Our Partner Tiago Severo Gomes Severo was featured in an article in Valor Econômico on BCB Normative Instruction No. 701, of 01/22/2026, which takes effect on February 2 and details the form of communication and minimum requirements for the technical certification by an independent qualified company that must accompany the notice of intent to provide virtual asset services in the intermediation and custody modalities, under BCB Resolution No. 520/2025.
From a regulatory standpoint, BCB IN 701/2026 shifts the focus of the discussion to auditable technical evidence: the certification must be a conclusive opinion attesting to the institution's compliance, item by item, covering, at a minimum: (i) effective segregation between proprietary and client virtual assets and (ii) proof of reserves, demonstrating that the provider actually holds the assets it declares it holds in custody on behalf of clients.
In addition, the certification covers: relevant services/critical third parties (with emphasis on processing, data storage and cloud computing), the technical capacity of providers (including those abroad), recovery plans/control of assets and resources in incidents, governance and policies, AML/CFT/CPWMD, security and resilience of the computing environment, requirements for safekeeping and protection of control instruments, continuous monitoring, and controls to mitigate conflicts of interest and abusive market practices.
The rule is also explicit as to the procedure: the notice requires (i) registration/update in Unicad and (ii) submission of the certification via APS-Siscom; without completion of all procedures, the notice is deemed "without effect" and the institution remains prohibited from providing the services.
For those preparing an authorization process to provide virtual asset services, BCB IN No. 701/2026 substantially changes the procedure and the timeline, since the request is no longer predominantly legal and documentary and now depends on an operational architecture previously implemented and certified by an independent third party, by means of a conclusive opinion. In practice, this brings forward investments in internal controls, contracts and governance of critical providers (including technology and cloud), audit trails and technical documentation; in other words, it is not enough to present a business plan and intentions: objective proof of a minimum structure will be required before filing.
