Brazil
Brazil's AML rules are national. Banco Central do Brasil licenses and supervises banks, payment institutions and, since February 2026, crypto providers, under one KYC rulebook anchored on the CPF taxpayer number, while SUSEP supervises insurers. Suspicious and threshold reports go to COAF, the financial intelligence unit. Remote onboarding is permitted and no biometric method is prescribed, while telecoms, healthcare, travel and public services follow their own identity rules.
Compliance guides by industry
More countries in this region
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
The AML law, Law 9.613/1998, sets the duties and each sector's supervisor writes the detail. Banco Central do Brasil supervises banks, payment institutions and crypto providers, SUSEP supervises insurers and brokers, and the Prizes and Betting Secretariat oversees lottery operators. The Council for Financial Activities Control (COAF), the financial intelligence unit, receives reports and supervises sectors without their own regulator, such as sellers of high-value goods.
Yes, in most sectors. Banks and payment institutions may open accounts through apps and websites, though not by voice telephone, and insurance can be sold and signed online. Identity must be verified and validated, including against databases, but no document or biometric method is prescribed. Hotels, however, must check guests' documents in person, and from 2027 mobile operators need face matching with liveness.
Suspicious operations in every obliged sector, plus threshold reports that vary by sector. Banco Central do Brasil's institutions report cash operations of R$50,000 or more and, since 1 October 2026, foreign-currency cash and self-hosted crypto wallet transfers of US$10,000 or more. Insurers report cash premiums of R$10,000 or more, and sellers of high-value goods cash of R$30,000 or more within six months.
Not always. Biometric data are sensitive under the data protection law (LGPD), but may be processed without consent where indispensable to prevent fraud in electronic identification and authentication, or to meet a legal obligation. Otherwise specific, highlighted consent is required. The National Data Protection Agency (ANPD) can fine up to 2% of Brazilian turnover, capped at R$50 million per infringement.
Mobile operators, healthcare and telehealth providers, travel businesses, public bodies and general online retailers are not obliged persons. Their identity duties come from sector rules instead, such as ANATEL's biometric standard, medical ethics rules, the FNRH Digital guest register and gov.br assurance levels. Travel firms that trade foreign currency, and retailers selling goods of R$10,000 or more per item, are covered.