The Central Bank's 24-Hour Hold Isn't a Hold: It's a Duty to Document

Coverage of BCB Resolution No. 584 has settled on a single phrase: "24-hour hold." The description is wrong on two counts, and both matter to anyone who will have to operate under the rule.

The first is what starts the clock. The second is what the rule actually requires you to do — which is not to wait.

The clock starts at the deposit, not at the order

The text of the new Article 2-B is specific about the triggering moment:

"may only execute transfer orders for such assets twenty-four hours after receiving the corresponding deposited funds in the wallet, whether in reais or in the form of virtual assets, where the transfer is destined for: I - an entity incorporated abroad that carries out activities in the virtual asset market; or II - a self-custodied wallet"

— BCB Resolution No. 584, Art. 2, inserting Art. 2-B into BCB Resolution No. 142/2021

This is not a 24-hour queue for every transfer. It is a quarantine on newly deposited funds before they can leave the perimeter. A balance that has sat for a week goes out immediately. Money that just arrived and is in a hurry to leave does not.

The design targets a behavior, not an amount. And the behavior in question is fraud's: funds that arrive and are pushed straight out before anyone can request a freeze.

The triggers are in § 1, item III: the hold applies when the transaction exceeds the equivalent of US$10,000 — per transaction or by the total value of the client's transactions on the same day — or when the institution's own risk management policies indicate the need for review. Paragraph 9 makes clear that stablecoins are in scope, extending the rule to the services listed in Art. 5, items I through V, of Law No. 14,478/2022, "including virtual assets referenced to fiat currency."

The effective date is January 1, 2027, under Art. 3. This is not a rule in force today — and part of the coverage treated it as though it were.

Holding is cheap; releasing is what costs

Here is the inversion the headline conceals, and the rule is explicit about it.

Ending the hold before 24 hours have elapsed is a discretionary power, not an operational right. Paragraph 5 conditions it on a "reasoned decision" that addresses, at minimum, the criteria in § 2 — the risk profiles of the client, the transaction, the counterparty, and the jurisdiction where the entity is domiciled. Paragraph 6 adds what turns this into an evidentiary obligation:

"The decision, its reasoning, and the criteria referred to in § 5 must be documented."

— BCB Resolution No. 584, Art. 2-B, § 6

And § 7 closes the loop. If a subsequent review finds the discretion was improperly exercised, the documentation must be accompanied by an additional record setting out "the measures actually adopted to correct the institution's internal control systems." Explaining the wrong call is not enough: you have to show the repair to the process that produced it.

Under § 8, all of this must be available for submission to the Central Bank.

Read it in terms of cost. Letting the clock run requires nothing — no analysis, no record, no later defense. Releasing in ten minutes requires a file produced in real time, one that still holds up months later, and that may force the institution to document the remediation of its own controls.

A rule that makes waiting free and haste expensive does not produce 24 hours of waiting. It produces two classes of institution: those that invested in risk analysis capable of deciding in minutes, with a record, and those that will hold everything until the clock runs out because it is cheaper. The client experiences this as service quality; the supervisor reads it as control maturity.

Why the exit, and not the path

The choice of enforcement point is not arbitrary, and it is what makes the rule more interesting than a generic hold.

Tracing crypto is not the bottleneck — the ledger is public and permanent. The bottleneck for anyone moving illicit money is conversion: the moment value has to become something usable or move beyond the reach of whoever can freeze it. A foreign entity and a self-custodied wallet are precisely the two exit doors from the perimeter where a Brazilian order still has force.

Hence a design that targets a time window rather than an identity. It does not try to determine who the fraudster is — it tries to keep the value within reach long enough for the trail to be worth something. It is the same logic behind the layered tracing the Central Bank just built into Pix infraction reporting: information arrives too late once the money is gone.

The counterargument: it pushes flow to DeFi

ABcripto argues that fraudsters don't use regulated exchanges, and that the hold will migrate flow to DeFi protocols — less traceability and less user protection, not more.

