Travel & Hospitality Compliance in Brazil

Brazil is open to online travel businesses, but its identity rules are written for the front desk and the border, not the app. The Ministry of Tourism regulates accommodation and travel agencies, the Federal Police controls the border and receives airline passenger data, the Ministry of Foreign Affairs issues visas, and the National Civil Aviation Agency (ANAC) sets airline passenger rules.

The biggest practical obstacle for a digital entrant is the FNRH Digital requirement: booking and pre-check-in flows must feed a government platform, and the final identity check remains in person.

1. Who regulates this sector

2. Licensing and authorisation

The General Tourism Law (Lei nº 11.771, de 17 de setembro de 2008, as amended, most recently by Lei nº 15.271/2025) defines tourism service providers as accommodation, travel agencies, tourist transport companies, event organisers, theme parks and tourist campsites (art. 21). These providers must register with the Ministry of Tourism, each branch included, and only registered providers may provide or intermediate tourism services to third parties (art. 22, caput and §§1 and 3). Registration lasts two years from the certificate date (art. 22, §4). Air transport is outside the duty (art. 22, §5).

A travel agency is any legal person that intermediates tourism services for a fee, or supplies them directly (art. 27). The law reaches online distribution expressly: providers advertised through online travel agencies or digital platforms must be registered, and both the provider and the advertising channel are liable if they are not (art. 22, §6).

Accommodation must hold an operating licence issued by the competent authority (or, for condo-hotels and similar, a building licence plus the documents listed in art. 24) to register. Providers must show their registration number in all advertising (art. 34, I). There is no separate online licence.

3. Identity framework (AML rules do not apply)

Hotels, tour operators and travel agencies are not listed among the obliged persons in art. 9 of the anti-money laundering law (Lei nº 9.613, de 3 de março de 1998). They have no general duty to identify customers for anti-money laundering purposes or to report to the Council for Financial Activities Control (COAF). A travel business enters that regime only through a listed activity, chiefly the purchase and sale of foreign currency (art. 9, II), or the promotion or marketing of fairs, exhibitions and similar events (art. 9, sole paragraph, XV).

Identity in this sector is governed instead by four sets of rules:

Guest registration

The FNRH Digital register (Lei nº 11.771/2008, art. 26; Portaria MTur nº 41/2025).

Minors

The Statute of the Child and Adolescent (Lei nº 8.069/1990) on hotel stays and travel by minors.

Border and visas

The Migration Law (Lei nº 13.445/2017) and Decreto nº 9.199/2017.

Air passengers

ANAC Resolutions nº 400/2016 (boarding) and nº 255/2012 (passenger data).

Currency exchange for travellers

Foreign exchange is carried out by institutions authorised by the Banco Central, which are responsible for identifying their customers (Lei nº 14.286/2021, arts. 4 and 5). A hotel or agency can offer it as a correspondent acting for an authorised institution, which remains fully responsible (CMN Resolution nº 4.935/2021, arts. 3 and 4), under a contract limited to US$ 3,000 per operation, or US$ 1,000 where cash is exchanged for cash (art. 13). When a correspondent takes part, the authorised institution must keep a copy of the customer's identification documents (BCB Resolution nº 277/2022, art. 10). Travel agencies and tourism providers may hold foreign-currency deposit accounts restricted to inbound and outbound tourism receipts and payments (Resolution 277, art. 70, I).

4. Identity verification and onboarding

Guests at accommodation

Portaria MTur nº 41, de 14 de novembro de 2025, creates one FNRH for each guest (art. 29). Annex I sets the fields: full name and social name, date of birth, nationality, sex, identity document type and number, the individual taxpayer number (CPF) where applicable or a passport for foreigners, contact details, home address, reason for travel, previous and next destination, means of transport and vehicle plate. At check-in the property confirms the data and documents and applies the platform's electronic validations (art. 32, II). Where data diverge, they must be corrected before check-in is confirmed (art. 33). Children and legally incapable persons are linked to the FNRH of their legal guardian (art. 29, sole paragraph).

Passengers

Airline passengers must show a civil identity document with public faith valid throughout Brazil for domestic and international flights; foreign passengers show a valid passport or other travel document; children under 12 may board domestic flights with a birth certificate (ANAC Resolution nº 400/2016, art. 16). ANAC guidance treats the digital driving licence (e-CNH) as a valid boarding document and recommends checking its QR code with the Vio validation app when the photo or layout looks inconsistent (Informativo SIA 02/25, 30 June 2025). At the border, entry requires a valid travel document plus a valid visa, a residence authorisation or a visa-exempt nationality (Decreto nº 9.199/2017, art. 164), checked by the Federal Police at the point of entry (art. 165). The visa regime table published by the Ministry of Foreign Affairs (updated 7 October 2026) shows that nationals of South American neighbours such as Argentina, Uruguay and Colombia may enter with a national identity card.

