Brazil adds 24-hour hold on crypto transfers

Brazil's central bank will require crypto firms to hold certain outbound transfers for up to 24 hours before they settle, starting Jan. 1, 2027. The rule targets transactions above $10,000 sent to overseas platforms or self-custody wallets, plus anything flagged by a provider's own risk checks.

What the rule actually covers

The threshold is $10,000, either in one transaction or across a customer's total transfers in a day, according to the Banco Central do Brasil notice reported by Cointelegraph. Virtual asset service providers must notify customers when a hold is applied and keep records of fraud attempts and any corrective steps taken. A VASP can release funds early if it finishes its review and follows the central bank's parameters, so 24 hours is a ceiling, not a mandate. The rule applies specifically to transfers heading to foreign providers or self-custody wallets, the exact corridors fraud investigators say are hardest to claw back once funds move.

Brazil isn't inventing this pattern from scratch. Japan's regulators have asked exchanges to require preregistered withdrawal addresses and a waiting period before new addresses can be used, though those measures are voluntary. European watchdogs have separately flagged a wave of scammers impersonating licensed firms and regulator logos since the EU's MiCA licensing deadline. Brazil's version is different in one respect: it's binding, with an 18-month runway before enforcement begins in 2027.

A pause built for irreversibility

The logic here is simple: crypto's biggest fraud advantage is that transfers are final and fast. A scammer who convinces a victim to move funds to a self-custody wallet or an offshore exchange today has the money gone in minutes, with no bank to call and freeze the wire. A 24-hour hold doesn't stop the scam from happening, but it gives victims, banks and providers a window to catch it before it's unrecoverable.

The $10,000 threshold and the choice of self-custody and overseas transfers as the trigger points are worth noting. Brazil isn't holding every crypto transaction, it's targeting the exact destinations where recovery is hardest once funds land. That's a narrower net than a blanket delay, and it suggests regulators are trying to preserve everyday crypto use while closing the door scammers rely on most. The 18-month lead time also matters: providers get real runway to build the review infrastructure rather than scrambling to comply overnight.

The tradeoff is friction for legitimate self-custody withdrawals, which will now face a delay they didn't before, even when there's no fraud involved. Whether that friction is worth the fraud prevention depends on how aggressively providers use the "early release" option versus defaulting to the full 24 hours.

What to watch

The test is whether providers treat the 24-hour window as a genuine review period or a default delay. If most transfers above $10,000 get released well before the cap, the rule will look like a targeted fraud filter. If holds routinely run the full 24 hours regardless of risk signals, it becomes a blanket tax on self-custody and cross-border transfers, and Brazilian users will likely route around it well before the January 2027 start date arrives.