Executive Summary
- The Irish receiver should suspend availability of this transfer. An identified account customer does not resolve the intended recipient's identity or the incomplete originator information. EU rules require a risk-based response; the present discrepancies justify investigation before release. Regulation (EU) 2023/1113, Articles 16–18; EBA/GL/2024/11, paragraphs 53 and 64.
- Different originator and beneficiary names can be correct. The receiver must establish which message field conflicts with its account records, then distinguish a spelling or trading-name issue from a different legal person. Corrected information needs an authenticated source and a preserved amendment history. EBA/GL/2024/11, paragraphs 32–39.
- Brazilian implementation periods do not postpone the Irish receiver's EU duties. The providers should agree a complete EU-compatible message before initiating each transfer, even where Brazil permits transitional declarations and risk assessment. Resolução BCB 520/2025, Articles 44 and 89; Regulation (EU) 2023/1113, Articles 14 and 16–17.
- The Brazilian entity needs the permission or transitional entitlement covering its actual services and foreign-exchange activity. Its FX reporting, counterparty checks and customer-data transmission have separate legal purposes and dates. Resoluções BCB 520/2025, Article 88, and 277/2022, Articles 29(IV), 29(5), 76-A–76-C and 82-A.
- Approval of future transfers must address Brazil's counterparty restriction taking effect on 6 November 2026. Its broad wording and express exceptions require analysis of the Irish receiver's actual role. The data agreement alone supplies no exception, so the providers should pause new flows from that date unless their operating structure has a documented lawful basis. Resolução BCB 520/2025, Articles 83 and 91, as amended by Resolução BCB 589/2026.
- A provider-linked wallet remains a hosted address even when its messaging system is incompatible. For a genuinely self-hosted address, information collection applies across transfer values. The EU ownership-or-control assessment concerns transfers exceeding EUR 1,000 and tests whether the CASP's own customer controls that address. Regulation (EU) 2023/1113, Articles 3(20), 14(5) and 16(2).
- A return to a changed address requires a fresh decision. The receiver should authenticate the originator's entitlement, validate the destination and check the rules applying to the return transfer. Technical settlement does not justify paying an unverified alternative recipient. Regulation (EU) 2023/1113, Article 17(1)(a); EBA/GL/2024/11, paragraph 55.
- Covered personal-data transfers between the EU and Brazil can use the current adequacy decisions in each direction. Lawful processing, data minimisation, security and retention still require their own controls. Commission Implementing Decision (EU) 2026/179, Article 1; Resolução ANPD 32/2026, Articles 1–2; Regulation (EU) 2023/1113, Articles 25–26.
- The proposed agreement should connect counterparty approval, message validation, custody restrictions and escalation. Repeated failures require a separate counterparty response and regulatory report; a vendor's successful message delivery cannot replace those decisions. Regulation (EU) 2023/1113, Articles 17(2) and 18; EBA/GL/2024/11, paragraphs 21–26 and 67–75.
The transfer map determines whose information belongs in each field
The Brazilian business ordering the customer transfer is the originator. The intended recipient of the crypto-assets is the beneficiary. The Brazilian provider sends for its customer, while the Irish CASP receives for its account customer. The blockchain source address can belong operationally to the sender's pooled wallet without making that provider the economic originator. The same distinction applies to the receiver's custody address. Regulation (EU) 2023/1113, Articles 3(10), 3(19) and 3(21)–(22).
The receiver should record the legal entity behind each customer account, the authority to order the movement and the address allocation. A shared brand, corporate group or wallet label cannot establish that two entities are the same person. If the message names the Brazilian originator while the receiving account names the beneficiary, that difference is expected. If the beneficiary field names an affiliate of the account holder, the receiver needs a supported explanation of the intended recipient and any collection mandate before treating the identities as reconciled. Articles 16(3) and 17 require that distinction to inform the decision.
An intermediary is a provider that receives and transmits the transfer for another provider. A supplier that only carries the data message does not acquire that role through its software contract. Where a real intermediary participates, it must preserve the information and perform its own checks and follow-up. The providers cannot relabel a customer transfer as their own treasury movement to invoke the exclusion for providers acting on their own behalf. Regulation (EU) 2023/1113, Articles 2(4), 3(16) and 19–22.
