Which laws make up AML in Brazil, from 1998 to 2026?
Three dates in 2026 set the current rules. On 2 February, the Central Bank's virtual asset framework took effect. On 1 October, Resolution 591 added cash foreign exchange and transfers to or from self custody wallets of US$10,000 or more to the operations Central Bank firms report to COAF. From 6 November, institutions the Central Bank authorizes may not carry out or enable virtual asset operations with providers it has not authorized, except where the rules expressly allow it.
The legal framework's history and key laws start in 1998. Law 9,613 of 3 March 1998, Lei 9.613, known as the Lei de Lavagem de Dinheiro, defines the crime, lists the obliged persons (art. 9), sets their duties (arts. 10 and 11) and created COAF (art. 14). Law 12,683 of 2012 dropped the closed list of predicate crimes, so the proceeds of any criminal offense now count (art. 1).
Like most AML rules in other jurisdictions, Brazil's anti money laundering legislation pairs one criminal statute with rules each supervisor writes for its own sector. For every institution the Central Bank authorizes, banks, payment institutions and authorized virtual asset providers among them, that rule is Circular 3,978 of the Banco Central do Brasil (art. 1).
| Instrument | Date | What it does |
|---|---|---|
| Law 9,613 (Lei 9.613) | 3 March 1998; amended by Law 12,683 of 2012, Law 14,478 of 2022 and Law 15,358 of 2026 | Laundering offense (art. 1), obliged persons (art. 9), duties (arts. 10, 11), sanctions (art. 12), COAF (art. 14) |
| Law 13,810 | 8 March 2019 | UN Security Council sanctions, asset freezes included, apply in Brazil; national designations of terrorism suspects (art. 1) |
| Law 13,974 | 7 January 2020 | COAF keeps technical and operational autonomy and is linked administratively to the Central Bank (art. 2) |
| Circular 3,978 | 23 January 2020; in force 1 October 2020; last amended by Resolution 591 of 2026 | Policy, risk assessment, know your customer, monitoring and COAF reports for Central Bank firms |
| Law 14,478 and Decree 11,563 | 21 December 2022; 13 June 2023 | Virtual asset service providers become obliged persons (Law 9,613 art. 9 XIX); the decree names the Central Bank their supervisor |
| Resolution 519, Resolution 520 and Resolution 521 | 10 November 2025; in force 2 February 2026, the 521 foreign exchange reporting parts 4 May 2026 | Authorization, operation and foreign exchange treatment of virtual asset providers |
| Law 15,358 | 24 March 2026; in force on publication, 25 March 2026 | Organized crime framework; amends Law 9,613's forfeiture rules; adds account blocking for unauthorized betting operators to Law 14,790 |
| IN BCB 761 | 9 July 2026 | Guidance on enhanced measures for customers, correspondents and partners in FATF listed jurisdictions |
| Resolution 589 and Resolution 591 | 23 and 30 September 2026 | Ban on unauthorized virtual asset counterparties from 6 November 2026; US$10,000 reports from 1 October 2026 |
Brazil's AML legal stack, in force November 2026.
Who supervises AML in Brazil, and where does COAF sit?
| Body | Who it covers | AML role |
|---|---|---|
| COAF (Conselho de Controle de Atividades Financeiras) | Receives reports from every obliged person; supervises sectors with no regulator of their own, such as factoring, jewelry and luxury goods (Law 9,613 art. 14 §1) | Brazil's FIU: analyzes reports, refers cases to the authorities (art. 15), issues instructions and imposes art. 12 sanctions for its sectors |
| Central Bank of Brazil (BCB) | Banks, payment institutions, foreign exchange firms; virtual asset providers since June 2023 | Writes Circular 3,978 and the virtual asset resolutions; inspects and sanctions |
| CVM (Securities and Exchange Commission of Brazil) | Securities firms, brokers and funds | Sector AML rules and supervision |
| SUSEP and PREVIC | Insurers, insurance brokers and pension entities | Sector AML rules and supervision |
| Ministry of Justice and Public Security | Receives UN freeze reports | Passes UN Security Council freezes to regulators (Law 13,810 art. 10) |
| Federal Police and prosecutors (Ministério Público) | Laundering cases | Criminal investigation and prosecution |
Supervisors and government bodies, as of November 2026.
