Brazil maintains its own domestic sanctions and PEP screening infrastructure, but it is fragmented across several authorities and does not consolidate into a single authoritative public register. The Conselho de Controle de Atividades Financeiras (COAF), the Banco Central do Brasil, and the Controladoria-Geral da União (CGU) each maintain separate lists and debarment databases. No single government portal delivers a one-stop consolidated match for a supplier or counterparty. For supply-chain due diligence, this means you must query multiple sources in parallel – and the absence of a hit on one list tells you nothing about the others.
What the Brazilian sanction and PEP ecosystem actually consists of
Unlike the OFAC SDN list in the United States or the EU Consolidated List, Brazil does not operate a single national sanctions list equivalent. Instead, risk screening in Brazil draws on a cluster of overlapping registries, each governed by a different federal body with a different legal mandate, different update cadences, and different levels of public access.
COAF (Financial Intelligence Unit). COAF is Brazil's anti-money laundering authority under the Ministry of Finance. It processes suspicious transaction reports from regulated entities (banks, fintechs, brokers, insurers, real estate agents, lawyers, and others) and issues administrative resolutions. COAF does not publish a named sanctions list accessible to the general public. Regulated entities are required to report to COAF, but third parties cannot query COAF's database to check whether a counterparty has been flagged. The intelligence flow is one-directional: regulated entities report in; COAF does not publish out.
CGU – CEIS, CNEP, and CEPIM. The Controladoria-Geral da União operates three public databases that are directly relevant to supply-chain screening. The Cadastro Nacional de Empresas Inidôneas e Suspensas (CEIS) records companies and individuals who have been administratively suspended or declared ineligible to contract with the federal government. The Cadastro Nacional de Empresas Punidas (CNEP) records companies fined under the Anti-Corruption Law (Lei 12.846/2013, the "Clean Company Act"). The Cadastro de Entidades Privadas Sem Fins Lucrativos Impedidas (CEPIM) covers non-profit entities barred from receiving federal transfers. All three are searchable by CNPJ (the company's federal tax registration number) or CPF (individual taxpayer number) through the CGU's Transparency Portal. Access is free and does not require registration.
TCU – Tribunal de Contas da União. The TCU, Brazil's federal audit court. Maintains its own list of individuals and entities declared ineligible to hold public office or receive public contracts, primarily as a result of TCU administrative proceedings. TCU sanctions differ from CGU sanctions in both legal basis and duration. TCU entries are searchable through the court's own portal. They are not automatically mirrored in CGU's databases, so a clean CGU result does not imply a clean TCU result.
PEP Lists – no single consolidated registry. Brazil defines Politically Exposed Persons through Banco Central do Brasil Resolution 4.753/2019 (and its successors) and corresponding SUSEP and CVM regulations for insurance and capital markets. Financial institutions must maintain internal PEP lists and apply enhanced due diligence. There is no government-published comprehensive PEP registry accessible to non-financial businesses. The categories of PEPs covered by Brazilian regulation are broad and include elected officials, senior executives of state-owned enterprises, judges and prosecutors of certain levels. Senior military officers. Additionally, their close family members and associates. but the operational list is held internally by each regulated institution, not published centrally.
SISCOAF and SISBACEN. These are restricted-access systems used by regulated financial institutions to interact with COAF and the Banco Central respectively. They are not accessible to non-financial corporate counterparties or to suppliers conducting their own self-screening. Their existence matters for the supply chain because it means your Brazilian bank counterpart may have information about a supplier that it cannot legally share with you directly.
What a supplier check actually covers – and where it breaks
What you can verify directly. A structured supplier screening in Brazil can reliably cover: (1) CEIS. suspension from federal contracting. (2) CNEP. fines under the Clean Company Act. (3) CEPIM. bars on non-profits receiving federal transfers. (4) TCU debarment list. (5) basic CNPJ status via the Receita Federal. This confirms whether the company is active. The registration date, the legal seat municipality. Additionally, the declared principal activity code. The Receita Federal's CNPJ query is free and returns real-time status. These five sources together constitute the publicly accessible minimum for any serious supply-chain screen.
