Brazil Weighs 24-Hour Crypto Transfer Hold to Curb Fraud

Brazil’s central bank has approved new rules that require virtual asset service providers (VASPs) to temporarily freeze certain crypto transfers before sending funds to foreign platforms or self-custody wallets. The precautionary hold is designed to give firms time to review suspected fraud and suspected illicit behavior.

According to a note published by the Banco Central do Brasil (BCB) on Friday, the requirement takes effect on Jan. 1, 2027 and will apply to transfers where the amount received by a customer exceeds $10,000, either as a single transaction or based on the customer’s total activity in a day. In addition to that threshold, VASPs must also place holds on other transfers flagged for enhanced scrutiny under their risk-management systems.

Key takeaways

• Brazil’s BCB will require VASPs to implement precautionary holds of up to 24 hours on certain outbound virtual asset transfers.
• The initial trigger is $10,000 in value received, measured per transaction or aggregated across daily customer activity.
• Holds also cover transfers marked for review under a provider’s existing risk-management policies.
• VASPs must inform customers about holds and maintain records of fraud incidents and remediation steps.
• Japan’s earlier anti-scam measures exist, but they are non-binding—a key difference from Brazil’s approach.

How the 24-hour hold will work

Under the BCB’s framework, VASPs must apply precautionary holds to certain transfers once the underlying conditions are met. The central bank’s statement specifies that the rules cover funds received above $10,000, either in a single transaction or through the accumulation of transactions over the course of a day.

The BCB also requires providers to place holds on additional transfers that need further evaluation under their own risk policies. In other words, the $10,000 threshold is not the only gate: the central bank expects VASPs to treat certain flagged activity more cautiously, even if the threshold is not the only factor.

Providers will be allowed to complete their assessment and release a transfer before the 24-hour window ends, as long as they follow parameters set out by the BCB. That gives firms flexibility in cases where they can quickly clear the transfer after review.

Operational duties for VASPs

The BCB’s note makes clear that the hold mechanism comes with compliance obligations. VASPs must:

• Notify customers when a transfer is subject to a hold.
• Keep records of fraud incidents, attempted fraud, and the corrective actions taken in response.

These requirements matter for users and firms alike because they effectively formalize what providers must do when suspicious cross-border activity is detected. For traders and businesses relying on fast settlement, the policy introduces a potential delay on outbound transfers routed to foreign venues or self-custody addresses when the relevant conditions apply.

Why this is being tightened now

The central bank’s move reflects a broader shift among regulators as they confront scams that leverage the speed and global reach of digital assets. Crypto transfers can settle quickly across borders, which can help legitimate users—but it also creates opportunities for criminals to move funds before counterparties can intervene.

Brazil’s rules are part of a larger international pattern where regulators seek to slow down or add friction at key stages of the transfer process, particularly when money is leaving regulated custody environments for higher-risk destinations such as self-custody wallets.

That context is especially important for investors and service providers: while blockchain activity is transparent, reversing losses is often difficult. Measures like precautionary holds aim to reduce the chance that funds are sent to the wrong addresses in the first place.

Comparisons: Japan’s withdrawal delays and Europe’s scam warnings

Brazil’s action follows similar anti-scam developments elsewhere. In Japan, the Financial Services Agency and the National Police Agency asked crypto exchanges to restrict withdrawals after customers deposit fiat or buy digital assets. As reported earlier by Cointelegraph, Japanese authorities urged exchanges to implement controls such as requiring customers to preregister withdrawal addresses and applying a waiting period before newly added addresses can be used.

Other safeguards discussed in Japan include customer-specific withdrawal limits, stronger monitoring, phishing-resistant multifactor authentication, and checks intended to confirm that a bank remitter’s name matches the crypto account holder.

However, the Japanese measures are not binding. Exchanges can decide how to implement protections based on their own operations and exposure to misuse, which stands in contrast to Brazil’s regulatory timing and threshold-based structure.

In Europe, regulators have also highlighted risks tied to impersonation and fraud. Earlier coverage from Cointelegraph noted warnings about criminals impersonating watchdogs and crypto firms, including instances involving fake websites and the misuse of identity and logos in falsified documents. While those reports focus more on deception surrounding licensed providers, they point to the same underlying issue: scammers adapt quickly to user demand, especially when people are looking for regulated access points.

What to watch next

With Brazil’s hold rules scheduled to begin on Jan. 1, 2027, VASPs will likely adjust transfer flows, customer communications, and fraud-review processes well before the effective date. Users sending large transfers to foreign services or self-custody wallets should watch how providers interpret the $10,000 trigger and what criteria they use to classify additional transfers as “requiring further scrutiny.”