The government and regulatory role is split: sector supervisors enforce their own rules, and COAF covers the rest. COAF was created in 1998 inside the Ministry of Finance (art. 14). Law 13,974 of 7 January 2020 gives it technical and operational autonomy and links it administratively to the Central Bank (art. 2); a 2023 provisional measure that moved it back to the ministry lapsed. It does not supervise the financial sector as a whole.
The plenary decides sanctions as a body. Law 13,974 art. 4 §1 seats the COAF president and 12 career officials from the Central Bank, CVM, SUSEP, PREVIC, the Federal Police, the Federal Revenue, the Comptroller General and five other federal bodies, and §2 II gives the plenary the art. 12 cases of sectors without a regulator.
Brazil's AML regime also answers to the FATF, which Brazil joined in 2000; COAF coordinates the delegation. The FATF's Brazil page asks for closer coordination between the police, the prosecution authority and the tax office, the bodies that build AML and CFT cases.
Who must comply with Law 9,613?
Article 9 applies the duties of articles 10 and 11 to anyone who, as a main or side activity, permanent or occasional, handles third party funds, trades foreign currency, or gold as a financial asset or exchange instrument, or deals in securities. Its sole paragraph adds 19 groups, among them insurers, card and payment schemes, leasing and factoring firms (V), lotteries including fixed odds betting (VI), real estate (X), jewels, precious metals and art (XI), luxury goods and cash heavy businesses (XII), commercial boards and public registries (XIII), advisers and accountants in listed operations (XIV), athlete and artist agents (XV), cash in transit firms (XVI) and virtual asset service providers (XIX). Lawyers are not named; the 2023 mutual evaluation reads item XIV as reaching them but found them still unregulated for AML, with no Bar Association rules.
Picture an illustrative factoring company in Belo Horizonte. Item V covers it and no sector regulator supervises it, so it registers with COAF (art. 10 IV) and answers to COAF for instructions and sanctions, as do jewel and luxury goods dealers and other designated non financial businesses and professions (DNFBPs) without a regulator.
What do the Central Bank's virtual asset rules add?
Resolution 520 article 44 ties providers to the AML rules, and its sole paragraph makes the sending provider pass originator and beneficiary data, wallet included, to the receiving institution: Brazil's version of the travel rule. Providers already operating had 270 days from 2 February 2026 to apply for authorization (art. 88 I). That window closed on 30 October 2026.
Article 91, as reworded by Resolution 589, applies the 6 November ban to financial institutions, payment institutions and every other authorized institution, save the forms the resolution allows.
What are Brazil's KYC requirements, AML obligations and reporting duties?
Brazil's KYC requirements mean identifying, qualifying and classifying each customer by risk, the three steps of customer due diligence (CDD) in Circular 3,978 (arts. 13 to 20). The table's last column shows how complead, formerly Sanction Scanner, covers each duty; Sanction Scanner, the screening product, is part of complead. Four duties of Central Bank firms sit outside the twelve rows:
- Responsible director (art. 9). One director is formally named to the Central Bank as responsible.
- Approved policy (art. 7). The board, or the executive board where there is none, approves the written policy.
- Effectiveness report (art. 62). A yearly report, base date 31 December, reaches the audit committee, where there is one, and the board, or the executive board where there is none, by 31 March.
