Brazil moves to curb crypto fraud with 24‑hour transfer holds on risky transactions
Brazil’s central bank is preparing to introduce one of the most structured anti‑fraud frameworks in the global crypto market, giving virtual asset service providers (VASPs) the power – and obligation – to pause certain transfers for up to 24 hours.
Under rules set to come into force on January 1, 2027, Brazilian VASPs will be required to place precautionary holds on specific crypto transactions heading to foreign platforms or self‑custody wallets. The measure is aimed at stopping scammers from exploiting the near‑instant and borderless nature of digital asset transfers.
Which crypto transfers will be affected?
The new regime applies to:
– Transactions involving more than 10,000 US dollars (or local‑currency equivalent) sent to overseas service providers or to self‑custody wallets.
– Amounts that exceed 10,000 dollars when considering a customer’s total transfers in a single day, even if no individual transaction passes that threshold.
– Any other transfers that, in the VASP’s view, demand deeper scrutiny under its own risk‑management rules.
In those cases, the VASP must be able to freeze the outgoing transfer for up to 24 hours while it evaluates whether the transaction is legitimate or potentially fraudulent.
Early release is possible – with conditions
The Banco Central do Brasil (BCB) is not mandating that all flagged transactions sit for a full day. Instead, the rule creates a maximum window.
If a provider completes its assessment quickly and determines that the transfer does not present fraud risks, it may release the funds before the 24‑hour period ends. However, this discretion is not unlimited: VASPs will need to follow technical and procedural parameters that the central bank will define to ensure consistent and auditable decision‑making.
New obligations for VASPs: notification and record‑keeping
The framework is not just about slowing down payments. It also reshapes how Brazilian crypto providers must handle customer communication and compliance:
– Customers must be informed whenever a transfer is temporarily held.
– VASPs are required to systematically log fraud incidents, attempted scams, and the actions taken in response.
– These records are expected to support supervisory inspections and to help refine risk models over time, as patterns of abuse become clearer.
In practice, that means Brazilian platforms will need more sophisticated monitoring systems, clearer customer messaging, and better integration between compliance, fraud, and customer‑support teams.
Brazil joins a global wave of tougher crypto safeguards
The Brazilian rules place the country among a growing group of jurisdictions that are tightening controls as scams evolve and migrate into digital assets. Fast settlement and global reach – two of crypto’s biggest advantages – have also made it a powerful tool for fraudsters, who rely on the difficulty of reversing or tracing cross‑border transfers.
By introducing a mandatory “friction layer” for high‑risk flows, Brazil is trying to preserve the benefits of crypto while cutting into the business model of criminals who depend on instant, irreversible payouts.
How Japan is approaching the same problem
Brazil’s move comes in the wake of anti‑fraud initiatives in other major markets, including Japan. There, the Financial Services Agency and the National Police Agency have urged crypto exchanges to adopt a set of voluntary controls designed to slow down suspicious outflows.
Among the Japanese recommendations:
– Restricting withdrawals that follow fresh fiat deposits or recent crypto purchases, a pattern frequently seen in scams.
– Requiring customers to pre‑register withdrawal addresses, so funds can only be sent to previously approved destinations.
– Enforcing a waiting period before any newly added address can be used for withdrawals.
Authorities have also floated other safeguards, such as:
– Tailored withdrawal limits based on each customer’s risk profile.
– More robust transaction monitoring tools.
– Stronger, phishing‑resistant multifactor authentication.
– Checks to ensure the name of the bank remitter matches the name on the crypto account.
Unlike Brazil’s framework, these Japanese measures are not legally binding. Exchanges are encouraged, but not compelled, to adopt them, and can calibrate controls according to their own operations and perceived exposure to misuse.
Europe warns about impostors and fake “regulated” platforms
In Europe, regulators are focusing on a different, but related, fraud tactic: impersonation.
As users increasingly look for licensed crypto service providers following the implementation of the EU’s Markets in Crypto‑Assets (MiCA) regime, criminals have been posing as regulators or legitimate firms to trick victims:
– The French financial watchdog has reported a growing number of cases involving fraudulent websites that mimic the branding and language of real institutions.
– The pan‑European securities authority has flagged attempts by scammers to misuse its name and logo in forged documents, giving an illusion of official approval.