Biometrics and digital identity

No travel rule prescribes a liveness standard. The FNRH platform can pre-fill fields from government databases reachable through the gov.br account and from the guest's previous stays (Portaria MTur nº 41/2025, art. 35). The Ministry of Ports and Airports' biometric identification policy promotes biometric boarding, with a guideline that alternatives be guaranteed for passengers who cannot use biometrics (Portaria GM-MPOR nº 48/2026, art. 3, VII).

5. Digital channels: what's different

Bottom line: online booking and pre-check-in are permitted and the guest register is now digital-only, but the identity check at check-in must still be done in person at the property.

Pre-check-in is online, check-in is not

Guests may complete the FNRH before arrival through the property's QR code or a shared link (Portaria MTur nº 41/2025, art. 38, caput and §3). Either way, check-in takes place at the establishment, in the guest's presence, with the property checking and confirming the data (art. 38, §§1 and 4).

Foreign guests and gov.br

Guests may sign in with a gov.br account or with credentials created on the platform itself (art. 38, §2), and foreign guests may use the platform without gov.br (art. 34, §1). A gov.br login may unlock automatic validations (art. 34, §2).

Online travel agencies

Where accommodation is intermediated, the intermediary is subject to the same data duties as the property, under a regulation still to define them (Lei nº 11.771/2008, art. 26, §3). The FNRH records the booking channel, including the online travel agency, for each reservation (Portaria MTur nº 41/2025, art. 4, XVII).

Electronic visas

Visas may be issued electronically for the nationalities the Ministry of Foreign Affairs sets, which may still ask for originals or an in-person appearance (Decreto nº 9.199/2017, art. 26). Nationals of the United States, Canada and Australia need a visit visa (visa regime table, 7 October 2026) and must apply for it electronically (Consulate General in Montreal, updated 24 August 2026).

[Bill, not enacted] Two Senate bills (PDL 268/2026 and PDL 273/2026) would suspend all or part of Portaria MTur nº 41/2025; both await referral.

6. Data protection and biometrics

The Brazilian Data Protection Law (Lei nº 13.709/2018, LGPD) applies to all guest and passenger data. In the FNRH the Ministry of Tourism is the controller and the property acts as processor (Portaria MTur nº 41/2025, art. 4, III and IV). Individual data may not be published (art. 6, I); data are deleted or anonymised once their purpose is met, with periods still to be set by ordinance (art. 12); access to minors' records is restricted (art. 17). Its privacy policy lists tourism promotion and public security among the purposes (Portaria MTur nº 2/2026). The platform's API for property management systems (v2.4.2, August 2026) makes race or colour and disability mandatory when a guest is registered, each with a "prefer not to say" option, although neither is among the Annex I fields. Race or colour is sensitive data (LGPD, art. 5, II), and the disability type can reveal health data, which is also sensitive. Since 11 November 2026, requests for access to FNRH data are decided by the National Secretary for Tourism Policies (Portaria MTur nº 37/2026).

Biometric data are sensitive data (LGPD, art. 5, II). They may be processed with specific, highlighted consent, or without consent where indispensable for fraud prevention and the security of the data subject in identification and authentication in electronic systems (art. 11, I and II, g). Children's data need the specific consent of a parent or guardian (art. 14, §1). Airlines must tell passengers in the contract of carriage that reservation data go to the authorities (ANAC Resolution nº 255/2012, art. 7).

7. Sector-specific obligations

Hotel stays and travel by minors

Hosting a child or adolescent in a hotel, motel, guesthouse or similar is prohibited unless authorised or accompanied by the parents or guardian (Lei nº 8.069/1990, art. 82). The FNRH rules require at least one parent or guardian to be present, or, for an unaccompanied minor, a written authorisation with a notarised signature or a court authorisation (Portaria MTur nº 41/2025, art. 37). Children and adolescents under 16 may not travel outside their judicial district without parents or a court authorisation, unless travelling to a neighbouring district in the same state or metropolitan region, or accompanied by an adult relative up to the third degree or an adult authorised by a parent (art. 83). For international travel, authorisation is not needed when both parents travel, or when one travels with the other's notarised consent (art. 84).

Airline passenger data

Airlines, other than non-scheduled operators with aircraft of up to 30 seats, must send advance passenger information (API) for international flights before take-off in the UN/EDIFACT PAXLST format, and make passenger name record (PNR) data available from their reservation systems; scheduled domestic operations are covered too (ANAC Resolution nº 255/2012, arts. 3, 4, 5-A and 5-B, as amended by Resolution nº 595/2020). Data go, to Federal Police specifications, to border, customs, health and aviation security authorities. PNR data include the CPF or, failing that, the migratory registration or passport number.

