- Afghanistan
- Albania
- Algeria
- Andorra
- Angola
- Argentina
- Armenia
- Australia
- Austria
- Azerbaijan
- Bahrain
- Bangladesh
- Belarus
- Belgium
- Belize
- Bolivia
- Bosnia and Herzegovina
- Brazil
- British Virgin Islands
- Brunei
- Bulgaria
- Cambodia
- Cameroon
- Canada
- Chile
- China
- Colombia
- Costa Rica
- Croatia
- Curaçao
- Cyprus
- Czech Republic
- Denmark
- Dominican Republic
- Ecuador
- Egypt
- El Salvador
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Monaco
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Saudi Arabia
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- UAE
- Uganda
- Ukraine
- UK
- USA
- Vanuatu
- Vietnam
- Zambia
Scale Identity Verification and KYC Operations in Brazil
Verify Brazilians and foreign residents through gov.br, CIN, CPF and Datavalid checks, ePassport NFC and 10,000+ foreign ID document types, run KYB on CNPJ-registered companies and their real owners, and monitor Pix transactions and sanctions lists. One platform runs compliance and fraud prevention across the full customer lifecycle for BCB- and CVM-supervised firms.
Operational Performance for Brazil KYC
Our Numbers Speak Volumes
98.62%
Pass
Rates
Under 5 secs
IDV
Verification
100%
eIDV
Coverage
Brazil IDV/KYC Challenges
RG and CIN Formats Circulate Side by Side Until 2032
KYC in Brazil meets state-issued RGs whose layouts differ by issuer, because Decree 10,977/2022 keeps the RG valid until 1 March 2032 while the CPF-numbered CIN rolls out. Shufti verifies both, reading the CIN's QR code and handling legacy state designs without a template.
Pix Fraud Rules Demand a Decision Before Funds Move
Pix settles in seconds, yet BCB rules require institutions on both sides to reject a transfer on well-founded suspicion of fraud, and since 13 October 2025 any payment into an account suspected of fraud. Shufti scores each payment in 500ms against the customer's usual behavior.
MED 2.0 Traces Stolen Pix Funds Past the First Account
Since 2 February 2026, MED 2.0 traces and returns Pix scam proceeds across several receiving accounts, so each mule account in the chain leads back to the institution that opened it. Shufti's money mule detection flags new accounts that collect from many senders and pass funds on.
Thin Case Files Weaken Siscoaf Reports
Circular 3,978/2020 gives institutions 45 days to analyze a selected operation and the next business day to report it to COAF through Siscoaf, and an incomplete file stalls both. Shufti's case management keeps identity, alerts and analyst reasoning together, so each report starts complete.
Documents and Languages
Individual Documents Shufti Verifies in Brazil
Shufti verifies 35+ Brazilian identity documents plus passports and ID cards from other countries. The cards below cover the core documents Brazilian onboarding relies on, with the full list on the supported documents page.
View All Supported Documentsgov.br Account and Digital Documents
gov.br accounts come in bronze, silver and gold levels, with gold reached through facial matching against CIN or electoral biometric records, or a digital certificate. Shufti supports gov.br sign-in through approved routes and verifies the digital CIN and CNH they carry in government apps, checking each QR code.
Carteira de Identidade Nacional (CIN)
State identification institutes issue the CIN under Decree 10,977/2022, using the CPF as its number and adding a QR code and MRZ. Shufti reads both, checks them against the printed fields, tests the card for tampering and matches the photo to a live selfie.
Legacy RG (Registro Geral)
Each state has issued its own RG under Law 7,116/1983, with its own layout, numbering and security features. Shufti checks every state design, extracts the CPF where it is printed and matches the holder's face, so customers with older cards still onboard first time.
CPF (Cadastro de Pessoas Físicas)
Law 14,534/2023 makes the CPF the single number identifying each person in public databases, and financial onboarding starts with it. Shufti checks the CPF's status with the Receita Federal, flagging suspended, canceled or deceased-holder records, and matches the name and date of birth to the document.
