Our partner Tiago Severo Gomes was interviewed by Valor Econômico in its coverage of the STJ Third Panel judgment that rejected the liability of Nvio Brasil Instituição de Pagamento (Bitso) for the disappearance of USDT transferred, on the client's own instruction, to a wallet linked to another platform, where the fraud actually occurred.
In the published analysis, Tiago highlighted the regulatory balance struck by the decision: "A decisão também evita uma equiparação automática entre exchanges e instituições financeiras, o que é relevante do ponto de vista regulatório. Criptoativos ainda operam em um ambiente jurídico distinto, e importar, sem calibragem, a lógica do CDC e da responsabilidade objetiva pode gerar distorções e desincentivar inovação. Ao mesmo tempo, o julgamento não elimina o dever de diligência das plataformas, ele apenas delimita melhor onde começa e onde termina esse dever." [The decision also avoids automatically equating exchanges with financial institutions, which is relevant from a regulatory standpoint. Crypto-assets still operate in a distinct legal environment, and importing, without calibration, the logic of the Consumer Protection Code and strict liability can create distortions and discourage innovation. At the same time, the judgment does not eliminate platforms' duty of care; it simply better defines where that duty begins and ends.]
The ruling, authored by Justice Ricardo Villas Bôas Cueva, consolidates two highly relevant developments for the sector: (i) it recognizes that the Consumer Protection Code applies to virtual asset service providers, with the corresponding duties of security, transparency and liability for service failures; and (ii) it rejects automatic liability of platforms, making it conditional on first identifying the service actually provided in the specific case — intermediation, purchase, sale, exchange or custody — before attributing any duty to indemnify.
The ruling contrasts, in outcome, with REsp 2,104,122/MG decided by the Fourth Panel in June 2025, in which the exchange's liability was recognized precisely because the failure (lack of a confirmation email in two-factor authentication) occurred within the service it provided, making clear that the decisive test lies in the fit between the alleged failure and the operational perimeter of the defendant platform.
For the market, the practical point is that the application of the Consumer Protection Code to VASPs is settled, but the scope of liability will be determined case by case, making contract design, operational workflows and documentation of each stage of the service (especially the point of delivery of assets to external wallets) central to mitigating litigation risk, particularly under the new SPSAV framework (BCB Resolutions 519 to 521/2025).
Read the full article: https://lnkd.in/dwYNexeZ