Disruptive passenger list

[In force from 14 Sep 2026] ANAC Resolution nº 800/2026 lets domestic airlines suspend a passenger who commits a very serious act of indiscipline for 6 or 12 months, and share the passenger's identification data with other airlines; during the suspension airlines must take measures to block ticket sales, check-in and boarding (arts. 6 and 7).

Cash at the border

Cash in reais or foreign currency above US$ 10,000 may cross the border only through an institution authorised to operate in foreign exchange, unless its entry or exit is proven under Federal Revenue Service rules; the excess is forfeited otherwise (Lei nº 14.286/2021, art. 14, §§1 and 3). Travellers must declare such amounts to customs on arrival.

8. Risk indicators and red flags

Identity and safeguarding indicators

• Unaccompanied minor: a child or adolescent checking in without a parent, guardian or notarised authorisation.
• Adult unrelated to a minor: an adult who cannot show kinship or a parent's authorisation for a travelling child.
• Document mismatch: pre-check-in data that differ from the identity document presented at the desk.
• Sexual tourism signals: requests or promotion linking a stay or package to sexual exploitation, which providers must inhibit.
• Suspended passenger: a booking for a passenger on the shared list of disruptive passengers.
• Large cash: travellers carrying more than US$ 10,000 in cash without using an authorised institution.
• Front tour company: fragmented cash deposits into a small agency's account, withdrawn in cash and justified as package sales (COAF typology).

9. Enforcement and penalties

The Ministry of Tourism enforces the General Tourism Law with written warnings, fines, interdiction of premises or activities, and cancellation of registration (Lei nº 11.771/2008, art. 36). Fines range from R$ 350 to R$ 1,000,000 per infringement, graded by gravity, advantage gained and the provider's economic condition (arts. 36, §3, and 38). Operating without registration, and failing to supply guest data under art. 26, each carry a warning and a fine (arts. 41 and 42). Sexual exploitation of children in tourism services and promoting sexual tourism carry fines, interdiction and cancellation (arts. 43-B and 43-D).

Hosting a minor without parents or authorisation is punished with a fine; repeat offences can lead to closure for up to 15 days, or permanent closure and loss of the licence for a repeat within 30 days (Lei nº 8.069/1990, art. 250). Transporting a minor in breach of the travel rules carries a fine, doubled for repeat offences (art. 251). ANAC sanctions airlines that fail to send API or PNR data, or send them late or incomplete, under art. 289 of the Brazilian Aeronautical Code (Resolution nº 255/2012, arts. 6 and 8-A). Data protection breaches carry fines of up to 2% of Brazilian turnover, capped at R$ 50 million per infringement (LGPD, art. 52, II).

10. Recent changes and what to watch

• [In force]11 November 2026: Portaria MTur nº 37/2026 names the authority that decides requests for access to FNRH Digital guest data.
• [In force]14 September 2026: ANAC's disruptive passenger rules apply; domestic airlines must block ticketing and check-in for suspended passengers.
• [Adopted, implementation plan pending]1 September 2026: the national biometric identification policy for airports, ports and waterways is published; a committee must issue an implementation plan and timetable.
• [Bill, not enacted]April and May 2026: PDL 268/2026 and PDL 273/2026, filed in the Senate, would suspend the FNRH Digital ordinance in whole or in part.
• [In force]20 April 2026: FNRH Digital becomes mandatory nationwide, after Portaria MTur nº 4/2026 extended the start date to 150 days from publication.
• [In force]10 April 2025: nationals of the United States, Canada and Australia need a visit visa, available electronically.
• [In force]26 December 2024: Lei nº 15.073/2024 adds a duty to inhibit sexual tourism, with new infringements.

Still to come: the regulation on intermediaries' guest-data duties and the FNRH anonymisation ordinance.

11. What this means for identity verification

• Design for a split flow. Online capture before arrival, then an in-person document check at the property that confirms the FNRH record.
• Integrate with the platform. Property systems connect to FNRH Digital by API.
• Two document sets. CPF and Brazilian identity documents for residents; passport for foreigners, with national identity cards accepted at the border for some South American nationalities.
• Minors and guardians. Capture the party's composition, the guardian's identity and any notarised authorisation, and link minors to the guardian's record.
• Biometrics need a legal basis. Use specific consent or the LGPD fraud-prevention basis, and offer a non-biometric alternative, as the airport biometrics policy does.
• Re-verification triggers. Mismatches at check-in, changes to the guest party, airline suspension-list matches.