Brazilian Passport
Brazilian passports have carried an electronic chip since December 2010. Shufti reads it by NFC and checks every passport across nine forensic detection layers, from MRZ checksum validation to hologram analysis, so a cloned or altered passport fails before onboarding.
CRNM and Migrant Documents
The Polícia Federal issues the Carteira de Registro Nacional Migratório to foreign residents under the Migration Law, with a digital version in the Carteira Digital do Migrante app and a provisional DPRNM for refugee applicants. Shufti verifies each one and matches the holder's face.
Foreign Passports and National ID Cards
Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. Foreign residents awaiting a CRNM, international students and non-resident investors rely on them to open accounts.
Brazilian Driving License (CNH)
Senatran issues the CNH through state DETRANs in physical or digital form, both legally valid, and cards issued since May 2017 carry a QR code. Shufti checks authenticity, expiry and QR data, and confirms license details against Senatran records through your firm's Serpro Datavalid contract.
Proof of Address
Water and electricity bills, bank statements and IPTU property tax notices are verified in the same step as the ID, with the extracted address matched against the street and CEP postal code the customer entered at sign-up.
Entity Identity
Junta Comercial Registration Extract
Each state's Junta Comercial registers companies and their amendments. Shufti confirms registration, status and administrators against the state registry and the CNPJ record, with a live call at every check, so a dissolved or altered company shows up before onboarding.
Contrato Social and Estatuto Social
AI-OCR reads ownership, capital and signing authority from the contrato social of a limited company or the estatuto social of a corporation, including later amendments, and flags GAN-generated or edited pages.
Business Address Proof
Leases, utility bills and IPTU notices are cross-checked against the address held on the company's CNPJ record.
Tax Identity
CNPJ Registration
The Receita Federal assigns every company a CNPJ, its single cadastral identifier, and has issued alphanumeric CNPJs to new registrations since July 2026. Shufti validates both formats, checks the registration status and matches the legal name to the registry.
State and Municipal Tax Registrations
Companies selling goods register with their state for ICMS through an Inscrição Estadual, and service providers register with their municipality through an Inscrição Municipal. Shufti reads each registration and matches it to the CNPJ being onboarded.
Foreign Tax Registrations and FATCA/CRS Self-Certification
Foreign-owned companies and overseas parents are verified with their home tax registrations, and FATCA and CRS self-certifications are captured in the same case file.
Ownership and Control
Beneficial Owner Declarations to the Receita Federal
Normative Instruction RFB 2,119/2022 requires companies to declare each beneficial owner, anyone holding more than 25% of capital or votes or exercising control, on the CNPJ register, with the new e-BEF form being phased in. Shufti extracts these owners and screens every one.
Quadro de Sócios e Administradores (QSA)
The QSA lists every partner and administrator on the CNPJ record. Shufti pulls it live, reconciles it with the contrato social and the owners the customer declares, and flags any partner or administrator missing from either side.
Shareholder Register and Ownership Chart
Holding companies, investment funds and foreign parents often sit between a Brazilian company and its real owners. Shufti maps ownership through every layer and screens each person and entity in the chain.
Administrators and Authorized Signatories
Each administrator and attorney-in-fact (procurador) is identity-verified and screened, and Shufti alerts the case owner when the registry records a change to the board or signing authority.
Languages We Cover
Portuguese and Foreign-Resident Document Parsing
Brazilian IDs, licenses and registry records are issued in Portuguese with accented characters, and foreign residents bring documents in many other scripts. Shufti's OCR reads 150+ languages and scripts at 99.7% accuracy, keeps marks such as ã, ç and ô intact, and averages 93% accuracy against Google Vision's 78.4% in its published benchmark. Zero-shot document intelligence extracts data from layouts it has never seen, on first sight, without waiting for a template.
