Brazil has no single national register of business licences and operating permits. Instead, licences are issued and held across federal, state and municipal layers – each with its own database, access rules and update frequency. For a counterparty due diligence or supply-chain risk assessment, this means that a clean CNPJ status from the federal tax authority tells you next to nothing about whether a supplier actually holds the environmental. Sanitary or sector-specific permits it needs to operate lawfully. Mapping licence exposure in Brazil requires a multi-layer search across at least three distinct regulatory tiers, and the gaps between those tiers are where supply risk lives.
Why Brazil's licensing architecture creates structural blind spots
Brazil is a federal republic of 26 states plus the Federal District, and within each state there are thousands of municipalities. Legislative competence over economic activity is shared across all three levels. Federal agencies regulate certain sectors nationally – ANVISA for food and pharmaceuticals, IBAMA for environmental matters at federal level, ANTT for road freight, ANAC for aviation. State-level bodies – secretarias de meio ambiente, vigilâncias sanitárias estaduais – issue a separate layer of environmental and sanitary licences for activities that do not cross federal thresholds. Municipal prefeituras issue the basic operating permit, the Alvará de Funcionamento, which is the foundational document a business needs simply to open its doors.
None of these databases speaks to the others automatically. A company can hold a valid federal CNPJ registration and an active CNPJ status in the Receita Federal's public query system, while simultaneously operating without a valid alvará (expired or never renewed). Without a current environmental licence (licença de operação). Additionally, without the sector-specific federal authorisation required for its line of activity. Each deficiency sits in a different register, and none surfaces in a routine CNPJ check.
The CNPJ check: what it actually confirms
The Receita Federal's public CNPJ query. available without login. returns the entity's tax registration status (active. Suspended, cancelled, etc.), its registered economic activity codes (CNAE), and basic cadastral data. It does not confirm that a licence has been issued, that an environmental permit is in force, or that the company is authorised to conduct regulated activities. CNPJ-active status means the entity exists in the tax system and has not been formally cancelled; nothing more.
State commercial registries (Juntas Comerciais)
Each Brazilian state has its own Junta Comercial. These bodies register the articles of incorporation, track share capital and amendments, and issue the Certidão de Registro Empresarial. Access to Junta records varies significantly by state – some offer partial digital searches, others require in-person requests or local agent engagement. The data is fragmented and not aggregated at federal level in any publicly accessible form. The Sistema Nacional de Registro de Empresas Mercantis (SINREM) is an integrating initiative, but the depth and currency of data available for external queries differs state by state. What a Junta record confirms: that the legal entity was constituted and registered, and what amendments have been formally filed. It does not confirm operational licences.
The three-tier licence map: federal, state, municipal
Federal permits – sector regulators
At federal level, the relevant authority depends entirely on the sector. ANVISA (Agência Nacional de Vigilância Sanitária) issues authorisations for manufacturers and importers of pharmaceuticals, cosmetics, food products, medical devices and related categories. IBAMA (Instituto Brasileiro do Meio Ambiente) issues federal environmental licences for activities with national or inter-state impact. ANTT controls road-freight operators and cargo carriers. ANS oversees health insurers; SUSEP oversees insurance companies; the Banco Central do Brasil and CVM regulate financial entities. Each of these bodies maintains its own register of authorised entities. Some publish searchable public lists; others require formal requests or do not maintain a consolidated public-facing database. Confirming federal authorisation status requires identifying the correct regulatory body for the specific CNAE codes the supplier operates under, then querying that body's records. a step that is easily skipped in a cursory compliance check.
State licences – environmental and sanitary
Brazil's environmental licensing system (Sistema Nacional do Meio Ambiente – SISNAMA) divides competence between IBAMA at federal level and state environmental agencies (e.g.. CETESB in São Paulo, FEAM in Minas Gerais, INEA in Rio de Janeiro) at state level, based on the nature and geographic footprint of the activity. For most manufacturing and processing operations, the relevant licence is the Licença de Operação (LO) issued by the state agency. An LO has a fixed validity period and must be renewed. an expired LO means the operation is technically unlicensed under environmental law. Exposing both the operator and potentially its clients. particularly in regulated supply chains. to administrative and civil risk.
