How to Verify Brazilian Supplier Bank Accounts: Pix and CNPJ
Two things make Brazil unlike any other market in this series. It has a national directory that will tell you the registered name behind a payment key before you send money — and the central bank explicitly forbids you from using it to check suppliers. And as of 31 July 2026, the CNPJ, the number every Brazilian company is identified by, can contain letters. Any validation rule in your ERP that assumes it is numeric will start rejecting legitimate new suppliers. This guide covers what you can verify, what you are not allowed to, and what changed last week.
Sources: Receita Federal, Instrução Normativa RFB nº 2.229/2024 and nº 2.333/2026; Banco Central do Brasil, Manual Operacional do DICT.
The account layer: Pix and the DICT
Pix is Brazil's domestic instant payment system, run by the Banco Central do Brasil. It settles in reais, inside Brazil. If you are paying from abroad you will not touch it directly — but your payout provider or your Brazilian entity will, and the section after this one covers the international route. Rather than routing on a bank and account number, Pix routes on a chave Pix — a key that can be a CPF, a CNPJ, a phone number, an email address, or a random UUID known as an EVP.
Behind it sits the DICT, the Diretório de Identificadores de Contas Transacionais: the national directory that maps every Pix key to its account and holder. Before a Pix transfer is initiated, the paying institution queries the DICT, and the directory returns who is on the other end.
What the DICT actually returns
The response is deliberately narrow, and the fields are set by the central bank rather than by the bank you use:
| Field | What you get |
|---|---|
| Holder name | The full legal name, or the razão social for a company. |
| Trading name | The nome fantasia, where the holder is a business. |
| Tax ID | The CPF or CNPJ, masked — only a fragment of the digits is shown. |
| Holder type | Whether the account belongs to an individual or a business. |
| Institution | The receiving PSP, identified by its ISPB code. |
Everything else comes back masked or null. So you learn the name and the shape of the tax ID, but not the full number.
You can submit the tax ID you expect alongside the query. The directory then returns a flag confirming whether the key's owner matches the document you supplied. Some implementations also return a hash of the tax ID, letting you confirm a CPF or CNPJ you already hold without the full number ever being disclosed. That is a genuine payee verification — a yes or no on whether the account belongs to the company you think you are paying.
The constraint that changes everything
Having built the best payee-verification primitive in this series, the Banco Central then restricts it to a single purpose. The DICT's operational manual is explicit: it must not be used for registry lookups, or for any purpose other than transacting to a Pix key.
This is enforced technically, not just written down. The directory runs an anti-scraping control the central bank calls a system of buckets and tokens: each participant holds a finite allowance of queries, tokens are consumed by lookups that do not settle into payments, and the allowance refills slowly. Exceed it and requests are refused, with a penalty window before you can query again. Every DICT query is logged against the CPF or CNPJ of whoever made it.
Brazil gives you a payee check at the moment of payment, and denies you one at onboarding. You cannot run your supplier master through the DICT to see whether the accounts on file still belong to the right companies. Bulk pre-payment verification of the kind used elsewhere is not available, by design.
The consequence is structural. In most markets the account layer is weak and buyers compensate with company checks. In Brazil the account layer is strong but fenced, so the company layer carries the ongoing work — and fortunately, that is the part Brazil makes unusually open.
Paying from outside Brazil: SWIFT, the BR IBAN, and the CNPJ requirement
Brazil is not in SEPA, and Pix does not cross the border. An international payment to a Brazilian supplier is a SWIFT wire, and it needs a different set of details.
Brazil does have an IBAN. It was regulated by the Banco Central in 2013 under Circular nº 3.625, and the Brazilian format is 29 characters.
Two practical points follow, and both cause avoidable friction.
First, the IBAN is not native to Brazilian banking. Domestic transfers run on agência and conta, or on a Pix key. Brazilian banking apps foreground those, not the IBAN, and many suppliers genuinely do not know their IBAN or where to find it. Asking for one and receiving confusion is not a red flag; it is normal, and the supplier usually has to request it from their bank or find it in the international transfers section of their online banking.
Brazilian banks generally require the sender to supply the beneficiary's CPF or CNPJ alongside the IBAN and SWIFT code, for central bank anti-money-laundering compliance. Omit it and the transfer can be delayed or sent back. This is useful rather than merely bureaucratic: it means the tax ID travels with the payment instruction, so the number you verified in the company checks is the number the receiving bank matches against.
Second, if you route through a local-currency payout provider rather than a correspondent bank, the last leg lands via Pix or TED inside Brazil — which is where the DICT check described above actually applies. Whether you get a payee-name check therefore depends on your payment route, not on Brazil.