Brazilian Name Matching
Native phonetic models for 80+ languages match long compound names with particles such as da, dos and de, accented and unaccented spellings such as João and Joao, and reordered surnames in sanctions and PEP screening.
Cross-Document Consistency Checks
Names, dates of birth and CPF numbers are reconciled across the CIN or RG, CNH, passport, CRNM and QSA, so one customer never splits into mismatched records.
Independent Validation
Shufti's Recognition Across Independent Evaluations
Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read More
Regulatory Update
Every Verification Route Brazilian Firms Rely On, in One Platform
Resolution CMN 4,753/2019 allows accounts to be opened through remote electronic channels, and Article 16 of BCB Circular 3,978/2020 requires identity to be verified and validated, where necessary, against public and private databases. Shufti supports both, plus chip, document and video routes for foreign residents and customers without a gov.br account.
Serpro Datavalid Validation
LiveShufti validates CPF, name, date of birth and CNH data against government records through Serpro's Datavalid and compares the customer's selfie with the Senatran facial record, storing every result in the case file.
gov.br Authentication
LiveCustomers sign in with their gov.br account through approved routes, and Shufti records the identity data the government has already verified. Silver and gold accounts carry facial or certificate-based checks, giving a high-assurance route that needs no document upload.
Docless Database (eIDV)
LiveWhen a customer skips gov.br, Shufti confirms CPF, name and date of birth against permitted Brazilian data sources, including Receita Federal records, with no upload and a decision in seconds.
NFC Chip Verification
LiveShufti reads the chip in Brazilian ePassports and most foreign biometric passports and checks it against the printed data page, the high-assurance route for foreign residents and Brazilians without a gold gov.br account.
Document and Face Biometric
LiveShufti authenticates the CIN, RG, CNH, CRNM or passport, then matches a live selfie to its photo with iBeta Level 3 liveness, the route for customers who prefer to upload a document.
Fraud Prevention Across the Brazilian Customer Journey
Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help Brazilian businesses act on risk while keeping legitimate customers moving.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Capture guidance for CINs, state RGs and CNHs catches glare, cropped QR codes and blur before submission, so customers rarely need a second attempt.
Cleaner Audit Trails
Shufti's case management records sources, results, timestamps, evidence, analyst notes and decisions, packaged as report-ready bundles for COAF filing through Siscoaf.
One Workflow, One Back Office
Unify KYC, KYB, AML screening and Pix transaction monitoring in one case file. Perpetual KYC/KYB tracks ownership, administrator and transaction changes across the full compliance lifecycle.
gov.br and CPF-First Flow Design
Customers with gov.br accounts authenticate and pass CPF checks first, while foreign residents move to CRNM or passport verification in the same flow.
Shufti's IDV/KYC Solutions for Brazil
KYC Solutions
Identity verification in Brazil serves gov.br users, customers still carrying a state RG, foreign residents with a CRNM and non-residents with passports. One Shufti flow routes each by risk, so nobody faces checks they don't need.
Explore More
Face Verification
Remote account opening in Brazil turns on matching a selfie to the CIN, the CNH or a Senatran record. Shufti's face matching delivers a 99.5% first-try pass rate, and DHS RIVR 2025 testing measured a false match rate below 0.001.
.
Age Verification
Since 17 March 2026, the Digital Statute of Children and Adolescents (ECA Digital) bans self-declared age on services unsuitable for minors and requires reliable checks at each access. Shufti estimates age from a selfie in under five seconds, blocks 99.8% of underage attempts and falls back to a document.
.
Bank Account Verification
Payouts, refunds and withdrawals fail when a bank code, branch, account number or holder name is wrong. Shufti validates Brazilian account details and matches the holder's name and CPF in real time before the first transfer, so funds reach the right customer.
.
Address Verification
Utility bills and IPTU notices vary by city and provider, and Brazilian addresses run long with complements and CEP codes. Shufti's layout-aware extraction and fuzzy matching verify them at a 99.3% pass rate, and docless checks confirm an address in under three seconds.
