DeCripto: Brazil's New Crypto Reporting Rules, in Force Since July 2026

Since July 2026, the way crypto-asset transactions are reported to Brazil's Receita Federal (the federal tax authority) has changed for good. The DeCripto — short for Declaração de Criptoativos, the Crypto-Asset Declaration — took over, and Normative Instruction (IN) 1,888, in force since 2019, was revoked.

We put this guide together to explain, in plain terms, what DeCripto is, who needs to worry about it and what has not changed.

For the wider picture — the annual income tax return (IRPF), capital gains, the R$ 35,000 rule, stablecoins and self-custody — see our complete guide to crypto taxation in Brazil in 2026.

What is DeCripto?

DeCripto is the new system for reporting crypto-asset transactions to the Receita Federal, created by Receita Federal Normative Instruction (IN RFB) No. 2,291, dated November 14, 2025. In practice, it is a standardized filing submitted through the Coleta Nacional system on e-CAC (the Receita's online portal), in a layout set by a separate executive act, where exchanges and taxpayers report their crypto activity. The Receita keeps the instruction, the layout act and the filling manual on its official DeCripto page.

Filing is monthly, due by the last business day of the following month. The first month covered was July 2026, with its filing due on August 31, 2026. As of November 2026, the October 2026 filing is due by November 30, 2026, and each later month follows the same rule.

One important point: DeCripto does not create any new tax and does not change the tax rules. The instruction itself says the taxation of these operations follows its own specific legislation, and the Ministry of Finance's announcement states that the new regulation does not deal with taxation. What changes is the format, the level of detail and the standardization of the information you send.

Why is this changing?

Brazil has required periodic reporting of crypto transactions since 2019. It is now going a step further by adopting CARF, the Crypto-Asset Reporting Framework developed by the OECD. According to the Ministry of Finance, more than 70 jurisdictions, Brazil included, have committed to this standard.

In practice, this means the information reported in Brazil now follows a format compatible with other countries', making automatic data exchange between tax administrations easier.

So who has to report what?

This is the point that causes the most confusion, and the answer depends on how you operate.

If you use Brazilian exchanges

If you buy and sell crypto on Brazilian exchanges, you can relax: the obligation to send the information to the Receita lies with the exchange. It reports every month, regardless of amount. In that scenario you do not need to file DeCripto yourself.

That does not mean you are free of tax obligations. You still need to list your crypto assets on your annual income tax return (in the "Bens e Direitos" — assets and rights — section, group 08) and to calculate and pay tax on capital gains when applicable. But the monthly reporting of transactions to the Receita is the exchange's job.

If you use foreign exchanges, DeFi protocols, P2P or your own wallet

Here the story is different. If you operate through foreign platforms — or transact directly with decentralized protocols, peer to peer (P2P) or from your own wallet (self-custody) — the reporting obligation is yours.

The rule: if your transactions in the month, individually or combined, exceed R$ 35,000, you must file DeCripto through e-CAC. Under IN 1,888 this threshold was R$ 30,000. The list of reportable operations covers purchases and sales, swaps between crypto assets, incoming transfers such as airdrops, staking and mining income or loans, outgoing transfers, and transfers to wallets not linked to a service provider, among others.

If your transactions stay below that threshold in a given month, there is no monthly filing obligation. But remember: the obligation to declare the assets you hold on the annual income tax return still applies.

Foreign exchanges that serve Brazilians

An important novelty: DeCripto now also reaches crypto-asset service providers based abroad that provide services in Brazil. Under the instruction, that includes, for example, providers using a ".br" domain, accepting Pix (Brazil's instant payment system) or local intermediaries for deposits and withdrawals, or advertising clearly aimed at Brazilian residents. These companies now have reporting obligations similar to those of Brazilian exchanges.

The foreign provider's report does not automatically replace the user's obligation. The instruction separately requires Brazilian residents to report operations carried out through foreign providers. If you operate without a Brazilian exchange in the middle, check whether your monthly total exceeds R$ 35,000 and, if so, comply with the applicable reporting duty. Do not make that obligation depend on confirming that the exchange filed; keep records of your transactions.

What about tax? Does anything change?

DeCripto itself does not change taxation. Here is a recap of the main rules, as set out in the Receita's official IRPF 2026 Questions and Answers (questions 473 and 653):

For crypto held or traded through institutions located in Brazil:

• Total monthly sales of crypto assets up to R$ 35,000: exempt from income tax on any capital gain. This limit counts the total of all sales of all crypto assets in the month, not each type of asset separately.
• Monthly sales above R$ 35,000: the gain on all of that month's sales is taxed as capital gain at rates from 15% to 22.5%, calculated monthly using the Receita's GCAP program, with the tax payment (DARF) due by the last business day of the following month.

For crypto held or traded through institutions located abroad:

• Since Law 14,754/2023 (known as the "Offshores Law"), crypto assets held or traded through institutions abroad are treated as financial investments abroad.
• The rate is a flat 15% on the gain, with no R$ 35,000 monthly exemption.
• The calculation is annual, on the annual tax return itself, not monthly via DARF.
• On the other hand, losses can be offset against gains from other financial investments abroad in the same year, and any losses left over can be carried forward to later years.

Did the R$ 35,000 exemption end?

In June 2025 the government published Provisional Measure (MP) 1,303, which proposed ending this exemption and introducing a single 17.5% rate. But on October 8, 2025, the Chamber of Deputies approved a motion to withdraw the MP from its agenda, and it lost validity without being voted on. As of November 2026, the R$ 35,000 monthly exemption remains in force for crypto held or traded through institutions in Brazil, as confirmed in the Receita's IRPF 2026 guidance.

