Insurance & Insurtech Compliance in Brazil

Brazil's insurance market is open to digital distribution. Remote contracting is governed by a dedicated CNSP rule (Resolution 408/2021), and the regulator runs a regulatory sandbox and an Open Insurance data-sharing system. The market is changing quickly: a new insurance contract law took effect in December 2025, detailed rules for insurance cooperatives and mutual protection schemes took effect in May 2026, and the AML framework is being replaced in January 2027.

SUSEP authorises and supervises insurers and brokers and enforces the AML rules for the sector. The National Council of Private Insurance (CNSP) sets policy and issues the main resolutions. COAF receives suspicious activity reports, and the National Data Protection Agency (ANPD) enforces data protection law.

The biggest obstacle for a new entrant is authorisation itself: an insurtech without its own SUSEP authorisation must work through an authorised insurer, which stays responsible for compliance, or obtain a temporary authorisation through the regulatory sandbox.

1. Who regulates this sector

Insurance broker self-regulatory entities may also register brokers and apply penalties under rules set by the CNSP (Decree-Law 73, arts. 123 and 128).

2. Licensing and authorisation

Under the Private Insurance Decree-Law (Decreto-Lei nº 73, de 21 de novembro de 1966, art. 24, as amended by Lei Complementar nº 213/2025), only joint-stock companies or cooperatives previously authorised by SUSEP may operate in private insurance. Authorisation is requested from SUSEP following the procedure and requirements set by the CNSP (art. 74), and the company then has 90 days to prove it has met the formalities before SUSEP issues the operating authorisation (arts. 75 and 76).

Complementary Law 213/2025 opened two new routes. Insurance cooperatives may now write a broad range of cover, and mutual protection (proteção patrimonial mutualista), widely used for vehicle cover, must be run through SUSEP-authorised administrators. CNSP Resolutions 491 and 492 of 2026 regulate both and have applied since publication on 6 May 2026.

Brokers and distribution partners

A broker is the intermediary legally authorised to place insurance contracts (Decree-Law 73, art. 122), and practising requires prior qualification and registration with a broker self-regulatory entity or with SUSEP (art. 123). CNSP Resolution 493/2026 consolidates broker, self-regulatory entity and training-provider rules and takes effect 180 days after its 21 July 2026 publication [Adopted, effective 180 days after 21 Jul 2026]. In embedded and partner models the authorised insurer remains responsible; stipulants, insurance representatives and capitalisation distributors are "other related parties" whose risk must be assessed (Circular SUSEP 612/2020, art. 3, VIII).

Operating without authorisation

Writing insurance, reinsurance, capitalisation or mutual protection without prior SUSEP authorisation brings the Decree-Law's penalties increased up to threefold (art. 113).

3. AML, KYC and customer due diligence

Insurers, insurance brokers, open pension entities and capitalisation companies are obliged persons under the AML law (Lei nº 9.613, de 3 de março de 1998, art. 9, sole paragraph, II). The obligation attaches to the entity, not only to life or investment products, and SUSEP's rules cover all products it supervises. SUSEP issues the sector instructions; today that is Circular SUSEP nº 612/2020, in force since 3 May 2021, which Resolução Susep nº 99/2026 replaces on 1 January 2027 [Adopted, effective 1 Jan 2027].

Who is covered

Insurers, capitalisation companies, local and admitted reinsurers, open pension entities, SUSEP-authorised cooperatives, reinsurance brokers and insurance brokers, plus their foreign branches (Circular 612, art. 2). From 2027 it expressly names insurance cooperatives and adds mutual protection administrators, client order processors (SPOC) and special-purpose insurers (Resolution 99, art. 2).

Know your customer

Identification, qualification (including income or turnover to assess financial capacity) and risk classification of clients, beneficiaries, third parties and beneficial owners, documented in a manual approved by the executive board and held in IT systems (arts. 16 to 24).

Beneficial ownership

Identify natural persons who own, control or significantly influence a legal entity; holding more than 25% of capital creates a presumption of significant influence (art. 3, IX and sole paragraph). Where the beneficial owner cannot be identified, reinforced monitoring applies (art. 32, III).

Politically exposed persons

Check PEP status, family members and close associates using public information or PEP databases regardless of a negative self-declaration (art. 23); in higher-risk cases PEP relationships need senior approval and source-of-funds checks (art. 32); the whole customer base is reviewed for new PEPs at least annually (art. 33).

Reporting to COAF

Suspicious proposals or operations go to COAF within 24 hours of concluding the analysis, without tipping off (Lei 9.613, art. 11; Circular 612, art. 35, §§ 2 and 4). Two categories are reported automatically, without analysis: premiums, contributions or capitalisation purchases paid in cash of R$ 10,000 or more, and redemptions, claims or prize payments to an account abroad of R$ 100,000 or more (art. 35, § 5). Firms with nothing to report file an annual nil report by the last business day of March (art. 37). Reports go through Siscoaf.

