Resolution BCB No. 584, published on August 7, 2026 and effective January 1, 2027, does not delay Brazilian crypto withdrawals — it delays the withdrawal of freshly deposited funds, starting the 24-hour clock at the moment money enters the wallet rather than the moment a customer asks to send it out.

The Banco Central do Brasil’s Collegiate Board approved Resolution 584 on August 6, 2026, amending Resolution BCB No. 142 of September 23, 2021 to extend Brazil’s payment-fraud rulebook to virtual asset service providers. The operative text, new Article 2-B, states that in-scope institutions “may only execute transfer orders for those assets twenty-four hours after receipt of the respective funding resources into the wallet, in reais or in the form of virtual assets,” where the destination is a foreign virtual-asset entity or a self-custodied wallet. That single clause is what most coverage has misread. This analysis walks through the mechanic, the US$10,000 trigger, the supervisory dial buried in new Article 6-A, and how Brazil’s mandatory hold compares with the UK, Singapore, the EU and the United States.

Methodology and sources

This analysis is built on the Portuguese-language texts of five Banco Central do Brasil normative acts read in full from the regulator’s own normative database: Resolution 584 of August 7, 2026; Resolution 142 of September 23, 2021, the instrument it amends; Resolution 501 of September 11, 2025; and Resolutions 520 and 521 of November 10, 2025, which together created the Brazilian virtual-asset service provider regime. Comparative material comes from the UK statutory instrument and Financial Conduct Authority (FCA) guidance cited below, Monetary Authority of Singapore (MAS) media releases, and Financial Crimes Enforcement Network (FinCEN) enforcement filings. Jurisdictional scope is Brazil, the United Kingdom, the European Union, Singapore and the United States. Where English-language reporting conflicts with the Portuguese primary text, the primary text governs — and on at least two points it does.

What Article 2-B actually says, and where the 24 hours starts

The widely repeated summary is that Brazilian exchanges must sit on outbound crypto transfers above US$10,000 for a day. The primary text says something narrower and more targeted. Article 2-B’s caput conditions execution on the passage of 24 hours “após o recebimento dos respectivos recursos de aporte na carteira” — after receipt of the corresponding funding into the wallet. The constraint therefore binds only where an outbound order arrives within 24 hours of the inbound funding that supports it. Assets that have been sitting in a customer’s account for a week are not queued. What Resolution 584 creates is a seasoning requirement on newly arrived value, not a settlement queue on the book. That distinction matters enormously for anyone modelling the operational impact, because the population of affected transactions is the deposit-and-immediately-withdraw pattern, which is precisely the behavioural signature of a money mule and a vanishingly small share of ordinary trading activity.

The second correction concerns the threshold. Several Brazilian outlets rendered it as R$10,000. The text is explicit: US$10,000.00, “dez mil dólares dos Estados Unidos,” or the equivalent in other currencies. At current levels that is roughly five times the real-denominated figure some reporting implied, and it happens to mirror the US Currency Transaction Report threshold under the Bank Secrecy Act — a borrowed number rather than an original calibration. The threshold is reached per operation or by the aggregate of all operations conducted in the customer’s name on the same day, which closes the obvious structuring route of splitting one withdrawal into nine.

Two further limbs deserve attention. Article 2-B, §1, III, “b” requires the hold to be applied, irrespective of value, wherever the institution’s own risk-management framework indicates the need for analysis — and §2 specifies that those criteria must at minimum reflect the risk profiles of the customer, the operation, the counterparty and the jurisdiction in which the destination entity is domiciled. The US$10,000 number is thus a floor for mandatory application, not a ceiling on the regime. And §§5 to 7 permit early release on a documented, reasoned decision, with a sting: if supervisors later conclude the early-release discretion was improperly exercised, the firm’s file must be accompanied by a further document setting out the corrective measures actually adopted to fix its internal controls.

