Brazil IN BCB 739: the Anexo IV assurance report you cannot write yourself

Brazil Published 2026-08-15

Brazil's PSAV authorisation is usually discussed as a paperwork exercise with a deadline of 30 October 2026. For most applicants that is now wrong. Since Instrução Normativa BCB 739, published 29 May 2026 and in force immediately, part of the application is no longer something you write. It is something an auditor has to be willing to sign.

What IN 739 changed

IN 739 amends IN BCB 704, the instruction that governs the authorisation procedure itself. It adds Anexo IV: a relatório de asseguração razoável — a reasonable assurance report — on the applicant's AML/CFT processes, procedures and internal controls.

Two words in that phrase carry the weight.

Reasonable assurance is the higher of the two standard levels. It is not limited assurance, and it is not a review. The practitioner has to gather sufficient appropriate evidence to express a positive conclusion. That is an audit-grade engagement, with audit-grade fieldwork behind it.

Independent means an auditor registered with the CVM. Not your compliance officer, not your law firm, not a group internal audit function. A self-certification does not satisfy Anexo IV.

The eight heads

The report must carry conclusive opinions on each of the following. Reported from IN 739 as summarised by Brazilian counsel; the underlying instruction has not been read line by line for this note:

• institutional policy
• organisational structure
• employee training
• internal risk assessment
• KYC and KYP — know your customer and know your partner
• monitoring and reporting of suspicious transactions for money laundering, terrorist financing and proliferation financing
• fraud prevention
• administrative blocking of assets and transaction recording

Read the list as an engagement scope, not as a table of contents. An auditor giving a conclusive opinion on "employee training" is testing attendance records, content and completion rates, not reading a policy that says training happens. The same applies to every other head.

The 2 February 2026 fork

Whether Anexo IV applies to you, and when, turns on one date — the same date that already splits the rest of the regime.

If you were not operating on 2 February 2026, the assurance report is part of your authorisation application. There is no phase to hide behind. You are a new entrant and the report comes with the file.

If you were operating on 2 February 2026, Phase 1 is exempt. The report becomes mandatory at Phase 2. The stated reason is to avoid disrupting timely processing of the transition-cohort applications.

Two heads — administrative blocking of assets, and transaction recording — are reported as applying only to providers already operational on 2 February 2026. That is a narrowing, and it is the kind of detail that changes an engagement letter.

Why the exemption is not relief

Phase 1 is due 30 October 2026. Phase 2 follows within 60 days of Phase 1. So a transition-cohort applicant who files on the last available day is looking at an Anexo IV report due around late December 2026.

That is not a distant problem. Working backwards from a December delivery: selecting and engaging a CVM-registered auditor, scoping, fieldwork across eight control areas, remediation of whatever the fieldwork surfaces, and then the report itself. Firms that treat Phase 1 as the deadline and Phase 2 as an administrative follow-up have mis-sequenced the work. The auditor should be engaged before Phase 1 is filed, not after.

There is no version of this where a reasonable assurance opinion is procured in three weeks. An auditor who cannot get comfortable will decline the engagement or qualify the conclusion, and a qualified conclusion on AML controls in an authorisation file is worse than a late filing.

The twelve-month look-back

One provision is worth money. A reasonable assurance report issued in the preceding twelve months that addresses Anexo IV of IN 704/2026 may be considered in forming the conclusive opinion.

If your group has had an AML controls assurance engagement in the last year — for a foreign regulator, for a banking counterparty, for an acquirer's diligence — that work may be capable of being carried across rather than repeated. Whether it can depends on whether its scope maps onto the eight heads, which is a question to put to the auditor before you commission anything new.

This is the single cheapest thing to check in the whole Brazilian file, and it is the thing most applicants will not think to check.

Who else this caught

IN 739 is not a virtual-asset instrument. The same assurance requirement lands on foreign exchange brokerages, securities brokerages and securities distribution companies. Anyone reading it as a crypto-specific rule will misjudge how the Banco Central intends to apply it, and how much prior practice the reviewers already have.

What is primary and what is not

To be explicit about provenance, because it matters here.

Reported by Brazilian counsel, not read against the instruction for this note: the eight heads, the 2 February 2026 carve-out, the two heads limited to already-operational providers, and the twelve-month look-back. Sources are Demarest, Bocater and Bichara e Motta, published between May and August 2026.

Dates: IN 739 published 29 May 2026, in force immediately. IN 704 dated 29 January 2026. The framework entered into force 2 February 2026, and the Phase 1 filing deadline of 30 October 2026 is 270 days from that date. Providers that do not file must cease activities within 30 days of the deadline.

The instruction itself should be read before an engagement letter is signed. Where a figure or a scope boundary decides who signs what, reporting of an instrument is not a substitute for the instrument.

The practical sequence

For a transition-cohort applicant, in order:

1. Establish whether any assurance report in the last twelve months can be carried across under the look-back.
2. If not, approach CVM-registered auditors now — availability, not fee, is the binding constraint this close to a deadline that applies to an entire cohort at once.
3. Map your existing controls against the eight heads and find the gaps before the auditor does.
4. Remediate. This is the step that takes months and the one that gets left out of plans.
5. File Phase 1 by 30 October 2026.
6. Deliver Phase 2 with the report inside 60 days.

Steps 1 to 4 are work you can start today without waiting for anything. Step 4 is the reason to start today.

77 days

To Phase 1. The Anexo IV clock is longer than that and it started earlier.