Brazil

The Law No. 14.478/2022, popularly known as the Brazilian Virtual Assets Law, provides the fundamental federal framework for virtual assets in Brazil by defining virtual assets, setting stringent AML requirements, and imposing heavy penalties up to a maximum of eight years of imprisonment in cases of cryptocurrency-related frauds. With the Central Bank of Brazil (BCB) being the principal regulatory authority, this legal framework came into full effect after BCB Resolutions 519, 520, and 521 were implemented. As per the new regulations, all Virtual Asset Service Providers (VASPs) which are locally classified as Sociedades Prestadoras de Serviços de Ativos Virtuais (SPSAVs) have to be authorized by the central bank, implement transaction-identifying 'Travel Rule', segregate corporate client and firm assets stringently, and operate from a fixed physical location in Brazil. Crypto firms have to apply for their official authorizations before the end date of October 30, 2026.

Law no. 13.709/2018 is the complete Brazilian regulation regarding data protection, which oversees the collection, processing, and storage of personal data of both public and private organizations. Very close to the GDPR of the European Union, this law was made enforceable in September 2020, with administrative sanctions taking effect in August 2021, with the necessity for data processing being based on one of the ten grounds, such as consent and legitimate interest. It is highly dependent upon the Autoridade Nacional de Proteção de Dados (ANPD), an independent data regulatory agency which audited corporations, prevented any kind of illegal processing, and imposed hefty administrative fines amounting to 2% of company revenues (up to a maximum of R$ 50 million). At its mature stage currently, the LGPD is known for having a data adequacy agreement between the EU and Brazil for seamless cross-border data transfer, along with other strict enforcement objectives like artificial intelligence platforms, 72-hour breach reporting, and transparency of children's data.

Law No. 12.865/2013, called the Brazilian Payment Systems Law, made the Brazilian Payments System modern and created the regulatory body for payment service providers and digital wallets. The law contains important consumer protection provisions like the separation of client assets provided by Article 22 and, at the same time, keeps up with new security standards.

Law 9,613/1998, otherwise known as the Brazilian Anti-Money Laundering Law, outlines the national legislation related to the prevention, detection, and punishment of financial crimes through the criminalization of the concealment or disguise of money derived from any criminal activity. This regulation is administered by the Council for Financial Activities Control (COAF), an organization that works alongside the central bank (CBF) and CVM in implementing stringent KYC and mandatory SAR reporting. The legislation took effect in March 1998 and underwent a major revision in 2012 through a critical amendment. The law imposes heavy penalties, such as imprisonment for a period not exceeding ten years for individuals, while administrative fines against firms do not exceed R$ 20 million. At present, the legislation is strictly implemented and covers the use of AI-based transaction monitoring systems and digital assets tracking laws.

Law No. 6,385/1976, known as the Brazilian Securities Law, establishes the foundational federal framework for the country's capital markets by defining what constitutes a security and regulating all public offerings, exchanges, and financial intermediaries. Entering into immediate force in December 1976, the statute created the Comissão de Valores Mobiliários (CVM) as the independent regulatory authority empowered to supervise publicly traded corporations, audit market participants, and penalize market manipulation or insider trading. The CVM enforces strict administrative sanctions, including corporate fines capped at R$ 50 million or three times the illegal advantage gained, alongside pursuing federal prison sentences of up to eight years for criminal market abuse. In its current operational state, the law serves as a highly active mechanism for digital finance, utilizing its broad investment contract definition to assert jurisdiction over tokenized real-world assets (RWAs), decentralized finance components, and crypto-assets that exhibit security characteristics.

Law No. 4,595/1964, popularly called the Brazilian Banking Reform Law, is the base law that laid out the foundation of the Brazilian Financial System (SFN), which has a centralized monetary authority and a very strict regulatory framework for banking and credit organizations. The law became effective in December 1964 and created the National Monetary Council (CMN) as the supreme governing body and the Central Bank of Brazil (BCB) as the main supervisory body with the power of issuing licenses of operation, inspecting the financial network, and exercising the banking monopoly. In its modern version, the BCB has a powerful set of administrative sanctions, such as imposing a fine up to R$ 2 billion or the extrajudicial dissolution of the non-conformity entities, while the unlicensed banking activity receives a criminal penalty with imprisonment of up to four years. Currently, this law works in coordination with new central bank autonomy laws as the ultimate regulatory framework for digital banks, open finance, and credit-providing fintechs.