Introduction
If your company is opening accounts, processing payments or shipping orders to people in Brazil, you will run into one identifier over and over again: the CPF. Banks ask for it, marketplaces ask for it, payment providers ask for it, and so does every serious KYC flow.
For teams based outside Brazil, the CPF can look like just another national ID. It is more central than that. This guide explains what the CPF is, how the number is built, where Brazilian companies use it and what a foreign company needs to know before collecting and verifying it.
What the CPF is
CPF stands for Cadastro de Pessoas Físicas, the individual taxpayer registry run by the Receita Federal (Brazil's federal tax authority). Every person registered in it gets a unique CPF number for life.
In practice, the CPF works as Brazil's de facto national identifier:
- One number per person. It does not change when someone moves, marries or renews a document.
- Required for daily life. Opening a bank account, getting a phone line, receiving a Pix transfer, signing a lease or buying online with an invoice all require a CPF.
- Printed on the main ID documents. The CPF appears on the driver's license (CNH) and on the new national identity card, which uses the CPF as its number.
Foreigners can also have a CPF. Anyone with tax obligations in Brazil, a Brazilian bank account or property in the country needs one (the Receita Federal explains how to register), so a CPF does not always mean a Brazilian citizen.
The company equivalent is the CNPJ (Brazil's company taxpayer ID), used for businesses, sellers and suppliers. CPFHub.io also offers a CNPJ lookup API.
Is the CPF the Brazilian Social Security Number?
For a US team, the closest comparison is the Social Security Number (SSN). Both are lifelong numbers that tie a person to taxes, banking and credit, and the IRS accepts the SSN as a taxpayer identification number, much like the CPF works for the Receita Federal. The differences matter when you design a signup flow:
| CPF (Brazil) | SSN (United States) | |
|---|---|---|
| Issued by | Receita Federal (tax authority) | Social Security Administration |
| Digits | 11, the last 2 are check digits | 9, no check digits |
| How private it is | Asked for routinely at checkout, printed on ID cards and invoices | Treated as confidential and rarely shared |
| Foreigners | Can get a CPF if they have tax, banking or property ties to Brazil | Usually get an ITIN instead |
| Company equivalent | CNPJ | EIN |
The practical consequence: Brazilian users expect to type their CPF in a signup or checkout form, so asking for it is normal in Brazil in a way that asking for an SSN is not in the US. Because the number is so widely shared, though, knowing someone's CPF proves very little. Verifying that the name and date of birth match is what stops fraud.
How a CPF number is built
A CPF has 11 digits, usually written as 000.000.000-00:
- The first 8 digits are the base number.
- The 9th digit indicates the tax region where the CPF was issued.
- The last 2 digits are check digits, calculated from the first nine with a modulo 11 algorithm.
The check digits catch typos. They do not prove that the CPF exists or belongs to the person in front of you. Anyone can generate a number that passes the algorithm, which is why sequences like 111.111.111-11 are explicitly rejected and why fraud teams never stop at the checksum.
Where companies use the CPF
| Use case | Why the CPF matters |
|---|---|
| Fintech and payments | Account opening requires the CPF, and the CPF is the most common Pix key. Brazilian anti-money laundering rules (Circular 3,978/2020) expect customer identification. |
| Crypto exchanges | Brazil's Central Bank framework for virtual asset providers requires knowing the customer. |
| E-commerce and marketplaces | Invoices (NF-e) and many payment methods require the buyer's CPF. Sellers are identified by CPF or CNPJ. |
| Delivery and mobility apps | Couriers and drivers are onboarded with their CPF. |
| HR and payroll | Hiring in Brazil requires the employee's CPF. |
If your product serves Brazilian users, the CPF will be the field that ties a person to everything else in your records.
What a foreign company should know
1. Collect the CPF early and verify it. Asking for the CPF at signup is normal for Brazilian users. Verifying it against registry data at that moment stops fake and borrowed identities before they reach your payment or payout flows.
2. The checksum is not verification. Validate the format and check digits in the frontend for user experience, then confirm on the backend that the CPF exists and matches the name and date of birth the user typed. The step-by-step guide shows how.
3. The CPF is personal data under the LGPD. The LGPD (Brazil's data protection law) applies to companies processing data of people in Brazil, even when the company is abroad. You need a legal basis to process the CPF (fraud prevention and legal obligations are the common ones), a clear privacy notice and sensible retention.
4. Use the CNPJ for businesses. If you onboard sellers, merchants or suppliers, the CNPJ tells you whether the company exists and is active, which is the core of KYB in Brazil.
How to verify a CPF with an API
With CPFHub.io, a CPF lookup is a single GET request. The Simple Lookup returns the holder's name, gender and date of birth so you can compare them with what the user typed:
curl --max-time 10 \
-H "x-api-key: YOUR_API_KEY" \
-H "Accept: application/json" \
https://api.cpfhub.io/cpf/00000000000
{
"success": true,
"data": {
"cpf": "00000000000",
"name": "Fulano de Tal",
"nameUpper": "FULANO DE TAL",
"gender": "M",
"birthDate": "15/06/1990",
"day": 15,
"month": 6,
"year": 1990
}
}
A CPF that is not found does not use a credit. When you also need the registration status from the Receita Federal, the Real-Time Lookup returns it, using the CPF and the holder's date of birth. The documentation covers both.
Frequently asked questions
Can a foreigner get a CPF?
Yes. Foreigners with tax obligations, a bank account or property in Brazil need a CPF, and they can register through the Receita Federal, including at Brazilian consulates abroad. See the official registration page (in Portuguese).
Is the CPF the same as a national ID card?
Not exactly. The CPF is a taxpayer number, while the RG and the CNH are identity documents. In practice the CPF works as the national identifier, and the new national identity card uses the CPF as its number.
Does a valid CPF number mean the person is real?
No. The check digits only show that the number is well formed. To know that the CPF exists and belongs to your user, compare the name and date of birth returned by a registry lookup, such as the CPFHub.io CPF validation API.
Can I check a CPF status on the Receita Federal website?
Yes, one at a time: the Receita Federal has a public status page that asks for the CPF, the date of birth and a captcha. For signup flows and batches, use an API such as the CPFHub.io Real-Time Lookup.
Read also
- How to Verify a Brazilian CPF Number
- Brazil KYC Requirements in 2026: What Foreign Companies Need to Know
- Brazil Identity Verification API: What Data You Can Get from a CPF
Conclusion
The CPF is the backbone of identity in Brazil: one lifelong number per person, required for banking, payments, e-commerce and work. For a foreign company, getting it right means collecting it at signup, verifying it against real data instead of trusting the checksum, and treating it as personal data under the LGPD.
You can test CPF verification with 50 free credits and no credit card at cpfhub.io.
CPFHub.io
Ready to integrate the API?
50 free credits to test now. No credit card. Instant access to the documentation.