.
Document Verification
Brazilian onboarding draws on the CIN, state RGs, CNHs, passports and CRNMs, in physical and digital form. Shufti verifies each within seconds, decoding QR codes and testing every document for tampering, screenshots and synthetic edits.
.
Identity Verification
Separate vendors for document checks, selfies, CPF lookups and addresses leave one customer spread across several records. Shufti combines document, biometric, NFC, address and docless checks in a single API session and returns one decision with its evidence.
.KYB Solutions
Business verification in Brazil means reconciling Junta Comercial records, the CNPJ and its QSA at the Receita Federal, and ownership that often runs through holding companies and funds. Shufti calls the registries live and identifies beneficial owners at the threshold Article 25 of Circular 3,978/2020 caps at 25%.
Explore More
Business Verification
Onboarding a Brazilian company means confirming its CNPJ status, Junta Comercial record, signatories and everyone above your beneficial ownership threshold. Shufti's live registry call pulls that picture together in one check, putting corporate onboarding under two minutes.
.
Enhanced Due Diligence
Layered holdings, PEP links, high-risk sectors and QSA mismatches need a closer look. Shufti's branching questionnaires and configurable risk scoring gather the evidence, send verification links to beneficial owners and log every answer in the case file.
.AML Screening
A customer who is clean at onboarding can land on a list next week. Shufti's perpetual KYC rescreens every customer against 4,000+ watchlists, including UN Security Council sanctions that Law 13,810/2019 makes enforceable in Brazil without delay, refreshed every 15 minutes, with every hit in one case file.
Explore More
Business AML Screening
A company's risk often sits with its partners and administrators. Shufti screens entities, everyone on the QSA and beneficial owners against sanctions lists, Brazil's CEIS and CNEP registers of sanctioned companies and 50,000+ adverse media sources, and perpetual KYB rescreens the whole portfolio.
.
Transaction Monitoring
The Pix Regulation requires every Pix, rejected ones included, to be monitored under Circular 3,978, and atypical transfers to be caught against the customer's profile. Shufti's library of 500+ pre-built rules covers structuring, smurfing and mule activity, with 60% fewer false positives and report-ready case bundles for Siscoaf.
.
Travel Rule
Under Article 44 of Resolution BCB 520/2025, virtual asset service providers must send originator and beneficiary details with each transfer. Shufti's single integration connects to major Travel Rule networks, exchanges IVMS101 data and verifies ownership of self-custodied wallets before funds move.
.
AI Compliance Co-Pilot
One common name can return 140+ screening hits. Shufti's AI Compliance Co-Pilot reviews every hit and gives a confidence score with a written reason, so analysts clear obvious false positives quickly while your compliance officer keeps the final call.
.Built To Fit Brazil's Compliance Landscape
Law 9,613/1998 and COAF reporting apply to every obliged entity in Brazil, while the BCB, CVM, SUSEP and sector supervisors add their own rules, and the BCB also sets Pix fraud controls. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each license your group holds.
Law 9,613/1998 (Anti-Money Laundering Law)
Brazil's AML law, amended by Law 12,683/2012, lists obliged entities in Article 9, which now include virtual asset service providers. Article 10 requires customer identification and records kept for at least five years, and Article 11 requires suspicious operations to be reported to COAF within 24 hours.
Banco Central do Brasil (Circular 3,978/2020)
Circular 3,978/2020 sets the anti-money laundering policy, known locally as prevenção à lavagem de dinheiro (PLD/FT), for BCB-authorized institutions. Article 25 caps the beneficial ownership threshold at 25%, Article 48 requires reports by the next business day after the decision and Article 67 keeps records for ten years.
Pix Regulation (Resolution BCB 1/2020)
Articles 38 and 39 require payer and payee institutions to reject Pix transfers on well-founded suspicion of fraud, and every operation, rejected ones included, must be monitored under Circular 3,978. Since 1 November 2024, Article 89 has required a fraud-risk solution that uses DICT security data and flags atypical transfers.
