KYB in Brazil: How to Verify a Company with the CNPJ

Introduction

KYB in Brazil starts with the CNPJ (Brazil's company taxpayer ID). From that one number you can confirm that the company exists, check whether its registration is active, see what it does and list its partners and officers. Then you verify the people: the legal representative who opens the account and, for regulated businesses, the beneficial owners. A Brazilian KYB flow is those two halves, company and people, joined by the partner list.

This guide walks through each step, the red flags worth automating and how to run the checks with an API.

Why KYB matters in Brazil

Two groups of companies need KYB in Brazil:

• Regulated institutions. Banks, payment companies and crypto service providers authorized by the Banco Central do Brasil must identify and qualify their customers, including legal entities and their beneficial owners, under Circular 3,978/2020. Other sectors covered by Brazil's anti-money laundering law have similar duties set by their regulators.
• Platforms that pay or sell to businesses. Marketplaces onboarding sellers, procurement teams paying suppliers and B2B platforms extending credit all lose money when a company is fake, closed or controlled by someone other than the person signing up. Brazil's Clean Company Act (Law 12,846/2013) also makes third-party due diligence a normal part of compliance programs.

Exact obligations depend on your sector, so confirm them with Brazilian counsel.

Step 1: collect and validate the CNPJ

Ask for the CNPJ in its own field, separate from the CPF (Brazil's individual taxpayer ID). Normalize it to uppercase without punctuation, and accept letters: since July 2026 the Receita Federal (Brazil's federal tax authority) issues alphanumeric CNPJs to some new registrations. The two check digits catch typos before any lookup.

If the difference between the two numbers is new to you, start with CPF vs CNPJ.

Step 2: look up the company record

The CNPJ registry is public. With CPFHub.io, the CNPJ Lookup returns it as JSON:

curl --max-time 10 \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  https://api.cpfhub.io/cnpj/11222333000181

The fields that matter most for KYB:

The data comes from the Receita Federal's public CNPJ dataset, refreshed monthly. A CNPJ that is not found returns 404 and does not use a credit. Full reference in the CNPJ documentation.

Step 3: check the red flags

Automate the checks that send an application to review:

• Status other than active. Anything other than Ativa (suspended, unfit, closed, void) is a stop or a review.
• Name mismatch. The legal or trade name does not match what the applicant typed or what appears on their invoices.
• Very recent opening date. A company opened weeks ago that claims years of trading history deserves a second look.
• Activity mismatch. The CNAE codes have nothing to do with what the company says it sells.
• Branch instead of head office. Not a problem by itself, but make sure you group branches by the 8-character root and apply your limits per company.
• MEI with business volume. An individual micro-entrepreneur has a revenue cap under the Simples Nacional. Volumes far above it suggest the CNPJ is a front.

A minimal server-side check in Python:

import os
import requests

def check_company(cnpj: str) -> dict:
    response = requests.get(
        f"https://api.cpfhub.io/cnpj/{cnpj}",
        headers={"x-api-key": os.environ["CPFHUB_API_KEY"], "Accept": "application/json"},
        timeout=10,
    )
    if response.status_code == 404:
        return {"decision": "reject", "reason": "cnpj_not_found"}  # no credit used
    response.raise_for_status()
    company = response.json()["data"]

    flags = []
    if company["situacao_cadastral"] != "Ativa":
        flags.append("status_" + company["situacao_cadastral"].lower())
    if company.get("opcao_mei") == "S":
        flags.append("mei")
    return {"decision": "review" if flags else "continue", "flags": flags, "partners": company.get("QSA", [])}

Step 4: verify the people behind the company

A valid, active CNPJ does not tell you who is typing. Three groups of people matter:

1. The legal representative who opens the account. Check that the name appears in the QSA with a role that can represent the company, such as an administrator.
2. The beneficial owners. Regulated institutions must identify the individuals who ultimately own or control the company. The QSA is the starting point, but when a partner is another company you have to follow the chain up.
3. The person in front of the screen. Verify the representative's CPF with a CPF lookup, which returns the holder's name, gender and date of birth, and for higher-risk accounts add document and selfie checks with Identity Verification.

The partner's CPF comes masked in the CNPJ record, so you match on the name and then ask the representative for their own CPF to verify.

Step 5: screening and monitoring

Identity is only part of KYB. According to your risk policy, add sanctions and PEP screening for the company and its owners, and recheck the CNPJ periodically: a company that was active at onboarding can be suspended or closed later. The bulk CNPJ lookup takes up to 10,000 CNPJs per request, which makes a monthly portfolio review practical.

Frequently asked questions

What is the minimum KYB check for a Brazilian company?

Look up the CNPJ, confirm that the status is active and that the name matches, and verify the CPF of the person opening the account. Regulated institutions add beneficial owner identification, screening and monitoring.

Does the CNPJ record show the beneficial owner?

It shows the partners and officers in the QSA. When a partner is a company, the record does not show who controls that company, so you look up its CNPJ in turn or ask for the ownership structure.

Can I get a partner's full CPF from a CNPJ lookup?

No. The CPF of an individual partner always comes back masked. Ask the representative for their CPF and verify it with a CPF lookup.

How often should I recheck a company?

It depends on your risk policy. Many teams recheck the CNPJ status before large payments and run a periodic batch review of the whole portfolio, since the registration data is refreshed monthly.

Read also

• CNPJ vs EIN: How to Verify a Brazilian Company (for US Teams)
• CPF vs CNPJ: Brazil's Individual and Company Tax IDs Explained
• Brazil KYC Requirements in 2026: What Foreign Companies Need to Know
• KYC for Crypto Exchanges in Brazil: The Banco Central VASP Rules

Conclusion

KYB in Brazil is a company check plus a people check. The CNPJ record answers whether the company exists, is active and does what it says, and lists who is behind it. The CPF lookup and, when the risk calls for it, document and selfie verification confirm that the person opening the account is one of them.

Run CNPJ and CPF lookups with 50 free credits and no credit card at cpfhub.io.