Brazil’s Central Bank has announced that crypto service providers will soon need to hold certain outgoing transfers for up to 24 hours before sending them through.
The new rule, Resolution BCB No. 584/2026, updates the central bank’s 2021 anti-fraud framework to include virtual asset services and is set to go into effect on 1 January 2027.
Under the regulation, once a customer deposits funds, in either reais or crypto, institutions must wait 24 hours before executing a transfer to an overseas crypto provider or a self-custodied wallet.
This 24-hour hold kicks in for any single transaction, or cumulative same-day transactions by the same user, that are over $10,000. However, companies can also have the option to hold smaller transfers if internal risk policies flag them as suspicious.
Providers will need to notify customers whenever a hold is placed and let them know about the 24-hour window. Funds can be released early if a documented risk review clears the transaction.
Institutions will need to get moving right away because they have less than five months to build the necessary tech, including systems that track a user’s daily cumulative transfer volume, risk algorithms that evaluate the client, counterparty, and destination jurisdiction, and audit logs for every early-release decision.
Additionally, the amendment requires firms to keep daily logs of both successful and attempted fraud.
Brazil’s self-custody dilemma
The new rule covers transfers to self-custody wallets, which is where regulators have the least visibility. The thinking behind the move appears to be that imposing a 24-hour cooling-off period gives institutions a window to spot and stop fraudulent transactions before the funds leave on an untrackable blockchain ledger.
However, if the added friction frustrates users, it might push them toward self-custody wallets or unregulated offshore exchanges to bypass the delay. If this happens, the rule could encourage market activity into places where authorities have no control.
Additionally, the practicality of enforcing this raised concern among industry experts. Commenting on a LinkedIn analysis by Michael Bacina, Co-Founder at NXT Law, Harry Behrens, Mechanism Designer at Incentive Markets, questioned how the Central Bank intends to pull this off.
He commented: “Self-custody wallets included? Pray: how exactly do you enforce such a ban? It’s almost not possible to even detect it unless you use quite sophisticated and scary surveillance methods.”
Unlike account transfers between regulated entities, where the recipient’s identity is verified through standard KYC rules, a blockchain address is just a text string of letters and numbers.
A central bank or exchange cannot see who owns a crypto address and therefore can’t tell if the address belongs to another business or a private personal wallet like MetaMask.
To reliably identify whether a destination is a self-custody wallet before executing the transfer, institutions will likely have to use advanced blockchain analytics, wallet clustering tools and transaction-monitoring software.
Andrew Chilcott, Chief Financial Officer at Coinweb.io, answered Behrens’ question by replying: “Sophisticated and scary surveillance methods incoming…”
Fighting fraud
The reason for this amendment is to combat fraud levels, with crypto and stablecoins becoming common ways to quickly move the proceeds of fraud out of reach of authorities.
According to Chainalysis’s 2025 Crypto Crime report, illicit addresses received $40.9bn in cryptocurrency in 2024, while stablecoins made up 63% of all illicit transactions. According to a 2024 FBI report, the FBI and the Internet Crime Complaint Center (IC3) received more than 69,000 complaints regarding crypto-related fraud attempts, which led to losses of more than $5.6bn.
The announcement also aligns with other changes to how digital currencies are treated in Brazil. Earlier this year, the central bank barred electronic foreign exchange providers from using cryptoassets to settle cross-border payments, instead routing them through traditional FX channels from 1 October 2026, with providers required to register their activities by the end of that month.
The central bank’s data shows Brazilians bought $12.13bn worth of digital assets and stablecoins in the year to May 2026, up 155%. This growth is perhaps causing regulators to be stricter.