The Irish registered-office connection brings the covered transfer within the EU Transfer of Funds Regulation, or TFR. The Brazilian sender's separate domestic duties must still be identified. A bilateral contract should require the sender to provide the information the Irish receiver needs; that condition does not create an EU authorisation for the Brazilian business. Pure transfers between private persons without a provider fall outside this TFR regime, but this customer transfer involves the Irish CASP. Regulation (EU) 2023/1113, Articles 2(1), 2(4) and 3(20).
The receiver should hold this transfer while it resolves the discrepancies
The Irish CASP should prevent withdrawal, onward transfer or conversion for the customer's unrestricted use while it investigates. Article 16(1) requires procedures to detect missing originator and beneficiary information. Article 16(3) requires verification of the beneficiary information before availability. Under Article 17(1), the receiver must respond without undue delay by rejecting or returning the assets, or requesting the required information before making them available. A blockchain confirmation does not satisfy those information duties.
The first request should identify the defective fields and ask which legal person the sender intended to pay. The sender should provide the complete registered name, the relevant account and wallet references, the missing originator particulars and evidence explaining the discrepancy. A trading name can help trace a company, but the European Banking Authority's guidance expects the registered legal name. Its temporary technical allowance for substituting a trading name expired on 31 July 2025. EBA/GL/2024/11, paragraphs 24 and 35(b).
The receiver should compare the answer with its verified customer record and the commercial relationship. A documented spelling variation can be reconciled without changing the recipient. A different company requires evidence of the actual mandate and entitlement; common ownership alone is insufficient. The original message, the correction, its sender and the decision should remain traceable. Any corrected submission must trigger the necessary checks again. EBA/GL/2024/11, paragraphs 32–33, 42 and 53.
There is a material argument against an absolute hold for every defective field. Article 17 creates risk-based procedures, and its request limb does not expressly require receipt of every requested item before every possible execution. EBA paragraphs 62 and 64 contemplate documented execution in some incomplete-information cases. Paragraph 64 also says that a transfer should not be executed where the parties cannot be unambiguously identified. These Guidelines state the supervisory approach under Article 16 of Regulation (EU) No 1093/2010; they do not amend the TFR.
That exception does not justify this sender's demand. The receiver still needs to reconcile the name, identify the originator adequately and examine the commercial explanation. If the discrepancy proves to be a correctly labelled originator whose name naturally differs from the beneficiary, that particular concern falls away. A remaining low-risk defect then requires its own recorded Article 17 decision. The proposed corridor should ordinarily require complete data before release, with exceptional decisions reserved to the Irish compliance function. That stricter operating condition should be stated in the agreement.
The data dictionary must preserve legal meaning across systems
The providers should agree one dictionary for the EU-required payload before enabling the corridor. Article 14 requires the originator's and beneficiary's names and their distributed-ledger addresses for an on-chain transfer. Their crypto-asset account numbers must also accompany the transfer where those accounts exist and are used. For a transfer outside a distributed ledger, the account-number rules apply; the unique-transaction-identifier alternative is confined to the prescribed no-account case. A transaction hash cannot replace every customer or account field. Regulation (EU) 2023/1113, Article 14(1)–(3).
Additional originator particulars require careful mapping. Article 14(1)(d) specifies the originator's address, including country, official personal-document number and customer-identification number, or alternatively date and place of birth. Its wording should not be converted into an unrestricted choice of any single identifier. EBA guidance specifies a legal person's registered or official office address. For this business corridor, the proposed dictionary should capture that address, the provider's customer identifier and the relevant official company identifier in separately typed fields. It must not invent a natural person's birth details or personal-document number for a company. EBA/GL/2024/11, paragraphs 36(b)–39.
