Itaú Unibanco Files as Regulated Crypto Provider as Brazil's Licensing Window Narrows

Itaú Unibanco, the largest private bank in Brazil, has formalized its role as a cryptocurrency service provider before the Central Bank of Brazil. The filing covers intermediation and custody of crypto assets, the same activities the regulator assigns to brokerage firms, according to local reports. It lands as the sector faces a compressed timeline to obtain licenses under a regime that did not exist a year ago.

The registration matters because Brazilian law now requires every company that holds, moves, or trades crypto for customers to register as a regulated provider. By filing, Itaú has told the market it intends to operate inside that perimeter rather than around it.

What does the filing change for custody clients?

For Brazilian users, the answer centers on custody. A regulated provider must keep client crypto separate from the firm's own money, meet minimum capital requirements, and follow the same governance and anti-money laundering standards that apply to securities brokers. Clients of an authorized bank gain a clearer legal footing than clients of an unregulated app or an offshore exchange.

For the bank itself, the filing is a commitment. A regulated crypto operation carries compliance costs, audit obligations, and reporting duties that smaller competitors may struggle to meet. The move also signals that Brazil's biggest lenders intend to keep crypto inside the domestic financial system rather than cede the activity to foreign platforms.

A regulatory position built on operational history

Itaú's crypto story predates the new rules. The bank announced plans for crypto custody in 2022, while building a tokenization platform. In late 2025, it began letting retail clients buy and sell bitcoin through its investment app, íon. The assets traded on íon sit in custody at Itaú itself, which made the bank's position an operational one long before it became a regulatory one.

The regulatory backdrop arrived in 2025 and early 2026, when the central bank published Resolutions 519, 520, and 521. These created a new license category, Sociedades Prestadoras de Serviços de Ativos Virtuais, or SPSAVs, and took effect on February 2, 2026. The framework sorts providers into three categories:

• Intermediaries
• Custodians
• Brokers

It requires formal segregation of client and company assets, sets minimum capital levels, and extends the customer protection, governance, internal control, security, and anti-money laundering rules that already govern banks and brokers to virtual asset firms.

Resolution 521 went further and brought crypto transactions into Brazil's foreign-exchange regime. Transfers with unauthorized counterparties now face a $100,000 cap, which constrains how crypto can move across borders outside regulated channels.

Companies already operating when the regime took effect had to file for authorization within a transition period. That timing is why Itaú's filing reads as a response to a pressure point rather than a routine update.

Stricter standards are already scheduled

Tighter rules are on the calendar. On July 1, 2026, the central bank approved stricter requirements: beginning in 2027, providers must meet financial security standards similar to those applied to securities brokers and distributors.

The regulator also barred institutions in Segment 5, the simplified-rules category for smaller banks, from offering virtual asset services altogether. That decision pushes crypto activity toward larger, better-capitalized players — precisely the group Itaú belongs to. In practice, the market is consolidating around institutions that can absorb the compliance load.

The near-term watch item is the licensing window itself: firms that were already operating when the February 2026 regime took effect must complete their authorization filings within the transition period, and the 2027 financial security requirements will define which of the newly licensed providers can actually stay in the market.