# Brazil Company Due Diligence by CNPJ – KYB & Sanctions Check (`cairolabs/brazil-company-due-diligence`) Actor

Brazil company check by CNPJ for KYB, KYC and supplier screening: Receita Federal data (status, QSA partners, CNAE), CEIS/CNEP sanctions, PNCP public contracts, risk flags and a HIGH/MEDIUM/LOW risk level. Compliance-ready, public data. $0.10 per report.

- **URL**: https://apify.com/cairolabs/brazil-company-due-diligence.md
- **Developed by:** [Cairo Labs](https://apify.com/cairolabs) (community)
- **Categories:** Business, Developer tools, Lead generation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$100.00 / 1,000 company due diligence reports

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

**Know who you are dealing with in Brazil in seconds: enter a CNPJ, get a due diligence report that flags sanctioned, inactive or brand-new companies before you sign, onboard or pay.** $0.10 per report; invalid and not-found CNPJs are free.

One call = one **Brazil company due diligence / KYB report**: Receita Federal registration data (status, CNAE, address, QSA partners), **CEIS and CNEP sanctions** (CGU, checked on the CNPJ *and* its 8-digit root), **public procurement awards (PNCP, Law 14.133)**, automatic **risk flags** and a **HIGH / MEDIUM / LOW risk level** with a one-line summary. A fast first step for **KYB, KYC of business customers, supplier screening, AML/anti-corruption compliance and sanctions checks**.

Everything comes from **public Brazilian open data** (Receita Federal via BrasilAPI / minhareceita.org, CGU Portal da Transparência, PNCP / Compras.gov.br). No login, no proxy, no scraping behind a login wall. Use it as a no-code tool or as a **Brazil company check API** through the Apify API, n8n, Make or Zapier.

#### Real result (run of 23 Oct 2026, 4 CNPJs in → 3 reports + 1 invalid)

| CNPJ | Company | Risk | Why |
|---|---|---|---|
| 11.338.577/0001-24 | CASSOL REPRESENTACOES E INTERMEDIACOES LTDA | **HIGH** | Active CNEP sanction (fine under Law 12,846, R$ 36,680.49, since 2022-07-01) |
| 33.000.167/0001-01 | PETROLEO BRASILEIRO S A PETROBRAS | LOW | Active, 60.1 years, no CEIS/CNEP sanctions, 1 public award |
| 00.000.000/0001-91 | BANCO DO BRASIL SA | LOW | Active, 60.2 years, no sanctions, 318 public awards (R$ 2,802,499,009.67) |
| (invalid input) | – | – | `INVALID_CNPJ_CHECK_DIGITS`, not charged |

### Use cases

- **KYB / business customer onboarding** – screen new merchants, sellers or B2B clients by CNPJ before activating the account.
- **Supplier and vendor screening** – check CEIS/CNEP sanctions and registration status before a purchase order or contract.
- **Anti-corruption compliance (Lei Anticorrupção 12.846)** – document third-party checks with source URLs and the sanctions file date.
- **B2B credit pre-check** – spot inactive, very new or low-capital companies.
- **M\&A, investor and partner due diligence** – a quick public-data snapshot, including public-sector revenue (PNCP awards).
- **Procurement and sales intelligence** – see which government buyers already contract a company.

### What does this Brazil company check do?

For each CNPJ the Actor returns **one dataset item = one report**:

- 🏢 **Company** – legal name, trade name, registration status and date, opening date, company age, main + secondary CNAE, legal nature, size, Simples Nacional / MEI, share capital, address, phones, email and **QSA partners (sócios)**.
- 🚫 **Sanctions (CEIS + CNEP)** – matches for the exact CNPJ and for other establishments with the same CNPJ root (`matchType`: `CNPJ_EXACT` / `CNPJ_ROOT`), with category, start/end dates, sanctioning body, legal basis and process number. Each match is marked `active` or expired.
- 📑 **Public contracts (PNCP)** – awards won in the last 1–36 months: count, total awarded value (BRL), distinct buyers, first/last award date, top 5 buyers by value and the 5 most recent awards with a link to the PNCP notice.
- ⚠️ **Risk flags** – `STATUS_NOT_ACTIVE`, `ACTIVE_SANCTION_CEIS`, `ACTIVE_SANCTION_CNEP`, `PAST_SANCTION`, `RECENTLY_OPENED`, `LOW_CAPITAL`, `NO_CONTACT_INFO`, `MEI`, plus `riskLevel` and a plain-English `summary`.
- 🔗 **Sources** – URLs and `fetchedAt` for every data source, and the date of the sanctions file used (`sanctions.sanctionsDataDate`).

### How do I run a Brazilian company due diligence check? (step by step)

1. Paste CNPJs in `cnpjs` (with or without punctuation) or a CSV/text column in `csvText`.
2. Click **Start**.
3. Download the reports as JSON, CSV or Excel, or read them through the Apify API.