State sanitary agencies (Vigilância Sanitária Estadual or municipal, depending on the activity category) issue their own registrations for food-handling premises, health-adjacent services and similar activities. As with environmental licences, these are held in state-level registers that are not automatically accessible through any central portal.
Municipal Alvará de Funcionamento
The Alvará de Funcionamento is issued by the municipal prefeitura and authorises a specific business activity at a specific address. It is renewed periodically – in most municipalities, annually. An expired alvará is an administrative infraction that can result in closure orders. Verifying alvará status requires querying the municipal system of the city where the facility is located. In larger cities (São Paulo, Rio de Janeiro, Belo Horizonte, Curitiba), municipal systems have become more digitised; in smaller municipalities, verification may require direct contact with the prefeitura. There is no national aggregator for alvará data.
What registers are accessible and how
CNPJ – Receita Federal
The Receita Federal's CNPJ consultation service is publicly accessible and free of charge. It returns cadastral data, CNAE codes, registered address, and status. Access does not require login. This is the first and easiest check, but also the shallowest.
ANVISA – authorised products and companies
ANVISA maintains public registers of authorised products and companies in the health-regulated sectors. These are searchable by product category, company name or CNPJ. This is among the more accessible federal regulatory databases and provides meaningful confirmation for suppliers in pharmaceutical, food-processing or cosmetics supply chains. ANVISA's registers are updated with notices of cancellation, suspension and non-compliance; checking for adverse entries is a standard pre-contract step for regulated-sector procurement.
IBAMA and state environmental agencies
IBAMA publishes certain enforcement data publicly, including the Cadastro Técnico Federal (CTF) – a registry of entities engaged in activities that use natural resources or generate pollution. CTF registration is compulsory for covered entities; checking whether a supplier is registered, and whether its annual attestation is current, is a meaningful data point. State agencies vary: CETESB in São Paulo provides some query functionality; others are less accessible externally. Licença de Operação validity is not universally searchable by third parties without direct contact with the state body.
State Juntas Comerciais
Certidões from Juntas Comerciais confirm registration status and allow review of corporate documents. Access is mixed – some states have partially digitised systems with limited external query; others require in-person or notarised requests. Obtaining a full corporate file (contrato social, alterações, certidão de regularidade) from a Junta typically involves engagement with a local correspondent or service provider.
Municipal systems
Municipal portals for alvará verification vary enormously. São Paulo's municipal portal allows online alvará queries by CNPJ. Many smaller municipalities have no such functionality. On-the-ground verification via a local representative is often the only reliable method for facilities outside major centres.
Supply-chain risk: where the chain actually breaks
From a supply risk standpoint, the most dangerous assumption is that a supplier's active CNPJ status is a proxy for regulatory compliance. In practice, the gap between CNPJ-active and fully-licensed is where most supply-chain liability concentrates. The failure modes that recur in Brazilian supply chain disputes and regulatory enforcement actions include the following patterns.
Environmental licence expiry in manufacturing and agribusiness
Licenças de Operação have fixed validity periods. typically between four and ten years depending on the state and activity class. but renewal processes are slow and administrative queues can stretch beyond the licence expiry date. An operator may continue production on an expired LO while the renewal application is pending. This creates an ambiguous compliance status: the company is not in outright violation if it has filed timely for renewal, but the licence is nonetheless expired. Buyers in regulated supply chains (export markets, large retailers with ESG supply-chain commitments, multinationals with compliance programmes) may treat expired LOs as disqualifying. The point is that this status is invisible in a CNPJ check and requires direct contact with the state environmental agency.
