Brazil's self-custody wallet rule: COAF reporting for transfers of US$10,000 or more

Brazil now requires a report to COAF, its financial intelligence unit, for every transfer of virtual assets worth US$10,000 or more to or from a self-custodied wallet. The rule took effect on October 1, 2026. Self-custody is not banned. Providers must know which wallets are self-custodied, so expect to be asked.

This article is general information, not legal advice. Confirm how the rules apply to your business with qualified Brazilian counsel.

Key takeaways

• The rule amends Article 49 of Circular 3.978, the Central Bank's AML rule. It is an automatic report triggered by amount, not a suspicious activity report.
• The threshold is US$10,000 or the equivalent, per transfer, in either direction: into a self-custodied wallet or out of one.
• Resolution 588 (September 23, 2026) created the rule. Resolution 591 (September 30, 2026) replaced it, kept the threshold, and moved reports for October to December 2026 to the first business day of January 2027.
• A wallet counts as self-custodied when the owner alone holds the private key. Exchange deposit addresses and custodian wallets don't count.
• A second rule follows: from January 1, 2027, Resolution 584 adds a 24-hour precautionary hold on large outgoing transfers to self-custodied wallets.

What does Brazil's self-custody wallet rule require?

Brazil's rule requires institutions authorized by the Central Bank to report to COAF every transfer of virtual assets to or from a self-custodied wallet worth US$10,000 or more.

The text is short. Resolution BCB 591 adds a fifth item to the list of operations that Article 49 of Circular 3.978 says must always be reported. The other four are large cash operations: deposits, withdrawals, and payments in cash of R$50,000 or more, and foreign exchange with physical currency of US$10,000 or more.

That neighbor list tells you how the Central Bank sees self-custody. It treats a large transfer to a wallet nobody else controls the way it treats a large cash withdrawal: money leaving the part of the system where a regulated institution can see where it goes next.

Three details matter in practice:

• It's automatic. The report is triggered by the amount and the wallet type. Nobody has to suspect anything.
• It runs both ways. Stablecoins sent from a provider to a self-custodied wallet count. So do stablecoins arriving from one.
• It's silent. Article 50 of Circular 3.978 says these reports are made without telling the people involved. Your customer won't get a notice for each one.

How did Resolutions 588 and 591 get here?

The Central Bank issued the rule twice in one week, and only the second version is in force.

After January 2027, the normal deadline applies again. Article 49 reports are due by the next business day after the operation.

Two things to take from the deferral. First, the transfers are in scope now, so providers have to identify and record them from October 1 even though nothing is filed until January. Second, many documents written in late September still cite Resolution 588. The rule is the same, but the citation is to a revoked resolution.

What counts as a self-custodied wallet?

A self-custodied wallet is one whose owner holds the private key and can move funds without a virtual asset service provider taking part. That's the definition in Resolution BCB 521, Brazil's rule for virtual asset transfers and foreign exchange.

The test that works in a support conversation is one question: "Can a third party move funds out of this wallet without your approval?" If the answer is no, the wallet is self-custodied.

Smart accounts and multisigs trip people up. If the customer's own keys control the wallet, it's self-custodied, even when the wallet is a smart contract. If a service provider holds a key that can move funds alone, it isn't.

The broader trade-offs between these models are in custodial vs non-custodial vs MPC wallets.

Who files the report, and who has to change something?

The report is filed by institutions authorized by the Central Bank of Brazil. Since the PSAV regime took effect, that group includes licensed virtual asset service providers.

Everyone else in the chain changes something, even if they never touch COAF:

That last row matters for the most common corridor. If a US company sends USDC to a provider that pays out reais over Pix, the recipient never touches a wallet. The USDC to Brazil payout guide walks through that flow.

What changes from January 2027 under Resolution 584?

From January 1, 2027, Resolution BCB 584 requires a 24-hour precautionary hold on some outgoing transfers to self-custodied wallets, and to virtual asset businesses set up abroad.

The hold counts 24 hours from when the funds arrived at the provider. It applies to transfers above US$10,000, measured per operation or as the customer's total for the day, and to smaller ones the provider's risk policy flags. Stablecoins are explicitly included.

The hold is not a freeze. The customer must be told it was applied, why, and for how long. The provider can release early with a documented, reasoned decision. At the end, it either releases the transfer or rejects it.

For product teams, this is the bigger change. The October rule adds a report nobody sees. The January rule adds a day of latency to a large withdrawal unless the provider releases it early. Build that into the timing you show users.

How should a business prepare?

Collect the self-custody answer once per wallet, store it as a compliance record, and plan for the January hold.

1. Map where Brazilian wallets enter your product. Onboarding, withdrawal settings, payout destinations. Every place a Brazilian user adds an external address needs the question.
2. Ask in plain language. Use the third-party question above, not "is this self-custodied?" Most users don't know the term.
3. Store the answer next to the address. Keep who answered and when. Treat it as final, and route corrections through a reviewed process, not a settings toggle.
4. Backfill existing wallets. Find every Brazilian user's saved wallet without an answer and ask before the field becomes mandatory with your provider.
5. Update customer-facing copy. Say plainly that large transfers to or from personal wallets are reported to Brazilian authorities under Central Bank rules. Don't promise anything about specific reports, since those are silent by law.
6. Model the January hold. For outgoing transfers above US$10,000 to personal wallets, show "up to 24 hours" instead of "minutes" from January 1, 2027.
7. Check your other wallet controls. Self-custody status overlaps with Travel Rule checks on unhosted wallets. One wallet record can serve both.

How does BlindPay handle the self-custody declaration?

BlindPay asks for the answer on each external blockchain wallet added for a customer whose country is Brazil, individuals and businesses alike. Managed wallets, which BlindPay creates and custodies, are out of scope, and the field is optional for customers in other countries.

Two dates apply:

• October 1, 2026: the is_self_custody field on blockchain wallets and the matching dashboard question became available. Requests without it still succeed.
• October 10, 2026: the field becomes required for Brazilian customers. Adding a wallet without it fails with 400 self_custody_required.

Existing wallets without an answer return is_self_custody: null and keep working. Each one can be answered once, in the dashboard or with a PATCH on the wallet, and a second attempt returns 409 self_custody_already_set. The self-custody wallets guide in BlindPay's docs has the requests and errors.

New to how wallets, payouts, and on-ramps fit together? The types of stablecoin APIs guide maps who holds the funds in each model.

What to do next

List your Brazilian customers' external wallets today, ask the one-question test for each, and save the answers before October 10. Then put "up to 24 hours" on large outgoing transfers to personal wallets in your January 2027 release notes.