A current legal entity identifier, or an available equivalent official identifier in its absence, has separate statutory conditions. It accompanies the relevant party's data where the message format has the necessary field and the originator supplied it. EBA paragraph 41 sets cumulative criteria for an equivalent identifier. A Brazilian CNPJ should therefore retain its identifier type and issuing jurisdiction; acceptance as an LEI equivalent requires the criteria to be met. Neither a wallet address nor a vendor-generated case number should silently occupy that field. Regulation (EU) 2023/1113, Article 14(1)(e) and (2)(d); EBA/GL/2024/11, paragraph 41.
The sender should verify its own customer's information against reliable records and deliver the agreed payload before initiation. The EU originating-provider rule expressly requires verification and full Article 14 compliance before sending. The Irish receiver separately verifies its beneficiary. Qualifying existing customer due diligence can satisfy the statutory verification conditions, so the process need not demand fresh identity documents for every transfer. The Brazilian sender's undertaking should expressly support the receiver's duties without claiming that Article 14 directly regulates every Brazilian business. Regulation (EU) 2023/1113, Articles 14(6)–(8) and 16(3)–(4).
The TFR permits the data to travel separately from the blockchain transaction. EBA guidance expects immediate, secure transmission no later than blockchain initiation. A complete authenticated direct channel can therefore form the agreed messaging arrangement where the firms' usual networks cannot communicate. It must preserve the data, identify the originating institution and link the message to the transfer. It cannot be a continuing use of the technical-deficiency concession that ended in July 2025. Regulation (EU) 2023/1113, Article 14(4); EBA/GL/2024/11, paragraphs 21–26.
The receiver should acknowledge successful field validation before the Brazilian provider broadcasts a new transfer. That acknowledgement is a proposed operational safeguard, not a regulatory approval or a promise of unconditional release. Later sanctions information, a changed customer instruction or an asset restriction can still require intervention. Licentium's EU and UK crypto Travel Rule guide provides the wider comparison; this corridor requires the additional Brazilian permissions and data mapping below.
Brazilian permission depends on the entity and the activity
The receiving firm should approve the Brazilian legal entity that actually contracts with the originator and controls execution. Brazil's authorisation process distinguishes an authorised virtual-asset service company, or SPSAV, from an incumbent operating under transition and an eligible regulated institution providing crypto services. The permitted modality also matters. A custody permission alone cannot establish authority for every exchange or transfer service. Resolução BCB 519/2025, Articles 2–3 and 26; Resolução BCB 520/2025, Articles 4, 7, 9–10 and 19–22.
For an incumbent, Article 88 requires an application within 270 days of the Resolution's entry into force on 2 February 2026. Instrução Normativa BCB 704 expressly sets 30 October 2026 for the phase-one application. The adaptation period ends when the BCB addresses phase one. During that period, the specific adaptation requirements apply; after it ends, full substantive compliance is required even before the final authorisation decision. The Irish file should contain evidence of pre-existing activity, the application and its scope, the relevant phase and any BCB conditions. A pending application should never be recorded as a granted licence. Resolução BCB 520/2025, Articles 88(1)–(3), 88(6)–(7) and 92; Instrução Normativa BCB 704/2026, Article 9.
The FX entitlement needs a separate check. Article 29(5) of Resolução BCB 277 permits qualifying incumbent SPSAVs to continue covered FX-market crypto operations on the prescribed conditions, including an application that requests FX permission. Fully authorised firms need the scope appropriate to the actual route. An eligible bank's ability to undertake FX business also remains conditional on the crypto-service requirements. A partner's permission cannot be borrowed through a commercial agreement. Resolução BCB 277/2022, Article 29(I), (IV) and (5).
The agreement should set the authorisation evidence required for launch and renewal, with immediate notice of restrictions, refusal or a change of modality. A business may choose to onboard only a fully authorised provider because it wants the completed-regime safeguards. That is a commercial risk condition, not a statement that all transitional activity is unlawful. The statutory conditions must still be checked if the parties choose an incumbent route.