MED 2.0 (Resolution BCB 493/2025)
MED 2.0 adds a value recovery function to the Pix Special Return Mechanism, tracing, blocking and returning funds across several accounts after a fraud claim. It became mandatory for transactional account providers on 2 February 2026, and since 1 October 2025 victims can contest a Pix in their banking app.
Resolution BCB 142/2021 (Payment Fraud Prevention)
Institutions must set a R$1,000 nighttime limit on transfers between individuals from 8pm to 6am, and limit increases a customer requests take effect only after at least 24 hours. Since 13 October 2025, Article 2-A has required payments into accounts with well-founded suspicion of fraud to be rejected.
Joint Resolution CMN/BCB 6/2023 (Fraud Data Sharing)
Since 1 November 2023, financial and payment institutions must share data on fraud indications through an electronic system that lets them register, update and query records, with customer consent built into the contract. Shared records are kept for ten years and do not replace reporting to the authorities.
Resolution CMN 4,753/2019 (Account Opening)
Banks may open deposit accounts through electronic channels but not voice telephone calls, validating identity against public or private databases. For prepaid payment accounts, Resolution BCB 96/2021 has required a BC Protege+ check before opening an account or changing its holders since 1 December 2025.
Council for Financial Activities Control (COAF)
COAF is Brazil's financial intelligence unit, administratively linked to the BCB under Law 13,974/2020. Obliged entities report through Siscoaf, which also gives access to the federal PEP register, and COAF supervises sectors without their own regulator under COAF Resolution 36/2021, with PEP rules in Resolution 40/2021.
Securities and Exchange Commission of Brazil (CVM)
CVM Resolution 50/2021 caps the beneficial ownership threshold for securities intermediaries at 25%, requires COAF reports within 24 hours of concluding an analysis and keeps records for at least five years. CVM Resolution 245/2026, in force since 15 July 2026, adds enhanced due diligence for FATF-listed jurisdictions.
Superintendence of Private Insurance (SUSEP)
SUSEP Circular 612/2020 sets AML duties for insurers and other SUSEP-supervised companies until 31 December 2026, when its replacement takes over. SUSEP Resolution 99/2026 applies from 1 January 2027, keeping the more-than-25% beneficial ownership test and the 24-hour deadline for reporting suspicious operations to COAF.
Virtual Asset Service Providers (Law 14,478/2022)
The BCB regulates virtual asset service providers, and its 2025 Resolutions 519 and 520 set an authorization regime in force since 2 February 2026. Resolution BCB 591/2026 requires transfers to or from self-custodied wallets worth USD 10,000 or more to be reported to COAF, covering operations from 1 October 2026.
COAF, COFECI and CNJ Rules for Designated Sectors
Real estate brokers follow COFECI Resolution 1,336/2014, and notaries and registrars follow the CNJ's National Code of Rules under Provimento 149/2023. COAF itself sets the rules for dealers in jewelry and precious metals (Resolution 23/2012), luxury goods (Resolution 25/2013) and factoring firms (Resolution 41/2022), and supervises them directly.
Receita Federal (CPF and CNPJ Registers)
The Receita Federal runs the CPF register for individuals and the CNPJ register for companies, which Law 11,598/2007 makes the single identifier across business registration. Normative Instruction RFB 2,290/2025 amended the CNPJ rules and introduced the e-BEF form for beneficial owner declarations, filed annually and within 30 days of a change.
Law 13,810/2019 (UN Security Council Sanctions)
UN Security Council sanctions are immediately enforceable in Brazil, and Article 9 requires obliged entities to freeze assets without delay or prior notice. Article 11 requires freezes to be reported to the Ministry of Justice, the sector regulator and COAF, and Resolution BCB 44/2020 applies these duties to BCB-authorized institutions.
