Brazil Tightens Grip on Virtual Asset Service Providers with Mandatory External Audits

Brazil's crypto regulatory landscape has become even more rigorous with the introduction of Normative Instruction No. 739, effective as of the latest Friday issuance. As a result, Virtual Asset Service Providers (VASPs) seeking to operate within the country must now submit to a thorough examination by a certified third-party auditor, a requirement that amplifies the already demanding licensing process.

In a bid to bolster its anti-money laundering (AML) and combating the financing of terrorism (CFT) framework, the Central Bank of Brazil has mandated that VASPs undergo independent audits. These evaluations, known as "reasonable assurance reports," are designed to scrutinize various facets of a VASP's operations, including its institutional policies, organizational structure, and employee training protocols. The audits will also delve into the company's internal risk assessment mechanisms, particularly those related to the potential misuse of its products and services for illicit activities.

Furthermore, the reports must assess the VASP's capacity to monitor, analyze, and report suspicious transactions, as well as its ability to detect and prevent fraudulent activities. The audits will also examine the company's procedures for implementing administrative asset freezes and its overall preparedness in combating money laundering, terrorism financing, and the proliferation of weapons of mass destruction.

The Central Bank of Brazil has emphasized that these measures are intended to enhance the security and transparency of the authorization process, aligning the country with international best practices in the fight against financial crimes. The move follows the high-profile Operation Hidden Flow, which uncovered a massive $5 billion money laundering scheme involving six fintech companies and suspected links to the Primeiro Comando da Capital, a notorious drug trafficking organization recently designated as a Specially Designated Global Terrorist (SDGT) by the Trump Administration.

By necessitating independent audits, the Brazilian authorities aim to ensure that VASPs operating in the country adhere to the highest standards of regulatory compliance, thereby mitigating the risks associated with crypto-linked crimes. As the crypto landscape continues to evolve, Brazil's Central Bank remains committed to strengthening its regulatory framework, underscoring the importance of transparency, security, and integrity in the virtual asset sector.