Itaú Unibanco, Brazil’s largest private lender, has formally registered its cryptocurrency brokerage and custody operations with the Banco Central do Brasil (BCB), the country’s central bank, bringing the country’s biggest bank into formal compliance with the virtual-asset rules that took effect at the start of October. The bank said in an official notice dated Oct. 27 that the filing covers the intermediation and custody of cryptoassets, activities the regulation treats as equivalent to the “corretora,” or broker, category.
The step does not introduce a new product. Itaú has offered the purchase and sale of cryptoassets since December 2023. Today the bank lists more than 14 virtual assets, including bitcoin (BTC), ether (ETH), and USDC, the dollar-pegged stablecoin, and it also provides custody for those holdings.
“From the start, we prioritized an approach based on customer security, and we believe this step creates increasingly solid foundations for the development of digital assets in Brazil and worldwide,” Guto Antunes, Itaú Unibanco’s superintendent of digital assets, said in a statement translated from Portuguese. “An environment with clear rules and high standards of security and governance benefits the entire industry and, above all, consumers.”
A Notification, Not a New License
The procedural detail at the center of Itaú’s filing is the difference between two separate tracks the central bank built into the framework. Dedicated virtual-asset service providers, which Brazil calls sociedades prestadoras de serviços de ativos virtuais, or SPSAVs, must apply for an operating authorization and wait for the BCB to approve it before they can keep operating. An institution that the central bank has already authorized, such as a licensed bank, follows a narrower path: it simply communicates its activity to the regulator and is then expected to comply with the same conduct, governance, and anti-money-laundering obligations.
Itaú fell into the second category. Because it already held a banking license, its formalization was a notification of existing and intended activity rather than an application for a new charter. The distinction matters for how quickly the country’s largest banks can enter the market. A lender that already passes the BCB’s prudential and governance standards does not need to repeat the full authorization process, which for a dedicated SPSAV can be a materially longer and heavier exercise.
That two-track design is visible in the regulation itself. The central bank’s Sept. 23 notice describes refinements to the rules for virtual-asset service provision and to the anti-money-laundering and counter-terrorist-financing standards known in Brazil as PLDFT. The changes strengthen information reporting for supervision and monitoring and adjust the operational deadline for institutions that must stop dealing with counterparties that are not authorized, or not yet in the authorization process.
The Rulebook Itaú Is Complying With
Brazil’s crypto regulatory architecture has been assembled in stages. The legal basis is Law 14.478 of 2022, the so-called legal framework for cryptoassets, which named the central bank as the sector’s supervisor. The BCB then issued Resolutions 519, 520, and 521 in November 2025, which took effect on Feb. 2, 2026, and created the SPSAV as a formal entity type with three classes: intermediary, custodian, and broker.
Resolution 588 and Resolution 589, published Sept. 23, 2026, tightened that framework and took effect on Oct. 1, 2026. The same September notice set October as the final month for SPSAVs already in operation to formalize their authorization requests with the central bank. It also added a specific reporting obligation: transfers of virtual assets to or from self-custodied wallets worth the equivalent of US$10,000 or more must be reported to Coaf, Brazil’s financial-intelligence unit, along with certain cash foreign-exchange transactions above the same threshold.
The self-custody reporting line is a concrete change with a compliance cost. A wallet where the user holds their own private keys gives the regulator less visibility than assets held at an authorized institution, and the BCB’s rule closes part of that gap by forcing providers to report large flows into and out of self-custody. For a bank like Itaú, the obligation lands on top of the standard bank-secrecy and suspicious-transaction duties it already carries, which is one reason the formalization is more than a symbolic filing.
What the Filing Does Not Change for Customers
For Itaú’s retail base, the practical effect is subtle. The bank has sold and held bitcoin, ether, USDC, and other assets for nearly three years, and it is not changing the products on offer because of the notification. The lender has separately been testing tokenized bonds inside the central bank’s regulatory sandbox, a distinct initiative from its retail crypto desk. The bank also declined to disclose how many clients use the service or how much volume it transacts in crypto, so the formalization does not by itself reveal the size of the adoption it is regularizing.
The gap between the legal event and the commercial reality is worth keeping separate. Formalizing with the central bank is a regulatory status change, not a product launch, a listing, or an expansion announcement. Investors reading the filing as a signal that Itaú is newly entering crypto would be misreading the timeline: the entry happened in December 2023, and what changed on Oct. 27 is the legal footing underneath it.
There is also a broader pattern the filing reinforces without proving. Brazil’s largest bank choosing to formalize, rather than wind down or ring-fence its crypto desk, is a statement that the bank expects the regulated market to persist. But one bank’s compliance step does not establish that its peers will follow on the same schedule, and the “more than 14 assets” figure the bank gave is deliberately not a precise number, which limits how much a reader can infer about the breadth of its offering.
The October Finish Line and Who Files Next
The more consequential deadline belongs to the dedicated providers, not the banks. October 2026 is the final month for SPSAVs already operating to formalize their authorization requests, which means the Brazilian market is about to be sorted into a formalized, authorized set of firms and a remainder that must stop operating or face restrictions. The regime is already reshaping even the largest global platforms: Binance restricted eight services and delisted 22 tokens in Brazil to comply with the same central bank rules earlier this week. The central bank’s September notice also staged a later obligation: specific data-reporting provisions tied to the new rules begin producing effects on Jan. 1, 2027.
For banks, the next observable signal is which of Itaú’s peers files next. Nubank and BTG Pactual have both offered crypto products to Brazilian customers, and the communication path an already-authorized institution can use is far lighter than the SPSAV authorization route, so additional filings from large lenders are a reasonable thing to watch rather than a certainty. The regulator’s public registry of authorized and communicating institutions will make the pace of those filings visible over the coming weeks.
The event that matters most, then, is not a new service but a confirmation of the market’s structure. Brazil spent four years moving from a 2022 law to enforceable resolutions, and Itaú’s Oct. 27 filing is the first clear example of a major incumbent bank stepping onto the formalized side of that regime. What remains unknown is the same thing that was unknown before: how many customers actually use bank-offered crypto in Brazil, and how quickly the rest of the institutional market follows.