How five jurisdictions treat payment holds and crypto transfers

Jurisdiction / Regulator	Effective date	Scope	Key requirement	Nature of the obligation
Brazil (Banco Central do Brasil)	January 1, 2027	Financial institutions, payment institutions and VASPs, including firms still in the Resolution 520 adaptation phase	Resolution 584, Article 2-B: 24-hour hold from wallet funding on transfers above US$10,000 to foreign VASPs or self-custodied wallets	Mandatory; supervisor may extend the period or lower the threshold per firm under Article 6-A
United Kingdom (HM Treasury / FCA)	October 30, 2024	Payment service providers executing authorised push payments in sterling	SI 2024/1013: delay permitted where reasonable grounds to suspect fraud, established by end of the following business day, capped at the end of D+4	Discretionary power, framed by FCA FG24-6
Singapore (MAS / IMDA)	December 16, 2024	Retail banks and telecommunications operators, phishing-scam losses	Shared Responsibility Framework: block until positive customer confirmation, or notify and hold for 24 hours	Duty with a payout consequence; six-month transition on the surveillance duty
European Union (ESMA / national CAs)	December 30, 2024	Crypto-Asset Service Providers (CASPs) under MiCA and Regulation (EU) 2023/1113	Originator and beneficiary information on every crypto transfer, with no de minimis threshold; CASP authorisation under MiCA	Information duty only — no holding period prescribed
United States (FinCEN)	Longstanding BSA regime	Money services businesses, including convertible virtual currency exchangers	Currency Transaction Reports at US$10,000; suspicious activity reporting; no execution delay imposed	Reporting only; enforcement runs through consent orders

Sources: primary regulator instruments linked above. Last updated: August 11, 2026.

Read across that row, Brazil is not diverging from international practice on the idea of a fraud hold — the UK and Singapore both landed on payment-delay mechanics in the same 2024 window, and Singapore’s framework even names 24 hours as an acceptable hold. Brazil diverges on two design choices. First, its hold is mandatory rather than discretionary: a British PSP delays when it has reasonable grounds to suspect fraud, whereas a Brazilian VASP delays because a number was crossed. Second, Brazil applies the mechanic to virtual-asset transfers, where the EU has so far chosen information duties alone. The Financial Action Task Force (FATF) Travel Rule, which our July review found at 83% implementation, requires originator and beneficiary data to travel with a transfer; it has never required the transfer to wait. Resolution 584 is the first mandatory execution delay applied to crypto by a G20 central bank.

“Most of that is to buy things and to shop things from abroad,” he said, adding that the pattern “maintains some kind of opaque vision for taxation or for money laundering.”

— Gabriel Galípolo, Governor, Banco Central do Brasil, speaking at a Bank for International Settlements event in Mexico City on February 6, 2025, on his estimate that roughly 90% of Brazilian crypto flow is stablecoins (Reuters)

Enforcement context: why the cash-out became the choke point

Resolution 584 is the third amendment to the same 2021 instrument in five years, and the sequence tracks Brazil’s fraud experience. Resolution 142 originally did two prosaic things: it capped night-time transfers between distinct natural persons at R$1,000 per account between 8pm and 6am, and it imposed a minimum 24-hour wait before a customer-requested limit increase takes effect. The 24-hour unit of friction is therefore not new to Brazilian payments law; Resolution 584 simply moves it from limit increases to asset movement.

What changed in between was the June 30, 2025 compromise of C&M Software, a Banco Central-authorised payment infrastructure provider. Attackers who had bought a junior developer’s credentials — reportedly for R$5,000 — reached the reserve accounts of six financial institutions and moved more than R$540 million, roughly US$100 million. The Federal Police opened an investigation with the central bank’s support on July 2, 2025, and arrested the employee, João Nazareno Roque. Estimates put US$30 million to US$40 million of the proceeds converted into bitcoin, ether and USDT through Latin American over-the-counter desks and exchanges within hours. Ten weeks later the Banco Central issued Resolution 501, inserting Article 2-A into Resolution 142 to require institutions to reject payment transactions destined for accounts under well-founded suspicion of fraud, with a compliance date of October 13, 2025. Resolution 584 closes the other end of the same pipe.

