Does your jurisdiction regulate Fintech services under the traditional Financial Services laws or does it have any ad hoc regulatory frameworks for fintech services? (Financial Services Laws/Ad Hoc Framework/Hybrid)

In Brazil, financial services are governed by Law 4,595/64, while payment services providers are governed by Law 12,865/13. Most fintech services fall within the general scope of financial and payment services laws and regulations, provided that the Brazilian regulators have created specific regulatory provisions for fintech services, such as simplified requirements for authorization and operation, waiver of authorization to provide certain services, development of regulatory sandboxes, etc.

Make a list of fintech services that may obtain a licence in your jurisdiction? 

There are several fintech services that may obtain a licence to operate, such as:

• (i) payment institutions, that may provide the following payment services: (a) e-money issuing; (b) post-paid instrument issuing; (c) acquiring; and (d) payment transaction initiation;
• (ii) direct credit company and peer-to-peer lending company – two types of financial institutions that may grant loans; and 
• (iii) virtual assets services providers (subject to future regulation – as detailed in items 11 and 13).

What is(are) the name(s) of the regulatory authority(ies) responsible to grant licences and regulate fintech service providers? If there is more than one, please list which fintech services are regulated by which authority.

Currently, the main authorities that regulate, supervise and grant licenses to fintech service providers (i.e. financial and payments institutions, payment initiation service providers, among others) are the National Monetary Council (CMN) and the Central Bank of Brazil (BCB).

If the services involve securities, the Brazilian Securities Commission (CVM) will have authority to regulate, supervise and grant licenses.

Virtual assets services will be regulated, but the authority was not defined yet.

Are there any specific restrictions on the types of fintech services that can be offered in and/or from your jurisdiction?

Most fintech services may be provided in Brazil and will fall into the jurisdiction of the Central Bank of Brazil, the Brazilian Securities Commission and, in the future, of the regulator to be assigned to supervise virtual assets service providers. Certain services may be provided without a prior licence (acquiring and issuance of post-paid instruments), provided that a licence will be required once a transaction threshold is reached. In the other cases, a prior licence must be obtained.

Is reverse solicitation allowed in your jurisdiction, for fintech firms licensed in other reputable jurisidictions? (Meaning that a third-country fintech firm can offer services to clients in your jurisdiction providing its at the exclusive initiative of the client).

Yes, as long as the services are provided in another jurisdiction and there is no direct offering of the services in Brazil. Otherwise, the foreign fintech will have to incorporate a subsidiary in Brazil and file for the applicable licences with the local authorities.

Are there any specific requirements for companies providing fintech services in your jurisdiction?

Most fintech services were regulated in recent years in Brazil. Therefore, depending on the activities performed, the institution may have to comply with requirements related to:

(i) prevention of money laundering and counter-terrorism financing; (ii) international sanctions; (iii) compliance; (iv) ombudsman; (v) internal controls; (vi) risk management; (vii) internal and external audit; (viii) corporate governance; (ix) cybersecurity; and (x) relationship with clients, among others.

Are there any specific consumer protection measures that apply to fintech services in your jurisdiction?

In case the provision of products/services by fintechs is considered a consumer relationship, these providers must comply with the Consumer Protection Code (Law 8,078/90).

Regarding credit offering services, we highlight that there are provisions that aim at protecting the consumer from over-indebtedness, which imposes to fintechs special duties, such as disclosure, credit analysis and procedures to deal with over indebtedness as a way to avoid the social exclusion of the consumer.

Are there any other legal issues that companies should be aware of when providing fintech services in your jurisdiction?

Besides the specific requirements associated with the provision of payment and/or financial services, fintechs should comply with general laws and regulations, such as Federal Law 13,709/18 (Brazilian Data Protection Law), Complementary Law 105/01 (Bank Secrecy Law), Federal Law 12,414/11 (applicable to credit bureaus), Federal Law 12,965/14 and Decree 8,771/16 (Internet Law), Law 8,078/90 (Consumer Protection), Decree 11,034/22 (Customer Services Decree) and Decree 7,962/13 (E-commerce Decree).

Are virtual assets (such as cryptocurrencies and) permitted in your jurisdiction? (Yes/No)

Yes

If the answer is Yes, is there any licensing /authorisation/notification process that needs to be followed for a person to issue a new virtual asset? (Yes/No)

Yes

If the answer is Yes, please provide a summary of the process that needs to be followed by a person to issue a new virtual asset).

The Brazilian Virtual Assets Law (Law 14,478/22) sets forth that a specific regulator will be in charge of licencing virtual assets services providers. No regulation has been enacted to this date and the regulator was not appointed yet. We believe that the regulatory framework will resemble the regulation of payment institutions.

If the virtual asset is considered a security, its issuer/service provider must comply with the applicable regulations enacted by the Brazilian Securities Commission.

Are Virtual Asset service providers regulated in your jurisdiction? (Yes/No)

Yes

If the answer to your previous question is Yes, please provide a summary of the framework that regulates such service providers explaining which licence(s) need to be obtained from which authority(ies).

Law 14,478/22, that governs virtual assets service providers, requires a prior license for the provision of such services. However, the regulator was not appointed yet. Once appointed, the regulator will enact a specific regulation detailing licensing requirements for virtual assets services providers. As mentioned in item 11 above, we believe that such procedure will likely be similar to the current licensing procedure required for payment institutions before the Central Bank of Brazil.

Are you as a firm providing services and advice relating to Virtual Assets? (Yes/No)

Yes

Please feel free to add any pertinent comments in addition to your answers.

Brazilian authorities have been promoting a series of initiatives to encourage innovation in the financial and payment sectors, among which we highlight the following: (i) Instant Payments (Pix); (ii) Open Finance; (iii) regulatory sandboxes; (iv) a project to issue CBDC; (v) peer-to-peer lending; (vi) investment crowdfunding; (vii) securitization; (viii) payment initiation services; (ix) legal framework for virtual assets services providers; and (x) updated foreign exchange regulations.