How to Investigate Any Brazilian Company in 20 Minutes Using Public Records

AML analysts at Brazilian banks spend an average of 3 hours investigating companies that could be vetted in 20 minutes using only public sources.

The problem is not access. It is execution order. Most analysts start with Google or paid tools that aggregate public data without disclosing the methodology. This guide shows what the data reveals and in what sequence to query it.

What You Will Find

Any active CNPJ in Brazil exposes five layers of information without special credentials or paid tools.

Layer 1: Registration status and ownership structure via Receita Federal (Brazilian Tax Authority). Includes company size, legal type, opening date, registered capital, primary and secondary CNAE codes, and all partners with percentage ownership.

Layer 2: Commercial records and incorporation documents via state commercial registries. JUCESP (São Paulo), JUCERJA (Rio de Janeiro), JUCEMG (Minas Gerais), and equivalents in other states. Articles of incorporation, amendments, registered powers of attorney.

Layer 3: Regulatory activity and sanctions via sector regulators. CVM for publicly traded companies or those raising investor capital. BACEN for financial institutions. CADE for mergers and anticompetitive conduct. SUSEP for insurance and reinsurance companies.

Layer 4: Public contracts and procurement via Portal da Transparência, PNCP, and ComprasNet. Historical contracts with federal, state, and municipal governments, including contract values and procurement modality.

Layer 5: Digital surface via Registro.br, crt.sh, and WHOIS. Registered domains, issued SSL certificates, exposed subdomains, DNS history.

5-Step Workflow

Step 1: Initial CNPJ Lookup (2 minutes)

Source: https://www.receita.fazenda.gov.br/Aplicacoes/ATCTA/CPFCNPJ/ConsultaPublica.asp

Query registration status, company size, legal type, opening date, registered capital, and CNAE code.

Red flags warranting deeper investigation:

• Company less than 6 months old winning a government contract above R$500,000
• Registered capital below R$10,000 with declared activity incompatible with that size
• Primary CNAE code incompatible with the contract object under review
• Partners listed exclusively as legal entities, with no natural person identified

Step 2: Ownership Structure and Beneficial Owner (5 minutes)

Source: Receita Federal, QSA (Shareholders and Officers Registry).

For each legal entity listed as a partner, query recursively until natural persons appear. For each natural person, check whether the CPF appears as a partner in other companies via https://cnpja.com.br or direct Receita Federal queries.

Red flags:

• Legal entity partner domiciled in an offshore jurisdiction with no registered activity in Brazil
• Partner turnover in the 12 months prior to the contract under review
• Same group of partners appearing across companies in different states with identical CNAE codes
• Any partner with a registration restriction at Receita Federal

Step 3: Judicial Records and Sanctions (5 minutes)

Run these sources in parallel:

• CEIS/CNEP: https://portaldatransparencia.gov.br/sancoes: companies barred or penalized for irregularities in public contracts
• State court records: https://esaj.tjsp.jus.br (São Paulo) and equivalent portals for other state courts
• Diário Oficial da União: https://www.in.gov.br: CNPJ search surfaces administrative acts, suspensions, and regulatory fines

Red flags:

• Company or any named partner appearing in CEIS or CNEP
• Labor claims from more than 20 plaintiffs, indicating undeclared workforce at scale
• DOU mentions in the context of disqualification, suspension, or regulatory fine

Step 4: Public Contract Exposure (3 minutes)

Sources:

• https://pncp.gov.br: National Public Procurement Portal
• https://portaldatransparencia.gov.br/contratos
• https://comprasnet.gov.br

Red flags:

• Company under 1 year old winning a procurement contract above R$1 million
• Same CNPJ winning contracts in geographically distant municipalities for locally-delivered services
• Bid price 40% below or above the median of other bidders in the same lot

Step 5: Digital Surface and Ownership (5 minutes)

Sources:

• https://registro.br: .br domains registered in the name of the company or its partners
• https://crt.sh: issued SSL certificates, surfaces non-public subdomains
• Historical WHOIS via https://whoishistory.com or equivalent

Red flags:

• .br domain registered under a CPF not matching any QSA partner
• Servers hosted in a jurisdiction unrelated to the company's sector
• Exposed subdomains revealing internal systems: erp., admin., invoice., financeiro.
• Company in a sector requiring digital presence (technology, consulting, e-commerce) with no registered domain

What This Reveals in 20 Minutes

This workflow classifies any company into one of three categories.

Shell company for public procurement. Registered capital below R$10,000, incorporation within 3 months of the tender, legal entity partners with no registered activity in Brazil, generic CNAE, no digital presence. All layers converge on the same signal.

Legitimate company with undisclosed problematic partners. The Receita Federal QSA diverges from what was declared during onboarding due diligence. Former partners appear in CEIS. Partner turnover concentrated in the 6 months before the transaction under review.

Company with digital exposure indicating undeclared assets. Active ERP or financial system subdomains for a company declaring small-business status. Server infrastructure disproportionate to declared company size and registered capital.

What the Workflow Does Not Find

Analytical honesty is part of the methodology:

• Offshore structures not linked to identifiable Brazilian partners at Receita Federal
• Beneficial owner anonymized via single-partner LTDA with a foreign legal entity holding 100% and no Brazilian registration
• Operations conducted entirely in cash with no public documentary trail

These cases require additional sources: commercial credit bureaus such as Serasa Experian, specialized credit bureaus, or human source investigation. The public records workflow does not replace advanced diligence for high-risk counterparties.

---

An analyst who owns this workflow processes 15 vettings per day instead of 3.

Each of these layers (Receita Federal, commercial registries, CEIS, cert transparency) can be automated via intel.mago.team, consolidating the data into a single report.