Brésil KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Brésil.
- Dernière revue
- Dernière revue:
- Version
- Version 1.2
Réponse directe
Que couvre la checklist de conformité pour Brésil ?
La checklist pour Brésil traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 44 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- National FIU
- Conselho de Controle de Atividades Financeiras (Coaf)
- Core AML law
- Law 9,613 of 3 March 1998, as amended
- Suspicious reporting
- To Coaf through Siscoaf; statutory and sector timing applies, commonly within 24 hours or by the next business day after the reporting decision
- Cash reporting
- Sector-specific; BCB Circular 3,978 requires specified cash reports from R$50,000
- Retention
- Five-year statutory minimum; ten years for core records under BCB Circular 3,978
- BCB beneficial-owner parameter
- A risk-based percentage set in policy, not above 25%, plus control analysis
- CNPJ beneficial owner
- Natural person with more than 25% capital or voting rights, or other preponderant control, under current IN RFB 2,119/2022
- Privacy authority
- Autoridade Nacional de Protecao de Dados (ANPD)
- Virtual assets
- BCB authorization regime under Resolutions 519 and 520; operating rule effective 2 February 2026 with transition for existing providers
- FATF status
- FATF/GAFILAT member; not on FATF public lists reviewed 1 August 2026
Détail d’implémentation
Exigences et actions de conformité pour Brésil
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities and licensingStart with the legal entity, exact activity and supervisor. Brazil's AML perimeter is activity-based and the operating licence does not follow from AML registration alone.4 éléments+
Persons and entities in Law 9,613 article 9 are subject to customer identification, records, controls and reporting, under rules issued by their competent supervisor.
- Action d’implémentation
- Map every product and legal entity to article 9 and the current BCB, CVM, Susep, Previc, professional-council or Coaf rule before onboarding.
- Preuves à conserver
- Perimeter memo, product inventory, legal-entity map, supervisor confirmation and current-rule register.
- Source primaire
- Law 9,613/1998 arts. 9-11 and 14
BCB-authorized institutions must implement Circular 3,978's risk-based AML/CFT policy, procedures and controls.
- Action d’implémentation
- Translate the Circular into approved ownership, roles, risk assessment, CDD, monitoring, reporting, training and effectiveness testing.
- Preuves à conserver
- Authorization, board-approved policy, procedures, risk assessment, system configuration and testing.
- Source primaire
- BCB Circular 3,978/2020 arts. 1-10 and 62-65
Persons without another sector supervisor that fall under Coaf competence must register and follow Coaf's applicable resolutions, including Resolution 36's proportional framework.
- Action d’implémentation
- Confirm direct-Coaf supervision, register in Siscoaf when required and document any proportional dispensation relied upon.
- Preuves à conserver
- Scope analysis, Coaf registration, applicable resolution, dispensation rationale and portal access list.
- Source primaire
- Law 9,613/1998 arts. 10(IV) and 14(1); Coaf Resolution 36/2021
Payment and virtual-asset activities may require prior BCB authorization independently of AML duties.
- Action d’implémentation
- Gate launch on a written classification under Law 12,865, BCB Resolutions 80/81 and, for virtual assets, Law 14,478 and BCB Resolutions 519/520.
- Preuves à conserver
- Regulatory classification, application or authorization, transition analysis, conditions and launch approval.
- Source primaire
- Law 12,865/2013 arts. 6 and 9; BCB Resolutions 80/2021, 81/2021, 519/2025 and 520/2025
02Governance and risk assessmentGovernance must be proportionate to the business and demonstrably control customers, products, channels, jurisdictions, employees and partners.4 éléments+
BCB-regulated institutions must maintain a board-approved AML/CFT policy compatible with their risk profile and group operations.
- Action d’implémentation
- Assign accountable senior management, approve the policy, cover domestic and foreign units and record exceptions and remediation.
- Preuves à conserver
- Approval minutes, accountable-officer appointment, group mapping, exception register and attestations.
- Source primaire
- BCB Circular 3,978/2020 arts. 2-7
An internal risk assessment must evaluate customer, institution, operation, transaction, product, service, employee, partner and third-party categories.
