A Filing, Not a Launch
Itaú Unibanco, Brazil’s largest private lender, has formally registered its cryptocurrency brokerage and custody business with the Banco Central do Brasil. The bank’s notice, dated October 27, brings the country’s biggest bank into compliance with the virtual-asset rules that took effect at the start of October. The step matters less for what it introduces than for what it confirms: the first clear case of a major incumbent bank stepping onto the formalized side of Brazil’s crypto framework.
The filing does not create a new product. Itaú has offered the purchase, sale and custody of cryptoassets since December 2023, and today lists bitcoin, ether, the USDC stablecoin and a broader range of other assets. What changed is the legal footing underneath that business.
Two Paths Into the Regime
Brazil’s framework splits virtual-asset service providers into two tracks. Dedicated providers, called SPSAVs, must apply for a full operating authorization and wait for the central bank to approve it before they can keep operating. An institution the regulator has already authorized, such as a licensed bank, follows a narrower path: it simply notifies the central bank of its activity and is then expected to meet the same conduct, governance and anti-money-laundering standards. Because Itaú already held a banking licence, its formalization was a notification of existing and intended activity rather than an application for a new charter.
The two-track design is visible in the rulebook itself. The legal basis is Law 14.478 of 2022, which named the central bank as the sector’s supervisor. Resolutions 519, 520 and 521, issued in November 2025, created the SPSAV as a formal entity type. Resolutions 588 and 589, published on September 23 of this year, tightened the framework, took effect on October 1, and set October 2026 as the final month for already-operating providers to formalize their authorization requests.
A Reporting Cost With Teeth
One concrete change carries a compliance cost. Under the amended anti-money-laundering rules, transfers of virtual assets to or from self-custodied wallets worth the equivalent of US$10,000 or more must be reported to Coaf, Brazil’s financial-intelligence unit. A wallet where the user holds their own private keys gives the regulator less visibility than assets held at an authorized institution, and the reporting obligation closes part of that gap.
What Does Not Change
For Itaú’s retail customers, the practical effect is subtle. The bank is not changing the products on offer, and it has separately tested tokenized bonds inside the central bank’s regulatory sandbox, a distinct initiative. Reading the filing as a signal that Itaú is newly entering crypto would misread the timeline: the entry happened in 2023, and what changed is the regulatory status.
The more consequential deadline belongs to the dedicated providers. October 2026 is the cutoff for SPSAVs already operating to formalize, which will sort the market into an authorized set of firms and a remainder that must stop operating or face restrictions. For the largest lenders, the next signal to watch is which peers file next: Nubank and BTG Pactual have both offered crypto products, and the notification route an already-authorized bank can use is far lighter than the full authorization path. The central bank’s public registry will make the pace of those filings visible in the weeks ahead.
Source: BlockchainReporter.