Brazil';s regulatory environment shifted materially in the second quarter, with significant legislative activity across tax reform implementation, financial market supervision, data protection enforcement, and corporate governance. For international businesses and foreign investors operating in Brazil, these changes carry direct compliance obligations and, in several cases, meaningful financial exposure if ignored. This guide covers the principal developments in brazil regulatory 2026, explains what each change means in practice, and identifies the steps businesses should take to stay compliant.
Brazil';s landmark tax reform, enacted through constitutional amendment and subsequent enabling legislation, continued its phased rollout during Q2. The two new consumption taxes - the Contribuição sobre Bens e Serviços (CBS), a federal levy, and the Imposto sobre Bens e Serviços (IBS), a subnational levy - moved from conceptual framework to operational detail as the Receita Federal do Brasil and the newly established Comitê Gestor do IBS published complementary regulations clarifying the tax base, credit mechanics, and transition rules.
The CBS and IBS together form the core of Brazil';s shift toward a dual value-added tax model, replacing a fragmented system of PIS, COFINS, ICMS, and ISS over a multi-year transition period. Recent regulations confirmed that businesses must begin adapting their fiscal systems, invoice structures, and accounting workflows well before the full transition deadline. Importantly, the split-payment mechanism - under which the tax is collected directly at the point of financial settlement rather than remitted by the taxpayer - was confirmed as the default collection model for digital transactions and marketplace platforms.
In practice, foreign companies operating through Brazilian subsidiaries or providing digital services to Brazilian consumers face a non-obvious requirement: they must register with the Comitê Gestor do IBS and comply with the split-payment rules even if their Brazilian revenue is modest. A common mistake among international groups is to treat the transition period as a grace period requiring no action. In fact, the obligation to adapt fiscal infrastructure begins now, and penalties for non-compliant invoicing can accumulate rapidly.
The Receita Federal also issued guidance on the Imposto Seletivo (IS), a selective excise tax targeting goods and services considered harmful to health or the environment. The list of covered goods was expanded in Q2 to include certain categories of single-use plastics and high-sugar beverages, with specific aliquots published for each category. Companies in consumer goods, food and beverage, and packaging industries should review their product portfolios against the updated IS schedule.
The Comissão de Valores Mobiliários (CVM), Brazil';s securities regulator, and the Banco Central do Brasil (Bacen) both issued significant regulatory updates during Q2, reflecting a coordinated push to align Brazilian financial market rules more closely with international standards.
CVM published a revised resolution on the disclosure obligations of publicly listed companies, strengthening requirements for material fact notifications and insider trading controls. The new rules lower the threshold for what constitutes a material fact requiring immediate public disclosure, and they extend the obligation to cover certain pre-IPO companies that have filed registration documents with the CVM. For foreign-controlled Brazilian entities listed on the B3 exchange, the practical implication is that group-level decisions made at the parent company level may now trigger disclosure obligations in Brazil if they are reasonably likely to affect the Brazilian subsidiary';s securities.
Bacen, for its part, issued updated guidance under its Resolution CMN framework governing foreign capital registration. The rules clarify the treatment of intercompany loans between Brazilian entities and their foreign parents, particularly regarding the registration of loan amendments, interest rate changes, and early repayment events in the Registro Declaratório Eletrônico (RDE) system. Many foreign groups underestimate the importance of keeping RDE records current. Failure to register amendments in a timely manner can result in the inability to remit principal and interest abroad, effectively trapping funds in Brazil.
Bacen also advanced its open finance framework, publishing technical standards for Phase 4 data sharing, which covers investment products and insurance. Financial institutions and fintechs operating in Brazil must comply with the new API specifications and data governance requirements within the timelines set by Bacen';s circular. Non-compliance carries supervisory sanctions and, for licensed institutions, the risk of licence conditions being imposed.
If your business is navigating CVM disclosure obligations or Bacen foreign capital registration requirements, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.
The Autoridade Nacional de Proteção de Dados (ANPD), Brazil';s data protection authority established under the Lei Geral de Proteção de Dados Pessoais (LGPD), significantly increased its enforcement activity during Q2. The quarter saw the conclusion of several administrative proceedings initiated in prior periods, resulting in the publication of formal decisions that clarify how the ANPD interprets key LGPD provisions in practice.
The ANPD';s decisions addressed three recurring issues. First, the authority confirmed that consent obtained through pre-ticked boxes or bundled with terms of service does not satisfy the LGPD';s requirement for free, specific, informed, and unambiguous consent. Second, the ANPD clarified that the legitimate interest legal basis - one of the ten lawful bases under Article 7 of the LGPD - requires a documented balancing test that weighs the controller';s interest against the data subject';s reasonable expectations. Third, the authority issued guidance on data breach notification timelines, confirming that the 72-hour notification window runs from the moment the controller becomes aware of the incident, not from the moment a full internal investigation is complete.
For international companies processing Brazilian personal data - whether through a local subsidiary, a Brazilian-facing website, or a service provided to Brazilian clients - these clarifications carry immediate practical weight. A common mistake is to rely on consent as the default legal basis for all processing activities. In practice, many B2B data processing activities are better supported by contract performance or legitimate interest, provided the balancing test is properly documented.
The ANPD also published a draft regulation on international data transfers during Q2, proposing a framework of adequacy decisions, standard contractual clauses, and binding corporate rules broadly analogous to the EU model. The draft is subject to public consultation, but businesses should begin assessing their cross-border data flows now, as the final regulation is expected to impose specific documentation and registration requirements.