Records

Customer records and transaction records must be kept for at least five years from the end of the relationship or completion of the transaction (Lei 9.613, art. 10, § 2), and insurers must keep records of all operations and payments, identifying the beneficial owner (Circular 612, art. 31).

What changes in January 2027

Resolution 99/2026 adds proliferation financing and three diligence levels set through the firm's risk assessment (art. 13, § 3); the AML director may authorise simplified procedures for lower-risk customers resident in Brazil or in countries without strategic deficiencies, under criteria in the firm's policy (art. 20). Under standard and simplified diligence, verification may be lighter but the minimum identification of the customer or beneficial owner may never be waived (art. 21, § 2); enhanced diligence requires senior approval plus additional information, where available, on identity, beneficial owner, structure and source of funds (art. 33). Firms may rely on checks by another institution in the same conglomerate or cooperative system, without transferring responsibility (art. 17). The automatic reporting thresholds are unchanged (art. 36, § 4); the annual nil report goes to COAF (art. 38).

4. Identity verification and onboarding

The minimum identification data today are, for individuals, full name, CPF taxpayer number and residential address; for companies, name, CNPJ number, registered office address and the individual data of controllers up to natural-person level, principal managers, attorneys and beneficial owners (Circular 612, art. 20, § 3). Non-residents exempt from the CPF may be identified by travel document (issuing country, number and type); foreign companies by name, address and home-country registration number (§§ 4 and 5). From 1 January 2027 address leaves the minimum identification set (Resolution 99/2026, art. 21, § 3) but remains relevant to qualification; the timing rules below carry over unchanged (art. 26).

Firms must obtain, verify and validate identification data, including against public and private databases (art. 20, § 1), to a depth set by risk (§ 2). No document type, biometric check or assurance level is prescribed; the firm chooses and justifies the method in its risk assessment.

Timing: before the contract and before every payout

Registration must be completed before the business relationship starts; if that is impossible it may follow later, but only on the basis of the internal risk assessment (art. 25, § 1). Beneficiaries, third parties or beneficial owners who enter the relationship after contracting must be registered before any financial settlement (art. 25, § 2). PEP status is re-checked on cancellation with premium refund, claim or benefit payment, renewal, and redemption or capitalisation draws if more than six months have passed since the last base review (art. 34).

Third parties and co-insurance

Insurers may use compliant registration data held by contracted banks, stipulants, representatives or database providers, but remain responsible (art. 27). Group companies may share a register (art. 28); in co-insurance the lead insurer keeps records (art. 29).

5. Digital channels: what's different

Bottom line: the customer due diligence rules are channel-neutral, but a remote sale must meet CNSP Resolution 408/2021's requirements for authenticated, tamper-evident acceptance, retrievable documents and an exit through the same channel.

Remote contracting under CNSP Resolution 408/2021

Proposals may be formalised by a secure remote means accepted by the parties, provided it is authenticated and proves authorship and integrity (art. 5); ticket policies (bilhetes) may be contracted remotely (art. 6). Remote operations must guarantee integrity, authenticity, non-repudiation and confidentiality (art. 3, I), and clients receive instructions for secure access to their documents (art. 7). Later requests needing express consent or signature meet the same standard (art. 8, § 3). The rules bind intermediaries too (art. 9).

Same channel in, same channel out

A remotely contracted policy must be cancellable through the same means, or an equivalent remote means if that channel is discontinued (art. 8, §§ 1 and 2).

New technology needs an AML risk review

The AML policy must include prior assessment of new products, services and new technologies (Circular 612, art. 6, I, b), and the internal risk assessment must cover all distribution channels (art. 13, § 1, IV). Remote onboarding is not automatically high risk; the firm's assessment decides, informed by SUSEP's risk lists once SUSEP publishes them.

6. Data protection and biometrics

The Brazilian Data Protection Law (LGPD, Lei nº 13.709/2018) treats biometric data as sensitive (art. 5, II). Sensitive data may be processed with specific, highlighted consent, or without consent where indispensable for a legal obligation or for fraud prevention in electronic identification and authentication (art. 11, I and II, a and g). Facial comparison or liveness checks at onboarding or claims therefore have a non-consent basis, subject to data subjects' rights. ANPD fines reach 2% of Brazilian turnover, capped at R$ 50 million per infringement (art. 52, II).

Open Insurance data sharing between institutions, by contrast, requires the customer's prior electronic consent for specified purposes.

7. Sector-specific obligations

Claims handling under the new insurance contract law

The insurance contract law (Lei nº 15.040, de 9 de dezembro de 2024) took effect on 11 December 2025, one year after publication (art. 134). The insurer has at most 30 days from receipt of a claim with all required documents to decide on cover, or loses the right to refuse it (art. 86), and 30 days after recognising cover to pay (art. 87). Payout checks must fit these deadlines.