What changed on 31 July 2026
The CNPJ — Cadastro Nacional da Pessoa Jurídica — is the fourteen-character number identifying every Brazilian legal entity. Under Instrução Normativa RFB nº 2.229/2024, the Receita Federal began issuing alphanumeric CNPJs on 31 July 2026. The first one has been issued.
The reason is prosaic: the purely numeric stock was running out. Brazil registers companies at a rate that has reached roughly 400,000 in a single month, and the available combinations could not keep up. Rather than lengthen the number — which would have meant changing nearly every system in the country — the Receita added letters.
Four points matter for anyone paying Brazilian suppliers:
- Existing CNPJs do not change. A supplier you already pay keeps its number, its check digits and its documents. Nothing is reissued.
- The length is unchanged at fourteen characters, with the same display mask of dots, slash and hyphen.
- Only the first twelve positions can take letters. The two check digits remain numeric.
- The check digit calculation changed. It is still modulo 11, but letters are converted to numeric values using their ASCII codes before the weights are applied.
Any field typed as numeric, any regular expression expecting fourteen digits, and any check-digit routine written before this change will reject a valid new Brazilian supplier. It will not look like a format change; it will look like the supplier gave you a bad number. Both formats now coexist permanently, so systems must accept either.
The Receita Federal publishes a free simulator that generates valid alphanumeric CNPJs for testing, and Serpro, the government IT corporation, has released reference check-digit implementations. There is no excuse for guessing at the algorithm, and no reason to.
One open detail worth knowing: technical discussions have suggested certain letters may be excluded from the permitted set to avoid visual confusion with digits. As at publication the Receita Federal had not confirmed a restricted list, so the safe assumption is that any letter A to Z may appear.
Reading the CNPJ
The structure is worth knowing regardless of format. The first eight characters identify the company. The next four identify the establishment: 0001 is the head office, and 0002 onward are branches. The last two are check digits.
That branch segment is the practically useful part. Two CNPJs differing only in that block are the same legal entity at different sites — normal, and not a discrepancy. But an invoice from one establishment and bank details registered to another is worth a question, because the legal person is the same while the operational unit is not.
The company layer: the Receita Federal register
Here Brazil is genuinely generous. The CNPJ register is public, free, needs no login, and returns more than most European registries.
A lookup gives you the razão social and nome fantasia, the registration status and the date it took effect, the full fiscal address, the legal nature of the entity, the main and secondary CNAE activity codes, the opening date, the company size classification, and the share capital.
Situação cadastral: the field that decides
The status field takes one of five values, and only one of them means you are dealing with a company that can trade.
Two of these deserve attention. Inapta generally follows a failure to file required declarations for two consecutive years, or a company not being found at its registered fiscal address — both of which describe a supplier that has stopped being properly run. Nula means the registration was annulled by the Receita, typically for fraud or duplicate registration, and is the single clearest signal in the Brazilian dataset.
The practical consequence is commercial rather than abstract: a company that is inapta or baixada cannot issue a valid nota fiscal. If your supplier cannot issue a valid invoice, your own tax position on that purchase is compromised. Checking the status is not diligence theatre; it protects your deduction.
Watch for the situação especial field too. It flags judicial recovery, bankruptcy and liquidation — the Brazilian equivalent of an insolvency notice, sitting in the same free lookup.
QSA: the partners, in public
The same free consultation exposes the Quadro de Sócios e Administradores — the register of partners and administrators. It lists each partner or administrator by name, their qualification (partner-administrator, administrator, holder) and the date they joined.
This is more ownership transparency than most European registers give a counterparty for free, and considerably more than the UAE or Poland currently offer. A recently changed QSA on a supplier requesting new bank details is exactly the correlation worth catching.
The register shows registration status, not debts. For tax and social security arrears you need the certidão negativa de débitos from the Receita Federal and the PGFN, which is a separate request. An ATIVA status tells you the company exists and files; it does not tell you the company pays.
What a DICT check will not catch
A DICT lookup is a strong control at the moment it runs. It confirms the key resolves, returns the registered name, and — where you supply the expected tax ID — tells you whether the account belongs to the entity you intend to pay.
It tells you nothing about the company. The key can resolve perfectly to a business whose CNPJ went inapta eighteen months ago, whose partners changed last quarter, which is in judicial recovery, or which cannot issue you a valid invoice. And because the central bank restricts the directory to transaction initiation, you cannot use it to watch a supplier base over time. There are several company red flags a bank account match alone will not catch, and in Brazil the account-layer tool is explicitly not permitted to look for them.
