Itaú Unibanco, Brazil’s largest private bank, has become the first lender in the country to formally register its cryptocurrency trading and custody operations with the central bank. The bank submitted its notification on October 27, three days before the October 30 deadline for institutions already offering these services.

The filing covers both trading and custody activities, which fall under the virtual asset brokerage category defined by the regulator. Itaú already provides access to 15 digital assets, including Bitcoin, Ethereum, Solana, XRP and the USDC stablecoin, through its investment platform.

Existing Service Brought Under New Framework

Although the notification brings the bank’s cryptocurrency business under the new regulatory regime, Itaú has offered digital asset investments since December 2023. The service initially allowed customers to buy Bitcoin and Ethereum through the bank’s Íon investment platform. It was later expanded to all platform users in June 2024 after internal surveys showed strong customer interest.

The bank now lists 15 cryptocurrencies on its official investment site. Customers can begin investing with as little as 10 Brazilian reais. Itaú holds the assets in its own custody rather than requiring users to manage private keys themselves. The bank has not disclosed the number of customers using the service or the total value of transactions processed.

Itaú has also explored broader blockchain applications. In August it joined a tokenization pilot organized by the Brazilian financial markets association ANBIMA to test the issuance, trading and settlement of tokenized bonds and investment funds.

Different Paths for Banks and Dedicated Providers

Brazil’s central bank introduced its cryptocurrency regulatory framework through resolutions that took effect on February 2, 2026. Under Resolution 520, financial institutions already authorized and supervised by the regulator can offer cryptocurrency services by submitting a notification, provided they meet operational and security standards. The process requires an independent technical certification confirming compliance.

Institutions that were already active when the rules took effect received a 270-day transition period ending October 30. Those that miss the deadline must stop offering the services within 30 days.

Dedicated cryptocurrency exchanges and other virtual asset service providers face a stricter process. They must apply for formal operating authorization rather than simply notifying the central bank. Several firms, including Binance through its local entity and domestic exchange Mercado Bitcoin, have indicated they are pursuing authorization ahead of the same deadline.

The regulatory requirements have prompted some smaller cryptocurrency companies to exit or scale back operations in Brazil because of compliance costs and capital requirements.

Broader Oversight Measures

In September the central bank issued Resolution 589, shifting the start of restrictions on dealings with unauthorized virtual asset providers from October 30 to November 6. From that date, banks and other supervised institutions will generally be prohibited from conducting cryptocurrency transactions with providers that lack authorization or an applicable exception.

Additional reporting obligations for cryptocurrency businesses during the transition period, covering customer asset balances, custody holdings and proof of reserves, are scheduled to take effect on January 1, 2027. Separate rules introduced on October 1 require covered institutions to report cryptocurrency transfers of at least $10,000 involving self-custody wallets to the country’s financial intelligence authority.

Itaú ranked first among Brazilian banks by total assets in 2025. Central bank data reviewed earlier this year showed that major Brazilian banks held no cryptocurrencies on their own balance sheets as of March 2026, even while offering trading and custody services to customers.

The notification places Itaú’s existing cryptocurrency operations firmly within the country’s formal supervisory framework as the transition period for already-active providers draws to a close.