Regulating Through Change: The CVM’s Evolving Definition of "Security"
In any jurisdiction with a regulated capital market, the definition of a "security" is a matter of ongoing discussion and debate. After all, it's the classification of an asset as a security –and its use as a means to raise funds from the investing public – that justifies regulatory oversight to protect investors and the broader public.
In Brazil, as in many parts of the world, the Comissão de Valores Mobiliários (CVM), the country's securities regulator, has faced the challenge of reinterpreting and updating this concept in response to new economic realities and the growing presence of digital assets.
Over the past few decades, we have witnessed the globalization and democratization of the internet, the digital transformation of the economy, the rise of big tech, and the emergence of virtual assets, not to mention the early stages of a revolution driven by rapid advances in artificial intelligence. These developments have reshaped the very structure of global societies and economies, bringing with them significant legal and regulatory implications. In the case of digital assets, their widespread adoption has demanded a more sophisticated debate around the definition of securities and the scope of the CVM's authority.
As we reflect on BMA's 30-year journey and the evolution of Brazil's capital markets, it is worth revisiting how far securities market regulation has come. Nearly two decades ago, in BMA Review 17 (November 2005 edition), we commented on one of the important issues facing the CVM at the time: the use of the internet to offer and broker trading in securities, including those issued and traded in other jurisdictions.
In CVM Guidance Notes 32 and 33, both issued on September 30, 2005 (and still in force), the CVM clarified its position on:
What constitutes a public offering of securities in Brazil when the internet is used as a communication channel or when the issuer is based abroad; and
When an activity conducted online – or involving the brokerage services offered to Brazilian investors for securities issued abroad – requires CVM authorization.
In Guidance Note 32, the CVM emphasized that, as a rule, using the internet to promote a securities offering constitutes a public offering under Law 6.385/1976 and former CVM Instruction 400/2003 (since replaced by CVM Resolution 160). Guidance Note 33 went further, stating that a public offering may be deemed to exist even without the intent to reach the general public, if mass communication tools are used and no precautions are taken to prevent broad dissemination.
Twenty years later the CVM's focus may have shifted, but its objective remains the same: to determine whether digital assets are securities. In 2022, the regulator issued Guidance Note 40 on cryptoassets, stating its position that the digital nature of a service or asset is irrelevant to its classification as a security or to the question of whether securities regulations apply. Thus, while tokenization, in itself, does not require prior approval or registration with the CVM, if a public offering of tokens is made, both the issuer and the offering are subject to securities legislation and the CVM's regulations. In other words, what matters is not the nature of the asset, but whether it is offered to the public and how that offering is conducted.
This principle was recently tested in a case involving the D¥N token, issued by Dynasty Global Investments BR Ltda. The CVM Commissioners considered whether the token was a security within the meaning of article 2(IX) of Law 6.385/1976, which sets out a broad definition intended to encompass instruments offered to the public that confer rights to a share of profits, partnership rights, or rights to income, including those resulting from the provision of services, where the earnings from the instrument or contract derives from the efforts of the entrepreneur or third parties.
The Commissioners debated whether Dynasty's use of a "buyback and burn" model to stabilize the token's value created an expectation of profit for holders. In a split decision, the CVM concluded that the D¥N token did not meet the definition of a security, because:
Preserving the purchasing power of the token is not equivalent to promising a return; and
The issuer's actions did not create a benefit intrinsic to the asset deriving from profit sharing, partnership or income rights required by law to categorize an asset as a security.
In sum, the two decades since 2005 have seen immense economic, legal, regulatory, and technological change, and through those changes the CVM has kept the concept of security under continuous review. Amidst evolving technologies and market innovations, the regulator's challenge is still to protect investors while remaining grounded in the legal framework that defines what constitutes a security in Brazil.
>>> This content is part of BMA Review #87. Click here for more.
