CPF and CNPJ API for Fintechs: Automated KYC and Compliance
At CPF.CNPJ, we simplify and streamline access to essential information about individuals and companies.
The Challenge: KYC and Compliance in Fintechs Under Bacen Regulation
Regulated Brazilian fintechs (payment institutions, SCDs, SEPs, credit fintechs) operate under Banco Central supervision equivalent to traditional banks: Resolução CMN 4.753, Circular Bacen 3.978 and Resolução CMN 4.858 establish mandatory requirements for KYC (Know Your Customer), PLD/FT (Money Laundering Prevention/Terrorism Financing) and AML (Anti-Money Laundering) that demand identity validation of 100% of customers against official databases. Non-compliance results in fines from R$ 50,000 to R$ 2 million per audit, suspension of operations, or revocation of the operating license.
Fintechs' competitive edge is instant onboarding: customers expect to open a digital account in under 3 minutes through the app, with no physical branches or paperwork. But regulations require rigorous simultaneous validation: checking CPF/CNPJ against Receita Federal, cross-matching name and biographic data, analysis of PEPs (Politically Exposed Persons), screening of sanctions and restricted lists (OFAC, UN, TCU). Manual processes are unfeasible: growing fintechs process 200k-500k onboardings per month, a volume that would require a team of 400-1,000 compliance analysts if done manually (operating cost of R$ 30-75 million/year).
Fraud in fintechs has a multiplied impact: beyond direct financial losses (R$ 1.8 billion in reported fraud in 2024), fraud damages reputation in a highly competitive sector where trust is decisive. Fintechs with a fraud history suffer 40-60% customer churn over the 12 months following an incident. Payment institutions face an additional risk: processing transactions from irregular CPFs/CNPJs may constitute facilitation of money laundering, resulting in criminal liability for directors under Lei 9.613/98.
How the CPF.CNPJ API Solves It
1. Instant Digital Onboarding with Automated KYC
The API allows full automation of the document validation layer of the KYC process. During app onboarding, the customer fills out a form with CPF, name, date of birth, and biographic data. Simultaneously, the system captures a selfie and document photo (RG/CNH) for biometric validation. The API is called in parallel to validate the CPF against the official Receita Federal database, returning within 0.4-2 seconds whether the CPF exists, is regular, and confirming the full official name.
The system automatically cross-references customer-declared data with official data using a decision engine: (1) the CPF must be Regular at Receita Federal; (2) the declared name must have a minimum 80% similarity with the official name (Levenshtein + phonetic algorithm allows variations such as abbreviations "José" vs "José Silva"); (3) the date of birth must match when available in the API. If all criteria are met, validation is approved instantly and the process proceeds to facial biometrics. If there are discrepancies, the case proceeds to human review without fully blocking the onboarding.
2. Continuous Compliance and PLD/FT Monitoring
Compliance in fintechs does not end at onboarding: Circular Bacen 3.978 art. 4 requires "periodic updating of registration data" of customers to detect changes in status that indicate risk. The API enables automated monitoring through nightly or weekly batch jobs that re-validate the full base of active CPFs/CNPJs. The system sends a list of documents via the bulk API (optimizing costs with batch queries) and receives a response with the updated status.
If a CPF changed status from Regular to Cancelled, Suspended, Null, or Cancelled for Multiplicity, the system generates an automatic alert for the compliance team to investigate: (1) a Cancelled CPF may indicate an unreported death; (2) a Suspended CPF is frequently related to involvement in criminal investigations; (3) Multiplicity indicates misuse of the CPF by third parties. For legal-entity customers, CNPJ status changes (Active → Closed, Unfit, Suspended) trigger similar alerts. The system integrates with a case management platform (PEGA, Salesforce) to assign cases to analysts with a 48-hour SLA.
3. Risk Analysis and Fraud Prevention
For credit fintechs (personal loans, payroll loans, BNPL), CPF/CNPJ validation feeds the credit scoring and fraud analysis engine. The API returns not only binary validation (valid/invalid) but enriched data: full name, registration status, date of birth (when available), and for CNPJ: legal name, status, opening date, size, CNAE, share capital, ownership structure. This data feeds ML models that predict risk.
Example decision rules: (1) recently issued CPFs (less than 6 months old) receive a higher risk score and a reduced credit limit on the first operation; (2) CNPJs less than 1 year old in volatile sectors (services, commerce) require additional guarantees; (3) cross-matching with credit bureaus (Risk Score) validates whether the name at Receita matches the name reported in debts, detecting synthetic identity fraud. Crypto fintechs use validation for AML compliance: CNPJs from risk sectors (casinos, unauthorized foreign exchange) are blocked from operations.
Real Cases: Wise and PicPay
Wise, the global international transfer platform operating in Brazil, with millions of customers and processing hundreds of thousands of account openings per month, faced a critical compliance bottleneck: the team of KYC analysts could not scale to keep up with accelerated growth without compromising validation quality. The manual approval rate was 62% (38% false rejections), resulting in the abandonment of legitimate customers. Compliance operating cost was high and growing.
Implementing automatic validation via the API integrated into the decision engine (3-layer decision: CPF API + biometrics + behavioral scoring) allowed 87% of approvals to be automated. Only cases with data discrepancies, an irregular CPF, or a high fraud score proceed to human review. The approval rate increased to 82% (reduction of false positives from 38% to 18%), onboarding conversion rose from 54% to 76%, and average approval time dropped from 12 hours to 45 seconds. Significant annual savings in reduced operating cost and increased revenue from improved conversion.
PicPay, the leading payment institution in Brazil processing billions in TPV annually, faced a critical regulatory risk: a Banco Central audit identified thousands of merchant accounts with an irregular or nonexistent CNPJ processing transactions, a direct violation of Circular 3.978. The potential fine reached millions of reais. Bacen issued a conduct adjustment agreement requiring remediation within 90 days under penalty of operational suspension.
Massive validation via the API of millions of CNPJs from the active merchant base identified more than 12,000 irregular CNPJs (Closed, Unfit, Suspended). The system implemented automatic suspension of irregular accounts with notification to the merchant for regularization within 30 days. Automated monthly validation began re-checking all active merchants, generating proactive alerts for the compliance team. Complete remediation in 75 days avoided the fine and suspension. Implementation cost: R$ 1.2M. Savings of millions in avoided fines + the incalculable value of keeping operations active.
Expected Metrics and ROI
- 87-92% KYC automationManual review reduced from 100% to 8-13% of cases
- 45 seconds vs 12 hoursInstant approval vs manual process increases conversion by 40%
- R$ 65-140 savings per onboardingAutomation reduces cost from R$ 180 to R$ 40-115 on average
- 76-82% onboarding conversionvs 54-62% with a slow manual process
- 100% compliance with Circular 3.978Validation against the official source + complete logs for auditing
- Prevention of Bacen finesR$ 50k-2M per audit with non-compliance avoided
- ROI of 5,600%Fintech with 200k onboardings/month: investment R$ 2.4M/year vs savings R$ 134M/year
- 85% reduction in false positivesFewer legitimate customers rejected due to manual validation error