- Action d’implémentation
- Score inherent risk, control effectiveness and residual risk; refresh at least biennially for the BCB perimeter and after material change.
- Preuves à conserver
- Methodology, datasets, model validation, biennial approval, change triggers and residual-risk acceptance.
- Source primaire
- BCB Circular 3,978/2020 arts. 10-16
Policies must be communicated, supported by training and evaluated for effectiveness.
- Action d’implémentation
- Train role-based populations, test knowledge and complete the annual effectiveness evaluation within the regulatory timetable.
- Preuves à conserver
- Training plan, attendance, assessments, annual evaluation report, management response and closure tracking.
- Source primaire
- BCB Circular 3,978/2020 arts. 3(V), 7 and 62-65
Outsourcing does not transfer the regulated entity's accountability or regulator-access duties.
- Action d’implémentation
- Risk-assess vendors, contract for security, audit and access rights, validate models and maintain an executable exit plan.
- Preuves à conserver
- Due diligence, contract, data-flow map, service tests, audit results, incidents and exit test.
- Source primaire
- BCB Circular 3,978/2020 arts. 3-7 and 60-61; Coaf Resolution 36/2021
03Natural-person KYC and representativesIdentity evidence must be reliable, current and sufficient to understand who acts, for whom and with what authority.4 éléments+
Obliged persons must identify customers and maintain current records under supervisor rules.
- Action d’implémentation
- Collect and verify legal name, CPF or official identifier, date of birth, address and risk-relevant occupation or activity using reliable independent evidence.
- Preuves à conserver
- Identity record, document or authoritative lookup, verification result, timestamps and refresh history.
- Source primaire
- Law 9,613/1998 art. 10(I); BCB Circular 3,978/2020 arts. 16-19
Representatives and agents must be identified and their authority verified.
- Action d’implémentation
- Verify each representative to natural-person standard, validate the mandate against current corporate or legal evidence and set expiry controls.
- Preuves à conserver
- Representative identity, power or mandate, registry check, authority scope, expiry and revocation monitoring.
- Source primaire
- BCB Circular 3,978/2020 arts. 16-18 and 24
Customer qualification must capture information compatible with the relationship and risk.
- Action d’implémentation
- Establish occupation, income or revenue, purpose, expected activity, source of funds where risk requires and update on risk-sensitive triggers.
- Preuves à conserver
- Profile, expected-activity baseline, corroboration, risk rating, review schedule and trigger events.
- Source primaire
- BCB Circular 3,978/2020 arts. 18-20
The institution must authenticate remote customers and manage fraud and impersonation risk without weakening AML controls.
- Action d’implémentation
- Layer document, device, biometric or database checks according to risk, test liveness where used and route discrepancies for human review.
- Preuves à conserver
- Channel assessment, verification logs, biometric justification, fraud signals, reviewer decision and model testing.
- Source primaire
- BCB Circular 3,978/2020 arts. 16-20; LGPD arts. 6, 11 and 46
04KYB, registries and beneficial ownershipCorporate registration, CNPJ beneficial-owner filing and AML beneficial-owner identification are related but separate controls.4 éléments+
A legal-entity customer must be identified, qualified and represented through valid constituent and registry information.
- Action d’implémentation
- Verify CNPJ status, legal name, address, activity, legal form, directors and representatives against RFB and the competent commercial registry.
- Preuves à conserver
- CNPJ proof, registry extract, constitutional documents, director list, representative authority and reconciliation log.
- Source primaire
- Law 9,613/1998 art. 10(I); BCB Circular 3,978/2020 arts. 16-20
BCB institutions must identify the ownership chain to the beneficial owner and use a policy-defined participation reference no higher than 25%, while also considering control.
- Action d’implémentation
- Trace direct and indirect ownership, voting and other control to natural persons; document the fallback and any impossibility to verify.
- Preuves à conserver
- Ownership chart, calculations, control analysis, source documents, beneficial-owner verification and exception approval.
