Countries › Brazil › Guide › 13. Regulation › Business regulation in Brazil: competition, data protection, anti corruption, AML and environmental rules

Business regulation in Brazil: competition, data protection, anti corruption, AML and environmental rules

Last verified: 2026-10-26 · Status: Changing

Deals in which one group has R$750,000,000 and another R$75,000,000 of Brazilian revenue must be cleared by CADE before closing, and the data protection law (LGPD) reaches any company handling data of people in Brazil, with fines up to 2 percent of revenue capped at R$50,000,000 per infraction. The Clean Company Act makes companies strictly liable for bribery with fines up to 20 percent of gross revenue, which a good integrity program can reduce. AML duties apply to banks and many other businesses, and a new general environmental licensing law in force since February 2026 sets license types and review deadlines.

USD figures use the Banco Central do Brasil PTAX selling rate of R$5.0377 per US dollar for 23 October 2026, the last business day before verification. Conversions are for orientation only.

Key facts

Brazilian revenue of one group that triggers mandatory CADE filing	750000000 BRLLei nº 12.529 art. 88 I; Portaria Interministerial nº 994/2012 art. 1 I, as of 2012-05-30 · in force
Brazilian revenue of another group that triggers mandatory CADE filing	75000000 BRLLei nº 12.529 art. 88 II; Portaria Interministerial nº 994/2012 art. 1 II, as of 2012-05-30 · in force
CADE merger filing fee	85000 BRLLei nº 12.529 art. 23 as worded by Lei nº 13.196/2015, as of 2016-01-01 · in force
Maximum CADE merger review period, extendable by up to 90 days	240 daysLei nº 12.529 art. 88 §§ 2 and 9, as of 2011-11-30 · in force
Maximum fine for closing a notifiable deal before CADE approval	60000000 BRLLei nº 12.529 art. 88 § 3, as of 2011-11-30 · in force
Maximum antitrust fine for companies, percent of gross revenue in the affected field	20 %Lei nº 12.529 art. 37 I, as of 2011-11-30 · in force
Market share presumed dominant	20 %Lei nº 12.529 art. 36 § 2, as of 2011-11-30 · in force
Maximum LGPD simple fine, percent of Brazilian revenue	2 %Lei nº 13.709 art. 52 II, as of 2021-08-01 · in force
LGPD fine cap per infraction	50000000 BRLLei nº 13.709 art. 52 II, as of 2021-08-01 · in force
Deadline to notify ANPD and data subjects of a relevant security incident	3 business daysResolução CD/ANPD nº 15/2024 arts. 6 and 9, as of 2024-04-24 · in force
Maximum Clean Company Act fine, percent of gross revenue	20 %Lei nº 12.846 art. 6 I, as of 2013-08-01 · in force
Maximum fine reduction for an effective integrity program, percent of revenue	5 %Decreto nº 11.129 art. 23 V, as of 2022-07-11 · in force
Deadline to report a suspicious transaction to COAF	24 hoursLei nº 9.613 art. 11 II, as of 2012-07-09 · in force
Fixed cap of AML administrative fine (alternatives: twice the transaction or twice the profit)	20000000 BRLLei nº 9.613 art. 12 II c, as of 2012-07-09 · in force
Maximum environmental administrative fine	50000000 BRLLei nº 9.605 art. 75, as of 1998-02-12 · in force
Maximum licensing authority review period for a prior license with EIA	10 monthsLei nº 15.190 art. 47 I, as of 2026-02-04 · in force

The rule

1. Mergers, acquisitions of control or of parts of companies, incorporations, and associative contracts, consortia or joint ventures are acts of concentration. They must be filed with CADE, the competition authority, before closing when, cumulatively, one group involved had gross annual revenue or business volume in Brazil in the prior year of at least R$750,000,000 and at least one other group had at least R$75,000,000. The statute sets R$400,000,000 and R$30,000,000, but Portaria Interministerial nº 994 of 30 May 2012 raised them under the power in art. 88 § 1, and CADE applies the higher figures. Revenue is counted for the whole economic group.
Cost to do it: CADE filing fee (taxa processual) of R$85,000 per filing, about US$16,873, under art. 23 as worded by Lei nº 13.196 of 2015, plus economic and legal advisory fees, which are negotiated.
Example: A foreign group with R$2,000,000,000 of Brazilian revenue buys control of a Brazilian company with R$100,000,000 of revenue: both thresholds are met, so the deal must be filed and the R$85,000 fee paid before closing. If the target had R$60,000,000 of revenue and the seller group no other Brazilian revenue, no filing would be mandatory. / Buyer group about US$397,006,570 of Brazilian revenue and target about US$19,850,329; fee about US$16,873. Thresholds are about US$148,877,464 and US$14,887,746.Lei nº 12.529 of 30 November 2011 (Competition Law); Portaria Interministerial MJ/MF nº 994 of 30 May 2012, Lei nº 12.529 art. 88 caput, items I and II, and § 1; art. 90 items I to IV; Portaria nº 994 art. 1, 2012-05-30 official text · verified 2026-10-26

