Brazil's new crypto transfer rules: the 24-hour hold, explained

The news: Brazil's crypto transfer rules get a 24-hour brake

On August 7, 2026, the Banco Central do Brasil published Resolution BCB 584/2026, amending its 2021 fraud-prevention framework (Resolution BCB 142) so that it explicitly covers virtual asset service providers. The operative change, as The Block reported: from January 1, 2027, providers operating in Brazil must wait 24 hours after a customer funds their account before transferring more than US$10,000 — in a single transaction or summed across a day — to a self-custody wallet or a crypto firm abroad.

The mechanics are precise. During the hold, the provider must assess the customer's risk profile, the transaction, the counterparty and the destination jurisdiction. It may release a held transfer early after a documented review; once 24 hours pass, it must either release the transfer immediately or reject it. Customers must be notified when a hold is imposed, with an explanation of its precautionary nature and duration. Transfers below the threshold aren't automatically exempt: anything flagged by the provider's risk controls must be held as well. And the enforcement lever points one way — a provider that fails to comply can be ordered to apply longer holds, lower thresholds, or lose its early-release authority.

The central bank was explicit about the motive: virtual assets, particularly stablecoins, are increasingly used to move money obtained through financial fraud out of reach quickly. The resolution lands on top of a regulatory build-out that has been running for two years — VASP authorization and governance requirements from February 2025, and stablecoin trading and international transfers brought under foreign-exchange rules in November 2025. This is not a jurisdiction improvising; per Crowdfund Insider, Brazil received roughly US$318.8 billion in crypto between July 2024 and June 2025 — about a third of all Latin American activity — and ranks fifth worldwide in adoption. When the region's largest market writes rules like this, the region reads them.

The analysis: the rule maps exactly where the perimeter sits

Start with what the resolution gets right. Brazil has a real fraud problem shaped by its own success: PIX made fiat move instantly, account-takeover gangs industrialized around it, and crypto withdrawals became the preferred exit ramp — convert the stolen balance to USDT, push it to a wallet or an offshore venue, and it's gone before the victim's bank picks up the phone. A 24-hour review window at the exit is a proportionate answer. It doesn't ban anything, doesn't freeze anything indefinitely, and obliges the provider to decide within a day. As fraud regulation goes, this is careful work.

Now look at what the rule can and cannot reach, because that boundary is the story. Resolution 584 works by instructing intermediaries — entities the central bank licenses and supervises. It can tell an exchange to wait 24 hours because the exchange holds the money and answers to the regulator. A transfer between two self-custody wallets has no such entity in the loop: there is nobody to instruct, so the mechanism simply doesn't apply. The resolution is, in effect, an official map of the perimeter: regulation attaches to custody. Money inside a platform is subject to that platform's obligations, queues and clocks; money in your own wallet moves at the speed of the chain.

This is the third time in six weeks this blog has watched the same lesson surface at the custodial boundary, each time in a different costume. In Europe it was Revolut redenominating USDT balances under MiCA — a licensing decision converting customers' working capital at a rate they didn't choose. Then it was Kulipa's overnight shutdown, where the only users who lost nothing were the ones whose architecture never let the provider hold a balance. Now it's Brazil, adding regulated latency at the withdrawal gate. Different continents, different triggers — solvency, licensing, fraud policy — but one invariant: whatever happens at the intermediary happens to the money parked inside it. The hold is mild as these things go. The pattern is not.

There's also a quieter implication worth naming: by regulating the transfer to self-custody rather than self-custody itself, the resolution treats holding your own keys as a normal, lawful place for money to end up. The regulator polices the border crossing; it doesn't dispute the destination.

What this means for a business that accepts or moves crypto

Read the resolution from the chair of a business rather than a trader and three consequences stand out.

First: custodial working capital in Brazil now has a speed limit. If your crypto revenue accumulates on an exchange or a custodial processor — because that's where your checkout provider settles, or where you park USDT between uses — then moving it to your own wallet becomes a regulated event once you cross US$10,000 in a day. That's not a high bar for a business: one good B2B invoice, one week of retail volume, one payout run. From 2027, that withdrawal waits up to 24 hours while someone else's compliance team reviews it, and the review can end in a rejection, not just a delay.

Second: the payment leg itself is untouched — if it never enters a platform. A customer paying from their own wallet to your own wallet crosses no custodial boundary. There is no provider in the middle, so there is no hold, no notification, no queue. On-chain finality still applies: USDT on Polygon or USDC on Base confirms in about two seconds, and the funds are yours at confirmation — settlement is the payment.

Third: the rule can reach your buyers, so plan for it. A Brazilian B2B customer who keeps treasury on a local exchange and needs to pay your US$15,000 invoice may hit the 24-hour hold on their side before the money leaves. That's worth engineering around: give invoices a realistic expiration window, tell large payers about the rule before it bites, and note that counterparties paying from self-custody — increasingly the norm among crypto-native firms — face no hold at all.

