Itaú formalises crypto role as Brazil closes its licensing window
Itaú Unibanco has formalised its role as a cryptocurrency service provider before the Central Bank of Brazil, covering intermediation and custody of crypto assets, according to Token Times. The move by Brazil's largest private bank places it inside a licensing framework that did not exist a year ago, and signals that the country's biggest lenders intend to keep crypto within the domestic financial system rather than cede it to offshore platforms.
The framework behind the filing is the central bank's Resolutions 519, 520 and 521, which created the SPSAV licence category and took effect on 2 February 2026. Providers are sorted into intermediaries, custodians and brokers, and must segregate client assets from their own, hold minimum capital, and meet the customer protection, governance, internal control, security and anti-money-laundering standards already applied to banks and brokers. Resolution 521 also brought crypto transactions into the foreign-exchange regime, capping transfers with unauthorised counterparties at $100,000. Firms already operating when the rules took effect had to file for authorisation within a transition window.
For Brazilian users, the filing matters most for custody. A provider holding crypto for clients must keep those assets separate from its own money and meet capital and governance standards, giving customers a clearer legal footing than an unregulated app or an offshore exchange offers. For Itaú, the commitment brings compliance costs, audit obligations and reporting duties that smaller competitors may struggle to absorb.
Itaú's crypto operations predate the rules. The bank announced plans for crypto custody in 2022 while building a tokenisation platform, and in late 2025 began letting retail clients buy and sell bitcoin through its investment app, íon, with the bank itself holding the assets in custody. That made its position operational long before it became a regulatory one.
The pressure on smaller players is set to grow. On 1 July 2026 the central bank approved tighter rules requiring providers, from 2027, to meet financial security standards similar to those for securities brokers and distributors. It also barred institutions in Segment 5, the simplified-rules category for smaller banks, from offering virtual asset services, pushing activity toward larger, better-capitalised firms of the kind Itaú belongs to.