2. Merger control is prior: a notifiable deal may not be closed before CADE decides, on pain of nullity, a fine of no less than R$60,000 and up to R$60,000,000, and an administrative proceeding. Review must end within 240 days of filing, extendable once by up to 90 days by reasoned decision of the CADE Tribunal. Deals that eliminate competition in a substantial part of a relevant market or create or strengthen a dominant position are prohibited unless they meet the efficiency conditions of § 6.
Cost to do it: Gun jumping exposure: fine from R$60,000 to R$60,000,000 plus nullity of the acts performed.
Example: Maximum gun jumping fine R$60,000,000; minimum R$60,000. / About US$11,910,197 maximum and US$11,910 minimum.Lei nº 12.529 of 30 November 2011 (Competition Law), Art. 88 §§ 2, 3, 5 and 9, 2011-11-30 official text · verified 2026-10-26

3. Acts that have as object or may produce the effects of restricting competition, dominating a relevant market, arbitrarily increasing profits or abusing a dominant position are infringements of the economic order regardless of fault. Dominance is presumed when a company or group can change market conditions unilaterally or in coordination, or controls 20 percent or more of the relevant market; CADE may change that percentage for specific sectors. Companies are fined from 0.1 to 20 percent of the gross revenue of the company, group or conglomerate in the field of activity affected in the year before the proceeding, never less than the advantage obtained when it can be estimated; other entities from R$50,000 to R$2,000,000,000; and an officer directly or indirectly responsible, when fault or intent is proven, from 1 to 20 percent of the company's fine.
Cost to do it: Fines of 0.1 to 20 percent of gross revenue in the affected field, plus personal fines for responsible officers.
Example: A company with R$400,000,000 of revenue in the affected field in the prior year faces a fine of R$400,000 to R$80,000,000. / About US$79,401 to US$15,880,263 on revenue of about US$79,401,314.Lei nº 12.529 of 30 November 2011 (Competition Law), Art. 36 caput and § 2; art. 37 items I to III, 2011-11-30 official text · verified 2026-10-26

4. The data protection law (LGPD) applies to any processing, regardless of the country where the processor is based or where data is stored, if the processing occurs in Brazil, aims to offer or supply goods or services to individuals in Brazil, or concerns data collected in Brazil. Processing needs one of the ten legal bases of art. 7, such as consent, legal obligation, performance of a contract or legitimate interest. The controller must appoint a data protection officer (encarregado). The ANPD may apply warnings, a simple fine of up to 2 percent of the revenue in Brazil of the private legal entity, group or conglomerate in its last fiscal year, net of taxes, capped at R$50,000,000 per infraction, daily fines within the same cap, publication of the infraction, blocking or deletion of data, and suspension or prohibition of processing. Administrative sanctions apply from 1 August 2021.
Cost to do it: No registration fee; the cost is the compliance program (records, legal bases, officer, security, contracts). Exposure up to 2 percent of Brazilian revenue capped at R$50,000,000 per infraction.
Example: A company with R$1,000,000,000 of Brazilian revenue: 2 percent is R$20,000,000, under the cap. With R$5,000,000,000 of revenue, 2 percent would be R$100,000,000, so the R$50,000,000 cap per infraction applies. / On about US$198,503,285 of revenue, up to about US$3,970,066; the cap is about US$9,925,164 per infraction.Lei nº 13.709 of 14 August 2018 (LGPD), as amended by Lei nº 13.853 of 2019 and Lei nº 14.010 of 2020, Art. 3 items I to III; art. 7 items I to X; art. 41; art. 52 items I to VI and X to XII; art. 65 item I-A, 2018-08-14 official text · verified 2026-10-26