FATF Mutual Evaluation of Brazil
The FATF adopted Brazil's mutual evaluation in October 2023 and published it on 21 December 2023, and Brazil was not among the jurisdictions under increased monitoring on the FATF's June 2026 list. Decree 10,270/2020 set up the working group behind Brazil's first National Risk Assessment, completed in 2021.
Brazil Data Residency and Deployment
Shufti runs in São Paulo cloud regions on AWS, Microsoft Azure, Google Cloud, Oracle Cloud and IBM Cloud, or on-premises in your own infrastructure, air-gapped if required. Hosting locations are fixed in your agreement, the detail Resolution CMN 4,893/2021 asks you to notify to the BCB within ten days of contracting.
General Data Protection Law (LGPD)
The LGPD treats biometric data as sensitive and, under Article 11, lets it be processed to prevent fraud in identification and authentication. Incidents that may cause relevant harm go to the National Data Protection Agency (ANPD) and data subjects within three business days. Shufti adds encryption, role-based access and configurable retention.
International Data Transfers
Article 33 of the LGPD limits transfers abroad, and ANPD Resolution 19/2024 sets standard contractual clauses that must be adopted without changes. Where data leaves Brazil, Shufti's agreement includes those clauses, and São Paulo hosting keeps identity data in the country when you prefer.
Age Verification Data under ECA Digital
Decree 12,880/2026 limits document-based age checks to confirming an age or age band and requires the document image to be deleted immediately and irreversibly. Shufti returns only the age result for these checks and deletes the captured image once the decision is made.
Retention Controls
Retention is configurable by client and license, covering the ten-year minimum for BCB-authorized institutions and the five-year minimums under Law 9,613/1998 and CVM rules. Statutory minimums are not automatic deletion dates, and legal holds keep records in place while an investigation or inspection is under way.
Encryption and Security
Data is encrypted in transit and at rest, with role-based access and audit logging throughout. ISO 27001:2022 and SOC 2 Type 2 reports support the vendor reviews behind Resolution CMN 4,893/2021, whose cybersecurity rules were updated in December 2025 to add annual penetration testing.
Automated Decisions and Biometric Data
Article 20 of the LGPD gives people the right to request a review of decisions made solely by automated processing. Shufti returns verification results and supporting reasons through the API and back office, so support teams can explain outcomes and route disputed results to a reviewer.
Scope of Our Role
Under Article 39 of the LGPD, an operator processes personal data on the controller's instructions. Shufti acts as your operator for verification while your firm remains the controller, and its privacy notice identifies any activities where Shufti acts as a controller in its own right.
Data Residency and Privacy Controls in Brazil
Brazil AML Sources That Strengthen Decisions
Council for Financial Activities Control (COAF)
Banco Central do Brasil (BCB)
Securities and Exchange Commission of Brazil (CVM)
Receita Federal do Brasil (RFB)
Portal da Transparência (CEIS and CNEP)
Superintendence of Private Insurance (SUSEP)
Superintendência Nacional de Previdência Complementar (PREVIC)
Polícia Federal
UN Security Council Consolidated List
Financial Action Task Force (FATF)
Financial Action Task Force of Latin America (GAFILAT)
Egmont Group of Financial Intelligence Units
Basel Committee on Banking Supervision
Turn Brazil Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.
Certified to Global Standards
PROVEN WORKFLOWS
Identity Verification Built Around Your Industry in Brazil
Open Accounts Remotely And Monitor Every Pix
Banks open accounts through electronic channels under Resolution CMN 4,753/2019 and must monitor every Pix their customers send or receive. Shufti runs gov.br, Datavalid and document routes in one flow, monitors Pix activity in real time and keeps every decision in a case file ready for BCB supervision.
Frequently Asked Questions
Does Shufti support gov.br, and what happens when customers cannot use it?
Yes. Customers sign in with gov.br through approved routes, and Shufti records the identity data the government has already verified. Customers without an account, or with only a bronze-level one, move to Datavalid, CPF and document checks with selfie matching, or passport NFC, in the same flow.