### Input example (JSON)

```json
{ "cnpjs": ["33.000.167/0001-01", "00000000000191"], "includePublicContracts": true, "contractsMonthsBack": 12 }
```

| Field | Default | Description |
|---|---|---|
| `cnpjs` | – | List of CNPJs (any punctuation) |
| `csvText` | – | Paste any text/CSV column with CNPJs |
| `maxItems` | 100 | Max CNPJs per run (cost cap, up to 10,000) |
| `includePublicContracts` | true | Add the PNCP awards summary |
| `contractsMonthsBack` | 12 | Months of award history (1–36) |
| `maxConcurrency` | 3 | Parallel reports (1–10) |
| `delayMs` | 400 | Pause per worker between CNPJs |
| `maxRetries` | 2 | Retries per source (0–5) |
| `skipInvalid` | false | Omit invalid CNPJs from output |

### Output example (real run, shortened)

```json
{
  "cnpjFormatted": "00.000.000/0001-91", "found": true, "riskLevel": "LOW",
  "summary": "LOW risk. BANCO DO BRASIL SA: ATIVA; 60.2 years old; no CEIS/CNEP sanctions; 318 public awards (R$ 2,802,499,009.67).",
  "riskFlags": [],
  "company": { "legalName": "BANCO DO BRASIL SA", "status": "ATIVA", "openingDate": "1966-08-01", "companySize": "DEMAIS", "partnersCount": 41 },
  "sanctions": { "checked": true, "sanctionsDataDate": "2026-10-23", "hasMatch": false, "hasActiveSanction": false, "matchesCount": 0, "matches": [] },
  "publicContracts": { "checked": true, "awardsCount": 318, "totalAwardedBRL": 2802499009.67, "distinctBuyers": 133, "firstAwardDate": "2025-10-27", "lastAwardDate": "2026-09-29",
    "topBuyers": [{ "buyerCnpj": "00394411000109", "buyerState": "DF", "awardsCount": 1, "totalAwardedBRL": 1250000000 }] }
}
```

A company with an active sanction (same real run):

```json
{
  "cnpjFormatted": "11.338.577/0001-24", "found": true, "riskLevel": "HIGH",
  "summary": "HIGH risk. CASSOL REPRESENTACOES E INTERMEDIACOES LTDA: ATIVA; 16.9 years old; ACTIVE sanction found; no public awards in period. Flags: ACTIVE_SANCTION_CNEP.",
  "riskFlags": [{ "code": "ACTIVE_SANCTION_CNEP", "severity": "HIGH", "message": "1 active CNEP sanction(s) on this CNPJ: Multa." }],
  "sanctions": { "checked": true, "sanctionsDataDate": "2026-10-23", "hasActiveSanction": true, "matchesCount": 1,
    "matches": [{ "list": "CNEP", "matchType": "CNPJ_EXACT", "category": "Multa", "startDate": "2022-07-01", "endDate": null, "active": true,
      "agency": "Petróleo Brasileiro S.A.", "processNumber": "PAR-PB.006.01186-2021", "fineBRL": 36680.49 }] }
}
```

Full real output: see `samples/sample_output.json`.

Not found / invalid rows: `{"found": false, "error": "NOT_FOUND" | "INVALID_CNPJ_CHECK_DIGITS" | "SOURCES_UNAVAILABLE: ..."}`.

### How much does a company due diligence report cost?

Pay per event: **$0.10 per report** (one CNPJ found at Receita Federal = one report, $100 / 1,000). **Invalid and not-found CNPJs are free.** The Actor respects your maximum total charge setting and stops cleanly when it is reached.

### FAQ

#### How much does it cost?

$0.10 per report (one CNPJ found at Receita Federal). Invalid and not-found CNPJs are free. Apify platform usage is billed by Apify as usual; set a maximum total charge per run to cap spend.

#### Can I use it for KYC / KYB and AML compliance?

Yes, as a first-pass public-data screen (registration status, CEIS/CNEP sanctions, risk flags with source URLs). It does not check international sanctions lists (OFAC, UN, EU), PEPs, court cases or credit bureaus, so combine it with those where your policy requires them.

#### Can I check many companies at once?

Yes: paste a list or a CSV column (up to 10,000 per run with `maxItems`), or call it from the Apify API, n8n, Make or Zapier.

#### Which sanctions lists are checked?

CEIS (Cadastro de Empresas Inidôneas e Suspensas) and CNEP (Cadastro Nacional de Empresas Punidas), published by CGU. The Actor downloads the current files once per run and reports the file date in `sanctions.sanctionsDataDate`. If the files cannot be downloaded, `sanctions.checked` is `false` with an error — the report never claims the company is clean in that case.

#### What does a CNPJ root match mean?

The first 8 digits identify the company group; other branches (filiais) share them. A `CNPJ_ROOT` match means a different establishment of the same company is sanctioned. Review it manually; sanctions may legally extend to the whole legal entity.