The November counterparty restriction changes corridor approval
The providers should make 6 November 2026 a separate approval gate for recurring transfers. The amended Article 91 prohibits BCB-regulated institutions from performing or enabling crypto-market operations with provider counterparties lacking BCB authorisation to operate in Brazil, except through forms expressly authorised by Resolução BCB 520. Its coverage extends beyond trading to specified services, FX and account arrangements. The amendment changed the restriction's start date from 30 October to 6 November 2026. It did not extend the incumbent application deadline. Resolução BCB 520/2025, Articles 88 and 91; Resolução BCB 589/2026, Articles 1–2; Instrução Normativa BCB 704/2026, Article 9.
The strongest argument for the proposed corridor distinguishes an Irish recipient-side provider serving its own customer abroad from a provider operating in Brazil. Resolução BCB 520 addresses domestic activity while expressly contemplating foreign commercial relationships and foreign services. Resolução BCB 277 also requires diligence on foreign providers. Those provisions support a role-specific territorial reading. Article 91's broad reference to provider counterparties creates the competing reading, and the foreign-diligence provision does not itself establish an express exception under Resolução BCB 520. Resolução BCB 520/2025, Articles 1, 23, 32, 89(II)(a) and 91; Resolução BCB 277/2022, Article 76-B(2).
Article 83 provides a specific route for contracted foreign custody, with additional conditions. The Irish firm receiving for its own customer does not become that custodian merely by signing a data-sharing agreement. The parties would need the actual custody function, contractual protections and other required arrangements before relying on that provision. Qualifying Brazilian incumbent permissions under Article 88 must also be evidenced separately; the removal of the words covering entities in an authorisation process from Article 91 does not justify calling every pending applicant authorised. Resolução BCB 520/2025, Articles 83, 88 and 91.
For this proposed operation, pause new or reopened flows from 6 November unless the documented roles establish a permissible basis under the applicable provisions. Changing the Brazilian sender or obtaining an Irish licence alone cannot settle Article 91's application. This is a recommended launch condition in response to the competing scope readings, not a claim that Brazil universally prohibits transfers to foreign CASPs. The providers must continue to resolve assets already received through a lawful custody, release or return process.
Brazilian information exchange and FX reporting have different functions
Brazil has an express provider information rule. Article 44 of Resolução BCB 520 specifies originator and beneficiary particulars for the receiving institution. Originator information includes name or business designation, payment or deposit account identification, address, CPF or CNPJ or the applicable foreign identifier, and wallet identification. The beneficiary information includes name or business designation, account identification and wallet identification. These fields do not map automatically onto every Article 14 field or its conditional LEI requirements.
Article 89 phases implementation. Domestic information-transfer procedures have a 365-day implementation period from 2 February 2026; the international stage follows over the next 365 days. Article 89(3) expressly makes Article 44 compliance mandatory for all authorised SPSAVs from 2 February 2028. Until the stages conclude, the provision permits documented customer declarations and risk analysis. That permission does not remove other applicable AML duties or require the Irish CASP to accept deficient information. The bilateral agreement should require the EU-compatible payload for this corridor from launch. Resolução BCB 520/2025, Articles 44, 89 and 92.
Brazil also places specified crypto activity within its FX rules. Article 76-B covers transfers involving changes of ownership between residents and non-residents and qualifying cross-border movements for the same owner. The provider must obtain the payment or transfer purpose and the prescribed foreign-party and relationship information. It must examine the foreign provider's effective supervision, or undertake the specified documented risk assessment where that jurisdiction lacks the relevant requirements. The Irish authorisation file supports that assessment without substituting for it. Resolução BCB 277/2022, Articles 76-A–76-C.
If the sender is an SPSAV, Article 29(IV) limits an international virtual-asset payment or transfer to USD 100,000 equivalent where the counterparty is not BCB-authorised for FX. Irish authorisation does not confer that Brazilian status. The provider must also address Article 76-A(3), which restricts movement in a third party's interests and provides a specific exception for service to a BCB-authorised FX institution acting for its clients. For the proposed direct route, require the disclosed customer to act for its own transaction; an omnibus arrangement must not conceal another intermediary or principal. Resolução BCB 277/2022, Articles 29(IV) and 76-A(1)–(4).