One integration, instead of one per country
Brazil's CNPJ lookup is free and excellent. It just shares no format, cadence or identifier scheme with the next market you pay into.
MonitorPay covers 49+ markets through one API — payee name matching, plus company status, directors, shareholders and ownership from 200+ government registries. Bulk, API or platform. Every check logged. We do not move money.
A practical verification workflow
For a new Brazilian supplier, or a change to an existing one, a defensible sequence looks like this:
- Accept alphanumeric CNPJs. Before anything else, confirm your ERP, vendor master and validation routines accept letters in the first twelve positions and calculate the check digits using the current algorithm.
- Check the CNPJ on the Receita Federal. Free, no login. Confirm the razão social matches the invoice and note the opening date.
- Read the situação cadastral. Only ATIVA is safe. Inapta or baixada means the supplier cannot issue a valid nota fiscal.
- Check the situação especial. Judicial recovery, bankruptcy or liquidation appear here, in the same lookup.
- Read the QSA. Note the partners and administrators, and whether they changed recently.
- Confirm the establishment. Check whether the invoice comes from the head office (0001) or a branch, and whether the bank details correspond.
- Request the certidão negativa where the relationship or the value justifies it. Registration status is not the same as being free of debts.
- Get the right account details for your route. Paying from abroad means a 29-character BR IBAN plus the SWIFT code, and the beneficiary's CNPJ supplied with the instruction. Paying inside Brazil means a Pix key or agência and conta.
- Use the tax-ID match at payment. Where your provider supports it, submit the expected CNPJ with the DICT query so the directory confirms the key belongs to that entity.
- Monitor the company layer, not the account layer. The DICT cannot be used for ongoing supplier surveillance. Registration status, special situation and QSA changes can be, and should be.
Bulk, API, or the online platform
Three ways in: bulk file checks for onboarding runs and supplier-base reviews, the REST API for verification inside your payment workflow, or the online platform for one-off checks with full audit logs.
Frequently asked questions
How do I verify a Brazilian supplier's bank account?
At the moment of payment, a Pix DICT lookup returns the registered holder name behind the payment key, the trading name, a masked tax ID and the receiving institution. Where your provider supports it, you can also submit the CNPJ you expect and the directory will confirm whether the key belongs to that entity.
You cannot use the DICT to check suppliers outside a payment, so the ongoing work sits on the company layer: verify the CNPJ on the Receita Federal register, confirm the registration status is ATIVA, and read the partner register. Both are free and need no login.
What is the Pix DICT and what does it return?
The DICT is the Brazilian central bank's directory mapping every Pix key — a CPF, CNPJ, phone number, email or random EVP — to the account and holder behind it. The paying institution queries it before initiating a transfer.
The fields returned are fixed by the Banco Central: the holder's full name or razão social, the trading name where applicable, the CPF or CNPJ in masked form, whether the holder is an individual or a business, and the receiving institution. Other fields come back masked or empty.
Can I use the DICT to check my Brazilian suppliers?
No. The DICT's operational manual states it must not be used for registry lookups or any purpose other than transacting to a Pix key, and the restriction is enforced technically. The directory operates an anti-scraping control the central bank describes as a system of buckets and tokens: each participant has a finite query allowance, lookups that do not result in payments consume it, and exceeding it triggers refusal and a penalty window.
Every query is also logged against the CPF or CNPJ of whoever made it. Bulk verification of a supplier master through the DICT is therefore not available, by design — the company-layer checks are where ongoing monitoring has to happen.
Can I pay a Brazilian supplier with Pix from another country?
Not directly. Pix is a domestic system settling in reais inside Brazil, and Brazil is not part of SEPA. An international payment to a Brazilian supplier is a SWIFT wire, which needs the 29-character BR IBAN and the bank's SWIFT code rather than a Pix key.
If you use a local-currency payout provider instead of a correspondent bank, the final leg does land via Pix or TED inside Brazil. So whether a DICT payee check happens at all depends on your payment route rather than on anything about the supplier.
Does Brazil have an IBAN?
Yes. The Banco Central regulated it in 2013 under Circular nº 3.625, and the Brazilian IBAN is 29 characters: the country code BR, two check digits, an eight-digit ISPB bank code, a five-digit branch code, a ten-digit account number, and two final characters for account type and owner type.
It is used only for inbound international transfers. Domestic Brazilian payments run on agência and conta or on a Pix key, so banking apps do not foreground the IBAN and many suppliers do not know theirs. They can usually obtain it from the international transfers section of their online banking or by asking their bank.
Why do I need my supplier's CNPJ to send an international payment to Brazil?
