regulation
Itaú Unibanco notifies Brazil's central bank, first bank to formalize crypto brokerage
Itaú notified the Banco Central do Brasil on Oct 27 that it will keep running crypto trading and custody under Resolution 520, three days before the Oct 30 compliance deadline.
Itaú Unibanco, Brazil's largest private bank, notified the Banco Central do Brasil (BCB) on Tuesday Oct 27 that it will continue running its crypto trading and custody service under Resolution 520, becoming "the first bank in the country to do so," per CoinDesk. The move lands three days before the Oct 30 compliance deadline for institutions already authorized by the central bank. Rule background: BCB Resolution 520.
Resolution 520 — the two tracks
The rule took effect Feb 2, 2026, after being adopted on Nov 10, 2025. It splits virtual-asset activity into two authorization paths:
- Already-authorized institutions (banks, payment institutions, brokers already supervised by BCB) — notify the regulator that they will add virtual-asset services, including an independent technical certification.
- Dedicated VASPs — must apply for authorization, meeting dedicated capital and governance requirements. Capital for custodian VASPs is reportedly ~R$37.2M.
Itaú's filing on Oct 27 is a notification under track 1. It is not a new license — it is a declaration that the bank's existing authorization now covers crypto trading and custody.
Deadlines
| Date | What |
|---|---|
| Nov 10, 2025 | BCB adopts Resolution 520. |
| Feb 2, 2026 | Rule enters force; 270-day transition opens. |
| Oct 30, 2026 | Compliance deadline for authorized institutions to notify. |
| Nov 6, 2026 | Prohibition takes effect: BCB-supervised institutions can no longer deal with unauthorized virtual-asset providers. |
| ~30 days after Oct 30 | Institutions that missed Oct 30 must stop crypto services. |
Nov 6 is the hinge date: a bank in Brazil cannot route a client's crypto trade through an unlicensed exchange after that, so onshore liquidity concentrates in notified/authorized providers.
What Itaú offers
Service started in December 2023. Current scope per CoinDesk:
- 15 cryptoassets, including BTC, ETH and dollar-pegged USDC.
- Trading and custody.
- User and volume figures not disclosed by Itaú.
The customer base sits inside Itaú's regulated retail and private-banking channels, which the Nov 6 prohibition reinforces as the compliant onshore path. Mercado Bitcoin — a native VASP — is separately seeking authorization under track 2.
Market context
- Brazil's broader crypto market has grown materially in the past five years, per central-bank data cited by other outlets. BCB has in parallel moved deadlines forward in September to tighten the perimeter around unauthorized providers ahead of Nov 6.
- Resolution 520 is Brazil's structural answer to the question most LatAm regulators are now closing on: whether crypto services sit inside the existing supervised financial system or in a parallel one. The notification path pulls incumbents in; the authorization path lets pure-play VASPs stay in business if they meet capital and governance rules.
What to watch
- Second-notifier: whether another large Brazilian bank (Bradesco, Santander Brasil, BTG Pactual) files a notification before Oct 30, and whether any file by Nov 6.
- Mercado Bitcoin and other native VASPs: how many clear the track-2 authorization bar before the dependent-services prohibition on Nov 6 bites.
- Scope creep for notified banks: BCB rules on whether Itaú's declared scope (15 tokens, trading + custody) can expand to lending or derivatives under the same notification, or whether a new filing is required.
- Published custody list: BCB has signalled a public register of authorized providers; the first version matters because Nov 6 depends on it.
Context
Itaú's filing moves the center of gravity of Brazil's onchain market into the supervised banking system. The signal to pure-play exchanges is that whatever liquidity depends on domestic bank rails will need to run through notified or authorized providers after Nov 6. The signal to regulators abroad — including the U.S. and Mexico, both of which have been drafting equivalent VASP frameworks — is that the "notification + authorization" split is the mechanism Brazil chose to avoid forcing banks to spin crypto out into separate subsidiaries.