The argument gets the description right and the target wrong. It is right that the professional criminal does not come through the front door: anyone moving illicit volume already uses nominee accounts, providers with no Brazilian presence, and conversion outside the regulated perimeter. It is wrong to treat that as a refutation, because the rule was not designed to catch the professional who is already outside — it was designed for the victim's money in the first few hours, which moves through wherever the victim had an account: a regulated provider.

The legitimate concern the argument raises is a different one, and it is worth watching: if the friction falls on lawful stablecoin use in payments and remittances, the cost is borne by people with no connection to fraud. That is not resolved in the text of the rule — it is resolved in the quality of each institution's risk analysis. Which is, once again, the real obligation 584 creates.

Who decides what counts as a restriction on property rights

On August 10, three days after publication, Congresswoman Júlia Zanatta (PL-SC) filed Legislative Decree Bill 926/2026 to strike down the resolution in its entirety. The argument turns on competence:

"a restriction on property rights is imposed by statute, voted by Congress, not by a resolution of an administrative authority"

— PDL 926/2026

The rule anticipated the objection. Paragraph 1 qualifies the measure across two items: the hold "is exclusively precautionary in nature and is intended to enable risk analysis of the relevant transaction" and "does not entail permanent unavailability of assets." Paragraph 3 requires the institution to notify the client of the hold, its precautionary nature, and the applicable period. And § 4 closes the cycle: once the analysis is complete, either the hold is lifted immediately or the transaction is rejected — there is no indefinite intermediate state.

Whether that is enough to defeat the claim of a property restriction imposed by administrative act is for Congress to decide, and possibly the courts thereafter. The bill still requires approval in both the Chamber and the Senate. Anyone planning compliance should not bet on the resolution being struck down — but should note that it enters force contested.

The power the rule reserves for the supervisor

One provision went unnoticed in the coverage and matters more than the number of hours. Article 6-A authorizes the Central Bank, at any time and in the face of non-compliance, to impose on a specific institution or a group of them: a period longer than the 24 hours in the main provision; application of the procedure to transactions below the US$10,000 threshold; and restrictions on the exercise of the discretion to release early.

In other words: the rule's parameters are the floor of the standard regime, not the ceiling. Those who perform poorly on documentation stand to lose precisely the freedom that documentation buys.

What has to be standing before January 1

The measure is daily, not per transaction. A control that looks only at isolated transfers will miss the client who splits into five US$2,500 withdrawals on the same day. Aggregating per client per day is a requirement of § 1, item III, subitem "a."

The trigger is the deposit, and that is a data problem. Applying the rule requires knowing when each unit of funds entered the wallet and tying that to the outbound order. An institution without that per-client timeline can neither apply the hold nor justify not having applied it.

Self-custody has to be identifiable. The rule treats self-custodied wallets as a distinct risk destination, deferring the definition to separate regulation. Without destination classification, there is no trigger.

Early release is a process, not a button. Reasoned decision, minimum criteria, documentation preserved and available to the Central Bank — and, if the discretion was improperly exercised, evidence of control remediation.

Being in the adaptation phase does not mean being out of scope. The sole paragraph of Art. 1 covers providers in the adaptation phase under Art. 88, § 2, of BCB Resolution No. 520 of November 10, 2025. For them, two calendars run in parallel: the authorization application by October 30, and the control standing on January 1.

Resolution 584 does not treat crypto as suspect. It treats the exit from the perimeter as the last moment at which analysis is still worth anything — and shifts to the institution the burden of proving that it analyzed. Anti-fraud, here, stops being a filter that blocks and becomes a record that sustains the decision not to block.

---

Sources

Resolução BCB nº 584, de 7 de agosto de 2026, amending BCB Resolution No. 142 of September 23, 2021 — Banco Central do Brasil. All quoted provisions are taken from the text of the resolution. The official announcement sets out the rationale for the measure; industry reaction appears in reporting by Exame, and the motion to strike it down in coverage by Cointelegraph Brasil on PDL 926/2026.