From the journal

Brazil Mandates DeCripto Crypto-Asset Reporting Form Effective 1 July 2026

Brazil's Federal Revenue Service (Receita Federal do Brasil) replaces Instrução Normativa RFB No. 1,888/2019 with IN RFB No. 2,291/2025, effective 1 July 2026, creating the Declaração de Criptoativos (DeCripto). All crypto-asset service providers domiciled in Brazil must submit monthly reports via the RFB's e-CAC portal regardless of transaction volume, aligning Brazil's reporting regime with the OECD Crypto-Asset Reporting Framework.

3 min read

Instrução Normativa RFB No. 2,291/2025, published by Brazil's Federal Revenue Service (Receita Federal do Brasil, RFB) on 14 November 2025, takes effect on 1 July 2026 and replaces Instrução Normativa RFB No. 1,888/2019 in full. The new rule is final and enacted: exchanges and other crypto-asset service providers have been required to report under the CARF-aligned standard since 1 January 2026, while the DeCripto electronic form and self-reporting obligations for individual users without a Brazilian intermediary become operative from 1 July 2026.

Instrução Normativa No. 2,291/2025 creates the Declaração de Criptoativos (DeCripto), an electronic declaration form submitted through the RFB's Virtual Service Centre (e-CAC). Licensed crypto-asset service providers domiciled in Brazil must report monthly regardless of transaction value. Individual and corporate taxpayers who conduct crypto-asset transactions without a Brazilian-domiciled intermediary must report when monthly transaction totals exceed BRL 35,000. The rule aligns Brazil's domestic reporting obligation with the OECD's Crypto-Asset Reporting Framework (CARF), allowing the RFB to share information automatically with foreign tax authorities under existing tax treaties.

Brazilian-licensed exchanges, digital asset brokers, and custody providers must update their reporting systems to populate the expanded DeCripto form fields, which capture transaction categories beyond those required under IN 1,888/2019, including transfers, payments, and exchanges. Foreign platforms serving Brazilian tax residents must appoint a Brazilian fiscal representative and complete e-CAC registration before 1 July 2026. Failure to file the DeCripto return attracts minimum penalties of BRL 100 per month, with higher sanctions for inaccurate or late submissions.

IN 2,291/2025 does not alter the capital gains tax treatment of crypto-asset disposals, the monthly BRL 35,000 exemption from gains tax, or the obligation to declare crypto assets in annual income tax returns (DIRPF). Staking rewards, airdrops, and assets received in hard forks are not explicitly addressed in the new instruction; supplementary RFB guidance is expected. Providers that began complying with the CARF-standard reporting from 1 January 2026 should verify that their existing submissions satisfy the expanded DeCripto form requirements before the July transition date.

Licentium advises crypto-asset service providers and foreign platforms on Brazilian regulatory compliance, CARF alignment, and cross-border reporting obligations. Entities facing DeCripto registration requirements or seeking to assess their exposure under IN 2,291/2025 are welcome to contact us. Work we undertake includes VASP regulatory advisory, tax reporting framework analysis, foreign-platform Brazil market entry structuring, and CARF and DAC8 alignment assessments.

Source: Receita Federal do Brasil, Atos referentes à DeCripto (IN RFB No. 2,291/2025), 14 November 2025

Crypto Regulatory

More from the journal

See all
Illia Prokopiev

From Cloud Concentration to AI Dependence: The UK’s Critical Third Parties Regime

The United Kingdom now directly oversees designated technology suppliers whose service failures could threaten financial stability. The question is whether the first cloud designations show a legal expansion toward AI-model providers, and what the present regime requires. This analysis assumes the quoted statement concerns the UK financial-services Critical Third Parties regime and assesses the law through 14 July 2026.

Alberta Regulated iGaming Market Launched on 13 July 2026 with 22 Operators

Alberta's regulated private iGaming market launched on 13 July 2026, making Alberta the second Canadian province to permit private online gambling operators after Ontario. The Alberta Gaming, Liquor and Cannabis Commission serves as market regulator and the Alberta iGaming Corporation oversees commercial operations and operator contracts. Twenty-two operator sites went live on day one, including FanDuel, DraftKings, BetMGM, and BetRivers. Operators must fully launch or exit the Alberta market by 13 October 2026.

European Commission Presents Cybersecurity and AI Action Plan on 7 July 2026

On 7 July 2026, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. The plan directs the Commission and ENISA to evaluate advanced AI models before they reach the EU market, establish a secure testing platform for critical-sector organisations, and launch an EU Grand Challenge on AI-powered cybersecurity solutions. It operates alongside the AI Act, NIS2 Directive, DORA, Cyber Resilience Act, and Cyber Solidarity Act, and introduces no new directly binding obligations.