5. The controller must notify the ANPD and affected data subjects of a security incident that may cause relevant risk or damage to them. The ANPD regulation sets the deadline at 3 business days, counted from when the controller learns the incident affected personal data, unless specific legislation sets another deadline; missing information may be supplemented within 20 business days.
Cost to do it: Filing through the ANPD electronic form is free; the cost is incident response, forensic and legal work.Lei nº 13.709 of 14 August 2018 (LGPD); Resolução CD/ANPD nº 15 of 24 April 2024 (Security Incident Reporting Regulation), LGPD art. 48 caput and § 1; Resolução CD/ANPD nº 15, Annex, arts. 6 and 9, 2024-04-24 official text · verified 2026-10-26 · changed: Resolução CD/ANPD nº 15 of 24 April 2024 replaced the ANPD's earlier guidance with a binding 3 business day deadline for notifying the ANPD and data subjects.

6. Personal data may be transferred abroad only on the grounds in LGPD art. 33, including adequacy of the destination, standard contractual clauses, global corporate rules, specific clauses approved by the ANPD, specific consent and the art. 7 bases of legal obligation, contract and exercise of rights. The ANPD regulation approved the Brazilian standard contractual clauses, which must be adopted in full without changes, and gave controllers using contractual clauses 12 months from publication on 23 August 2024 to incorporate them.
Cost to do it: No fee for standard clauses; specific clauses and global corporate rules need ANPD approval.Lei nº 13.709 of 14 August 2018 (LGPD); Resolução CD/ANPD nº 19 of 23 August 2024 (International Transfer Regulation), LGPD art. 33 items I to IX; Resolução CD/ANPD nº 19 art. 2 sole paragraph; Annex I arts. 1, 15, 16 and 25 to 28; Annex II, 2024-08-23 official text · verified 2026-10-26 · changed: Resolução CD/ANPD nº 19 of 23 August 2024 regulated international transfers and approved the Brazilian standard contractual clauses; the 12 month window to incorporate them ran from publication on 23 August 2024. A rectification was published on 18 August 2025.

7. Companies are strictly liable, administratively and civilly, for harmful acts against Brazilian or foreign public administration done in their interest or benefit, such as promising, offering or giving undue advantage to a public agent directly or through third parties, or defrauding public tenders and contracts. The law applies to foreign companies with a seat, branch or representation in Brazil. Administrative sanctions are a fine of 0.1 to 20 percent of gross revenue in the year before the proceeding, never less than the advantage obtained, or R$6,000 to R$60,000,000 when revenue cannot be used, and extraordinary publication of the decision. Courts may order forfeiture of gains, suspension of activities, compulsory dissolution and a ban on public incentives and loans for 1 to 5 years. A leniency agreement can cut the fine by up to two thirds.
Cost to do it: Fines of 0.1 to 20 percent of gross revenue; leniency reduces the fine by up to two thirds.
Example: A company with R$500,000,000 of gross revenue faces a fine of R$500,000 to R$100,000,000. / About US$99,252 to US$19,850,329 on revenue of about US$99,251,643.Lei nº 12.846 of 1 August 2013 (Clean Company Act), Arts. 1 sole paragraph, 2, 5 items I to IV, 6 items I and II and § 4, 16 § 2 and 19, 2013-08-01 official text · verified 2026-10-26

8. In federal proceedings the fine is built as a sum of aggravating percentages of gross revenue, net of taxes, less mitigating percentages. An integrity program that meets the decree's parameters reduces the fine by up to 5 percentage points of revenue, the largest single reduction. The program is assessed against 15 parameters, including top management commitment, a code of conduct extended to third parties, training, periodic risk assessment, accurate books, an independent compliance function, reporting channels with whistleblower protection, risk based third party due diligence and integrity checks in mergers.
Cost to do it: Cost of a documented integrity program; the payoff is a reduction of up to 5 percent of gross revenue in any fine.
Example: On R$500,000,000 of gross revenue net of taxes, a qualifying integrity program can cut the fine by up to R$25,000,000. / Up to about US$4,962,582 on revenue of about US$99,251,643.Decreto nº 11.129 of 11 July 2022 (regulation of Lei nº 12.846), Arts. 20, 22, 23 item V, 56 and 57, 2022-07-11 official text · verified 2026-10-26