- Source primaire
- BCB Circular 3,978/2020 arts. 24-26
The CNPJ regime separately defines and requires reporting of beneficial owners for covered entities; current IN RFB 2,119 includes more-than-25% ownership or voting rights and other preponderant control.
- Action d’implémentation
- Determine CNPJ filing scope, submit or update the e-BEF within the current timetable and do not substitute the tax filing for AML verification.
- Preuves à conserver
- Scope analysis, e-BEF submission, signatures, receipt, annual confirmation and change log.
- Source primaire
- IN RFB 2,119/2022 arts. 53-57, as amended by IN RFB 2,290/2025
Complex structures, trusts, nominees and unexplained ownership require deeper verification and may justify declining or exiting the relationship.
- Action d’implémentation
- Obtain the complete chain, trust roles and economic rationale; resolve bearer, nominee or opaque-jurisdiction risks before approval.
- Preuves à conserver
- Structure documents, trust instrument or extracts, role identities, rationale, EDD decision and escalation outcome.
- Source primaire
- BCB Circular 3,978/2020 arts. 24-26 and 39-41; IN RFB 2,119/2022 arts. 53-54
05PEPs, EDD and onboarding decisionsPEP status is a risk factor requiring specific approval and diligence, not an automatic prohibition.4 éléments+
BCB-regulated institutions must identify Brazilian and foreign PEPs and relevant representatives, family members and close associates under the current rule.
- Action d’implémentation
- Screen at onboarding and periodically, capture the basis and dates, and apply the required post-office lookback.
- Preuves à conserver
- Screening result, role source, relationship mapping, dates, disposition and refresh log.
- Source primaire
- BCB Circular 3,978/2020 arts. 27-30
BCB-regulated institutions must adopt controls compatible with PEP status, reflect that status in the customer risk classification, and have a person holding a position or function hierarchically above the relationship authorizer evaluate whether to begin or maintain the relationship.
- Action d’implémentation
- Document the risk rationale and higher-level evaluation, and apply enhanced measures, including source-of-funds or source-of-wealth checks, where justified by risk.
- Preuves à conserver
- PEP risk file, higher-level evaluation, wealth or funds evidence where required, monitoring scenario and periodic review.
- Source primaire
- BCB Circular 3,978/2020 arts. 19 and 27-29
Higher-risk customers, products, channels and jurisdictions require enhanced due diligence; lower-risk measures require a documented basis.
- Action d’implémentation
- Define objective escalation and simplification criteria linked to the internal risk assessment and prohibit simplification where suspicion exists.
- Preuves à conserver
- Risk rules, EDD or simplified-DD rationale, approvals, test samples and monitoring linkage.
- Source primaire
- BCB Circular 3,978/2020 arts. 10-16 and 39-41; Coaf Resolution 36/2021
Material identity, ownership or purpose doubts must be resolved before relying on the relationship.
- Action d’implémentation
- Pause restricted activity, request reliable corroboration, escalate unresolved cases and assess reporting without tipping off.
- Preuves à conserver
- Exception case, requests, response, restriction log, decision, report assessment and exit record.
- Source primaire
- Law 9,613/1998 arts. 10-11; BCB Circular 3,978/2020 arts. 16-20 and 43-48
06Monitoring, suspicious reporting and confidentialityMonitoring must cover completed and attempted activity and preserve the distinction between automated cash reports and suspicion-based communications.4 éléments+
BCB institutions must select and analyze atypical operations and situations using criteria compatible with their risk assessment.
- Action d’implémentation
- Monitor customer behaviour against the expected profile, aggregate related activity and document the analysis whether or not it results in a report.
- Preuves à conserver
- Alert logic, alert history, investigation record, data lineage, decision and quality review.
- Source primaire
- BCB Circular 3,978/2020 arts. 38-47
The analysis period for a selected event may not exceed 45 days under BCB Circular 3,978, and a reportable conclusion must be sent to Coaf by the next business day.
- Action d’implémentation
- Start the regulatory clock at selection, control aging, record the decision time and transmit through Siscoaf by the next business day.
- Preuves à conserver
- Selection timestamp, analysis log, decision, Siscoaf receipt and late-case escalation.
