Itaú Unibanco, the largest private bank in Brazil, has formalized its role as a cryptocurrency service provider before the Central Bank of Brazil. The filing covers intermediation and custody of crypto assets, the same activities the regulator assigns to brokerage firms, according to local reports. The news arrives as the country’s crypto sector faces a compressed timeline to obtain licenses.
Itaú’s move places the bank inside a licensing framework that did not exist a year ago. Brazil’s central bank requires every company that holds, moves, or trades crypto for customers to register as a regulated provider. By filing, Itaú tells the market that it intends to be one of them.
For Brazilian users, the change matters most for custody. A provider that holds crypto for clients must keep those assets separate from the firm’s own money, meet minimum capital requirements, and follow the same governance and anti-money laundering standards that apply to securities brokers.
Clients of an authorized bank gain a clearer legal footing than clients of an unregulated app or an offshore exchange. For the bank, the filing is a commitment. A regulated crypto operation carries compliance costs, audit obligations, and reporting duties that smaller competitors may struggle to meet.
The move also signals that Brazil’s biggest lenders plan to keep crypto inside the domestic financial system rather than leave it to foreign platforms.
Itau’s embrace of bitcoin and crypto
Itaú’s crypto story started before the new rules. The bank announced plans for crypto custody in 2022, when it was building a tokenization platform. In late 2025, it began letting retail clients buy and sell bitcoin through its investment app, íon. The crypto assets traded on íon are held in custody by Itaú itself, which made the bank’s position an operational one long before it became a regulatory one.
The regulatory backdrop came in 2025 and early 2026, when the central bank published Resolutions 519, 520, and 521. They created a new license category called Sociedades Prestadoras de Serviços de Ativos Virtuais, or SPSAVs, and the rules took effect February 2, 2026.
The framework sorts providers into three categories: intermediaries, custodians, and brokers. It requires formal segregation of client and company assets, sets minimum capital levels, and extends the customer protection, governance, internal control, security, and anti-money laundering rules that already govern banks and brokers.
Resolution 521 brought crypto transactions into the foreign-exchange regime. Transfers with unauthorized counterparties face a $100,000 cap, which limits how crypto moves across borders outside regulated channels.
Companies already operating when the regime took effect had to file for authorization within a transition period.
That timing is why Itaú’s filing reads as a response to a pressure point, not a routine update.
Stricter standards follow. On July 1, 2026, the central bank approved tighter rules. Beginning in 2027, providers must meet financial security requirements similar to those for securities brokers and distributors.
The regulator also barred institutions in Segment 5, the simplified-rules category for smaller banks, from offering virtual asset services. That decision pushes crypto activity toward larger, better-capitalized players, the group Itaú belongs to.
