Brazil's anti-money laundering regime has entered a new phase. Regulators have significantly tightened obligations for companies operating in regulated sectors, with enhanced requirements for KYC (know-your-customer) procedures, beneficial owner disclosure, and internal compliance programs. International businesses with Brazilian operations that fail to adapt face administrative sanctions, restrictions on bank account opening, and potential suspension of credit facility access.
Brazil's AML legislation, updated with effect from early 2025, expands the categories of obligated entities and strengthens identification and reporting duties across financial, commercial, and professional service sectors. Companies must now maintain updated beneficial owner records, conduct enhanced due diligence on higher-risk relationships, and submit suspicious transaction reports within tightened timeframes. The compliance deadline for full implementation of internal program requirements falls within the first half of 2025.
This alert outlines which business categories are affected, the threshold criteria that trigger obligations, and the immediate steps international companies should take now.
What changed and when it takes effect
Brazil's anti-money laundering legislative regime has long been anchored in the country's financial crime prevention legislation and successive regulations issued by the Conselho de Controle de Atividades Financeiras (COAF – Brazil's Financial Intelligence Unit). The 2025 round of updates builds on that foundation in three material ways.
First, the scope of obligated entities has been broadened. Previously, AML obligations applied primarily to financial institutions and a defined list of regulated intermediaries. The updated rules bring a wider range of non-financial businesses and professions into the compliance perimeter. Real estate agents, dealers in high-value goods, accounting professionals, and certain technology-enabled payment service providers now carry obligations that previously applied only to banks and brokers.
Second, beneficial owner identification requirements have been substantially reinforced. Under Brazil's updated financial crime prevention rules, companies must identify and verify the natural persons who ultimately own or control a legal entity, typically those holding a meaningful direct or indirect equity interest. This standard now applies not only at account opening but on a rolling basis – companies must update their records whenever a change in ownership or control occurs.
Third, the timeframe for filing suspicious transaction reports with COAF has been compressed. Obligated entities must now report suspected transactions within a shorter window than the previous standard, and the failure to do so on time constitutes an independent breach. even if the underlying transaction ultimately proves legitimate.
The updated obligations became binding in stages. The expanded entity scope and beneficial owner rules took effect in early 2025. Full implementation of internal compliance program requirements – including documented policies, designated compliance officers, and staff training records – is required by mid-2025.
Which companies are affected and what the threshold criteria require
The updated AML rules in Brazil apply to any entity that qualifies as an "obligated person" under the revised financial crime prevention legislation. The practical question for international businesses is whether their Brazilian subsidiary, branch, or commercial partner falls within this definition.
The following categories are directly in scope:
- Banks, payment institutions, and other regulated financial entities supervised by the Banco Central do Brasil (Brazilian Central Bank)
- Securities brokers, investment managers, and capital market intermediaries supervised by the Comissão de Valores Mobiliários (CVM – Brazilian Securities Commission)
- Real estate developers and brokers involved in transactions above defined monetary thresholds
- Dealers in luxury goods, precious metals, and high-value assets where single transactions or related transactions exceed regulatory thresholds
- Accounting, auditing, and legal service providers that manage client funds or execute transactions on behalf of clients
Threshold criteria matter. For non-financial businesses, AML obligations are triggered when transactions – individually or in a series of related operations – exceed the monetary limits set by sector-specific regulations. International companies that conduct correspondent banking arrangements or maintain credit facility lines with Brazilian financial institutions must also ensure their Brazilian counterparties comply, as correspondent banking due diligence now extends obligations upstream.
Foreign-owned Brazilian subsidiaries face the same obligations as domestically owned entities. There is no exemption based on the nationality or domicile of the ultimate shareholder. A European or US parent company whose Brazilian subsidiary falls within a regulated sector must ensure that subsidiary maintains its own compliant AML program. it cannot rely on a group-level program designed for a different jurisdiction.
To receive an expert assessment of your company's AML exposure in Brazil, contact us at info@ferrazwhitmore.com.
Immediate actions for international companies
The compliance window is short. International companies with Brazilian operations should treat the following as priority actions.
1. Map your entity's regulatory status. Determine whether your Brazilian subsidiary, branch, or commercial vehicle falls within the expanded list of obligated entities. The classification exercise should be carried out under Brazilian financial crime prevention legislation, not by analogy to the rules of your home jurisdiction. Engaging a banking and finance lawyer in Brazil with direct knowledge of COAF and Central Bank guidance is the most reliable starting point.
2. Audit your beneficial owner records. Verify that your Brazilian entity holds complete, current, and documented identification of all beneficial owners. Where your ownership chain passes through intermediate holding structures – common in cross-border investment arrangements – each layer must be traced to the ultimate natural person. Gaps in this chain are among the most frequently cited deficiencies during regulatory inspections.
3. Review your KYC procedures for clients and counterparties. If your Brazilian entity onboards clients, opens bank accounts, or enters into financial arrangements with third parties, your KYC procedures must meet the updated standard. Enhanced due diligence applies to politically exposed persons, high-risk jurisdictions, and unusual transaction patterns. Relying on KYC documentation collected before the 2025 updates without re-verification may not satisfy current requirements.
4. Appoint a designated compliance officer and document your internal program. The updated rules require obligated entities to maintain a formal, written AML compliance program. This must include a designated officer responsible for implementation, documented risk assessment procedures, a suspicious transaction reporting protocol, and evidence of regular staff training. A program that exists only in outline form – without training records, risk matrices, and written policies – will not withstand regulatory scrutiny.
5. Assess your correspondent banking and credit facility relationships. If your Brazilian operations involve correspondent banking arrangements or rely on credit facility access from regulated financial institutions. Be aware that those institutions are themselves subject to enhanced AML due diligence obligations. They may request updated beneficial owner information, AML program documentation, or certifications of compliance from their corporate clients. Preparing this documentation in advance reduces the risk of account restrictions or credit disruptions.
International companies operating across multiple jurisdictions should also note that Brazil's updated AML standards increasingly align with the recommendations of the Grupo de Ação Financeira Internacional (GAFI – the Financial Action Task Force, or FATF). This convergence means that a robust compliance program built to FATF standards will satisfy Brazilian requirements in most respects – but local implementation details, filing deadlines, and supervisory expectations still require jurisdiction-specific attention. For a parallel perspective on AML developments in another major market, see our alert on AML updates in the United States.
Companies with exposure to Brazilian capital markets should also review how the updated AML rules interact with CVM reporting obligations. Our analysis of capital markets regulation in Brazil covers the disclosure and compliance intersection in greater detail.
About Ferraz & Whitmore
Ferraz & Whitmore is an international law firm based in Lisbon, advising business clients across 46 jurisdictions. Our Americas practice supports international companies managing AML compliance, banking regulation, and financial crime prevention obligations across Brazilian and Latin American markets. We work with multinational groups, institutional investors, and in-house legal teams who need results-oriented counsel in civil law systems. Engaging a law firm in Brazil with cross-border experience is particularly valuable when group-level compliance programs must be adapted to local regulatory requirements. Our practitioners have advised on AML program design and regulatory review matters across both civil law and common law systems. For a preliminary review of your company's AML compliance position in Brazil, email info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.