9. Money laundering is a crime punished with 3 to 10 years of imprisonment and a fine. Obligated persons, which include financial institutions, insurers, card and payment businesses, real estate developers and brokers of property sales, dealers in luxury or high value goods, advisers and consultants in transactions such as company and real estate deals, sports and artist rights intermediaries and virtual asset service providers, must identify clients, keep records, adopt internal policies and controls, register with their regulator or COAF, and report proposed or completed suspicious transactions to COAF within 24 hours without tipping off anyone. Administrative fines may reach the greatest of twice the transaction, twice the profit obtained or R$20,000,000, with disqualification of managers for up to 10 years and loss of authorization.
Cost to do it: Compliance program costs; administrative fines up to the greatest of twice the transaction, twice the profit or R$20,000,000.
Example: Maximum fixed administrative fine R$20,000,000. / About US$3,970,066.Lei nº 9.613 of 3 March 1998 (Anti Money Laundering Law), as amended by Lei nº 12.683 of 9 July 2012 and Lei nº 14.478 of 2022, Art. 1 caput; art. 9 sole paragraph items I to XIX; art. 10 items I to V; art. 11 item II; art. 12 items I to IV, 2012-07-09 official text · verified 2026-10-26

10. Companies are liable administratively, civilly and criminally for environmental offenses decided by their legal representative or board in their interest or benefit, without excluding individual liability. Building, expanding or operating a potentially polluting activity without the required environmental license is a crime. Administrative sanctions include warnings, simple and daily fines, embargo, demolition and suspension of activities, with fines from R$50 to R$50,000,000.
Cost to do it: Fines from R$50 to R$50,000,000 per infraction, plus embargo and remediation.
Example: Maximum administrative fine R$50,000,000. / About US$9,925,164.Lei nº 9.605 of 12 February 1998 (Environmental Crimes Law), art. 60 as worded by Lei nº 15.190 of 8 August 2025, Arts. 3, 21, 60, 72 and 75, 1998-02-12 official text · verified 2026-10-26 · changed: Lei nº 15.190 of 8 August 2025 rewrote the penalty in art. 60 for operating without an environmental license to detention of 6 months to 2 years, a fine, or both, in force from 4 February 2026.

11. The General Environmental Licensing Law sets national rules for licensing. License types are prior (LP), installation (LI), operation (LO), single (LAU), by adhesion and commitment (LAC, a self declared license), corrective operation (LOC, to regularize activities running without a license) and special (LAE, for strategic projects). Maximum review periods for the licensing authority are 10 months for an LP with an environmental impact study (EIA), 6 months for an LP with other studies, 3 months for LI, LO, LOC and LAU, 4 months for two phase licensing without EIA and 12 months for LAE. The law was published on 8 August 2025 with 63 vetoes, entered into force 180 days later, and Congress later overrode part of the vetoes.
Cost to do it: Licensing fees are set by each federal, state or municipal licensing authority and vary by activity size and polluting potential; environmental studies such as an EIA are a significant separate cost.Lei nº 15.190 of 8 August 2025 (General Environmental Licensing Law), Art. 3 items XXVI to XXXII; art. 5 items I to VII; art. 47 items I to V; art. 67, 2025-08-08 official text · verified 2026-10-26 · changed: New framework law in force from 4 February 2026 (180 days after publication on 8 August 2025), creating the LAC, LOC and LAE and maximum review periods; Congress rejected part of the partial veto and the restored provisions were promulgated afterward.

Regime	Main law	Authority	Key trigger or duty	Top exposure
Merger control	Lei nº 12.529/2011 art. 88; Portaria nº 994/2012	CADE	Groups with R$750,000,000 and R$75,000,000 of Brazilian revenue: file before closing	Nullity plus fine up to R$60,000,000 (US$11,910,197) for gun jumping
Antitrust conduct	Lei nº 12.529/2011 arts. 36 and 37	CADE	Abuse of dominance (20 percent share presumed dominant), cartels	0.1 to 20 percent of revenue in the affected field
Data protection	Lei nº 13.709/2018 (LGPD); Resoluções CD/ANPD nº 15 and 19/2024	ANPD	Legal basis, officer, 3 business day breach notice, transfer mechanisms	2 percent of Brazilian revenue capped at R$50,000,000 (US$9,925,164) per infraction
Anti corruption	Lei nº 12.846/2013; Decreto nº 11.129/2022	CGU and each public body; courts	Strict corporate liability for bribery and procurement fraud	0.1 to 20 percent of gross revenue; dissolution by court
Anti money laundering	Lei nº 9.613/1998	COAF and sector regulators	KYC, records, controls, 24 hour suspicious transaction reports	Greatest of 2x the transaction, 2x the profit or R$20,000,000 (US$3,970,066)
Environment	Lei nº 9.605/1998; Lei nº 15.190/2025	IBAMA, state and municipal agencies	License before building or operating polluting activities	Fines up to R$50,000,000 (US$9,925,164); embargo; criminal liability

Brazil's five core business regulatory regimes at a glance (sources in the rules above). USD at PTAX R$5.0377.

