provider Companies in Operation

Art. 87. In addition to the regulations and disciplines mentioned in this Resolution, virtual asset service provider companies must observe the set of regulations established for financial institutions and other institutions authorized to operate by the Central Bank of Brazil, as applicable.

Art. 88. Companies that, on the date of entry into force of this Resolution, are carrying out one or more of the activities indicated in Art. 7º, caput and items, and in Art. 9º, caput and items, must:

I - request authorization to operate in Brazil, within a maximum period of two hundred and seventy days counted from the date of entry into force of this Resolution, in accordance with the regulation that disciplines the authorization processes for virtual asset service provider companies;

II - prove, upon the request referred to in item I, compliance with the norms regarding the following aspects, as provided in the legislation and current regulation:

a) risk management structure for market, credit, operational and liquidity risks, as applicable;

b) cybersecurity policy, action and incident response plan and hiring of data processing and storage and cloud computing services;

c) internal control policies and procedures, aimed at preventing the use of the National Financial System and the Brazilian Payments System for the practice of money laundering or concealment of assets, rights and values crimes;

d) procedures for the execution of measures determined by Law No. 13.810, of March 8, 2019; and

e) accounting and audit regulation applicable to financial institutions and other institutions authorized to operate by the Central Bank of Brazil, in the form of the Accounting Standard of Institutions Regulated by the Central Bank of Brazil – Cosif; and

III - send, from the protocol of the authorization request referred to in item I until the conclusion of phase 1 of the authorization process for operation, in accordance with specific regulations:

a) information regarding their clients and users, or legal or conventional representatives of these clients or users, to the Client Register of the National Financial System;

b) daily, the information and data regarding the accounting balances maintained by the institution in favor of its clients and users, in accordance with specific regulation;

c) daily, the information and data regarding the provision of virtual asset custody services, equivalent to the total of virtual assets custodied, on its own behalf or on behalf of third parties, in the country or abroad, reported by quantities and respective financial values, as well as total quantities and aggregated values custodied in favor of each client or user;

d) monthly, verifiable statements, in the form of proofs of reserves of virtual assets held, itemized by virtual asset, regarding the quantities and financial values custodied of these virtual assets for its clients or users;

e) monthly, verifiable statements, containing the total of virtual assets of clients or users that are intended for staking operations, if the institution performs these operations; and

f) timely, the information and documents that the Central Bank of Brazil may request, additionally, within the scope of its legal competence for authorization, monitoring and supervision.

§ 1º The period of adaptation of virtual asset service provider companies to the provisions of Law No. 14.478, of December 21, 2022, and to the norms established by the Central Bank of Brazil is ended when the Central Bank of Brazil manifests itself regarding phase 1 of the authorization process for operation referred to in the regulation that disciplines the authorization processes for virtual asset service provider companies.

§ 2º During the adaptation period referred to in § 1º, the virtual asset service provider company must observe the provisions of this article, in addition to others that the regulation expressly directs to institutions in the adaptation phase.

§ 3º Upon the cessation of the adaptation period referred to in § 1º, the virtual asset service provider company must fully observe the provisions of Law No. 14.478, of December 21, 2022, and the norms established by the Central Bank of Brazil, even if there has been no final decision on its request for authorization to operate.

§ 4º The provisions of Art. 87 apply to virtual asset service provider companies when instructing phase 2 of the authorization process for operation referred to in the regulation that disciplines the authorization processes for virtual asset service provider companies, observing the provisions of § 1º.

§ 5º The presentation of comparative financial statements, semi-annual and annual, is permitted for the first year of observation of the accounting and audit regulation provided for in item II, letter “e”, of the caput.

§ 6º Virtual asset service provider companies that timely submit the request referred to in item I of the caput may continue to provide virtual asset services until the conclusion of their authorization process, with the assumption of another modality being prohibited during this period.

§ 7º Virtual asset service provider companies that do not timely submit the request referred to in item I of the caput must cease the provision of virtual asset services within thirty days after the end of the period provided for in said provision.

Section II - Implementation of Monitoring Information

Art. 89. The implementation process of the rules referred to in Art. 44, for providers of virtual asset services that operate in the country, must occur in two stages, arranged as follows:

I - Stage I, of the national virtual asset market:

a) refers to the establishment of procedures for the transfer of information to occur between providers of virtual asset services established in the country; and

b) must be implemented within three hundred and sixty-five days from the date of entry into force of this Resolution; and

II - Stage II, of the international virtual asset market:

a) refers to the establishment of procedures for the transfer of information to reach operations carried out abroad, including entities that operate outside the country with which authorized providers of virtual asset services maintain commercial relations; and

b) must be implemented within three hundred and sixty-five days from the end of the period referred to in item I, letter “b”.

§ 1º It is permitted, until the conclusion of stages I and II of the implementation process referred to in the caput, that providers of virtual asset services:

I - use declarations provided by their clients and users, in the manner to be defined by the institution, aiming to identify the client or user, the beneficiary, the virtual asset, the amount transacted and the purpose of the transaction, categorically (self-declarations); and

II - carry out analysis of operations carried out based on the risks involved.

§ 2º The declarations referred to in § 1º must be documented and kept available to the Central Bank of Brazil, preferably in electronic format.