Is a CIN or RG image enough to verify a Brazilian customer?
No. An image can be edited or replayed. Shufti decodes the CIN's QR code, tests the card for tampering, confirms the CPF's status with the Receita Federal and matches a live selfie, checking it against Senatran records through your firm's Datavalid contract where the customer holds a CNH.
Can Shufti verify foreign documents or identity formats it has not encountered before?
Yes. Shufti's zero-shot AI adapts to unfamiliar layouts without a template, so a foreign resident's national ID or a redesigned passport is checked for authenticity and tampering like any known format, before or alongside the CRNM the Polícia Federal issues.
How accurately does Shufti read Portuguese identity documents?
Shufti's OCR reaches 99.7% accuracy across 150+ languages, Portuguese included, keeps accents such as ã and ç intact and decodes CIN and CNH QR codes. Across the languages in its published benchmark, it averages 93% accuracy against Google Vision's 78.4%, which matters for documents foreign residents bring.
How does Shufti verify ownership when a Brazilian company has several corporate layers?
Shufti pulls Junta Comercial and CNPJ records for each company in the chain, maps holdings through funds and foreign parents and identifies owners at your threshold, capped at 25%. The result is reconciled with the QSA and the beneficial owners declared to the Receita Federal.
Does Shufti's ongoing monitoring cover more than sanctions screening?
Yes. Circular 3,978/2020 requires institutions to monitor, select and analyze operations, and the Pix Regulation extends that to every Pix, rejected ones included. Shufti monitors transactions against each customer's baseline, rescreens customers and owners, and alerts you when CNPJ, QSA or ownership records change.
How does Shufti keep screening current and handle Brazilian name variations?
Watchlists, including UN Security Council lists applied under Law 13,810/2019 and the CEIS and CNEP registers, update within 15 minutes of a change at source. Phonetic matching handles accents, particles such as da and dos and reordered surnames, so spelling differences never hide a match.
Can we choose Brazilian hosting or run verification inside our own infrastructure?
Yes. Choose Shufti's São Paulo cloud regions on AWS, Azure, Google Cloud, Oracle or IBM, or deploy on-premises in your own environment, air-gapped if required. The agreement names where data is stored and processed, which your BCB outsourcing notice and LGPD transfer review both need.
What controls help us protect identity and biometric data?
Shufti encrypts data in transit and at rest, applies role-based access and logs every access. Biometric data, which the LGPD treats as sensitive, is limited to what verification needs and deleted on your schedule, and age-check document images are deleted once the decision is made.
Can we configure different retention periods for different Brazilian licenses?
Yes. Retention is set per client, license and record type, so BCB-authorized institutions keep records for ten years under Circular 3,978/2020 while CVM-regulated firms apply five years. Legal holds pause deletion when COAF, a regulator or a court requests records.
What does Shufti provide when our compliance team needs to prepare a Siscoaf report?
Shufti's case file holds the verified identity, screening results, transaction history, Pix alerts and analyst notes in one place. Your team exports a report-ready bundle and files through Siscoaf by the next business day, with related MED claims and fraud markings logged alongside.
Can we add verification checks without rebuilding our onboarding journey?
Yes. The AI Journey Builder adds or reorders checks such as gov.br authentication, Datavalid or address verification without code changes. Routing rules send customers to different checks by product, state or risk tier, keeping KYC compliance consistent across every channel you run.
How does Shufti make verification queries easier for our customer support team?
Every decision appears in the back office with its reason, the failed check and the captured evidence. Support teams can tell a customer exactly what to fix, such as a glare-covered QR code or a suspended CPF, and escalate disputed results to compliance.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
19 June, 2026
Brazil Bets KYC Playbook for .bet.br Operators 2026
Written for licensed .bet.br operators. How to cut fraud, tighten KYC workflows, and prepare for SPA and MF enforcement with a connected identity verification framework.
Product Guide
