Brazil’s new crypto rules impose up to 24-hour transfer holds for fraud checks

Brazil’s central bank is introducing a new anti-fraud rule for cryptocurrency transfers, requiring regulated virtual asset service providers (VASPs) to temporarily “hold” certain outbound payments. The measure is designed to slow down potentially fraudulent flows that take advantage of cross-border speed and the complexities of self-custody transfers.

According to a statement from the Banco Central do Brasil (BCB), the rules will apply to funds received above $10,000—either in a single transaction or based on a customer’s total transactions over a day—when those funds are sent to foreign platforms or to customers’ self-custody wallets. The precautionary hold can last up to 24 hours, and providers will also need to hold other transfers that require additional review under their risk-management systems.

Key takeaways

• Brazil’s central bank (BCB) will require up to 24-hour precautionary holds on certain VASP transfers tied to fraud prevention.
• The rule targets transfers involving funds received above $10,000, measured by single transactions or daily aggregates.
• Holds must also cover other transfers flagged for extra scrutiny under a provider’s existing risk policies.
• The requirement takes effect Jan. 1, 2027, with VASPs required to disclose holds to customers and keep detailed records.

24-hour holds for high-value cross-border and self-custody transfers

The BCB says the framework applies when VASPs receive funds over the $10,000 threshold and then transfer them to either overseas providers or wallets held directly by customers. The central bank’s approach is effectively threshold-based: it covers not only one-off large transactions but also cases where multiple smaller moves add up to more than $10,000 in a day for the same customer.

Beyond the headline threshold, the rules also extend to “other transfers requiring further scrutiny” according to each provider’s risk-management policies. That language matters because it gives regulators flexibility to capture additional suspicious patterns even when transfers fall below the $10,000 number, as long as the provider’s compliance framework would normally treat them as higher risk.

When VASPs can release transfers early

A key operational detail is that the hold is not necessarily an automatic full 24-hour delay in every case. The BCB’s statement indicates that a VASP can complete its assessment and release a transfer before the 24 hours expire, as long as it follows parameters set out by the central bank.

Separately, VASPs will be expected to notify customers that a hold has been applied and to document relevant compliance activity. The BCB also requires providers to keep records related to fraud incidents, attempted fraud, and the corrective actions they take. For traders and users, the practical implication is that transfers to foreign platforms or self-custody wallets may become more variable in settlement timing—especially around higher-value or risk-flagged transactions—even if a provider ultimately clears the transfer quickly.

Brazil’s shift reflects a broader anti-scam push

Brazil’s central bank move comes as regulators globally respond to crypto scams that are enabled by fast settlement and the borderless nature of digital assets. The BCB’s approach mirrors a growing trend: slowing down or gating withdrawals and outbound transfers long enough to detect fraud patterns.

Earlier this year, Japan’s Financial Services Agency and National Police Agency asked crypto exchanges to restrict withdrawals in certain circumstances after users deposit fiat currency or buy digital assets. The Japanese authorities outlined expectations that exchanges require customers to pre-register withdrawal addresses, impose a waiting period for newly added addresses, and adopt additional measures such as customer-specific withdrawal limits and stronger monitoring. They also pointed to security practices including phishing-resistant multifactor authentication and checks to ensure the name of a bank remitter matches the account holder of the crypto transaction.

However, the Japan steps are not binding, and exchanges retain flexibility over how they implement restrictions based on their operations and exposure to misuse. Brazil’s plan, by contrast, is framed as an explicit central-bank requirement with a clear effective date and compliance obligations.

What to watch as the rules approach 2027

With the BCB rules scheduled to begin on Jan. 1, 2027, VASPs operating in Brazil will need to ensure their transfer monitoring systems can reliably identify the threshold conditions—particularly the “single transaction or daily total” logic tied to inbound funds above $10,000. They also need workflows for customer notification and for maintaining compliance records on fraud-related events and responses.

For users, the biggest day-to-day impact is likely to be around transfer timing and the need for clarity from providers when outbound moves are paused for review. For investors and market participants, these kinds of rules can affect how quickly capital moves through on-ramps, custody, and exchanges—potentially changing risk pricing, liquidity expectations, and the practical usability of cross-border or self-custody transfers during periods of heightened scam activity.

The next question for Brazil’s crypto market is how strongly providers will apply holds under the broader “risk-management” portion of the framework, and whether central bank guidance will specify further operational parameters that determine when transfers can be released early. Those details will likely shape how disruptive compliance becomes in practice—and how effectively it deters fraud without unduly burdening legitimate users.