Brazil Tightens Crypto Regulations with OECD-Compliant Framework

Latin America's largest economy just raised the stakes for crypto compliance.

Brazil's Central Bank rolled out sweeping new oversight measures aligning with OECD standards—targeting exchanges, custody providers, and DeFi protocols. The rules mandate KYC for all transactions above $1,000 and require licensing by Q3 2026.

Key changes:

- FATF-style travel rule implementation

- Mandatory proof-of-reserves audits

- 10% capital reserve requirement for exchanges

Market reaction was predictably mixed: BTC prices dipped 2.3% on local exchanges while compliance-focused altcoins rallied. 'Finally bringing order to the Wild West,' tweeted the finance minister—though crypto natives whisper this mainly benefits TradFi gatekeepers. After all, nothing unites bureaucrats and bankers like fresh paperwork revenue streams.

Key Highlights

• Brazil adopts OECD CARF rules, replacing its 2019 crypto reporting system.
• Foreign exchanges serving Brazilians must now report activity under DeCripto.
• Stricter AML/KYC standards position Brazil as a regional regulatory benchmark.

Brazil’s Receita Federal has overhauled its crypto disclosure regime, adopting the OECD’s Crypto-Asset Reporting Framework (CARF) under Normative Instruction 2.291/2025. 

The update replaces the 2019 rules and integrates Brazil into a global system of automatic information exchange used to combat tax evasion, money laundering, and criminal financing. Officials say the MOVE strengthens coordination with over 70 jurisdictions that have pledged to implement CARF.

DeCripto: The new reporting system

A central element of the update is DeCripto, a redesigned reporting tool that becomes mandatory in July 2026. Domestic exchanges will continue monthly submissions, and individuals must still report when transacting outside Brazilian platforms, now with a slightly higher R$35,000 threshold.

The main shift targets foreign operators: any offshore exchange serving Brazilian users, whether through Pix, local payment partners, .br domains, or Brazilian-focused advertising, must report user activity directly to Receita Federal.

The new instruction formalizes CARF-driven AML and KYC procedures, requiring providers to identify users, verify counterparties, and track cross-border crypto transfers in a standardized format shared internationally. Crypto Accountant @declarandobtc noted on X:

🚨 A Receita Federal acaba de publicar a DeCripto, a declaração que irá substituir a IN 1888.

O investidor precisará entregar a DeCripto quando movimentar mais de 35k fora de exchanges nacionais, valor que antes era de 30k (in 1888).

Segundo a nova norma, será considerado… pic.twitter.com/3QFsQPU4T5

Receita says these measures close long-standing gaps in visibility, especially around activity routed through foreign platforms.

Part of Brazil’s broader regulatory pivot

The update follows the central bank’s newly announced rules treating crypto-fiat and stablecoin transactions as foreign-exchange operations and extending banking-style governance and capital requirements to exchanges. 

Together, these measures show Brazil pushing toward full financial integration of crypto markets while tightening surveillance on cross-border activity.

Latin America watches the region’s largest market

Brazil processed more than R$1.7 trillion in on-chain activity between mid-2024 and mid-2025, making it the region’s dominant crypto hub. As the country adopts the OECD standard and prepares for the launch of the Drex CBDC in 2026, neighboring regulators are expected to follow closely. 

Though the new rules do not change the country’s tax treatment of crypto gains, they give Receita far greater visibility into how assets move—both inside and outside Brazil’s borders.

Also read: Is Brazil Leading the BTC Adoption Wave? What Saylor Has To Say