- Source primaire
- BCB Circular 3,978/2020 arts. 43 and 48
Law 9,613 requires covered proposals or transactions to be reported to Coaf within 24 hours under the applicable supervisor instructions and prohibits tipping off.
- Action d’implémentation
- Map the exact sector trigger and clock, file confidentially and restrict knowledge of the report to authorized personnel.
- Preuves à conserver
- Sector-rule mapping, decision log, filing receipt, access log, confidentiality control and customer-communication review.
- Source primaire
- Law 9,613/1998 art. 11(II)-(III)
A non-occurrence declaration is required at the frequency and through the route specified by the relevant supervisor.
- Action d’implémentation
- Calendar the applicable annual or sector period, validate that no reportable case was omitted and retain the acknowledgement.
- Preuves à conserver
- Population reconciliation, officer sign-off, declaration and submission receipt.
- Source primaire
- Law 9,613/1998 art. 11(III); Coaf Resolution 41/2022 arts. 28-29
07Cash, payments, wires and agentsObjective reporting thresholds and payment authorization rules are sector-specific and must not be treated as universal customer limits.4 éléments+
BCB institutions must report specified cash deposits, withdrawals and provisions of R$50,000 or more to Coaf under Circular 3,978.
- Action d’implémentation
- Detect single and linked qualifying events, capture the required payer, beneficiary, owner and purpose fields and report within the rule's timetable.
- Preuves à conserver
- Threshold logic, cash record, party data, purpose, report file and Siscoaf receipt.
- Source primaire
- BCB Circular 3,978/2020 arts. 49-51
Transaction records must identify the parties, amount, date and other information required by the competent authority, including aggregated monthly operations above its fixed limit; BCB transfer records must include the required originator and beneficiary information.
- Action d’implémentation
- Preserve originator, beneficiary, instrument, account, timestamp and linked-transaction data in reconstructable form.
- Preuves à conserver
- Transaction record, aggregation output, message fields, exception queue and reconciliation.
- Source primaire
- Law 9,613/1998 art. 10(II)-(III); BCB Circular 3,978/2020 art. 30
Payment institutions must operate only within their permitted modality and obtain BCB authorization when required by the current Resolutions 80 and 81 framework.
- Action d’implémentation
- Classify issuance, acquiring, initiation and account functions; confirm current authorization status and conditions before launch or material change.
- Preuves à conserver
- Product classification, authorization, corporate-object check, regulatory correspondence and launch gate.
- Source primaire
- Law 12,865/2013 arts. 6 and 9; BCB Resolutions 80/2021 and 81/2021
Use of correspondents, agents or technology providers does not remove customer, monitoring, reporting or record duties.
- Action d’implémentation
- Apply due diligence, contractual controls, training, monitoring and data-access requirements to every distribution or processing partner.
- Preuves à conserver
- Partner file, contract, training, transaction oversight, incidents, audits and termination plan.
- Source primaire
- Law 9,613/1998 arts. 10-11; BCB Circular 3,978/2020 arts. 3-7 and 60-61
08Targeted financial sanctionsUN Security Council measures apply immediately and the statutory standard of without delay means immediately or within hours.4 éléments+
UN Security Council sanctions resolutions and committee designations have immediate enforceability in Brazil.
- Action d’implémentation
- Screen customers, beneficial owners, representatives and transactions against the current UN list at onboarding, continuously and on list updates.
- Preuves à conserver
- List source, update timestamps, screening logs, match rules and coverage tests.
- Source primaire
- Law 13,810/2019 arts. 2(V), 3 and 6-8
A person in Brazil must not make assets available to a designated person or entity, directly or indirectly.
- Action d’implémentation
- Block release and movement of confirmed-match assets immediately, including indirect availability, while preserving funds and audit data.
- Preuves à conserver
- Match analysis, freeze timestamp, asset inventory, blocked transactions and control-room log.