These warnings illustrate how regulation itself can become part of the scam narrative: fraudsters routinely claim that their platforms are “approved,” “registered,” or “overseen” by well‑known institutions to gain trust.
What the 24‑hour hold means for Brazilian users
For everyday users in Brazil, the new rules will likely translate into a slightly different experience when sending large or unusual amounts of crypto abroad or to personal wallets:
– Some transfers that once cleared almost instantly may now be held for review.
– Users can expect more verification steps, questions about the nature and purpose of the transfer, and perhaps additional identity checks depending on risk.
– Clear in‑app warnings and notifications should explain why a transfer is on hold and when it will be released.
While this may be frustrating for legitimate users who rely on speed, the central bank is betting that the trade‑off is acceptable if it reduces large‑scale losses from scams and social‑engineering attacks.
Impact on Brazilian exchanges and global platforms
For local VASPs, compliance will go beyond simply turning on a “pause” button:
– Risk engines will need to distinguish between routine large transfers and ones that follow fraud‑like patterns, such as sudden high‑value activity from a previously inactive account.
– Back‑office teams must be ready to investigate held transfers quickly, document their decisions, and show they followed the central bank’s guidelines.
– Integration with foreign platforms may need to change, as counterparties adjust to the reality that incoming funds from Brazil could be delayed by compliance checks.
Global exchanges that serve Brazilian customers can also expect more questions from local partners, greater documentation requirements for cross‑border flows, and possibly a need to harmonize their own anti‑fraud processes with Brazil’s new standards.
Balancing innovation and protection
The timing of Brazil’s move is notable. While regulators tighten controls around fraud, interest in digital assets continues to evolve:
– Domestic and international institutions are exploring tokenized financial products, including money market funds and other traditional instruments issued on blockchains.
– Discussions around stablecoins – especially those backed by major currencies – are intensifying, with some policymakers arguing they can improve payment efficiency if properly regulated.
In this context, Brazil’s framework sends a signal: the authorities are not trying to shut down digital assets, but rather to make the environment safer so innovation can continue without being overshadowed by scams.
Possible benefits – and concerns – around the new rules
The 24‑hour hold mechanism could bring several advantages:
– It offers a critical time window to detect and stop fraudulent transfers before they become irreversible.
– It encourages VASPs to invest in better analytics, behavior‑based alerts, and fraud‑response playbooks.
– It creates more consistent expectations for how providers should react to suspicious transactions.
At the same time, industry participants may raise questions:
– Could criminal groups simply adjust, moving funds in smaller tranches below the 10,000‑dollar threshold?
– Will legitimate high‑value users feel penalized by delays, and could they move to less regulated platforms as a result?
– How will VASPs manage the cost and complexity of the required technology and compliance infrastructure?
The answers will depend largely on how the central bank refines technical details and how flexibly firms can implement risk‑based approaches, rather than blanket delays.
What users and businesses can do to prepare
With the rules set to start on January 1, 2027, there is time for both users and companies to adapt:
For individual users:
– Expect more questions from providers when sending larger sums offshore or to fresh self‑custody addresses.
– Document the purpose of major transfers in advance to respond quickly if a VASP requests information.
– Strengthen personal security habits – using hardware keys, unique passwords, and offline backups – to reduce the chance that scammers gain control of your accounts in the first place.
For businesses and high‑volume traders:
– Review internal treasury and payment workflows to account for possible 24‑hour delays when moving funds out of Brazil.
– Work closely with service providers to understand their risk thresholds, documentation requirements, and dispute‑resolution processes.
– Invest in internal compliance capabilities so that information requested by VASPs can be provided promptly, reducing hold times.
A step toward a more mature crypto market
By formalizing 24‑hour holds for high‑risk transactions, Brazil’s central bank is pushing the local crypto ecosystem toward higher standards of consumer protection and operational discipline. The measure reflects a broader global trend: as digital assets become more integrated into mainstream finance, expectations around safeguards and accountability are rising.
Whether the rules will significantly reduce fraud will only become clear after implementation. But they mark a decisive attempt to close some of the gaps that scammers have exploited – especially the combination of speed, anonymity, and cross‑border access that has defined the darker side of the crypto boom.