#### Where do the public contract numbers come from?

Awarded items from PNCP under Law 14.133 (via Compras.gov.br open data). It covers only awards published there, not older Law 8.666 contracts, and is capped at 20 pages per CNPJ (`publicContracts.truncated` tells you if the cap was hit). Cancelled awards are excluded.

#### How fresh is the Receita Federal data?

As fresh as the Receita open-data release used by the BrasilAPI and minhareceita.org mirrors (automatic failover).

#### Is it legal?

The data is public and published as open data. Partner CPFs are masked at the source. Use personal data in compliance with LGPD.

### Limitations

- **Public data only**; it does not include court cases, protests, credit scores, negative media or state/municipal sanction lists.
- **Not legal advice** and not a substitute for a full compliance review; the risk level is a heuristic based on the flags above.
- Sanctions reflect the CGU file of the date shown in `sanctionsDataDate` (the latest available, up to 7 days back).
- CPF-based sanctions (individuals, such as partners) are not matched; only company CNPJs are.
- Numeric CNPJs only (alphanumeric CNPJ is not yet supported).

### Related Actors

- [Brazil CNPJ Enrichment](https://apify.com/cairolabs/brazil-cnpj-enrichment) – cheap bulk CNPJ lookup (company data only).
- [PNCP Tenders Monitor](https://apify.com/cairolabs/pncp-tenders-monitor) – monitor new Brazilian public tenders.
- [Brazil Bills Monitor](https://apify.com/cairolabs/brazil-bills-monitor) – track bills in the Brazilian Congress.

***

### 🇧🇷 Due diligence de empresas por CNPJ (pt-BR)

Gere um **relatório de due diligence / KYB** a partir do CNPJ: dados cadastrais da **Receita Federal** (situação, CNAE, endereço, sócios/QSA, porte, capital), **sanções CEIS e CNEP** da CGU (CNPJ e raiz do CNPJ), **contratos públicos no PNCP** (Lei 14.133), **alertas de risco** e nível de risco ALTO/MÉDIO/BAIXO (`HIGH`/`MEDIUM`/`LOW`).

- **US$ 0,10 por relatório.** CNPJs inválidos e não encontrados não são cobrados.
- Útil para cadastro de fornecedores, análise de terceiros (Lei Anticorrupção), crédito B2B e M\&A.
- Somente dados públicos; não substitui análise jurídica. A data do arquivo de sanções é informada em cada relatório.

*Unofficial community Actor; not affiliated with Receita Federal, CGU or PNCP.*

# Actor input Schema

## `cnpjs` (type: `array`):

Brazilian company tax IDs, with or without punctuation (33.000.167/0001-01 or 33000167000101).

## `csvText` (type: `string`):

Paste any text containing CNPJs separated by line breaks, commas, semicolons or tabs.

## `maxItems` (type: `integer`):

Safety cap to control cost ($0.10 per report).

## `includePublicContracts` (type: `boolean`):

Adds a summary of Law 14.133 awards won by the company (count, total value, buyers, recent awards).

## `contractsMonthsBack` (type: `integer`):

How far back to look for PNCP awards.

## `maxConcurrency` (type: `integer`):

Parallel reports. Keep low to respect the public sources.

## `delayMs` (type: `integer`):

Per-worker pause between CNPJs (rate limiting).

## `maxRetries` (type: `integer`):

Retries with exponential backoff on 429/5xx before failing over.

## `skipInvalid` (type: `boolean`):

If on, CNPJs with wrong check digits are not written to the dataset.

## Actor input object example

```json
{
  "cnpjs": [
    "33000167000101",
    "00000000000191"
  ],
  "maxItems": 10,
  "includePublicContracts": true,
  "contractsMonthsBack": 12,
  "maxConcurrency": 3,
  "delayMs": 400,
  "maxRetries": 2,
  "skipInvalid": false
}
```

# Actor output Schema

## `overview` (type: `string`):

One row per input CNPJ: risk level, flags, sanctions and public contract summary, or found=false with an error code (NOT_FOUND / INVALID_CNPJ_CHECK_DIGITS / SOURCES_UNAVAILABLE).

## `results` (type: `string`):

All dataset items with every field.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cnpjs": [
        "33000167000101",
        "00000000000191"
    ],
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("cairolabs/brazil-company-due-diligence").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "cnpjs": [
        "33000167000101",
        "00000000000191",
    ],
    "maxItems": 10,
}

# Run the Actor and wait for it to finish
run = client.actor("cairolabs/brazil-company-due-diligence").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cnpjs": [
    "33000167000101",
    "00000000000191"
  ],
  "maxItems": 10
}' |
apify call cairolabs/brazil-company-due-diligence --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,cairolabs/brazil-company-due-diligence"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/qLGgBk5qcbI8aGlIG/builds/qQdEvEntSjy8EXFR8/openapi.json