- Source primaire
- Law 13,810/2019 arts. 2, 5-8
Law 13,810 requires obliged persons to implement applicable UN asset-freezing measures without delay and without prior notice to the sanctioned person, in the form prescribed by their supervisor. Asset freezes and attempted transfers involving sanctioned persons must be communicated to the Ministry of Justice and Public Security, the relevant supervisor and Coaf.
- Action d’implémentation
- Maintain a tested escalation path to legal, the Ministry, supervisor and Coaf without delaying the freeze.
- Preuves à conserver
- Escalation matrix, notifications, receipts, timestamps, legal assessment and follow-up.
- Source primaire
- Law 13,810/2019 arts. 9 and 11
False positives, delisting and permitted-access cases require controlled legal handling rather than unilateral release.
- Action d’implémentation
- Verify identifiers, document the disposition and release or allow access only under the applicable official decision or procedure.
- Preuves à conserver
- Identifier comparison, legal decision, authority communication, release approval and customer notice review.
- Source primaire
- Law 13,810/2019 arts. 14-18 and 27-32
09Records, audit and regulator accessRetention starts from the legally specified event and must support prompt reconstruction and production.4 éléments+
Law 9,613 sets a minimum five-year period from account closure or transaction completion, extendable by the competent authority.
- Action d’implémentation
- Attach the correct closure or completion trigger to each record class and apply longer sector periods where required.
- Preuves à conserver
- Retention schedule, trigger fields, legal holds, disposal approvals and deletion logs.
- Source primaire
- Law 9,613/1998 art. 10(2)
BCB Circular 3,978 requires core customer, beneficial-owner, transaction, analysis and communication records to be retained for ten years under its specified triggers.
- Action d’implémentation
- Map each Circular record to its ten-year trigger and make archived evidence searchable and readable.
- Preuves à conserver
- Record map, immutable archive, retrieval test, access log and disposal control.
- Source primaire
- BCB Circular 3,978/2020 art. 67
Obliged persons must answer lawful Coaf and supervisor requests in the form and period specified while preserving secrecy.
- Action d’implémentation
- Authenticate requests, collect responsive records, quality-check production and log secure delivery.
- Preuves à conserver
- Request, authority check, collection log, production set, approval and receipt.
- Source primaire
- Law 9,613/1998 art. 10(V); BCB Circular 3,978/2020 arts. 60-61
Effectiveness testing must identify weaknesses and drive documented remediation.
- Action d’implémentation
- Independently sample onboarding, ownership, PEP, monitoring, reporting, sanctions and retention controls and verify closure.
- Preuves à conserver
- Scope, independence record, samples, findings, action owners, deadlines and closure testing.
- Source primaire
- BCB Circular 3,978/2020 arts. 62-65; Coaf Resolution 36/2021
10Privacy, biometrics and international transfersAML processing must be reconciled with LGPD purpose, necessity, transparency, security and data-subject rights.4 éléments+
LGPD applies to covered personal-data processing and requires a documented legal basis, purpose limitation, necessity, transparency and accountability.
- Action d’implémentation
- Map every KYC field and processing purpose to an LGPD basis, minimize collection and document statutory-obligation processing separately from consent.
- Preuves à conserver
- Data inventory, purpose and basis register, notice, minimization review and rights procedure.
- Source primaire
- LGPD, Law 13,709/2018 arts. 3, 6-7 and 37
Biometric data linked to a natural person is sensitive personal data and must satisfy article 11's stricter grounds and safeguards.
- Action d’implémentation
- Complete a necessity and proportionality assessment, restrict biometric templates, test bias and spoofing controls and provide a safe exception route.
- Preuves à conserver
- Sensitive-data basis, assessment, template architecture, access logs, test results and alternative process.
- Source primaire
- LGPD arts. 5(II), 11 and 46
Where a security incident may cause relevant risk or damage to data subjects, the controller must notify ANPD and affected data subjects within three business days, unless specific legislation establishes another period.
- Action d’implémentation
- Record the controller-awareness timestamp, assess relevant risk or damage, and submit the required ANPD and data-subject communications within three business days.
- Preuves à conserver
- Security plan, incident register, awareness timestamp, impact assessment, ANPD and data-subject notices, receipts and remediation.