Sanctions: freeze without delay

Obliged persons must comply without delay and without prior notice with United Nations Security Council asset freezes (Lei nº 13.810/2019, art. 9). SUSEP requires firms to monitor the Security Council lists directly, apply freezes immediately without waiting for SUSEP's notice, keep the freeze after the holder's death and extend it to beneficiaries, and report freezes and attempted transfers to SUSEP, the Ministry of Justice and COAF (Circular 612, art. 45). This duty is not subject to the risk-based approach (art. 45, § 5). The FATF's 2023 evaluation found insurers' practice mixed, with minimal understanding of the duty not to make funds available to designated persons, such as by blocking a payout.

Brokers' proportionate regime

Brokers with annual revenue under R$ 12 million, and admitted reinsurers, may apply a reduced regime if their operations are low risk, but must still identify clients, report to COAF and apply freezes (Circular 612, art. 47); SUSEP's FAQ confirms that brokers below the threshold need not file the annual nil report.

Cybersecurity

Insurers, open pension entities, capitalisation companies and local reinsurers must keep a cybersecurity policy, incident detection and response processes, and notify SUSEP of relevant incidents within five business days (Circular SUSEP 638/2021, arts. 4 to 8). CNSP Resolution 491/2026 covers mutual protection administrators; SUSEP's 2026 manual also covers cooperatives.

8. Risk indicators and red flags

Situations SUSEP requires firms to analyse with special attention

• Profile mismatch: proposals incompatible with the client's socio-economic profile, financial capacity or occupation.
• Unrelated beneficiary: payment to a beneficiary with no apparent link to the policyholder.
• Pre-loss ownership change: change of the insured asset's holder just before a claim.
• Third-party premiums: premiums paid by someone unconnected to the policy, or outside the banking network.
• Abnormal claim frequency: apparently legitimate claims at unusual frequency, or relevant changes in sum insured without apparent cause.
• Large survival-cover contributions: survival-cover pension or life contributions of R$ 1 million or more in a calendar month or as a single payment.
• Foreign links: contracting by non-resident foreigners, and payouts made abroad.
• Opaque ownership: proposals where the beneficial owner cannot be identified.

Source: Circular 612, art. 36, which applies until SUSEP publishes its new risk lists.

9. Enforcement and penalties

AML breaches are sanctioned under Lei 9.613, art. 12 (Circular 612, art. 44): warning; a fine of up to the greatest of twice the transaction value, twice the actual or presumed profit, or R$ 20 million; disqualification of managers for up to ten years; and suspension or withdrawal of authorisation.

Other breaches of insurance rules fall under Decree-Law 73, art. 108, as amended with effect from January 2026: warning, suspension of up to 180 days, disqualification for 2 to 20 years, fines and suspension from specific lines. A fine may not exceed the greatest of R$ 35 million, twice the contract or irregular operation, twice the loss caused to consumers, or three times the gain obtained or loss avoided (§ 1-B), and repeat offences can triple it.

SUSEP's first-instance decision of 8 April 2026 upheld charges against BTG Pactual Vida e Previdência S.A. (process 15414.602501/2025-05) and imposed fines for irregular or missing COAF communications (Circular 612, art. 35), missing internal controls and insufficient effectiveness reports (art. 42).

10. Recent changes and what to watch

• 9 Nov 2026: SUSEP Public Consultation 18/2026 on broker qualification, registration and self-regulatory entities, regulating CNSP Resolution 493 [Proposed, comments close 9 Dec 2026].
• 1 Oct 2026: Resolution 99/2026 published, replacing Circular 612/2020 [Adopted, effective 1 Jan 2027].
• 18 Aug 2026: CNSP Resolution 496/2026 on damage insurance contracts [Adopted, applies to contracts from 5 Jan 2027]. Sets 30-day claim regulation and payment deadlines for damage cover.
• 21 Jul 2026: CNSP Resolution 493/2026 consolidates broker and self-regulatory entity rules [Adopted, effective 180 days after publication].
• 16 Jan 2026: Complementary Law 213/2025's new penalty chapter took effect [In force], setting a fine cap of R$ 35 million or a multiple of the operation, loss or gain.
• 11 Dec 2025: Insurance contract law 15.040/2024 took effect [In force], with 30-day decision and payment deadlines for claims.

SUSEP's higher-risk and lower-risk lists under Resolution 99/2026 (art. 51) were still being prepared as of 11 November 2026. They will inform firms' risk assessments and are not exhaustive (art. 51, § 2).

11. What this means for identity verification

• Data set: the CPF is the anchor for individuals (non-residents exempt from it use a travel document); capture name and CPF, plus address until 31 December 2026. For corporate clients, collect CNPJ and trace beneficial owners (more than 25%, or significant influence).
• Method: no prescribed document or biometric standard. Verification depth is set by risk; document capture, face match and liveness are options the firm justifies in its risk assessment.
• Remote acceptance: signing and later consents need authentication with proof of authorship and integrity, so tie identity verification to the acceptance event and keep the evidence.
• Payout re-verification: verify every new payee before settlement and re-check PEP status at claims, refunds, renewals and redemptions if the last review is over six months old.
• Screening: screen against United Nations Security Council lists continuously and act immediately, and against PEP sources whatever the customer declares.
• Retention: keep identification records at least five years after the relationship ends.