Where the chain breaks. Several critical layers of risk are not captured by any of these public sources. First, beneficial ownership: Brazil has introduced a beneficial ownership register under the Receita Federal (the CNPJ reform effective from 2023 onward). However. Disclosure depth and verification quality vary significantly depending on company type. Additionally, the register is not yet fully operational across all entity classes. Second, state-level debarments: the Juntas Comerciais (commercial registries) operate state by state, with highly inconsistent digitisation. A supplier barred from contracting with the government of São Paulo may appear completely clean in a federal CGU search. Third, judicial sanctions: criminal convictions that do not produce an administrative debarment are not captured in any of the above registries. A supplier whose controlling shareholder was convicted of corruption under Article 333 of the Penal Code may have no entry in CEIS or CNEP if the case resolved through criminal courts without a parallel administrative proceeding. Fourth, international sanctions exposure: Brazil does not automatically incorporate UN Security Council sanctions or the OFAC SDN list into domestic law. A Brazilian supplier that is not on any domestic list may nevertheless be an OFAC-designated party, which creates downstream exposure for non-US entities that are subject to US secondary-sanctions risk.
The CNPJ fragmentation problem. Brazil's corporate registry system is structurally decentralised. The federal CNPJ (maintained by the Receita Federal) provides tax registration status but does not contain the full corporate record. articles of association. Shareholder history, capital changes, directorship changes. which is held by the relevant Junta Comercial. The quality and accessibility of Junta records vary dramatically: the Junta Comercial do Estado de São Paulo (JUCESP) has a well-developed digital platform. many smaller state Juntas require in-person requests or deliver scanned documents of variable legibility. This means that verifying the actual ownership structure and signatory authority of a Brazilian supplier often requires state-specific research that cannot be replicated from a single federal portal.
The PEP problem in supply chains specifically
The supply-chain dimension of PEP exposure in Brazil is more acute than in many other jurisdictions because of the scale of public procurement and the pervasiveness of state-owned enterprise contracting. A supplier that provides goods or services to Petrobras, Eletrobras. Alternatively, federal and state health authorities is operating in an environment where PEP relationships are commercially normal. directors. Procurement officers. Additionally, contract supervisors on both sides of those relationships may meet Brazilian PEP definitions. This does not make the relationship improper, but it creates an enhanced due diligence obligation for any regulated entity that banks or insures that supplier.
Who counts as a PEP under Brazilian rules. Brazilian regulation defines PEPs to include: holders of elected federal, state. Additionally, municipal mandates above certain thresholds. senior officials of federal, state. Additionally. Municipal executive bodies. members of the judiciary and public prosecutors' offices at specified levels. senior officers of the armed forces and federal police. members of supervisory boards of major state-owned enterprises. and their first-degree relatives, spouses, and known close associates. The practical difficulty for a non-financial business screening its own supply chain is that this is a definitional standard, not a searchable database. The determination requires knowing the individual's current and historical roles – which is not always visible from CNPJ filings or publicly available corporate records.
What regulated entities must do vs. what non-regulated buyers can do. Banks, insurers, and other COAF-regulated entities must apply systematic PEP screening using internal or licensed databases updated at defined intervals. A non-financial company onboarding a Brazilian supplier has no equivalent legal obligation under Brazilian AML law. but may have obligations under its own jurisdiction's laws (e.g.. UK Bribery Act, German Supply Chain Due Diligence Act. Alternatively, FCPA) that effectively require equivalent checks. The absence of a Brazilian legal obligation does not eliminate the compliance exposure created by foreign law.
Clean Company Act (Lei Anticorrupção) and what it adds to the picture
Brazil's Clean Company Act of 2013 introduced strict liability for legal entities for corrupt acts committed on their behalf, regardless of whether the individual responsible is identified or convicted. This has direct implications for supply-chain risk. A Brazilian supplier that faces a current Clean Company Act investigation – even before any final administrative determination – carries reputational and operational risk. Such investigations are not always visible in CNEP until a final penalty is imposed. Preliminary investigation notices and administrative proceedings may be disclosed in the Official Gazette (Diário Oficial da União or state equivalents) but require targeted monitoring rather than a point-in-time database query.
Leniency agreements. The Clean Company Act introduced a leniency mechanism under which companies under investigation can negotiate with the CGU (at federal level) or state authorities for reduced penalties in exchange for cooperation and remediation. Companies that have entered leniency agreements are listed in a specific section of the CGU Transparency Portal. This is a meaningful signal: a supplier with an active leniency agreement is in a supervised compliance process, which may reduce forward risk – but it also confirms that substantiated corrupt conduct occurred. Whether that changes or confirms your appetite for the counterparty is a judgment call, but it must be an informed one.
Practical screening sequence for supply-chain due diligence
Step 1 – CNPJ status check. Run the supplier's CNPJ through the Receita Federal's public query. Confirm the entity is active, identify the registration date, legal seat, and declared activity. Flag any CNPJ registered within the preceding 12 months with a declared activity that does not match the goods or services being contracted. This is a common red flag for shell or pass-through structures.