- Source primaire
- LGPD art. 48; Resolution CD/ANPD 15/2024 arts. 6 and 9
International transfers require an LGPD article 33 mechanism and compliance with ANPD Resolution 19/2024, including standard clauses where used.
- Action d’implémentation
- Map every cross-border transfer, select and implement the valid mechanism, update contracts and notices and control onward transfers.
- Preuves à conserver
- Transfer register, assessment, contract or standard clauses, notice, vendor diligence and onward-transfer controls.
- Source primaire
- LGPD arts. 33-36; Resolution CD/ANPD 19/2024
11Virtual assets and launch evidenceBrazil now has an operative BCB virtual-asset regime. Existing-provider transition and other financial, securities and exchange rules must be assessed separately.4 éléments+
Virtual-asset services within Law 14,478 and BCB Resolution 520 may be provided only by an authorized SPSAV or another institution expressly permitted by the BCB framework.
- Action d’implémentation
- Classify each exchange, transfer, custody or financial service, identify any CVM or exchange overlay and obtain the required BCB authorization before operating outside a valid transition.
- Preuves à conserver
- Service map, asset classification, legal opinion, application or authorization, restrictions and launch approval.
- Source primaire
- Law 14,478/2022 arts. 3-9; Decree 11,563/2023; BCB Resolution 520/2025 arts. 1-20
An SPSAV carrying on an activity listed in articles 7 or 9 when Resolution BCB 520 entered into force on 2 February 2026 must apply for authorization within 270 days of that date and comply with article 88's transitional conditions and information duties.
- Action d’implémentation
- Calculate the exact deadline, preserve evidence of pre-existing activity, submit under Resolution 519 and track every transition milestone and prudential commencement.
- Preuves à conserver
- Transition memo, activity evidence, application receipt, BCB correspondence, milestone tracker and contingency plan.
- Source primaire
- BCB Resolution 520/2025 art. 88; BCB Resolution 519/2025; IN BCB 713/2026
SPSAVs must apply the BCB AML/CFT/CPF framework and maintain governance, customer-protection, security, records and asset-segregation controls.
- Action d’implémentation
- Extend Circular 3,978 controls to virtual-asset data, wallets and counterparties; implement segregation, reconciliation and independent assurance required by Resolution 520.
- Preuves à conserver
- AML mapping, wallet screening, travel-data design, segregation policy, reconciliations, proof-of-reserves method and audit.
- Source primaire
- BCB Resolution 520/2025 arts. 29-30 and 85-92; BCB Circular 3,978/2020
A production launch must demonstrate that licensing, KYC/KYB, monitoring, reporting, sanctions, privacy, records and incident controls work end to end.
- Action d’implémentation
- Run controlled dry tests without sending fictional reports to Coaf or BCB, close defects and obtain legal, compliance, privacy, security and product sign-off.
- Preuves à conserver
- Completed checklist, source register, test scripts and results, defect closure, approvals and monitoring ownership.
