# Brazil KYC Requirements in 2026: What Foreign Companies Need to Know > The rules behind KYC in Brazil for fintechs, crypto exchanges and platforms, what Brazilian identity data you can check and how to build a compliant flow. **Published:** November 13, 2026 **Author:** Lucas Vieira **URL:** https://www.cpfhub.io/en/blog/brazil-kyc-requirements --- ## Introduction Brazil is one of the largest digital markets in the world, with a huge base of users paying by Pix, trading crypto and shopping online. It also has its own identity system and its own regulators. A KYC flow designed for Europe or the United States will not fit Brazilian users without changes. This guide gives foreign compliance and product teams an overview of the rules that shape KYC in Brazil, the identity data available, and how a typical Brazilian onboarding flow is built. It is a practical overview, not legal advice: confirm your specific obligations with Brazilian counsel. --- ## The identity building blocks Every KYC flow in Brazil starts with two identifiers: - **CPF** (Brazil's individual taxpayer ID): one lifelong number per person, issued by the [Receita Federal](https://www.gov.br/receitafederal/pt-br/assuntos/orientacao-tributaria/cadastros/cpf) (Brazil's federal tax authority). It is the key that ties a customer to their bank accounts, Pix transfers and documents. See [What Is a Brazilian CPF?](/en/blog/what-is-a-brazilian-cpf) - **CNPJ** (Brazil's company taxpayer ID): the equivalent for companies, central to KYB. The main identity documents are the **RG** (state identity card, being replaced by the new national identity card, which uses the CPF as its number) and the **CNH** (driver's license, which also shows the CPF). Foreign residents use the **RNM** (national migration registry card). --- ## The rules that shape KYC in Brazil ### Anti-money laundering law Brazil's anti-money laundering law ([Law 9,613/1998](https://www.planalto.gov.br/ccivil_03/leis/l9613.htm)) requires regulated sectors to identify customers, keep records and report suspicious transactions to [**COAF**](https://www.gov.br/coaf/pt-br), Brazil's financial intelligence unit. Sector regulators detail what this means for each industry. ### Financial institutions and payment companies For institutions authorized by the **Banco Central do Brasil**, [Circular 3,978/2020](https://www.bcb.gov.br/estabilidadefinanceira/exibenormativo?tipo=Circular&numero=3978) sets the anti-money laundering and counter-terrorist financing policy: customer identification and qualification, risk-based assessment, monitoring and reporting. In practice, onboarding collects and verifies the CPF, name, date of birth and address, plus additional checks for higher-risk customers, such as politically exposed persons (PEPs). ### Crypto exchanges (virtual asset service providers) Since February 2026, the Central Bank framework for virtual asset service providers (Resolutions BCB 519, [520](https://www.bcb.gov.br/estabilidadefinanceira/exibenormativo?tipo=Resolu%C3%A7%C3%A3o%20BCB&numero=520) and 521, published in November 2025) brings crypto companies under authorization and supervision, including customer identification and AML controls. Foreign platforms serving Brazilian customers must be authorized or work through an authorized local entity. Application deadlines and transition periods have their own dates, so check the current status with counsel. ### Other regulated sectors Betting operators, insurers, securities intermediaries and real estate professionals have their own identification duties set by their regulators. Rules for online betting in particular have changed several times since 2023, so confirm the rules in force before designing that flow. ### Data protection: the LGPD The **LGPD** (Brazil's data protection law, [Law 13,709/2018](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm)) applies to any company processing personal data of people in Brazil, wherever the company is based. For KYC, the relevant points are: - **Legal basis.** Compliance with a legal or regulatory obligation and fraud prevention are the usual bases for identity checks. - **Biometric data is sensitive data.** Selfies and face matching need a specific legal basis, and fraud prevention in identification and authentication is one of them. - **Transparency and retention.** Tell users what you check and why, and keep data only as long as needed. The regulator is the [**ANPD**](https://www.gov.br/anpd/pt-br) (Brazil's national data protection authority). How CPFHub.io handles data is described on the [security and compliance page](/en/security-compliance). --- ## What a Brazilian KYC flow looks like A typical onboarding for a fintech, exchange or high-risk platform combines four layers: | Layer | What it checks | How | |---|---|---| | 1. CPF validation | The number is well formed | Check digit algorithm in the form | | 2. CPF lookup | The CPF exists and matches the name and date of birth | Registry lookup API | | 3. Registration status | The CPF is regular at the Receita Federal, and the holder is alive | Real-time query to the Receita Federal | | 4. Document and biometrics | The person holds a genuine document and is present | Document reading, liveness and face match | Lower-risk flows (a marketplace buyer, a delivery customer) often stop at layer 2. The [CPF verification guide](/en/blog/how-to-verify-a-brazilian-cpf) shows layers 1 to 3 with code. Regulated onboarding uses all four, plus PEP and sanctions screening according to the risk policy. --- ## How CPFHub.io fits [**CPFHub.io**](/en) covers layers 2 to 4 with one API key: - **Simple Lookup** (`GET /cpf/{cpf}`): name, gender and date of birth for a CPF. A CPF that is not found does not use a credit. - **Real-Time Lookup** (`POST /cpf/realtime`): registration status at the Receita Federal, year of death when there is one, and the proof issued by the Receita Federal. Requires the CPF and the date of birth. - [**Identity Verification**](/en/identity-verification): liveness, face match between selfie and document, and document reading for RG, CNH and passport. - [**CNPJ Lookup**](/en/cnpj-lookup-api): company data for KYB. ```bash curl --max-time 10 \ -H "x-api-key: YOUR_API_KEY" \ -H "Accept: application/json" \ https://api.cpfhub.io/cpf/00000000000 ``` --- ## Frequently asked questions ### Is KYC mandatory in Brazil? For regulated sectors, yes. Financial institutions, payment companies, crypto service providers, betting operators and other sectors covered by [Law 9,613/1998](https://www.planalto.gov.br/ccivil_03/leis/l9613.htm) must identify their customers. Other platforms are not always required to, but most verify the CPF at signup to prevent fraud. ### Does the LGPD apply to a company based outside Brazil? Yes, when it processes personal data of people in Brazil or offers services to them. The [LGPD](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm) applies regardless of where the company is based. ### Can foreign crypto exchanges serve Brazilian customers? Under the Central Bank framework for virtual asset service providers, they must be authorized or work through an authorized local entity. Deadlines and transition rules have their own dates, so confirm the current status with Brazilian counsel. ### Do I need biometrics for KYC in Brazil? Not in every flow. Regulated onboarding usually adds document and selfie checks to the CPF lookup, based on the risk policy. Under the LGPD, biometric data is sensitive data and needs a specific legal basis, such as fraud prevention. --- ### Read also - [What Is a Brazilian CPF? A Guide for Foreign Companies](/en/blog/what-is-a-brazilian-cpf) - [How to Verify a Brazilian CPF Number](/en/blog/how-to-verify-a-brazilian-cpf) - [Brazil Identity Verification API: What Data You Can Get from a CPF](/en/blog/brazil-identity-verification-api) ## Conclusion KYC in Brazil rests on the CPF, sector rules from regulators such as the Banco Central do Brasil, and the LGPD for everything involving personal and biometric data. Foreign companies that build their flow around these pieces, with CPF verification at signup and document checks where the risk requires them, onboard Brazilian users faster and with fewer surprises. Try the API with 50 free credits and no credit card at [cpfhub.io](/en).