KYB Compliance in Brazil: BACEN, COAF, CNPJ, and UBO Requirements

Brazil collected BRL 44.2 million in AML fines during 2024, according to COAF’s enforcement data, and its financial intelligence unit is now actively running electronic compliance assessments across obligated sectors. For compliance teams building Know Your Business processes for Brazil’s corporate market, KYB compliance Brazil spans three overlapping regulators, a national UBO registry, and sector-specific mandates that expanded to cover fintechs in 2025. This guide covers the full framework, from the legislative foundation to the document set required for a defensible business onboarding in Brazil.

What does KYB compliance require in Brazil?

Know Your Business Brazil compliance means running a structured review that covers legal-entity validation, beneficial ownership analysis, and ongoing AML monitoring. That obligation rests on two foundational instruments. Lei 9.613/1998 is Brazil’s anti-money laundering law. It criminalized money laundering, established the Conselho de Controle de Atividades Financeiras (COAF) as the national financial intelligence unit, and created reporting obligations for all obligated entities. Banco Central do Brasil (BACEN) Circular 3.978/2020 translates those obligations into sector-specific standards for all supervised institutions.

Circular 3.978/2020 adds operational specificity to what the anti-money laundering law requires. BACEN uses it to set risk classification standards, define documentation thresholds for business onboarding, and mandate ongoing client monitoring rather than a single check at account opening. For corporate clients, that means the institution must document the entity’s corporate structure, identify its controllers, and apply enhanced due diligence (EDD) when the risk profile warrants it.

How do BACEN and COAF govern business verification in Brazil?

Understanding which regulator governs Brazil’s AML business verification and COAF reporting obligations is the starting point for any compliance team in the country. BACEN and COAF share Brazil’s AML supervisory space but divide oversight by sector.

BACEN supervises banks, credit unions, payment institutions, and fintech platforms. Its KYB requirements flow through Circular 3.978/2020. Institutions must document the purpose of each business relationship, risk-classify corporate clients, and maintain a current profile on each. Brazil’s broader AML regulatory framework sets out how BACEN’s obligations connect to the wider domestic compliance picture.

COAF operates as the national financial intelligence unit above the sectoral supervisors. It receives suspicious activity reports (SARs) from all obligated entities, analyses financial intelligence, and passes findings to law enforcement. Any institution that identifies a suspicious corporate transaction is required under Lei 9.613 to file a SAR with COAF within 24 hours. By 2024, COAF was producing close to 19,000 financial intelligence reports annually, up from roughly 12,000 in 2020, based on COAF’s integrated management data.

COAF also directly supervises sectors without a dedicated prudential regulator. Lawyers, accountants, real estate brokers, and luxury goods dealers report to COAF rather than to BACEN. For financial institutions, COAF reporting sits on top of BACEN’s KYB requirements, creating a layered compliance obligation rather than a single unified standard.

What documents are required for KYB verification of a Brazilian company?

CNPJ business verification in Brazil-side runs across three documentation tiers. A complete file at onboarding is the difference between a compliant record and a gap that surfaces during a BACEN inspection.

Corporate identity documents

The Cadastro Nacional da Pessoa Jurídica (CNPJ) is the 14-digit identifier issued by the Receita Federal (Brazil’s Federal Revenue Service) and sits at the center of every business verification. The CNPJ’s active status is verifiable through the REDESIM portal, Brazil’s business registration system operated by the Receita Federal. A suspended CNPJ signals either tax non-compliance or a failed UBO declaration. Either outcome requires escalation before the business relationship proceeds.

Beyond the CNPJ, the corporate identity layer includes the Contrato Social (articles of association), the company’s official registration certificate, and proof of registered business address.

Ownership documentation

Government-issued identification must be collected for every natural person meeting the ownership threshold. The legal benchmark is 25%. Any individual who directly or indirectly holds at least 25% of the company’s capital qualifies as a UBO under Normative Instruction 2119/2022 and must be verified on record.

AML evidence

Regulated institutions must document the source of the business’s funds, the intended purpose of the relationship, and any adverse media or sanctions hits against the entity and its controllers. Institutions conducting anti-money laundering screening on corporate clients are expected to refresh this layer periodically, not just at onboarding.

What are Brazil’s UBO verification requirements?

Brazil UBO verification requirements follow a structured disclosure model set by Normative Instruction 2119/2022, issued by the Receita Federal. Under this rule, all companies registered with the CNPJ must declare the existence or absence of a UBO within 30 days of registration. Beneficial ownership Brazil regulations define the UBO as a natural person who directly or indirectly holds more than 25% of the share capital or who exercises predominant control over the entity’s decisions.

Foreign companies operating in Brazil face the most demanding disclosure standard. They must declare their UBO or confirm its absence. Domestic companies without any natural person meeting the 25% threshold may file a negative declaration stating that no UBO exists, but that filing is still mandatory.

Non-compliance carries direct operational damage. A company that fails to make the required UBO declaration faces suspension of its CNPJ. Once suspended, the entity cannot conduct banking transactions, access financial investments, or obtain loans, creating immediate pressure on any business trying to work with regulated counterparts.

As of January 2026, Brazil’s beneficial ownership framework moved further with the operationalization of the e-BEF system. This digitalized UBO reporting required obligated entities to submit ownership information through a central federal platform. The FATF’s 2023 Mutual Evaluation of Brazil had flagged UBO transparency as a persistent gap in the country’s AML regime. The e-BEF rollout addresses it directly.

Is KYB mandatory for fintechs in Brazil?

Brazil’s fintech KYB regulations tightened substantially in August 2025. Normative Instruction No. 2,278, published by the Receita Federal, extended the same AML and business verification obligations that apply to banks to payment institutions and fintech platforms participating in payment arrangements. Fintechs that operated under lighter-touch rules must now apply a full KYB framework when onboarding corporate clients.

From August 2025, a fintech onboarding a business client in Brazil faces the same CNPJ validation, UBO identification, and SAR reporting requirements as a licensed bank.

KYB LATAM Brazil sits in a distinct regulatory position compared to other major markets in the region. Brazil’s AML regime layers a central bank regulator, a financial intelligence unit, and a national tax authority, each with overlapping corporate verification obligations. Compliance teams managing multiple Latin American jurisdictions will find that Brazil requires the most documentation and the most structured ongoing monitoring program.

BACEN KYB requirements in Brazil follow a risk-based approach throughout. Business profiles classified as high-risk, including entities with complex ownership structures, offshore controllers, or activity in elevated-risk sectors, trigger EDD requirements. Well-documented lower-risk businesses can move through the business verification process at a pace that avoids unnecessary onboarding friction for genuine counterparts.

How Shufti handles beneficial-ownership checks in Brazil

The compliance burden in Brazil’s KYB framework, layered across BACEN, COAF, and the Receita Federal, creates real friction for teams relying on manual processes or managing multiple vendor tools. A single corporate onboarding can require CNPJ verification, multi-tier UBO mapping, SAR-ready documentation, and a clear audit trail for BACEN inspection.

Shufti’s KYB verification maps entity ownership down to the UBO level and cross-checks the entity and its controllers against global sanctions and adverse media databases, matching the AML coverage BACEN and COAF require. Business AML screening runs alongside the verification step, not after it, so the compliance record is complete at onboarding rather than assembled retrospectively. Shufti covers 240+ jurisdictions, so Brazilian corporate clients with foreign ownership chains don’t create coverage gaps during the UBO mapping step.

See how Shufti maps beneficial ownership for Brazilian corporate clients end to end. Book a demo.