Brazil and Japan tighten crypto withdrawal controls with 24-hour holds and new address checks

Brazil’s Central Bank and Japan’s Financial Services Agency have both moved to make crypto withdrawals harder to abuse in fraud cases. For PSPs, exchanges, and VASPs, the important part is not the headline “anti-fraud” label but the operating detail: delayed withdrawals, more verification, and more recordkeeping around suspicious flows.

1. Brazil’s Central Bank (BCdB) approved new anti-fraud rules for the virtual asset sector. Virtual asset service providers (VASPs) will have to impose a mandatory 24 hour preventive hold on certain transactions, with the measure aimed at making it harder to move funds obtained through criminal activity.
2. The hold applies to funds exceeding $10,000, calculated on both individual transactions and a customer’s aggregate daily transfer volume. The BCdB also said VASPs must conduct enhanced reviews of other transactions when required under their internal risk management procedures.
3. The regulator tied the rule to a specific fraud pattern: stolen funds are increasingly moved through virtual assets, often sent abroad or to non-custodial wallets, which makes intervention harder once the transfer is underway. The BCdB said the rule does not freeze assets or prohibit later movement; if the risk assessment is completed and the transaction meets the requirements, VASPs may process it before the 24 hour period ends.
4. Brazil’s new requirements also add operational chores that compliance teams will recognize immediately: VASPs must notify customers whenever a temporary hold is applied and keep records of identified fraud cases and attempted fraud involving virtual asset transactions, including the actions taken in response. The regulation takes effect on January 1, 2027.
5. In Japan, the Financial Services Agency (FSA) and the National Police Agency (NPA) submitted updated recommendations to the Japan Virtual and Crypto Assets Exchange Association (JVCEA). The proposals call for enhanced identity verification at account opening, more thorough customer due diligence, customer warnings about fraud risks, and temporary restrictions on digital asset withdrawals after fiat deposits or cryptocurrency purchases.

The Japan package goes a step further on withdrawal control: it also recommends mandatory pre registration of withdrawal addresses, plus a waiting period after a new address is added, during which withdrawals remain restricted. For high-risk operators, that is the familiar trade-off between user friction and reducing the chance that an attacker can cash out immediately after taking over an account.