- Nil declaration (art. 54). A year without reports means a declaration within ten business days after year end; Law 9,613 art. 11 III asks the same of every obliged person, filed with its regulator or COAF.
| Obligation | Legal basis | What a program must do | How complead does it |
|---|---|---|---|
| Risk based policy and internal risk assessment | Law 9,613 art. 10 III; Circular 3,978 arts. 2, 7, 10 | Keep a written policy matched to customer, institution, product and staff risk; assess each risk by likelihood and impact and set risk categories. | Each rule can be limited to one product, segment or jurisdiction; its versions record who changed what, when and why. |
| Know your customer | Law 9,613 art. 10 I; Circular 3,978 arts. 13, 18, 20 | Identify, qualify and classify each customer under a manual the executive board approves, and keep the register current. | Onboarding, screening and monitoring feed a single risk score for each customer. |
| Beneficial owner | Law 9,613 art. 10 §1; Circular 3,978 art. 25 | Fix by risk a shareholding line for beneficial ownership, at most 25 percent counting direct and indirect stakes, justify it in the manual and identify each ultimate beneficial owner above it. | KYB and UBO verification climbs the ownership chain, parents and controlling entities included, to the natural persons at the top and flags any layer it cannot resolve as unresolved. |
| Politically exposed persons | Circular 3,978 arts. 19, 27 for Central Bank firms; COAF Resolution 40 for COAF sectors; Law 9,613 art. 12-A §2 (CNPEP check) | Flag the PEPs art. 27 lists (federal elected officials and senior federal posts, members of the higher and regional federal courts, senior prosecutors, national party presidents and treasurers, state and city officials, senior foreign and international officials) for five years after they leave office, with family to the second degree, spouses, stepchildren and close associates; someone senior to the person who authorizes the relationship decides whether to start or keep it. | Each PEP alert shows which signals matched, and the record names who approved the relationship. |
| Monitoring, selection and analysis | Circular 3,978 arts. 38, 39, 43 | Monitor operations and proposals, select those with signs of laundering within 45 days of the operation, and finish each analysis within 45 days of selection in a written dossier. | Every alert shows which rule fired and which signals matched. |
| Suspicious operation communication | Law 9,613 art. 11 II; Circular 3,978 arts. 48, 50 | File Brazil's suspicious activity report (SAR) with COAF without telling the customer or third parties: within 24 hours under the law, by the next business day after the decision under the Circular. | Reporting support within case management; agent outputs on the case carry the evidence, a narrative and a work log. |
| Cash and specific operations | Circular 3,978 art. 49, amended by Resolution 591 | Report cash deposits and withdrawals, payments and transfers against cash, and cash withdrawal requests of R$50,000 or more, and from 1 October 2026 cash foreign exchange and self custody wallet transfers of US$10,000 or more. | A team writes both lines as no code rules and tests each against a 30, 60 or 90 day window of its own past data. |
| Sanctions | Law 13,810 arts. 2, 9, 11 | Freeze assets held directly or indirectly by persons named under UN Security Council sanctions or its committees' designations without delay (immediately or within a few hours) and without prior notice to them, as the regulator sets out; report freezes and attempted transfers to the Ministry of Justice, the regulator and COAF. | Screening consults 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes, and logs searches without a match too. |
| Virtual asset transfers | Resolution 520 art. 44; Resolution 521 | Pass originator and beneficiary data, wallets included, with each transfer; from 4 May 2026 record the purpose and the foreign counterparty of international crypto payments for foreign exchange reporting. | Payer and payee are screened over the API while the transfer is still in processing. |
| Record keeping | Law 9,613 art. 10 §2; Circular 3,978 art. 67 | Keep registers and records at least five years after the account closes or the transaction ends; Central Bank firms keep customer data, operation records and dossiers ten years. | Each check leaves an audit entry: who searched, for which name, at what moment, with which result. |
| Registration | Law 9,613 art. 10 IV, V; Circular 3,978 art. 55 | Register with the sector regulator or, where none exists, with COAF, and answer COAF's requests on time; Central Bank firms enable reporting on Siscoaf. | Screening history per customer, searches without a match included, stays on file for COAF requests. |
| Training | Circular 3,978 art. 3 I f, g | Select staff and outsourced providers with laundering risk in mind and train staff, including correspondents' staff who serve customers for the institution. | Closed alerts keep the rule and the signals that raised them, so training can draw on real cases. |
Twelve obligations with their legal basis, in force November 2026.