On the corporate law front, the Departamento Nacional de Registro Empresarial e Integração (DREI), the federal body that sets standards for Brazil';s commercial registries, issued updated instructions affecting the registration and amendment of corporate documents. The changes are relevant to any foreign investor holding an interest in a Brazilian entity.
The updated DREI instructions revised the requirements for notarisation and apostille of foreign documents submitted to Brazilian commercial registries, including the Junta Comercial do Estado de São Paulo (JUCESP) and its counterparts in other states. Recent changes align the documentary requirements more closely with Brazil';s accession to the Hague Apostille Convention, reducing - but not eliminating - the need for consular legalisation in certain cases. In practice, the applicable requirements depend on the country of origin of the document and the specific registry involved, so case-by-case verification remains necessary.
DREI also updated its instructions on the use of digital signatures for corporate filings. Brazilian entities may now use qualified electronic signatures recognised under the Infraestrutura de Chaves Públicas Brasileira (ICP-Brasil) framework for a broader range of corporate acts, including amendments to articles of association and changes to management. For foreign signatories who do not hold an ICP-Brasil certificate, the rules provide alternative pathways, but these require advance planning and, in some cases, the appointment of a Brazilian attorney-in-fact.
The Agência Nacional de Vigilância Sanitária (ANVISA) and the Agência Nacional de Energia Elétrica (ANEEL) also issued sector-specific regulatory updates during Q2. ANVISA published revised good manufacturing practice requirements for pharmaceutical and medical device companies, while ANEEL updated its framework for distributed energy generation, expanding the categories of eligible installations and revising the net metering compensation rules. Companies in these sectors should review the updated frameworks against their current operational and licensing arrangements.
Consider two practical scenarios. A European pharmaceutical group seeking to register a new product in Brazil must now comply with the updated ANVISA GMP requirements from the outset of the registration process, not as a post-approval condition. A renewable energy developer planning a distributed generation project must verify that its installation category qualifies under the revised ANEEL framework before committing to project financing.
Given the breadth of Q2 regulatory activity, international businesses operating in Brazil should prioritise a structured compliance review across four areas.
On tax, the immediate priority is to assess readiness for the CBS/IBS transition. This means reviewing fiscal systems, invoice templates, and accounting workflows, and engaging with Brazilian tax counsel to map the split-payment obligations that apply to the business';s specific transaction types. Companies in the IS-affected sectors should update their product classification and pricing models to reflect the expanded excise schedule.
On financial regulation, foreign groups with intercompany loans involving Brazilian entities should audit their RDE registrations to confirm that all amendments, interest rate changes, and repayment events are correctly recorded. Listed entities and pre-IPO companies should review their material fact disclosure procedures in light of the revised CVM resolution.
On data protection, the priority is to conduct a legal basis audit across all major processing activities, replacing blanket consent with more appropriate bases where the LGPD and ANPD guidance support doing so. Companies should also review their data breach response procedures to ensure the 72-hour notification timeline can realistically be met. Cross-border data transfer arrangements should be documented now, in anticipation of the forthcoming ANPD transfer regulation.
On corporate governance, foreign investors should verify that their Brazilian entities'; corporate documents are current and that any pending amendments are filed using the correct documentary and signature requirements under the updated DREI instructions.
To discuss how these developments affect your specific operations in Brazil, contact info@vlolawfirm.com. We can assist with documents and filings across all of the areas covered in this update.
Does the CBS/IBS transition require action from foreign companies with limited Brazilian revenue?
Yes. The split-payment collection mechanism and the registration obligation with the Comitê Gestor do IBS apply based on the nature of the transaction, not the volume of revenue. Foreign companies providing digital services to Brazilian consumers or operating through marketplace platforms are within scope regardless of the size of their Brazilian business. Waiting until the full transition deadline to adapt fiscal systems is a common and costly mistake. Businesses should engage Brazilian tax counsel now to map their specific obligations and build the necessary infrastructure.
How quickly must a Brazilian data breach be reported to the ANPD, and what triggers the clock?
The ANPD has confirmed that the 72-hour notification window begins when the controller becomes aware of the incident. Awareness does not require completion of a full internal investigation - it is triggered when the organisation has sufficient information to conclude that a personal data incident has occurred. Preliminary notification with available information is acceptable, with supplementary details provided as the investigation progresses. Failure to notify within the window is treated as an aggravating factor in any subsequent administrative proceeding and can increase the severity of sanctions.
What is the practical impact of the revised DREI instructions on foreign investors amending Brazilian corporate documents?
The revised instructions reduce the documentary burden in some cases by accepting apostilled documents without consular legalisation where the originating country is a Hague Convention signatory. However, the specific requirements vary by document type, registry, and the country of origin of the foreign signatory. Foreign investors should not assume that a process that worked previously will work under the updated rules without verification. The use of ICP-Brasil qualified electronic signatures is now available for a broader range of acts, but foreign signatories without ICP-Brasil certificates must plan alternative pathways in advance, typically involving a Brazilian attorney-in-fact.
Q2 brought a dense and consequential set of regulatory changes across tax, financial markets, data protection, and corporate law in Brazil. The common thread is that compliance obligations are becoming more precise, more documented, and more actively enforced. International businesses should treat this quarter';s developments as a prompt to audit their Brazilian compliance arrangements rather than wait for enforcement action.
VLO Law Firms advises international clients on regulatory compliance and corporate matters in Brazil. We can assist with tax reform readiness assessments, CVM and Bacen filings, LGPD compliance programmes, and corporate registry procedures. To request a consultation, contact: info@vlolawfirm.com