Step 2 – CGU portal queries. Search CEIS, CNEP, and CEPIM by both CNPJ and CPF for the principal beneficial owners and directors identifiable from corporate filings. A clean result reduces but does not eliminate risk; interpret it as one data point, not a clearance.
Step 3 – TCU query. Search the TCU's Jurisprudence and Sanctions portal separately for the same entities. Cross-reference against any TCU decisions visible through the portal's public search function.
Step 4 – State Junta research. Obtain the full corporate record – articles of association, shareholder registry, directorship history – from the relevant Junta Comercial. For suppliers incorporated in São Paulo, Santa Catarina, or Minas Gerais, digital access is feasible. For smaller states, allow for additional lead time and possible in-person retrieval through a local correspondent.
Step 5 – Diário Oficial monitoring. For high-value or sensitive supply relationships, set up keyword monitoring against the federal and relevant state Official Gazettes to capture investigation notices. Administrative proceedings. Additionally, leniency announcements that have not yet resulted in database entries.
Step 6 – International sanctions overlay. Run the same identifiers against the UN Consolidated List, OFAC SDN list, EU Consolidated List, and OFAC's non-SDN lists (including the Non-SDN Menu-Based Sanctions List). Brazilian domestic clearance does not imply international clearance. This step is non-negotiable for any cross-border transaction or for any buyer subject to US, EU, or UK sanctions jurisdiction.
Step 7 – PEP determination. For suppliers with identified directors or beneficial owners, assess each individual against the Brazilian PEP definition criteria. This requires biographic research, not database lookup. Commercial PEP screening databases (maintained by specialised compliance data providers) aggregate this information but must be used with an understanding of their coverage lag and definitional mapping methodology. For regulated financial entities, this step is legally required; for non-regulated entities, it is strongly advisable wherever the relationship involves public contracts, concessions, or state-owned enterprise procurement.
What to document and retain
Regardless of whether your organisation is itself a regulated entity under Brazilian AML law, building a documented record of your screening rationale is essential for two reasons. First, if a Brazilian compliance authority ever reviews the transaction (under the Clean Company Act. A buyer can face scrutiny if it is found to have facilitated corrupt acts, even absent bad faith), having a documented process demonstrates due care. Second, foreign law exposure – particularly under the UK Bribery Act's adequate procedures defence and the FCPA's compliance program standards – requires demonstrable, repeatable processes rather than ad hoc searches.
The record should include: the date and scope of each query, the search terms used, the sources queried, the results obtained (including screenshots or downloaded records where platforms permit), and the analyst's assessment. For PEP determinations, document the criteria applied and the sources reviewed. Retain records for at least five years or in line with the longest applicable statutory limitation period, whichever is greater.
Where outside counsel adds value in this context
The complexity of Brazil's fragmented registry landscape. combined with the gap between what public databases show and what actually exists. creates conditions where a point-in-time self-service search is rarely sufficient for high-value or sensitive supply relationships. The value of legal involvement is not in running the database queries (which anyone can do) but in: interpreting ambiguous results in light of current regulatory enforcement trends. identifying the correct entity in multi-CNPJ group structures where the contracting entity and the sanctioned entity may share beneficial ownership but appear as distinct database entries. coordinating state-level Junta research efficiently through established local correspondent networks. and advising on when and how to use representations and warranties. Indemnification provisions. Additionally, compliance audit rights to allocate residual risk contractually.
If you are structuring a supply agreement with a Brazilian counterparty, managing a cross-border supply chain that touches Brazil. Alternatively. Need to assess a specific counterparty ahead of contract execution, the team at Ferraz & Whitmore can assist. Contact us at info@ferrazwhitmore.com or visit our contacts page to discuss your specific requirements.
For related analysis on trade and sanctions frameworks, see our Trade & Sanctions practice and the Banking & Finance practice for AML compliance considerations in cross-border transactions.
Disclaimer: This page provides general legal and regulatory information for informational purposes only. It does not constitute legal advice and does not create a lawyer–client relationship. The information reflects publicly available sources as of the publication date and may not account for subsequent regulatory or legislative changes. Specific legal questions regarding Brazilian sanctions and PEP compliance should be addressed to qualified legal counsel with jurisdiction-specific expertise. Ferraz & Whitmore makes no representations as to the completeness or accuracy of third-party registry data referenced herein.