Where the business model exceeds the SPSAV's permission or fails that principal test, the parties should use a properly entitled Brazilian institution and redesign the mandates. A pure data-format correction cannot repair the activity. The providers should also avoid converting the arrangement into an eFX service whose settlement uses prohibited virtual assets. Since 1 October 2026, the eFX provider's settlement with its immediate foreign counterparty must use the permitted fiat channels. Resolução BCB 277/2022, Articles 29, 50(I) and 76-A, as amended by Resolução BCB 561/2026.
The BCB's C212 report has its own timetable. The current Article 82-A covers relevant operations carried out from 3 November 2026, with reporting by the fifth day of the following month. Instrução Normativa BCB 693, as amended by Instrução Normativa 756, specifies the November 2026 reporting start and the C212 file. The already operative Article 76-C collection duty must not be postponed to that reporting date. Sending the regulator a monthly file does not deliver the TFR payload to the Irish receiver. Resolução BCB 277/2022, Articles 76-C and 82-A, as amended by Resolução BCB 574/2026; Instrução Normativa BCB 693/2025, Articles 2–4.
A self-hosted address changes the evidence required
The receiver must classify the actual address before choosing a process. TFR Article 3(20) excludes addresses linked to EU providers or equivalent service businesses outside the Union from the self-hosted definition. A Brazilian custodian's failed messaging connection therefore remains a provider problem. Routing through a private wallet would change the transaction and introduce additional inquiries; it would not cure the missing customer information.
For a genuinely self-hosted incoming transfer, the Irish CASP must obtain and hold originator and beneficiary information and identify the transfer individually. Where the amount exceeds EUR 1,000, it must assess whether its beneficiary customer owns or controls the source address. For an outgoing transfer, the corresponding assessment concerns the originator customer and the destination address. The threshold governs that additional assessment; it creates no general exemption from information collection below EUR 1,000. Regulation (EU) 2023/1113, Articles 14(5) and 16(2).
A signature challenge, a controlled test transfer or another reliable technical method can support that assessment. The firm should select methods suited to the wallet and risk, combine them where one is insufficient and monitor changes after any address approval. It should record the valuation and time used for the threshold test. EBA/GL/2024/11, paragraphs 81–86.
A finding that a third party controls the address does not itself prohibit the transfer. It requires the relevant identification and risk controls. Here, the Irish customer's inability to sign for a Brazilian business's private wallet can be consistent with a third-party originator. The receiver must identify that originator and explain the relationship rather than misclassify the wallet as its customer's. EBA/GL/2024/11, paragraphs 87–90.
Brazil's rules use their own tests. Article 76-A(5) requires identification of a self-custody wallet's owner and documented processes for checking asset origin and destination. Under the applicable Circular 3.978 regime, a separate COAF report applies to transfers to or from self-custodied wallets of at least USD 10,000 equivalent. For operations contracted from 1 October to 31 December 2026, the specified report is due on the first business day of January 2027. That automatic report differs from suspicion-based reporting and from the EU EUR 1,000 assessment. Resolução BCB 277/2022, Article 76-A(5); Circular BCB 3.978/2020, Article 49(V) and (2), as amended by Resolução BCB 591/2026.
A lawful return needs a verified destination and custody authority
The Irish CASP should treat the proposed changed return address as a new control point. Article 17(1)(a) identifies return to the originator's crypto-asset account. EBA paragraph 55 addresses technical inability to reject or return to the original address: the firm should use its documented alternative process, including secure segregated holding while arranging a suitable return to the originator. Neither provision authorises diversion to an unrelated person on an urgent message from the sender.
The original blockchain source address is not always a usable customer return address. It may be a pooled operational address or require a specific account allocation. The receiver should authenticate the request through the pre-approved institutional contact, obtain confirmation of the originator's entitlement and verify the destination's owner and function. An independent callback or equivalent second-channel check should validate changed instructions. The return record should identify the same token and network, the amount after agreed lawful costs, the original transfer and the reason for the change. These proposed controls implement Article 17 and EBA paragraph 55.
