CNPJ Due Diligence – Registry, Sanctions, Contracts & CVM

Watch the demo: https://youtu.be/lz-ZwLdJK0k

Check a Brazilian company by CNPJ in one call. For each CNPJ you get one row with four public fronts side by side: the Receita Federal registry, federal sanctions (CEIS, CNEP, CEPIM, leniency agreements), federal government contracts and the CVM (securities regulator) registration. Every fact carries its source, status and query date. No score, no risk rating, no personal data: only facts.

Price: $0.02 per CNPJ report. Invalid CNPJs, CNPJs unknown to Receita Federal and status rows are free. Português: README.pt-BR.md

What makes it different

Most CNPJ actors on the Store return registry data only. This one joins four official fronts and tells you, per source, whether the answer is ok, nao_encontrado, erro, timeout or limite_excedido. An empty sanctions list with status ok means "nothing in that database"; a source that was down comes back as null and is listed in secoes_com_falha. The two are never mixed up.

Use cases

• Supplier and partner onboarding: registry situation plus federal sanctions before signing.
• Credit and KYB pre-checks: is the company active, sanctioned, a listed issuer, a federal supplier?
• Procurement and compliance teams: batch-check a vendor list and keep the sources and dates as evidence.
• Sales and research: confirm that a prospect exists and what its public footprint looks like.

Input

Field	Default	Description
cnpjs	["33000167000101"]	CNPJs with or without punctuation (33.000.167/0001-01). Check digits are validated before any source is called.
maxItems	10	Max CNPJs queried per run, 1–100. Duplicates are queried once.

{ "cnpjs": ["33000167000101", "00.000.000/0001-91"], "maxItems": 10 }

Output (one row per CNPJ)

Field	Content
cnpj	14 characters, no punctuation
consultado_em	ISO timestamp, São Paulo time (−03:00)
fontes[]	per source: nome, url, status (ok, nao_encontrado, erro, timeout, limite_excedido), de_cache, idade_cache_s, consultado_em
cadastro	legal name, status, opening date, legal nature, size, share capital, main and secondary CNAE, city/state, address, Simples/MEI, dados_omitidos_lgpd
sancoes	ceis, cnep, cepim, acordos_leniencia, total_registros
contratos	scope (Federal Executive Branch), total_encontrado, latest 10 contracts
cvm	registrada, registros (CVM code, status, category, sector, auditor company)
completo	true only if every section answered
secoes_com_falha	sections that came back null
aviso	public data, no warranty, not legal or financial advice

A real example (Petrobras, 33000167000101, run on 2026-11-08) is in docs/amostra-petrobras-2026-11-08.json: registry ATIVA, no records in CEIS/CNEP/CEPIM/leniency (status ok), 55 federal contracts found, CVM code 9512, all 7 sources ok.

Status rows (free, no billing event) replace the report when: invalid_cnpj (bad format or check digits), not_found (Receita Federal does not know the CNPJ), source_unavailable (no source answered) and skipped_max_items.

Coverage and limits (read this)

• Sanctions and contracts are federal only. CEIS, CNEP, CEPIM and leniency agreements are federal registries; contracts are from the Federal Executive Branch only. No record here does not prove there is none at state or municipal level, in the Legislative/Judiciary, or in other databases.
• A branch (filial) CNPJ is also checked against its head office, because sanctions fall on the legal entity. Records from another establishment are flagged outro_estabelecimento: true.
• Public data from third parties, no guarantee of completeness or freshness. Not legal or financial advice. There is no risk score by design.
• Registry: BrasilAPI, falling back to OpenCNPJ. CVM: the daily open-data file. Sanctions and contracts: Portal da Transparência (CGU).
• Contracts: the Portal does not sort results, so the Actor reads up to 10 pages (150) per CNPJ and returns the 10 most recent; possivelmente_mais flags a capped read.

Personal data (LGPD)

The Actor never returns partners (QSA), e-mails or phone numbers, and drops CVM contact fields. For sole proprietors, EIRELI, single-member law firms, other individual-person legal natures and MEI, the legal name, trade name and address are omitted and dados_omitidos_lgpd is true; status, CNAE, city/state and dates are kept. Sanction and contract records whose counterpart is a CPF or an unrelated company are discarded.

Pricing

Pay per event: $0.02 per CNPJ report (cnpj-consulted), charged even if the report is partial, as long as at least one source answered and the CNPJ is known to Receita Federal. Plus the standard platform start event. For reference, registry-only lookups on the Store cost roughly $0.001–$0.002, lead lists $0.07 and litigation checks $0.35; this Actor covers four fronts and does not compete on raw registry price.

Operator note: Portal da Transparência key

Sanctions and contracts need a free Portal da Transparência API key, read from the environment variable PORTAL_TRANSPARENCIA_API_KEY of the Actor run (set it as a secret in the Actor settings). It is not an input field and users never provide it. Without it these sections return null, their sources show erro ("chave … não configurada"), and completo is false; registry and CVM still work. In that case (or if the key is rejected) the report is still delivered but not charged (sem_cobranca_motivo = portal_api_key_missing / portal_api_key_invalid); a Portal failure with a valid key (timeout, 429, 5xx) is still charged as a partial report. Requests to the Portal are capped at 60 per minute to protect the key.

More from Errand Code

• Errand Code: https://errandcode.com/cnpj-due-diligence
• mcp-empresas-br, the same checks as an MCP server for AI agents: https://errandcode.com/mcp-empresas-br and https://mcpize.com/mcp/mcp-empresas-br
• Public docs: https://github.com/DouglasGouvea/mcp-empresas-br-docs