- Source primaire
- Law 9,613/1998 arts. 9-12; BCB Circular 3,978/2020; LGPD arts. 6-7 and 46
Registre des sources primaires
25 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Law 9,613/1998 - current consolidated AML lawPresidencia da Republica · Primary legislation
- Coaf duties for obliged personsConselho de Controle de Atividades Financeiras · Official FIU guidance
- Coaf Resolution 36/2021Conselho de Controle de Atividades Financeiras · Primary regulatory instrument
- Coaf Resolution 41/2022Conselho de Controle de Atividades Financeiras · Primary regulatory instrument
- Siscoaf reporting systemConselho de Controle de Atividades Financeiras · Official reporting channel
- BCB Circular 3,978/2020 - current compiled textBanco Central do Brasil · Primary regulatory instrument
- Law 13,810/2019 - UN sanctions implementationPresidencia da Republica · Primary legislation
- UN Security Council Consolidated ListUnited Nations Security Council · Official sanctions list
- IN RFB 2,119/2022 - current annotated CNPJ and beneficial-owner ruleReceita Federal do Brasil · Primary regulatory instrument
- e-BEF beneficial-owner manual v2.0, April 2026Receita Federal do Brasil · Current official registry guidance
- CNPJ consultation serviceReceita Federal do Brasil · Official company register
- Law 12,865/2013 - payment arrangements and institutionsPresidencia da Republica · Primary legislation
- BCB Resolution 80/2021 - payment institutionsBanco Central do Brasil · Primary regulatory instrument
- BCB Resolution 81/2021 - payment authorizationBanco Central do Brasil · Primary regulatory instrument
- Law 14,478/2022 - virtual-asset servicesPresidencia da Republica · Primary legislation
- Decree 11,563/2023 - BCB virtual-asset authorityPresidencia da Republica · Primary decree
- BCB Resolution 519/2025 - SPSAV authorizationBanco Central do Brasil · Primary regulatory instrument
- BCB Resolution 520/2025 - SPSAV operationBanco Central do Brasil · Primary regulatory instrument
- IN BCB 713/2026 - existing SPSAV transition reportingBanco Central do Brasil · Primary regulatory instrument
- LGPD - Law 13,709/2018Presidencia da Republica · Primary legislation
- ANPD international data-transfer regulationAutoridade Nacional de Protecao de Dados · Primary regulatory instrument
- ANPD security-incident communication regulation and official guidanceAutoridade Nacional de Protecao de Dados · Official regulator guidance
- FATF Brazil country and assessment pageFinancial Action Task Force · Official international assessment
- FATF jurisdictions under increased monitoring, 19 June 2026Financial Action Task Force · Official current-status source
- FATF high-risk jurisdictions subject to a call for action, 19 June 2026Financial Action Task Force · Official current-status source
Réponses directes
Questions KYC, KYB et AML pour Brésil
Who receives suspicious transaction reports in Brazil?+
Coaf is Brazil's FIU. Obliged persons submit through Siscoaf or the route prescribed by their sector supervisor.
What is the suspicious-reporting deadline?+
Apply the exact sector rule. Law 9,613 uses a 24-hour requirement for covered proposals or transactions; BCB Circular 3,978 requires a report by the next business day after the institution decides to communicate, following an analysis period capped at 45 days.
Is there a universal cash-report threshold?+
No. Threshold reports are sector-specific. BCB Circular 3,978 requires specified cash reports from R$50,000, but other supervisors may define different events and fields.
What beneficial-owner threshold applies?+
The test depends on purpose. BCB institutions set a risk-based reference percentage not above 25% and must consider control. The separate current CNPJ rule uses more than 25% capital or voting rights or other preponderant control for covered entities.
How long are AML records retained?+
Law 9,613 establishes a five-year minimum from account closure or transaction completion and allows extension. BCB Circular 3,978 requires ten years for its principal customer, ownership, transaction, analysis and reporting records under specified triggers.
Are UN sanctions immediately effective?+
Yes. Law 13,810 makes applicable UN Security Council measures immediately enforceable and defines without delay as immediately or within hours.
Does a payment company need BCB authorization?+
Often yes, depending on the modality and current transition. Classify the service under Law 12,865 and the current BCB Resolutions 80 and 81 before operating.
Are virtual-asset providers regulated?+
Yes. Law 14,478 and BCB Resolutions 519 and 520 establish authorization and operating rules. Resolution 520 took effect on 2 February 2026 and includes a 270-day application transition for providers already operating on that date.
Can AML data be processed without LGPD controls?+
No. A legal obligation can support necessary processing, but purpose, necessity, security, transparency, rights handling and transfer controls remain relevant; biometrics receive sensitive-data protection.
Is Brazil on a FATF public list?+
Brazil was not named on the FATF increased-monitoring or call-for-action lists reviewed 1 August 2026. Its FATF/GAFILAT mutual-evaluation findings should still inform country and control risk.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice, an authorization decision or a substitute for the operative Portuguese text, sector rules, official reporting manuals or regulator instructions. Reviewed 1 August 2026. Confirm the entity, activity, customer, transaction, reporting route, threshold, transitional status and later developments with qualified Brazilian counsel and the competent authority before launch.