The receiving firm should classify its role in the return and satisfy the applicable outgoing-transfer requirements. A return to a self-hosted address requires the relevant address and risk assessment. Sanctions restrictions, a competent authority's direction or a court order can prevent movement even after the information defect is repaired. A new address cannot be used to evade those restrictions. Regulation (EU) 2023/1113, Articles 14, 17 and 23.
The custody terms must support restricted availability, lawful returns and review of unresolved holdings. MiCA requires a custody agreement, a record of customer positions, segregation and procedures for returning assets as soon as possible. A compliance hold does not give the CASP ownership or an unlimited right to retain the assets. The agreement should define the restriction, authorised decision-makers, review intervals and a dispute route while preserving mandatory legal restrictions. Regulation (EU) 2023/1114, Article 75(1)–(3), (6)–(7).
Missing information is relevant to suspicion but does not establish money laundering by itself. The unexplained name, pressure for immediate release and changed return instruction should be assessed together. An Irish designated person must report business information giving knowledge, suspicion or reasonable grounds to suspect money laundering or terrorist financing. The report goes to FIU Ireland and the Revenue Commissioners as soon as practicable. It must precede the suspicious service or transaction unless delay is impracticable or there is a reasonable opinion that stopping would risk alerting the suspect. Any Garda direction or court order prohibiting the transaction remains binding. Customer notices must avoid disclosures likely to prejudice an investigation. Regulation (EU) 2023/1113, Article 18; Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, sections 17, 42(1)–(2), 42(7)–(8) and 49(1)–(2); EBA/GL/2024/11, paragraph 48.
The Brazilian provider should make its own suspicion assessment and any required COAF report. The receiver should request the transaction facts needed for its own decision, rather than demand disclosure of a confidential suspicious-transaction filing. The two institutions' reporting duties cannot be discharged through the commercial exception ticket. Lei 9.613/1998, Articles 10–11; Circular BCB 3.978/2020, Articles 48–50.
Token and service eligibility can independently prevent release
The providers should approve the exact asset, issuer arrangement, network and service before opening the corridor. The TFR's crypto-asset definition incorporates MiCA's scope exclusions. An instrument qualifying as a financial instrument therefore needs the applicable securities analysis; its token format does not make ordinary CASP permission sufficient. E-money tokens remain within the TFR's crypto treatment under its express rule. Regulation (EU) 2023/1113, Articles 2(4) and 3(14); Regulation (EU) 2023/1114, Articles 2 and 3.
For the Irish firm, custody, transfer and exchange are distinct service permissions. MiCA Article 59 authorisation or the relevant Article 60 entitlement must cover the service actually performed. An old Irish virtual-asset registration is insufficient after the Irish transition ended on 30 December 2025. The actual entity and permissions should be checked against the Central Bank's official record. Licentium's MiCA registers provide a reader aid, but the regulator's record determines the authorisation evidence. Regulation (EU) 2023/1114, Articles 59–60 and 63; S.I. No. 607/2024, regulation 20.
Stablecoins require a separate issuer and service assessment. MiCA's rules for asset-referenced tokens and e-money tokens govern lawful offers and admission to trading. ESMA's Opinion of 8 October 2026 also addresses services involving non-compliant tokens, including custody and transfer. It links its supervisory expectation to the Article 66(1) duty to act in clients' best interests. The Opinion does not declare that every custody service constitutes a public offer. Regulation (EU) 2023/1114, Articles 16, 48 and 66(1); ESMA75-113276571-1742, paragraphs 7 and 12–21.
The strongest contrary argument is that a private transfer can fall outside an offer-to-the-public restriction. That does not resolve ESMA's separate concern about continued CASP services. Its limited, supervised arrangements for disposing of existing holdings do not justify starting this corridor with a non-compliant stablecoin. The providers should approve an eligible token and service combination, with a separate lawful disposal decision for any ineligible asset already received. ESMA75-113276571-1742, paragraphs 21–27.