Worked example

Acquisition checklist. A foreign group with R$2,000,000,000 (about US$397,006,570) of revenue in Brazil agrees to buy a Brazilian company with R$100,000,000 (about US$19,850,329) of revenue. Both CADE thresholds are met (Lei nº 12.529 art. 88; Portaria nº 994 art. 1), so the parties file, pay R$85,000 (about US$16,873) and wait for clearance before closing; integration steps such as setting prices together or transferring management before approval risk a gun jumping fine of up to R$60,000,000 (about US$11,910,197). Diligence should also test the target's LGPD records, any history of public contracts under Lei nº 12.846, and its environmental licenses.
Anti corruption fine with and without a program. A company with R$500,000,000 (about US$99,251,643) of gross revenue net of taxes is fined in a federal proceeding. If aggravating factors add up to 8 percent of revenue, the fine starts at R$40,000,000 (about US$7,940,131); a qualifying integrity program can subtract up to 5 points, lowering it to R$15,000,000 (about US$2,977,549) before other reductions (Decreto nº 11.129 arts. 20, 22 and 23). A leniency agreement can then cut the fine by up to two thirds (Lei nº 12.846 art. 16 § 2).
Data breach. A retailer with R$5,000,000,000 (about US$992,516,426) of Brazilian revenue learns on a Monday that customer data was exposed. It must notify the ANPD and affected customers by Thursday, within 3 business days (Resolução CD/ANPD nº 15 arts. 6 and 9). A fine for the underlying violation is capped at R$50,000,000 (about US$9,925,164) per infraction even though 2 percent of revenue would be R$100,000,000 (LGPD art. 52 II).

Step by step

1. At deal stage, compute the Brazilian revenue of each economic group for the prior year; if one group has R$750,000,000 and another R$75,000,000, plan the CADE filing and up to 240 days (plus up to 90) of review into the timetable, and keep the businesses separate until clearance.
2. On entry, map the personal data the Brazilian business will process, record a legal basis for each purpose (LGPD art. 7), appoint the data protection officer (art. 41) and put the ANPD standard contractual clauses or another art. 33 mechanism in place for transfers to the parent abroad.
3. Prepare an incident response plan that can notify the ANPD and data subjects within 3 business days.
4. Adopt an integrity program built on the 15 parameters of Decreto nº 11.129 art. 57, with third party due diligence for agents, distributors and customs brokers who deal with public officials.
5. Check whether the Brazilian business is an obligated person under Lei nº 9.613 art. 9 (for example payments, real estate, luxury goods or virtual assets); if so, register with the competent regulator or COAF and set up KYC, records and 24 hour reporting.
6. Before building or expanding any plant, confirm with the competent federal, state or municipal agency which license type applies under Lei nº 15.190 and budget the review period of art. 47, then keep license conditions monitored in operation.

Common traps

Closing before CADE clears the deal. Any step that transfers control or integrates the businesses before approval can be gun jumping, with nullity and fines up to R$60,000,000 (Lei nº 12.529 art. 88 § 3).
Counting only the target's revenue. CADE thresholds use the revenue of the whole economic group in Brazil, so a small target bought by a large group can still require a filing.
Assuming the LGPD does not reach a foreign company. It applies to processing of data collected in Brazil or aimed at offering goods or services to people in Brazil, wherever the processor sits (LGPD art. 3).
Treating 3 business days as 3 days from confirmation. The deadline runs from when the controller learns that personal data was affected (Resolução CD/ANPD nº 15 art. 6).
Editing the ANPD standard clauses. They must be adopted in full without changes; a modified version needs ANPD approval as specific clauses (Resolução CD/ANPD nº 19, Annex I arts. 15, 16 and 21).
Relying on agents. Undue advantage given through a third party still triggers strict corporate liability (Lei nº 12.846 arts. 2 and 5 I), and fines start from gross revenue, not profit.
Operating while a license is pending. Running a potentially polluting activity without a license is a crime for the company and its decision makers (Lei nº 9.605 arts. 3 and 60).

Sources

← Brazil's key sectors: oil and gas, power, mining, telecom, infrastructure and agribusiness finance, and the rules that govern themDisputes in Brazil: courts, arbitration and enforcing foreign judgments and awards →