Sector-authorisation gaps in food and health products
A food-processing or pharmaceutical supplier may hold a valid CNPJ. A valid alvará. Additionally, even a valid state sanitary registration. but may lack the specific ANVISA federal authorisation required for a particular product category. This gap is common when companies expand their product lines without updating their federal authorisations, or when regulatory categories are reorganised. The risk for the buyer is liability for receiving or commercialising non-compliant products. ANVISA enforcement records, which include interdictions, cancellations and consent decrees (termos de ajustamento de conduta), are the relevant check.
Municipal alvará expiry and zoning changes
Alvarás can lapse due to non-renewal, non-payment of municipal fees, or changes in municipal zoning that reclassify the permitted uses for a property. In growing urban areas, zoning reclassifications are not uncommon. A facility whose zoning designation has changed may find its alvará renewal refused – but continue operating without one. Municipal enforcement of expired alvarás is inconsistent; the risk to a buyer is that a supplier's facility is subject to a closure order at any point, creating an unplanned supply disruption.
Fragmentation in multi-site operators
Brazilian suppliers with multiple facilities present a compounded challenge: each facility has its own alvará and state licences; the federal CNPJ may cover all sites or there may be subsidiary CNPJs. A head-office CNPJ that is clean and active says nothing about whether an individual production site at a different address holds current licences. Site-level verification requires knowing all facility addresses and checking each one separately through the relevant municipal and state systems.
What to check before a transaction or first contract
A practical pre-contract licence check for a Brazilian supplier should proceed in the following sequence.
Step 1 – CNPJ status and CNAE codes
Confirm the entity's tax registration is active via the Receita Federal's public system. Note all CNAE codes listed – these determine which sector regulators have jurisdiction and what licences are required.
Step 2 – Corporate registry
Obtain the certidão simplificada or certidão de inteiro teor from the relevant Junta Comercial. This confirms the entity's legal existence, current ownership structure as filed, and any registered amendments. Note that beneficial ownership information held in the Cadastro de Beneficiários Finais (maintained by the Banco Central) is not publicly accessible.
Step 3 – Federal sector authorisation
Based on the CNAE codes and the nature of the supply relationship. Identify the relevant federal regulator (ANVISA, ANTT, ANAC, ANEEL, etc.) and query that body's public register or request confirmation of authorisation status. For ANVISA-regulated suppliers, check for adverse enforcement records.
Step 4 – State environmental and sanitary licences
Identify the state or states where facilities are located. Contact the relevant state environmental agency to confirm Licença de Operação status and validity. For food or health-related activities, check the state vigilância sanitária register as well. Request copies of current licences directly from the supplier and verify their face validity (expiry date, scope of authorised activities, facility address).
Step 5 – Municipal alvará
Confirm the current alvará for each relevant facility address. In major municipalities this can be done through the municipal portal. For other locations, request the document from the supplier and verify directly with the prefeitura if the risk level warrants it.
Step 6 – IBAMA Cadastro Técnico Federal (CTF)
For suppliers in extraction, agriculture, mining, waste management or industrial manufacturing. Check whether the entity is registered in IBAMA's CTF and whether its annual attestation (Relatório Anual de Atividades Potencialmente Poluidoras – RAPP) is current. Non-compliance with CTF obligations is an environmental infraction and a red flag in ESG-linked supply contracts.
Step 7 – Tax clearance certificates (Certidões Negativas de Débitos)
While not strictly a licence register, federal, state and municipal CND status is a standard supply-chain due diligence item. Tax debts at any level can result in asset attachments, enforcement actions and operational disruption. Federal CND is available via the Receita Federal / PGFN joint certificate. State and municipal CNDs must be obtained separately for each relevant jurisdiction.
Limitations inherent to any register-based check
Even a thorough register-based check in Brazil has structural limitations that practitioners should understand before relying on results.
Update lag
Registers are updated at irregular intervals and with varying delays. An enforcement action taken by a state environmental agency may not appear in any publicly searchable system for weeks or months. A licence that has been suspended may show as valid in the register until the formal administrative record is updated. Register snapshots reflect the state of data entry, not necessarily the state of regulatory reality.