§ 3º Compliance with the rules established in Art. 44 is mandatory for all providers of virtual asset services authorized to operate in the country from February 2, 2028.

Section III - Prohibitions and Final Provisions

Art. 90. It is prohibited for providers of virtual asset services to hire, adopt or use mechanisms and procedures that:

I - irregularly or anti-competitively hinder the provision of services by other providers of virtual asset services;

II - violate the provisions of laws and regulations or hinder the legal or regulatory action of authorities constituted in Brazil; or

III - hinder the detection, investigation or processing of crimes and other irregular conduct, such as the use of mixers, shufflers or robots aimed at concealing the authors or beneficiaries of transactions.

Sole Paragraph. For the purposes of the provisions of item III of the caput, mixers or shufflers refer to mechanisms developed with the purpose of concealing the origin and destination of transactions with virtual assets.

Art. 91. It is prohibited, as of October 30, 2026, for financial institutions, payment institutions, and other institutions authorized to operate by the Central Bank of Brazil to carry out or facilitate operations in the virtual asset market that have as counterparties entities that provide virtual asset services and are not authorized or in the process of being authorized to operate in the country by this Autarchy, except in the forms expressly authorized in this Resolution.

Sole paragraph. The prohibition referred to in this article covers negotiations, intermediation, and custody of virtual assets, foreign exchange operations and intermediation, opening and maintenance of payment accounts, and execution of payment transactions, among other acts and services, when practiced to facilitate the operations mentioned in the main text.

Art. 92. This Resolution enters into force on February 2, 2026.

GILNEU FRANCISCO ASTOLFI VIVAN
Director of Regulation

ANNEX TO BCB RESOLUTION NO. 520, OF NOVEMBER 10, 2025

Minimum requirements for the selection of virtual assets to be offered by virtual asset intermediation service providers:

I - regarding the virtual assets offered or listed:

a) the purpose of the virtual asset;

b) the use cases, practical applications, and functionalities of the virtual asset;

c) the descriptive technical document(1) prepared by the issuer, promoters, or creators of the virtual asset, as applicable;

d) the reserve assets, in the case of a virtual asset referenced in fiat currency;

e) the economic value of the virtual asset, as applicable;

f) the traceability, monitoring, and method of proof of existence of the virtual asset;

g) market elements, such as the return, volatility, liquidity, maturity, and market capitalization of the virtual asset, as applicable;

h) the protocols of the distributed ledger technology-based system or similar on which it relies;

i) the type of distributed ledger technology-based system or similar, aspects regarding its governance, and any identified problems;

j) the identification of the individuals or organization that maintains control or ownership of the stock or creation of the virtual asset;

k) the identification of any association or relationship of the virtual asset with politically exposed persons or national and international restriction lists;

l) the concentration of ownership of virtual assets and risks related to possible blocking of the virtual asset in favor of affiliates or related parties to the issuers, promoters, or creators;

m) the consensus mechanism model(2) used by the protocol supporting the virtual assets;

n) the assessment of robustness, so that transactions and the security of the virtual asset can be verified regularly;

o) security audits, code audits, and audits of technologies related to the virtual asset, as applicable;

p) the history and reputation of the virtual asset, as well as episodes of security violations related to the virtual asset, if applicable;

q) specific risks related:

1. to the virtual asset; and

2. to the distributed ledger technology-based system or similar;

r) the rights of clients in the event of definitive network forks(3);

s) detailed information about airdrops, considering risks and benefits for the client; and

t) the virtual asset trading pairs offered;

II - regarding suspended or delisted virtual assets:

a) the criteria adopted for suspension or delisting;

b) the documentation and procedures for suspension or delisting;

c) the date and time when the offering of the virtual asset will be discontinued;

d) the deadline for canceling orders with the virtual asset at the virtual asset service provider;

e) the date of interruption of negotiations with the virtual asset by the virtual asset service provider;

f) the withdrawal period for the virtual asset from the virtual asset service provider; and

g) the implications and possible costs involved; and

III - regarding related parties, such as issuers, promoters, or creators of virtual assets:

a) the development team and founders, if applicable;

b) the due diligence of participants, as applicable;

c) the participants, partners, and investors involved with the virtual asset;

d) the ratings, scores, or technical qualifications for issuers and virtual assets, as available;

e) aspects related to the country of development of the virtual asset project, the business model, the governance, and the reputation of those involved;

f) other virtual asset service providers that admit the listing for trading of the virtual asset; and

g) information on plans and mechanisms to deal with network failures, exploitation of vulnerabilities(4), and other adverse events in the virtual asset market, aiming at the recovery and protection of clients and users.

---

(1)
The descriptive technical document – white paper or analogous – refers to the document that details, among other elements, the proposal, objectives, concepts, governance, architecture, and underlying technology of a virtual asset project.

(2)
The consensus mechanism refers to the set of rules and procedures defined for the validation of shared records in the distributed ledger technology-based system or similar.

(3)
A definitive network fork refers to the change in the protocol of the distributed ledger technology-based system or similar that affects the process of validating blocks created for new transactions.

(4)
An exploitation of a vulnerability refers to unauthorized access to a system or technological network, based on identified or stimulated vulnerabilities or weaknesses, usually carried out with malicious intent or to obtain control of that network.