The domestic precedent for what the regime is trying to prevent is Braiscompany, the R$1.1 billion (about US$190 million) Ponzi scheme dismantled under Operation Halving in February 2023. Its founders, Antônio “Neto” Ais and Fabrícia Farias Campos, were sentenced in February 2024 to 88 years and seven months and 61 years and 11 months respectively; in April 2025 three men convicted of laundering the proceeds received a combined total of more than 170 years, with Joel Ferreira de Souza given over 128 years — among the longest financial-crime sentences ever handed down in Brazil, per CoinDesk. The international precedent for what happens to a venue whose controls fail is FinCEN Consent Order No. 2023-04 against Binance Holdings Limited, dated November 21, 2023, which assessed a US$3.4 billion civil money penalty — the largest in the Treasury Department’s history — alongside a five-year monitorship, with a further US$968,618,825 settled with the Office of Foreign Assets Control (OFAC). Brazilian supervisors have read that file.

What this means for exchanges, brokers, custodians and compliance teams

For exchanges and VASPs, the build is a per-lot ledger, not a per-withdrawal timer. Because the clock runs from funding, firms must track the age of each tranche of value credited to a wallet and match outbound orders against it — the same first-in-first-out discipline custody desks already run for tax lots, applied to a fraud control. Firms that implement this as a blanket 24-hour delay on all withdrawals above US$10,000 will have over-complied, degraded their customer experience and handed liquidity to offshore venues for no supervisory credit. Article 2-B, §3 separately requires the customer to be told that a hold has been applied, that it is precautionary, and how long it lasts, which means notification templates and support scripts, not just a queue.

For compliance and legal teams, the operative work sits in §2 and §§5 to 7. Risk policies must be rewritten to contain explicit trigger criteria across four dimensions — customer, operation, counterparty and destination jurisdiction — because the sub-threshold limb of the rule is self-executing against a firm’s own framework. Every early release needs a reasoned, documented decision, and §7 creates a remediation trail if that discretion is later judged wrong. Article 6-A, §II makes the consequence concrete: where non-compliance is found, the Banco Central can lengthen the period beyond 24 hours, apply the procedure below US$10,000, or strip the early-release discretion entirely, for a named firm or a class of firms. That is a supervisory dial, not a fixed rule, and it is the part of Resolution 584 that should be modelled as a tail risk.

For brokers, custodians and fund managers, the interaction with Brazil’s foreign-exchange framework is the underrated exposure. Resolution 521 already folded virtual-asset service provision into the FX market regulated by Law 14.286 of December 29, 2021, and capped international payments or transfers in virtual assets at the equivalent of US$500,000 where the counterparty is not an institution authorised to operate in the FX market. A firm now faces an FX-market classification, a value cap and a timing constraint on the same cross-border leg. There is also a definitional gap worth flagging to counsel: Article 2-B, II defers the meaning of “self-custodied wallet” to “specific regulation,” yet Resolution 520 — the rulebook that carefully defines cold, warm and hot wallets — never uses the term. That definition has to arrive before January 1, 2027 or the scope of limb II is genuinely uncertain.

“A ampliação dessas regras representa um retrocesso para o desenvolvimento do mercado de ativos virtuais no Brasil.” (“The extension of these rules represents a step backwards for the development of the virtual asset market in Brazil.”)

— Regina Pedroso, Executive Director and founder, ABToken (Cointelegraph Brasil)

What’s next: a legislative challenge and an October licensing cliff

Resolution 584 is already contested. On August 10, 2026, federal deputy Júlia Zanatta (PL-SC) filed Projeto de Decreto Legislativo 926/2026, seeking to suspend the resolution in full on the ground that the Banco Central exceeded its regulatory competence by imposing a general, compulsory restriction on the movement of client assets without specific statutory authority. A PDL must pass both the Chamber of Deputies and the Senate before promulgation, so the odds are long, but the constitutional argument is not frivolous: the central bank’s authority here derives from Articles 4 to 6 and 9 of Law 14.478 of December 21, 2022 read with Decree 11.563 of June 13, 2023, and how far that reaches into property rights is a question for the courts rather than the market.