Informal operations
A significant share of Brazilian economic activity – including activity by entities that hold CNPJ registrations – occurs in conditions of partial or full informality with respect to licences. This is particularly pronounced in agribusiness supply chains beyond the first tier, in waste and recycling, and in construction sub-contracting. Third-party and fourth-party supplier exposure cannot be assessed from first-tier licence checks alone.
Corporate structure opacity
Beneficial ownership information in Brazil is not publicly accessible. The Cadastro de Beneficiários Finais, introduced under BACEN Resolution 4,753/2019 and subsequently updated. Is held by the Banco Central and accessible only to regulated financial institutions and designated authorities, not to counterparties conducting private due diligence. This means that licence checks cannot, without additional investigation, identify whether the entity behind a licence is connected to sanctioned persons, debarred parties or entities subject to judicial recovery (recuperação judicial).
State-to-state inconsistency
There is no standardised format for state environmental licences, no uniform renewal cycle, and no shared federal portal that aggregates state licence status. A process that works for a São Paulo-based supplier does not map cleanly onto a supplier in a state with less digitised administrative infrastructure.
Practical implications for supply contracts
Given the fragmentation and opacity described above, the most reliable risk-mitigation tool is contractual rather than purely diligence-based. Supply contracts with Brazilian counterparties in regulated sectors should include representations and warranties as to the status of all material licences, ongoing obligations to notify the buyer of any licence suspension. Cancellation or adverse regulatory action, audit rights allowing the buyer to request documentary evidence of licence renewal. Additionally, termination rights triggered by loss of material authorisation. These contractual provisions shift the information asymmetry: instead of the buyer bearing the cost of continuous monitoring across multiple registers, the supplier bears the obligation to disclose.
ESG-linked and sustainability-linked supply contracts increasingly require suppliers to provide third-party-verified evidence of environmental compliance – not merely self-certification. In the Brazilian context, this typically means requiring the LO issued by the state environmental agency, updated CTF attestation, and, for food and health products, current ANVISA records. Buyer supply-chain compliance teams should be aware that these documents are jurisdiction-specific, expire on varying cycles, and cannot be replaced by a CNPJ status check.
For clients with recurring procurement relationships in Brazil. A structured licence monitoring protocol. with defined check-in points tied to contract renewals and LO expiry cycles. is considerably more cost-effective than reactive due diligence triggered by a supply disruption or regulatory incident. The Ferraz & Whitmore team advises on building compliance frameworks for cross-border supply relationships; contact info@ferrazwhitmore.com or visit our contacts page to discuss how this applies to your supplier portfolio.
Summary: the coverage map
To close, it is useful to state explicitly what a thorough licence check in Brazil can and cannot establish.
What it can establish: CNPJ active status. entity existence and registered corporate documents. whether ANVISA has issued (and not revoked) specific federal authorisations for covered products. whether a federal environmental authorisation has been granted by IBAMA. whether the entity appears in the IBAMA CTF with a current attestation. the face validity and stated scope of state environmental and sanitary licences provided by the supplier. the stated validity of the municipal alvará.
What it cannot establish: Whether an expired licence is actually being enforced or whether the renewal is pending. beneficial ownership of the entity behind the licence. licence status of sub-contractors and second-tier suppliers. whether informal operations are being conducted outside the licensed scope. whether a licence that is valid on its face covers the specific activity being procured (licence scope descriptions are not always granular). whether a state body has issued a suspension or enforcement notice that has not yet been entered into a searchable register.
The gap between these two columns is where supply risk in Brazil is concentrated. Understanding that gap – and building contractual, structural and operational responses to it – is the practical starting point for any serious supply-chain risk management programme involving Brazilian counterparties.
Disclaimer: This page is provided for informational purposes only and does not constitute legal advice. The regulatory framework described reflects publicly available information as of the publication date and is subject to change. Access rules, register availability and enforcement practices vary across Brazilian states and municipalities and may differ from what is described here in specific cases. Ferraz & Whitmore does not represent any government body or registry mentioned in this text. For advice specific to your situation, please consult qualified legal counsel.