Which reais and dollar thresholds and deadlines apply in 2026?
Brazil runs two reporting clocks. Law 9,613 art. 11 II gives every obliged person 24 hours to report to COAF. Circular 3,978 sets the procedure for Central Bank firms: select within 45 days of the operation (art. 39), analyze within 45 days of selection (art. 43 §1), decide inside that window, then report by the next business day (art. 48 §2).
Take a customer who wants R$60,000 in cash. The bank needs the request three business days ahead (art. 36), records the bearer's name and CPF (art. 33), and reports both the request and the withdrawal to COAF by the next business day (art. 49).
| Rule | Line or clock | Basis |
|---|---|---|
| Bearer of cash identified | Above R$2,000: bearer's name and CPF recorded; a cash in transit firm counts as the bearer | Circular 3,978 art. 33 |
| Cash deposit details | R$50,000 or more: owner, bearer and origin of funds recorded | Art. 34 |
| Cash withdrawal notice | R$50,000 or more: request three business days ahead | Art. 36 |
| Cash communication | R$50,000 or more: to COAF by the next business day | Art. 49 I to III and §1 |
| Cash foreign exchange and self custody wallet transfers | US$10,000 or more; operations of 1 October to 31 December 2026 reported on the first business day of January 2027 | Art. 49 IV, V and §2 (Resolution 591) |
| Selection of an operation | Within 45 days of the operation | Art. 39 sole paragraph |
| Analysis of a selected operation | Within 45 days of selection | Art. 43 §1 |
| Suspicious communication | Next business day after the decision; 24 hours in the law | Art. 48 §2; Law 9,613 art. 11 II |
| Nil declaration | Within ten business days after year end | Art. 54 |
| Beneficial owner line | Set by risk, at most 25 percent | Art. 25 §1 |
| Unauthorized virtual asset counterparties | Barred from 6 November 2026 | Resolution 520 art. 91 (Resolution 589) |
Circular 3,978 articles unless marked; in force November 2026.
What is the penalty for money laundering in Brazil, and who enforces it?
| Breach or offense | Basis (Law 9,613) | Maximum | Condition |
|---|---|---|---|
| Irregular compliance with the KYC and record instructions of art. 10 I and II | Art. 12 I, §1 | Warning | None stated |
| Breach of arts. 10 and 11 | Art. 12 II, §2 | Fine not above twice the operation value, twice the real or presumed profit, or R$20 million | Fault or intent: a warning not cured on time, a breach of art. 10 I to IV, a COAF request not answered on time, a missed report or a breach of the tipping off ban |
| Serious breach or specific repeat | Art. 12 III, §3 | Disqualification as an administrator for up to 10 years | Serious breaches, or a repeat of breaches already fined |
| Repeat after disqualification | Art. 12 IV, §4 | Revocation or suspension of the authorization | Revocation for a repeat of breaches already punished with disqualification |
| Laundering | Art. 1 | 3 to 10 years in prison and a fine | Proceeds of any criminal offense |
| Aggravated laundering | Art. 1 §4 | One third to two thirds more | Repeated, through a criminal organization or using a virtual asset |
Law 9,613 maximums, in force November 2026.
AML penalties and enforcement run on two tracks. On the administrative track, the Central Bank, CVM, SUSEP or, for sectors with no regulator, COAF apply article 12 to the firm and to its administrators, cumulatively or not. A fine needs fault or intent. The criminal track runs through article 1, whose penalty line reads "Pena: reclusão, de 3 (três) a 10 (dez) anos, e multa": three to ten years in prison and a fine.
What did COAF fine in 2026?
COAF's 98th session, held on 2 June 2026, judged nine sanctioning cases against firms and their administrators and imposed fines totaling R$18,045,267.05. Every firm sat in a COAF supervised sector: luxury and high value goods, jewels and precious metals, and factoring. The breaches punished track the obligations table, from stale customer registers and missing records to unreported cash and suspicious operations and absent nil declarations. By its 100th session on 3 November 2026, COAF had issued 739 judgments and about R$380 million in fines since its first session in 2006.