An e-money-token transfer can also constitute a payment service. MiCA requires related payment services to be provided by an appropriately authorised institution. EBA's nonbinding February 2026 Opinion advises national authorities that they may allow conditional continuation for certain pending payment-authorisation applications after 2 March 2026. Its conditions require cessation of related marketing and no such services for new clients while the application remains pending. A new corridor should use a payment-authorisation basis that covers the actual service; the Opinion supplies no automatic Irish permission. Regulation (EU) 2023/1114, Articles 48(2) and 70(4); European Union (Payment Services) Regulations 2018, S.I. No. 6/2018, regulation 6(1)–(4); EBA/OP/2026/01, paragraphs 8–15.
Adequacy permits covered transfers while purpose and retention limits remain
The data agreement should identify each direction and recipient. Brazil-to-Ireland transfers within scope can rely on ANPD Resolution 32/2026. Ireland-to-Brazil transfers to controllers or processors subject to the LGPD can rely on Commission Implementing Decision (EU) 2026/179. Those decisions remove the need to prescribe standard contractual clauses as the default mechanism for this covered bilateral exchange. The Brazilian decision excludes transfers exclusively for public security, national defence, state security, or criminal investigation and prosecution. The purpose of each disclosure determines whether that exclusion applies. Ordinary provider compliance processing and a separate law-enforcement disclosure require distinct assessments. GDPR, Article 45; Commission Implementing Decision (EU) 2026/179, Article 1; Resolução ANPD 32/2026, Articles 1–2.
The Irish receiver has a GDPR legal-obligation basis for processing necessary to meet its TFR duties. The Brazilian provider must identify its own LGPD basis, with the domestic duty and implementation stage accurately described. An obligation imposed on the Irish firm does not automatically become a Brazilian statutory obligation. Any additional personal information about representatives or employees needs its own necessity assessment; a contract with their company does not automatically make those individuals parties to that contract. GDPR, Articles 5–6; Lei 13.709/2018, Articles 6, 7 and 10.
Each regulated provider will ordinarily determine the purposes and means of its own compliance processing. The agreement should record that allocation and separately identify any messaging supplier acting as a processor. It should provide for restricted access, encryption, incident escalation, correction handling and deletion. Map vendor access and onward destinations separately; an onward transfer outside the applicable adequacy coverage needs its own lawful transfer mechanism. GDPR, Articles 28, 32 and 44–46; Lei 13.709/2018, Articles 33 and 46.
Transfer data should be carried through the secure messaging channel rather than published on the ledger. TFR Article 25 restricts the processing purpose and prohibits commercial processing of personal data on the basis of the Regulation. Names of companies can be accompanied by personal data concerning representatives or identifiable wallet users. The providers should avoid copying whole identity files where the required data and appropriate verification evidence will suffice. GDPR, Articles 4(1) and 5; Regulation (EU) 2023/1113, Articles 14(4) and 25.
New clients must receive the required TFR and GDPR information before the relationship or occasional transaction. Privacy notices should explain purposes, legal basis, recipients, transfer mechanism and retention. Indirect collection requires the applicable GDPR Article 14 treatment, while the Brazilian provider must meet LGPD transparency requirements. Regulation (EU) 2023/1113, Article 25(3); GDPR, Articles 13–14; Lei 13.709/2018, Article 9.
Retention must be allocated by record category. TFR Article 26 requires five years for the prescribed transfer information. Irish regulation 5 permits a further period, up to five years, on the specified proportionate Garda requirement. Brazilian Article 45(II) sets a minimum five-year transaction-record requirement. Where Circular BCB 3.978 applies, Article 67 requires at least ten years for its specified KYC, partner, transaction and suspicion-analysis records, with different starting events. The agreement should retain each record for its governing period, preserve any lawful hold and delete personal data when the relevant basis ends. Regulation (EU) 2023/1113, Article 26; S.I. No. 310/2025, regulation 5; Resolução BCB 520/2025, Article 45(II); Circular BCB 3.978/2020, Article 67; Lei 13.709/2018, Articles 15–16.
The bilateral agreement should connect approval to an executable runbook
The providers should launch only after approving the entities, permissions, token and data route together. The counterparty file should identify the contracting entity, official register evidence, business model, ownership and relevant AML controls. It should include authorised contacts and proof that the receiving endpoint belongs to that entity. The Brazilian file must contain the foreign-supervision assessment required by Article 76-B(2). The Irish firm should assess whether the actual relationship engages additional correspondent-relationship duties rather than infer that result from a data-sharing agreement alone. Resolução BCB 277/2022, Article 76-B(2); Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, section 38.