Brazilian banks generally require the beneficiary's CPF or CNPJ alongside the IBAN and SWIFT code, for central bank anti-money-laundering compliance. Leaving it out is one of the most common reasons a transfer to Brazil is delayed or returned.
It is worth treating as a control rather than an obstacle: the tax ID travels with the payment instruction, so the CNPJ you verified against the Receita Federal register is the same number the receiving bank matches the account against.
What is the alphanumeric CNPJ and when did it start?
From 31 July 2026 the Receita Federal began issuing CNPJs containing letters as well as digits, under Instrução Normativa RFB nº 2.229/2024. The change was made because the purely numeric combinations were running out, with Brazil registering as many as 400,000 new companies in a single month.
The number keeps its fourteen characters and its familiar display mask. Letters can appear in the first twelve positions only; the final two check digits stay numeric. The check digit is still calculated with modulo 11, but letters are converted using their ASCII values first.
Will my existing Brazilian suppliers get a new CNPJ?
No. Existing CNPJs are unchanged, remain valid, and keep their current check digits. Nothing is reissued, and no contract, invoice or registration needs updating because of the change. Only new registrations from the cut-off date can carry letters.
The two formats now coexist permanently, which is the practical point: your systems have to accept both indefinitely rather than migrating from one to the other.
Why is my system rejecting a valid Brazilian CNPJ?
Most likely because the supplier has one of the new alphanumeric numbers and your validation still assumes fourteen digits. Any numeric-typed database field, any regular expression expecting only digits, and any check-digit routine written before the change will refuse a legitimate number.
It rarely presents as a format problem — it looks like the supplier supplied a bad CNPJ. Fix the field types, update the validation to accept letters in the first twelve positions, and adapt the check-digit calculation to convert letters via their ASCII values. The Receita Federal publishes a free simulator that generates valid alphanumeric CNPJs for testing, and Serpro has released reference implementations.
How do I check a Brazilian company on the Receita Federal?
Use the public CNPJ consultation on the Receita Federal site. It is free, requires no login, and returns the razão social and nome fantasia, the registration status and its date, the fiscal address, the legal nature of the entity, the main and secondary CNAE activity codes, the opening date, the company size and the share capital.
The same consultation gives access to the Quadro de Sócios e Administradores, listing the partners and administrators with their qualification and entry date.
What does situação cadastral mean, and which statuses are safe?
It is the CNPJ's registration status, and it takes one of five values. Ativa is the only one that means the company is trading normally. Suspensa indicates paused activity or a flag for review. Inapta generally follows two consecutive years of missed declarations or the company not being found at its registered address. Baixada means the company has been closed. Nula means the registration was annulled, often for fraud or duplication.
The commercial consequence matters: an inapta or baixada company cannot issue a valid nota fiscal, which compromises your own tax treatment of the purchase, not merely theirs.
Can I see who owns a Brazilian company?
To a useful degree, yes, and for free. The Quadro de Sócios e Administradores in the public CNPJ consultation lists each partner and administrator by name, with their qualification and the date they joined. That is more counterparty ownership transparency than most European registers currently provide without an application.
It shows the registered partners rather than a full beneficial ownership chain, so an entity partner may require a further lookup. Even so, a QSA that changed shortly before a request to alter bank details is exactly the correlation worth checking.
Does an ATIVA status mean the supplier has no tax debts?
No. Registration status and indebtedness are different things. ATIVA confirms the company exists and is meeting its registration obligations; it says nothing about whether it owes tax or social security.
For that you need the certidão negativa de débitos from the Receita Federal and the PGFN, which is a separate request. Watch the situação especial field in the main lookup too — judicial recovery, bankruptcy and liquidation are flagged there.
My Brazilian supplier's CNPJ differs from the one on file by four digits. Is that a problem?
Probably not. Characters nine to twelve identify the establishment: 0001 is the head office and 0002 onward are branches. Two CNPJs differing only in that block belong to the same legal entity at different sites, which is entirely normal for a supplier operating in several states.
It is worth a question when the invoice comes from one establishment and the bank details are registered to another. The legal person is the same, but the operational unit is not, and the mismatch should have an explanation.
Does a successful Pix key lookup mean a Brazilian supplier is legitimate?
No. It confirms the key resolves to a named holder and, where you supply the expected tax ID, that the account belongs to that entity. That is a real control, but it is a statement about an account, not about a business.
The company behind it may have gone inapta, changed partners, entered judicial recovery, or lost the ability to issue a valid invoice. Because the central bank restricts the directory to payment initiation, you also cannot use it to watch for those changes over time — which is precisely why the company layer carries the monitoring burden in Brazil.