How non-custodial acceptance stays out of the queue

Payzum is a non-custodial, crypto-only payment processor. The property that matters under Resolution 584 is architectural: there is no Payzum balance. Payments — at checkout, by link, on an invoice, at the counter — settle directly from the buyer's wallet to a wallet the merchant controls. Payzum orchestrates the flow, verifies the payment and fires the webhooks, but it never holds, pools or controls the money. A rule that operates by instructing custodians has nothing to instruct here, because custody never happens.

Accepting payments: hosted checkout, no-code payment links and buttons, invoices with expiration and overpayment detection, recurring subscriptions, and donations — across nine networks including Solana (~0.4s confirmations), Base and Polygon (~2s). Optional auto-convert to USDC/USDT keeps volatility off your books while staying in your own wallet.

In person: the Payzum POS turns any phone into a terminal — a fresh QR per sale, PIN-protected cashiers, per-terminal analytics, no chargebacks.

Paying out: mass payouts execute from your own wallet — CSV batches for BTC/LTC/DOGE and stablecoin payouts on six EVM chains (Polygon, Arbitrum, Optimism, Base, BNB Chain, Avalanche). Because there's no funding-then-withdrawing through a platform account, there's no withdrawal gate for a payout run to wait behind.

One thing non-custodial architecture does not do: exempt you from your own obligations. Brazil's November 2025 rules put stablecoin international transfers under foreign-exchange regulation, and tax reporting applies to crypto revenue like any other. Payzum keeps your settlement out of custodial queues; your compliance stays yours — talk to a Brazilian professional about how the FX and tax framework applies to your case.

How you'd set it up, step by step

1. Create your merchant account and connect your wallet. Non-custodial from the first minute — settlement addresses are wallets whose keys you hold, so revenue never sits on a platform waiting to be withdrawn.
2. Pick your acceptance surfaces. Hosted checkout or a drop-in plugin for your store, payment links for quotes and one-offs, invoices with expiration windows sized for large B2B payers, or POS QR for the counter.
3. Turn on auto-convert if you want dollars. Accept whatever your customers hold and settle in USDC or USDT to your wallet — coin-agnostic in, stable out.
4. Wire the webhooks and reconcile. Signed webhooks confirm every payment to your systems; the audit log records who did what; every transaction has a public on-chain hash your accountant can verify independently.

Where this lands in practice

Three situations where the difference between custodial and non-custodial settlement becomes visible the day the rule takes effect:

• An exporter or agency invoicing foreign clients. Cross-border receivables in USDT are exactly the flow Brazil's framework watches most closely. Paid to your own wallet via a Payzum invoice, the money is yours at confirmation; routed through a custodial venue, the same revenue joins the withdrawal queue once your daily volume crosses the threshold — and it's cross-border volume that crosses it fastest.
• A retailer or restaurant taking stablecoins at the counter. Individual sales rarely trip a US$10,000 line — but a custodial processor's aggregated daily settlement to your wallet can. QR-per-sale POS settlement to your own wallet keeps each payment final and yours, with nothing accumulating on someone else's books.
• A marketplace or affiliate program paying people in Brazil and beyond. A payout run funded by topping up an exchange account and withdrawing is now a held transfer waiting to happen. Batches that execute from your own wallet skip the funding-withdrawal round-trip entirely — and recipients get on-chain proof instead of a pending notice.

Custodial route vs. non-custodial settlement under the 2027 rules

One honest asymmetry to keep in view: custodial venues in Brazil offer the thing Payzum deliberately doesn't — a fiat leg. Payzum is crypto-only: you receive crypto or stablecoins in your wallet, and converting to reais is a step you run yourself, with a provider you choose, on a schedule you control. From 2027 that off-ramp step may itself involve a regulated venue and its rules — the difference is that it happens when you decide, with money that is already yours, rather than being the default state of your revenue.

Fair objections

"Isn't this rule a reason to avoid crypto in Brazil altogether?"

The opposite reading is more accurate. Regulators write withdrawal rules for rails that carry real volume — nobody drafts resolutions about money movement that isn't happening. Brazil formalizing how custodial crypto moves is the strongest signal yet that stablecoins are ordinary business money there; the rule just makes explicit which architecture carries the regulatory latency and which doesn't.

"A 24-hour wait doesn't sound like much."

For a trader, it isn't. For a business it compounds: it applies per provider per day, it can end in rejection rather than release, non-compliant providers can be pushed to longer holds and lower thresholds, and it sits on top of the queues and reviews platforms already run. Cash-flow planning against "up to 24 hours, maybe" is exactly the friction stablecoins were adopted to remove — paying a supplier, making payroll, catching an FX window all stop fitting inside 'sometime tomorrow.'

"My customers pay from exchanges — won't their transfers get held anyway?"

Above the threshold, they can be — on the payer's side, before the money leaves. You can't remove their hold, but you can stop adding your own: settle non-custodially so the payment is final the moment it arrives, size invoice expiration windows for large payers realistically, and note that buyers paying from self-custody wallets face no hold at all.