Is Brazil a high risk country for money laundering?
An illustrative case: a payment institution near the Paraguay border opens accounts online. One new account receives dozens of Pix transfers from unrelated senders and pays them out the same day to a company abroad. The pattern fits fraud proceeds, tax evasion or drug trafficking cash alike, three money laundering risks in Brazil. The FATF names all three.
The FATF and GAFILAT mutual evaluation, adopted in October 2023, finds that Brazil's authorities share a sound understanding of the main threats: corruption, drug trafficking and organized crime, environmental crimes and tax crimes, with financial flows from environmental crime less well understood. Supervision of most of the financial sector, led by the Central Bank, has improved since 2010 and shows effective results; DNFBP supervision is still incipient. The beneficial ownership data companies file with the Federal Revenue is "largely unpopulated".
Brazil was on neither FATF list of 19 June 2026.
The plenary of 26 to 30 October 2026, where COAF led Brazil's delegation, reviewed the lists again, so check the current FATF lists of high risk countries before relying on a status.
The Central Bank acted in July. IN BCB 761 of 9 July 2026, an answer to the 2023 evaluation, sets at least seven enhanced measures for customers, correspondent banks and partners in listed jurisdictions, from extra qualification data and closer monitoring to operating limits where risks are unacceptable or cannot be mitigated and a written record of each decision.
Where do screening and transaction monitoring fit a Brazilian program?
The Circular's dossier and ten year record rules (arts. 43 §2 and 67) make the evidence trail the test: which list a customer was checked against, which rule raised the alert, who closed it and why. AML solutions for Brazil must keep it.
In complead, an AI native platform for AML, KYC and fraud, client screening and ongoing monitoring records each search with its author, the name checked, a timestamp and the outcome, empty results as well. Match sensitivity is configured by list type and down to a single list, and API triggers start or stop ongoing monitoring for each name. The data set comprises 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
Take an illustrative São Paulo lender entering the virtual asset market. In transaction monitoring, its team builds the R$50,000 cash rule and the US$10,000 self custody rule without code, backtests each on 30, 60 or 90 days of history and scopes both to Brazil, with every change versioned. Routine cases are closed by agents, each with its evidence, a written narrative and a work log; anything else waits for the compliance officer, whose name the record keeps.
What has Brazil changed since November 2025, and what is due in 2027?
- 10 November 2025. Resolutions 519, 520 and 521 issued (published 11 November).
- 2 February 2026. Virtual asset framework takes effect.
- 25 March 2026. Law 15,358 in force: financial institutions, payment institutions and payment scheme operators must, as regulated, block the accounts of fixed odds operators the regulator finds unauthorized and stop new transactions serving them (Law 14,790 art. 21-A).
- 4 May 2026. Resolution 521's crypto foreign exchange reporting starts: purpose and foreign counterparty recorded, a monthly report to the Central Bank by the fifth.
- 9 July 2026. IN BCB 761 on FATF listed jurisdictions.
- 1 October 2026. Resolution 591 and the new article 91 wording take effect.
- 6 November 2026. Dealings with unauthorized virtual asset providers stop.
From 1 January 2027 the rest of Resolution 589 applies, including balance, custody and proof of reserves reporting by providers that have applied for authorization.
What to do this week:
- Check the Central Bank authorization of each virtual asset counterparty your crypto and digital assets business uses, as the ban runs from 6 November.
- Switch on the US$10,000 rules, so the January 2027 filing covers operations from 1 October.
- Apply IN 761's measures to customers and partners in listed jurisdictions and record each decision.
The 2026 PDF. Every rule, date and article above stays readable here. The 16 page PDF, sent from the side panel form, adds what a team files rather than reads: a 14 point program checklist, a Brazil customer risk factor template and a suspicious operation decision record that logs reviewed cases a team chose not to report. Button: Get the Brazil PDF (to the side panel form)
