Brazil: technology regulation at a glance

Framework: Law No. 14,478/2022 (Brazilian Virtual Assets Law – 'Marco Legal dos Criptoativos'), implemented by Banco Central do Brasil (BCB) Resolutions Nos. 519, 520 and 521 of 10 November 2025 (in force 2 February 2026); Comissão de Valores Mobiliários (CVM) regulates tokens qualifying as securities under Law No. 6,385/1976; Receita Federal (RFB) governs tax reporting.

Crypto is legal in Brazil and, as of 2 February 2026, subject to a comprehensive prudential and licensing regime. Law 14,478/2022 established Virtual Asset Service Providers (VASPs) as regulated entities under the Banco Central do Brasil, and BCB Resolutions 519/520/521 (published 10 Nov 2025) now impose authorization, capital, governance, segregation, AML/CFT and cross-border FX rules; tokens qualifying as securities remain under the CVM.

Framework: Bill PL 2338/2023 ('Marco Legal da Inteligência Artificial') — approved by the Federal Senate in December 2024, pending final vote in the Chamber of Deputies (rescheduled to February 2026). No comprehensive AI law is yet in force; the National Data Protection Authority (ANPD) is designated as the future coordinator of the proposed National System for the Regulation and Governance of AI (SIA). In parallel, Brazil has a non-binding national strategy (EBIA, Portaria MCTI 4.617/2021) and the Plano Brasileiro de Inteligência Artificial (PBIA) 2024–2028.

Brazil does not yet have a comprehensive, in-force AI law. Its flagship risk-based bill (PL 2338/2023) passed the Senate on 10 December 2024 and is awaiting final approval by the Chamber of Deputies, with the vote pushed to early 2026 amid political disputes. AI governance today therefore rests on a patchwork of the LGPD (data protection), sectoral rules (e.g., ANPD, Central Bank, Anatel, Anvisa), the non-binding EBIA strategy, and the PBIA 2024–2028 investment plan, while the ANPD has flagged AI as a top enforcement priority for 2026–2027.

Framework: Lei Geral de Proteção de Dados Pessoais (LGPD) — Lei nº 13.709/2018, in force since September 2020; supervised by the Autoridade Nacional de Proteção de Dados (ANPD), which became a fully autonomous regulatory agency in February 2026 under Lei nº 15.352/2026. Data protection is a fundamental right under Article 5, LXXIX of the Federal Constitution (EC 115/2022).

Brazil operates a comprehensive, GDPR-inspired data protection regime centred on the LGPD (Law 13.709/2018), applicable to any natural or legal person processing personal data in Brazil or of Brazilian data subjects. It is enforced by the ANPD, which in February 2026 was upgraded to an independent regulatory agency and has significantly escalated sanctioning activity, imposing over BRL 98 million in fines cumulatively between 2023-2025. On 26-27 January 2026, Brazil and the European Union adopted mutual adequacy decisions, allowing personal data to flow between the two jurisdictions without additional transfer safeguards.

Framework: Law No. 12,865/2013 (Payment Arrangements and Payment Institutions), supervised by the Banco Central do Brasil (BCB) and the National Monetary Council (CMN); implementing rules include BCB Resolution No. 80/2021 (as amended by Joint Resolution No. 14/2025) on authorisation and minimum capital, BCB Resolution No. 1/2020 and successors governing Pix, and the Open Finance framework under Joint Resolution No. 1/2020.

Brazil operates a mature, dedicated licensing regime for payment and fintech activities under Law 12,865/2013, administered by the Central Bank of Brazil (BCB). Payment institutions must be authorised in one of four regulated categories (e-money issuer, post-paid instrument issuer, acquirer, or payment initiation service provider), and the BCB additionally runs the Pix instant-payment rail and a phased Open Finance regime. Rules were significantly updated in 2025 (Rules #493, #495, #506 and Joint Rule #14), tightening Pix participation criteria, revising minimum capital by activity, and formalising Pix Parcelado (instalment-based BNPL over Pix).

Framework: VITEM XIV visa and residence authorization for digital nomads, established by CNIg/MJSP Normative Resolution No. 45 of 9 September 2021 (published DOU 24 January 2022); administered by the Ministry of Justice & Public Security and the Ministry of Foreign Affairs (Itamaraty).

Brazil operates a dedicated digital-nomad visa (VITEM XIV) in force since 2022, granting a temporary visa or residence authorization to foreigners without a labor tie in Brazil who work remotely for a foreign employer or client. It is issued for up to one year and renewable once for an additional year, subject to a US$1,500 monthly income or US$18,000 savings threshold. Beyond this pathway, Brazil also offers a residency-by-investment route (VIPER) via real estate and other long-stay categories such as the retirement (aposentado) and investor visas.

Framework: Marco Civil da Internet (Law 12,965/2014) as modified by the STF's 26 June 2025 ruling on Article 19, plus the Digital ECA (Law 15,211/2025, in force since 17 March 2026, enforced by ANPD); the general 'Fake News Bill' (PL 2630/2020) remains stalled in Congress.

Brazil does not yet have a single unified online-safety statute equivalent to the EU DSA or UK OSA, but it operates a layered regime: the Marco Civil da Internet (2014) as reshaped by a landmark 2025 Supreme Court (STF) ruling imposing a qualified duty of care on platforms, and the Digital ECA (Lei 15.211/2025), a dedicated child/adolescent online-safety law enforced by the ANPD that took effect in March 2026. The proposed comprehensive 'Fake News Bill' (PL 2630) remains stuck in the Chamber of Deputies.

Framework: Patchwork of sectoral rules (BCB/CMN for finance, ANATEL for telecoms) plus LGPD Law No. 13.709/2018 with ANPD Resolution CD/ANPD No. 15/2024 on security incidents, coordinated under the National Cybersecurity Policy — PNCiber (Decree No. 11.856/2023) and the National Cybersecurity Strategy — E-Ciber (Decree No. 12.573/2025). A comprehensive Cybersecurity Legal Framework (Senate Bill PL 4.752/2025) is pending.

Brazil does not yet have a single comprehensive, NIS2-style cybersecurity law. Instead it relies on a governance framework set by presidential decree (PNCiber 2023 and the updated E-Ciber Strategy of August 2025), combined with sector-specific cybersecurity rules for banking (BCB Resolution 538/2025 and CMN Resolution 5.274/2025) and telecoms (ANATEL Resolutions 740/2020 and 780/2025), plus the LGPD's personal-data breach-notification duties enforced by the ANPD. A dedicated Cybersecurity Legal Framework bill (PL 4.752/2025) that would create a National Cybersecurity Authority was introduced in the Senate in September 2025 but has not been enacted.

Framework: Federal Law 11.598/2007 (Redesim) integrates registrations; company forms governed by the Civil Code (Ltda) and Law 6.404/76 (S.A.); foreign-party filings follow DREI Normative Instructions (esp. IN 81) at state Juntas Comerciais; investor immigration under CNIg Normative Resolutions (VIPER)

Foreigners may own 100% of a Brazilian company (Ltda or S.A.) in most sectors, and the digital Redesim/Junta Comercial portals now issue registration for low-risk activities in 1–7 business days. However, non-resident partners must appoint a Brazil-resident legal representative, foreign documents require sworn translation and consular/apostille legalization, and full setup with CNPJ, banking, sectoral licenses and tax enrolments typically takes several weeks to a few months — reflecting Brazil's persistent 'Custo Brasil' bureaucracy.