An important clarification: do not confuse the R$ 35,000 limit for the capital gains exemption (a tax rule) with the R$ 35,000 limit that triggers the DeCripto filing (a reporting obligation). They are independent rules that just happen to share the same amount.

What if you hold crypto in your own wallet?

If you keep your crypto in self-custody (a hardware or software wallet), the Receita's IRPF 2026 guidance (question 473) now addresses one key point: in the case of self-custody, the taxpayer's residence determines whether the asset is considered located in Brazil or abroad. For a Brazilian resident, that points to Brazil. Even so, the tax treatment of a specific sale may depend on other factors — including how and where the sale is carried out (through a Brazilian exchange, a foreign one or a P2P trade). It is worth talking to a specialized accountant to understand the right treatment for your case.

Either way, for monthly reporting to the Receita (DeCripto), transactions made without a Brazilian exchange as intermediary that exceed R$ 35,000 in the month must be reported by you.

And Picnic? Does it report anything to the Receita?

Many users ask us: "Does Picnic send my data and balances to the Receita Federal, the way traditional exchanges do?" The answer has to do with the product's technical architecture.

Based on our interpretation of IN RFB 2,291/2025, Picnic operates as a decentralized technology platform in a self-custody model: it does not hold users' assets in custody, does not control the underlying distributed ledger technology and does not set the remuneration rules or operating parameters of the public blockchain networks it runs on. These characteristics bring Picnic close to the concept of a "Decentralized Platform" (Plataforma Descentralizada) defined in Annex I, item 19, of IN 2,291/2025.

IN 2,291/2025, in Article 5, II, "b", establishes that when transactions are carried out through a decentralized platform, the obligation to file DeCripto falls on the individual or entity resident or domiciled in Brazil who carries out the transaction, not on the platform.

In short: based on this interpretation, the obligation to report to the Receita Federal the transactions carried out via Picnic is the direct, individual responsibility of each user, whenever the monthly value of the transactions exceeds R$ 35,000.00 (Article 5, § 3). This interpretation is subject to regulatory developments and to any specific statement by the Receita Federal on non-custodial models. We recommend that each user assess their tax situation with a qualified professional.

To help you meet this obligation, Picnic lets you export the history of your transactions on the platform, which you can use as a basis for filling in DeCripto or organizing your information for the annual income tax return.

Also note: on Picnic, conversions between Brazilian reais and crypto assets (and vice versa) are carried out through a partner, Avenia, which provides Picnic's reais and Pix rails. Avenia is responsible for the obligations that apply to it in connection with those conversions.

What must be declared on the annual tax return?

Regardless of DeCripto, the rule for the annual return stays the same. In the Receita's IRPF 2026 rules (the return filed in 2026, covering 2025), each type of crypto asset with an acquisition value of R$ 5,000 or more had to be declared in the "Bens e Direitos" section. The return covering 2026 is filed in 2027, under instructions the Receita publishes early that year — check them before filing.

• Report the acquisition cost in reais, not the market value.
• Open a separate item for each type of crypto asset.
• State the quantity and where the asset is held (the company's name and CNPJ, its Brazilian business registration number, or self-custody).
• For amounts in foreign currency, the Receita's guidance uses the Central Bank of Brazil's closing selling rate (PTAX) for the date of the relevant transaction.

Practical summary

Penalties for late filing or omissions

Pay attention: anyone who files DeCripto late, fails to file or omits information is subject to fines under Article 13 of IN 2,291/2025. For individuals, the fine is R$ 100 per month or fraction of a month late (halved if the filing is made before any official Receita procedure begins). Inaccurate, incomplete or omitted information can lead to a fine of 1.5% of the transaction value. For companies, the fines are higher: R$ 500 per month late for entities that are starting their activities, are tax-immune or exempt, opted for Simples Nacional (Brazil's simplified tax regime for small businesses) or calculated corporate income tax under presumed profit (lucro presumido) in their last return, and R$ 1,500 per month for all others. For companies, inaccurate information carries a fine of 3% of the transaction value, with a minimum of R$ 100. Errors corrected through an amended filing before any official procedure begins do not incur a fine.

What does Picnic recommend?

Picnic is a technology platform and does not provide tax or financial advice. But we want to help you stay informed and organized. A few practical tips:

• Keep every record of crypto purchases, sales, transfers and conversions. Statements, transaction hashes, screenshots — it all counts.
• Keep track of the acquisition cost in reais of each asset. This is essential for calculating capital gains in the future.
• If you operate on foreign platforms or in DeFi, watch the R$ 35,000 monthly threshold to know whether you need to file DeCripto.
• When in doubt, consult an accountant who specializes in crypto assets. The rules have nuances that can make a real difference to your wallet.

---

Picnic is a technology platform that lets users independently interact with USDC, a U.S. dollar-pegged stablecoin issued by Circle, on public blockchains. USDC is not legal tender in Brazil.

Displayed exchange rates vary with market conditions. The final applicable amount is the one shown on the transaction confirmation screen. Cryptoassets involve risks, including volatility and loss of peg.

Picnic does not custody user assets and is neither a financial institution nor a virtual asset service provider. Sending and receiving U.S. dollar payments through a U.S. account is offered in partnership with Noah Savings Inc. Terms and conditions apply.

Information verified in November 2026.