For responsible regulation

For years, the debate on cryptocurrency regulation was presented as a choice between two extremes: absolute freedom or state control.

Reality has made that opposition insufficient.

When millions of people hold wealth in digital assets, companies hold third-party funds in custody and services connect national financial systems to global networks, discussing rules stops being an ideological abstraction.

It becomes a discussion about responsibility.

The challenge is to regulate without repeating two possible mistakes: imagining that complex markets can resolve all their conflicts on their own, or building barriers so expensive that only large institutions can get past them.

Brazil has already entered this stage

Law No. 14,478 of December 2022 set out guidelines for the provision of virtual asset services in Brazil and included among its objectives consumer protection, security of operations, prevention of money laundering and free competition.

The Central Bank was later given authority to regulate virtual asset service providers.

The process moved forward.

Resolution BCB No. 520, issued in November 2025 and updated in 2026, began to govern how these providers are set up and operate.

This changes the nature of the Brazilian debate.

We are no longer seriously discussing whether there will be regulation. We are discussing which regulation will be able to build trust without eliminating competition and innovation.

Regulating intermediaries is not regulating mathematics

One distinction must be preserved.

Bitcoin is not a company.

Ethereum is not a bank.

A decentralized protocol is not legally identical to an exchange that receives client funds.

Brazil's securities regulator, the CVM, itself distinguishes between categories of crypto assets and clarifies that its authority covers those characterized as securities. Bitcoin and most cryptocurrencies, for example, do not automatically fall under its authority simply because they are digital assets.

This differentiation is essential to avoid technologically imprecise regulation.

The focus should be on the activities, the risks and the responsibilities actually assumed.

A company holding billions belonging to clients should be subject to obligations proportionate to that risk.

That does not mean a person running open-source software should automatically be treated the same way.

Protection is not paternalism

There is a frequent criticism of regulation: adults should be able to take whatever risks they want.

In principle, yes.

Free markets depend on people's ability to make choices.

But freedom of contract presupposes minimally adequate information and rules against fraud.

When a platform mixes its own funds with client assets, hides conflicts of interest or presents something high-risk as safe, we are not discussing economic freedom. We are discussing information asymmetry and accountability.

Likewise, protecting investors does not mean promising that no one will lose money.

Crypto assets can be extremely volatile. Projects can fail. Investors can make mistakes.

The role of the State should not be to eliminate economic risk, which is impossible, but to reduce avoidable fraud, manipulation and opacity.

There is also a global problem

Crypto assets cross borders far more easily than most regulatory institutions.

This creates a classic coordination problem.

The Financial Action Task Force monitors the international implementation of standards for virtual assets and found, in a 2024 report, that a large share of the jurisdictions assessed remained only partially compliant or non-compliant with the established standards.

The consequence is predictable: activities can migrate to jurisdictions with weak controls.

International cooperation is therefore necessary.

But it needs to preserve another concern: legitimate financial privacy should not automatically be confused with criminality.

The necessary balance

Good regulation should simultaneously pursue objectives that sometimes come into tension:

protecting consumers;

fighting fraud and money laundering;

preserving privacy;

allowing legitimate self-custody;

encouraging competition;

not making it impossible for small innovators to operate;

distinguishing protocols from intermediaries;

and providing legal certainty.

There is no perfect formula.

Responsible regulation is precisely the recognition that these values need to be balanced.

The most productive debate is not “regulation versus freedom”.

It is finding out which rules increase people's real freedom by preventing economic power, fraud or information asymmetry from destroying their capacity to choose.

In this sense, regulating may be precisely a way of allowing innovation to mature.