When building products in Brazil, verifying a business counterpart usually means paying for Serasa/SPC reports or hiring a due diligence firm. But most of what you actually need is already free.
Here's what the Brazilian government publishes openly — and how to use it.
The dataset
Brazil's Receita Federal (IRS equivalent) maintains the CNPJ registry — a database of every registered company in the country. It's public by law and updated monthly.
Stats:
- 65.7M total registrations
- 17M currently active
- 27M partner/director records (QSA)
- 1,300+ CNAE economic activity codes
What you get for free
For every company:
{
razao_social: "EMPRESA XYZ LTDA",
situacao: "ATIVA", // or BAIXADA, SUSPENSA, INAPTA
data_abertura: "2019-03-15",
cnae_principal: "6201-5/01", // Software development
endereco: {
logradouro: "Rua das Flores, 123",
municipio: "São Paulo",
uf: "SP",
cep: "01310-100"
},
qsa: [
{
nome: "João Silva",
qualificacao: "Sócio-Administrador",
data_entrada: "2019-03-15"
}
],
telefone: "(11) 99999-9999",
email: "contato@empresa.com.br"
}
Practical checks before onboarding a Brazilian company
1. Situação cadastral
Any company that's INAPTA or BAIXADA cannot legally issue invoices. If your payment flow accepts invoices from cancelled CNPJs, you have a compliance problem.
2. CNAE vs claimed activity
The CNAE code tells you what the company is legally registered to do. If someone's selling software but their CNAE is "wholesale trade of cereals", that's worth a question.
3. QSA cross-reference
The partner list lets you check if a counterpart's director also runs companies with bad history. One lookup by partner name surfaces all their other companies.
4. Capital social
A company offering R$1M contracts with R$1K in stated capital is a yellow flag for credit or payment terms.
How to access it
Quickest way without parsing raw dumps: Jurídico Online — search by CNPJ or company name, get structured results instantly. Free.
For bulk access: Receita Federal publishes monthly CSV dumps at dados.gov.br (~7GB). You can also use Brasil.io's API for programmatic lookups.
What it doesn't cover
- Debts (need SPC/Serasa for that)
- Court cases (use Jusbrasil)
- Beneficial ownership beyond QSA
- Real-time status changes (monthly update cycle)
This is often enough for basic KYC. If you're building fintech, lending, or procurement products in Brazil, it's worth integrating before you reach for paid solutions.
Happy to share more about the data structure if useful.
