BCB Normative Instruction 739: the AML/CFT reasonable assurance report required from VASPs in Brazil

BCB Normative Instruction 739, of 29 May 2026, added a document to the authorization application of virtual asset service provider companies (SPSAVs) in Brazil: a reasonable assurance report, issued by an independent auditor registered with the CVM, on anti-money laundering and counter-terrorist financing (AML/CFT) controls.

For an exchange going through authorization, this means hiring an auditor to test and give an opinion on its AML/CFT structure before the Banco Central do Brasil reviews the application. This article summarizes what the regulation requires, based on the official text. The regulations are published in Portuguese; the quotes below are our translation.

What BCB NI 739 is

NI 739 amends BCB Normative Instruction 704/2026, which lists the documents and deadlines for authorization applications by FX brokers, CTVMs, DTVMs and SPSAVs. Its summary:

Amends BCB Normative Instruction 704 of 29 January 2026, which sets out the procedures, documents, deadlines and information required to support authorization applications related to the operation of FX brokers, securities brokers, securities distributors and virtual asset service provider companies.

It was published in the Official Gazette on 1 June 2026 and took effect on publication (art. 3). Its basis is BCB Resolution 519/2025, which governs authorization processes. According to the note attached to the regulation, the goal is to “bring greater rationality, security and robustness to the review of these applications”.

It has three articles:

art. 1 adds the report to the list of application documents (art. 5, XV, and art. 10, X, of NI 704) and changes the rule for reporting capital increases (art. 24);
art. 2 creates Annex IV of NI 704, with the content of the report;
art. 3 sets the effective date.

BCB NI 739 amends NI 704, which governs the SPSAV authorization application

Who must file the report

The report is required from virtual asset service provider companies applying for authorization from the Banco Central. NI 739 does not reach banks and brokers filing the formal notice under BCB Resolution 520. For them, the required document is the technical certification under BCB NI 701.

Who may issue the report is also set: only an independent auditor registered with the Comissão de Valores Mobiliários (CVM), Brazil’s securities regulator.

When to file: new SPSAVs and SPSAVs already operating

The timing depends on whether the SPSAV was already operating when Resolutions 519 and 520 took effect, on 2 February 2026.

When the BCB NI 739 report is filed in the authorization process

A new SPSAV files the report with its authorization application (art. 5, XV, of NI 704).

An SPSAV that was already operating goes through two phases. Phase 1 must be filed by 30 October 2026 (art. 9) and does not include the report: it covers the application form, a statement that the company was operating, reputation statements from the controlling shareholders and other documents. Phase 2 starts after the Banco Central’s favorable opinion on phase 1 and has a deadline of up to 60 days, extendable by another 60 on a justified request (art. 10). The reasonable assurance report is filed in phase 2 (art. 10, X).

What the reasonable assurance report covers

Annex IV says the report addresses the “detection and prevention of transactions whose characteristics may indicate the crimes defined in Law 9,613 of 3 March 1998”, Brazil’s money laundering law. It must contain a conclusive opinion on eight aspects.

The eight aspects of Annex IV of BCB NI 704, added by BCB NI 739

Policy, structure and training

The AML/CFT policy must be documented and approved by the board of directors or, if there is none, by the executive board, following the guidelines of Circular 3,978/2020. The structure must fit the size of the company and be free of conflicts of interest with business areas. Training also extends to staff of correspondents in Brazil.

Internal risk assessment

The assessment must be approved by the responsible officer and shared with the risk and audit committees, where they exist, and with the board. It covers the risk profiles of customers, the company, transactions, products, channels, new technologies, employees, partners and outsourced providers.

Know your customer and know your partner

The report assesses customer identification, qualification and classification procedures, backed by a specific manual. Qualification includes financial capacity, politically exposed person checks, beneficial ownership and reputation, with enhanced due diligence for PEPs, high-risk customers and jurisdictions under FATF monitoring. Partners go through formalization, identification, qualification and classification.

Monitoring and reporting to Coaf

This covers the monitoring manual, the parameters and scenarios used to select transactions, alert analysis and reporting to Coaf, Brazil’s financial intelligence unit. Analysis files are kept for ten years, and the auditor checks whether the structure is enough to analyze every alert generated.

Fraud, asset freezes and transaction records

The last three aspects cover monitoring of fraud and scam indicators, administrative freezing of assets ordered by the UN Security Council under BCB Resolution 44/2020, and transaction records with the minimum information required by Circular 3,978/2020, including the origin and destination of funds.

Two rules in Annex IV help size the work:

part of the scope, such as fraud monitoring, asset freezes and transaction records, applies only to SPSAVs that were already operating when Resolution 519 took effect (§ 1);
reasonable assurance reports issued in the previous twelve months on the same aspects may be taken into account in the opinion (§ 2).

The change to capital increase reporting

NI 739 also changed art. 24 of NI 704, which applies to every institution under that regulation, not only SPSAVs. Capital increases made with profits, reserves or shareholder credits, which do not need authorization, must be reported within fifteen days by an entry in Unicad, following the Sisorf procedure.

Frequently asked questions

Is the NI 739 report the same as the NI 701 technical certification?

No. The NI 701 technical certification is issued by a qualified independent firm, covers 17 items of Resolution 520 and goes with the formal notice filed by banks and brokers. The NI 739 report is issued by an auditor registered with the CVM, covers AML/CFT and goes with the SPSAV authorization application.