The nearer deadline is authorisation. Under Article 88 of Resolution 520, firms already carrying on virtual-asset activities when the regime took effect on February 2, 2026 must file for authorisation within 270 days — October 30, 2026 — and those that miss the filing must cease providing virtual-asset services within 30 days of that date. Firms that file on time may keep trading through their authorisation process. Resolution 584’s sole paragraph expressly captures firms still in that adaptation phase, so a VASP awaiting a decision on phase one must build the hold anyway. Compare the attrition in Europe, where the MiCA authorisation cliff left 210 firms licensed and 990 winding down, and the shape of Brazil’s 2027 market becomes easier to guess. The unresolved questions for the year ahead are the self-custody definition, whether Article 6-A is used routinely or reserved for outliers, and who carries the loss if a customer’s price moves against them during a hold that a firm was legally obliged to impose — a liability question the UK and Singapore answered explicitly and Brazil, so far, has not.

Frequently asked questions

Does Resolution 584 delay every crypto withdrawal over US$10,000?

No. Article 2-B conditions execution on 24 hours having passed since the funding was received into the wallet. If a customer deposits reais or virtual assets and then tries to send more than US$10,000 abroad or to self-custody within that window, the transfer is held. If the value has been in the account longer than 24 hours, the mandatory limb does not apply, though a firm’s own risk framework may still trigger a hold under §1, III, “b”.

Is the threshold in US dollars or Brazilian reais?

US dollars. The text specifies US$10,000.00 — “dez mil dólares dos Estados Unidos” — or the equivalent in other currencies. Some Brazilian coverage rendered it as R$10,000, which understates the trigger by roughly a factor of five. The threshold is met either by a single operation or by the total value of all operations executed in the customer’s name on the same day.

Which transfers are in scope?

Only two destinations: entities incorporated abroad that carry on activities in the virtual-asset market, and self-custodied wallets. Transfers between accounts at the same Brazilian provider, or to another authorised Brazilian institution, are outside the caput. Paragraph 9 confirms the rule reaches the virtual-asset services listed in Article 5, items I to V of Law 14.478/2022, and expressly includes fiat-referenced tokens, meaning stablecoins.

Can a provider release the assets early?

Yes. Paragraph 5 permits release before the 24 hours elapse on a reasoned decision that addresses, at minimum, the customer, operation, counterparty and jurisdiction criteria in §2. The decision and its reasoning must be documented under §6, and §7 requires a supplementary record of corrective measures where a later review finds the discretion was improperly used. Article 6-A allows the supervisor to restrict that discretion for firms found non-compliant.

Who bears the loss if the market moves during the hold?

The resolution does not say. It characterises the hold as precautionary and states that it does not create definitive unavailability of assets, but it allocates no liability for price movement or missed execution during the window. That contrasts with the UK’s reimbursement regime and Singapore’s Shared Responsibility Framework, both of which pair a delay or block with an explicit loss-allocation rule. Brazilian firms should expect this to be litigated rather than legislated.

How does this interact with Brazil’s VASP licensing regime?

Directly. Resolution 584 applies to authorised institutions and to virtual asset service providers still in the adaptation phase under Article 88, §2 of Resolution 520 of November 10, 2025. Firms operating when that regime took effect on February 2, 2026 must file for authorisation by October 30, 2026 or stop providing services 30 days later. A pending application is not a reason to defer building the hold.

Does any other major jurisdiction mandate a crypto transfer hold?

Not on these terms. The UK permits, but does not require, PSPs to delay suspicious authorised push payments to the end of the fourth business day. Singapore’s framework contemplates a 24-hour hold as one way to discharge a fraud-surveillance duty in retail banking. The EU imposes travel-rule information duties on crypto transfers with no holding period, and the United States relies on reporting. Brazil’s mandatory, threshold-triggered delay on virtual-asset transfers is the first of its kind at a G20 central bank.

For context on how differently jurisdictions allocate fraud losses once a payment goes wrong, see our analysis of PSD3 and the UK’s £85,000 reimbursement cap, and on why supervisory labels rarely mean what firms assume, our recent piece on the four regimes that look alike. Brazil’s broader financial-infrastructure trajectory is visible in Nubank’s pursuit of a full banking licence and in the early integration of crypto venues with the instant-payment system, covered when Binance Pay connected to Pix. Pix itself cleared 79.8 billion transactions worth R$35.36 trillion in 2025 on Banco Central figures — the cultural baseline against which a 24-hour hold will be judged by Brazilian customers.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.