The agreement should specify governing law, forum and dispute procedure. An express Irish-law choice provides a coherent starting point for the receiver's contractual obligations, while Rome I preserves overriding mandatory rules. That Regulation does not determine the validity of the separate court-selection clause. A choice of law cannot authorise a regulated service or remove the Brazilian sender's domestic duties. Regulation (EC) No 593/2008, Articles 1(2)(e), 3 and 9.
The message schedule should specify each field's legal meaning, source, format and validation rule. It should preserve the registered Portuguese name and identifiers, document any transliteration, and prohibit silent truncation or substitution. Institution identity, endpoint authentication, message timestamps and the transfer reference should establish provenance. A vendor's successful delivery report should be retained as transport evidence, with separate evidence of field validation and the receiver's decision. EBA/GL/2024/11, paragraphs 21–26, 32–42.
Acceptance testing should cover a complete transfer, a missing originator identifier, a beneficiary-name mismatch, an unavailable messaging route and a delayed answer. It should include a changed return address and a third-party self-hosted address. Both firms should demonstrate that they can retrieve the original message, identify the decision-maker and prevent an unresolved transfer from becoming available. A small successful blockchain transfer tests execution only; it does not test these exception controls.
The proposed service levels should require immediate incident routing, a prompt acknowledgement and a complete information response within the agreed investigation deadline. EBA paragraph 56 sets a normal ceiling of five working days for information requested on a transfer received from outside the Union, measured from identification of the omission. Its longer-deadline provision has separate conditions. The agreement should use the normal ceiling for this direct corridor and require an evidenced decision for any permitted extension. Expiry triggers a recorded release, continued lawful suspension or return decision; it does not release the assets automatically. EBA/GL/2024/11, paragraphs 56–64.
The Irish compliance officer should own the customer-availability decision and suspicion escalation. The Brazilian compliance officer should own corrections, customer contact and Brazilian reporting. Operations should implement the approved hold or return, with a second authorised person validating changed destinations. Legal and custody teams should review contested entitlement or prolonged restrictions. The customer terms should explain conditional availability, return handling, charges, delay notices and complaint rights. Neither provider should promise that an on-chain confirmation guarantees immediately spendable funds. Regulation (EU) 2023/1114, Articles 66(1), 71 and 75; Resolução BCB 520/2025, Articles 41 and 43–47.
For repeated failures, the agreement should use quantitative measures and qualitative triggers. Track defective transfers as a proportion of the sender's traffic and unanswered requests as a proportion of follow-ups. Record the missing field, reason, response quality and cooperation. The proposed stop rule is to restrict new corridor transfers when a material identity failure persists after a written warning and cure deadline, or recurs after purported remediation. Evidence of falsification, loss of permission or an inability to transmit the required data warrants immediate restriction. These are proposed risk controls; the TFR supplies no universal number of permitted failures. Regulation (EU) 2023/1113, Article 17(2); EBA/GL/2024/11, paragraphs 67–73.
Once the sender is identified as repeatedly failing, the Irish firm must report the failure and its response to the competent AML authority. EBA paragraph 74 requires reporting without undue delay and no later than three months after that identification, regardless of the sender's location. That report is separate from a suspicion report. Before terminating the entire relationship, the firm should consider whether enhanced checks or restricted transfers can manage the risk. EBA/GL/2024/11, paragraphs 73–75; Regulation (EU) 2023/1113, Articles 17(2) and 18.
The agreement should require renewed approval after a change of licence status, token, network, endpoint or message version. Reopening a restricted corridor should depend on corrected records, successful testing and written compliance approval. Licentium's AML and KYC programme service describes work on counterparty due diligence, Travel Rule workflows and escalation procedures. For this transfer, the operative decision remains with the providers: preserve the assets, resolve the identified discrepancies, then approve a supported release or a validated lawful return.