Introduction to Conselho de Controle de Atividades Financeiras
The Conselho de Controle de Atividades Financeiras (Coaf) is Brazil’s key financial intelligence unit overseeing anti-money laundering (AML) and know-your-customer (KYC) compliance across multiple sectors, including payments. Its role is crucial for merchants entering the Brazilian market and payment service providers (PSPs) navigating licensing and compliance requirements.
This guide is designed for merchants seeking smooth merchant identification number (MID) onboarding in Brazil and PSPs aiming to meet Coaf’s regulatory standards. Understanding Coaf’s oversight helps ensure legal operations, manage compliance risks effectively, and gain timely authorization to process payments. As Brazil’s AML watchdog, Coaf’s monitoring influences how payment activities are conducted and reported across the financial landscape.
You’ll find clear coverage of Brazil’s regulatory environment, Coaf’s scope and responsibilities, relevant licensing requirements, compliance expectations, risk management advice, and practical steps to work confidently within this framework. Expect actionable checklists, common pitfalls to avoid, and insider insights that simplify your relationship with Coaf and support compliance success.
Jurisdiction & Scope of Conselho de Controle de Atividades Financeiras
The Conselho de Controle de Atividades Financeiras (COAF) serves as Brazil’s key financial intelligence unit, focusing on anti-money laundering (AML) and know-your-customer (KYC) compliance across multiple sectors. Understanding COAF’s jurisdiction is crucial for any payment service provider (PSP) or merchant operating within Brazil’s financial ecosystem.
COAF oversees activities spanning various financial sectors to detect and prevent illicit finance, including money laundering and terrorist financing. Although it does not function as a licensing regulator in the traditional sense, its enforcement of AML/KYC rules impacts banks, PSPs, money transmitters, and other financial institutions operating in Brazil. Both domestic and foreign entities offering payment solutions or financial services to Brazilian residents fall within COAF’s monitoring scope. Compliance with COAF regulations is essential for maintaining the integrity and legality of financial operations in Brazil.
Key areas under Conselho de Controle de Atividades Financeiras (COAF) oversight:
- Monitoring AML and KYC compliance across financial sectors
- Financial intelligence gathering and analysis
- Supervision of money transmission and payment service providers
- Oversight of banks, lenders, and other financial institutions
- Coordination with law enforcement and regulatory bodies on suspicious activities
Takeaway for merchants & PSPs: Operating in Brazil requires strict adherence to COAF’s AML/KYC regulations to avoid penalties and enable smooth MID onboarding with compliant PSPs.
Regulated Entities under Conselho de Controle de Atividades Financeiras (COAF)
The Conselho de Controle de Atividades Financeiras (COAF) regulates a broad spectrum of financial and non-financial entities involved in Brazil’s anti-money laundering (AML) and know-your-customer (KYC) framework. This includes key players such as financial institutions, payment service providers (PSPs), and other designated businesses, making it essential for merchants and PSPs to understand their compliance obligations under COAF.
Entities regulated by COAF encompass banks, money transmitters, credit and financing companies, and fintech startups active in Brazil. These entities must establish and maintain robust AML/KYC controls and report suspicious transactions promptly. Companies operating physically within Brazil are subject to COAF’s registration and ongoing oversight. Furthermore, foreign PSPs and other service providers that offer financial services to Brazilian residents are required to comply with COAF’s regulations, regardless of their physical location.
Entities under COAF supervision include:
- Banks and credit institutions operating in Brazil
- Payment service providers (PSPs) handling transactions for Brazilian customers
- Money transmitters and remittance companies licensed or operating in Brazil
- Fintech startups involved in financial activities within Brazil
- Non-financial businesses designated under AML obligations (e.g., real estate agents, dealers in precious metals)
Local Presence Requirements:
Entities regulated by COAF generally must appoint a compliance officer responsible for AML/KYC adherence and maintain registration with COAF. Those with physical operations in Brazil must establish local compliance functions aligned with COAF standards.
Implications for Foreign Providers:
Foreign PSPs and financial service providers offering products or services to Brazilian residents need to comply with COAF’s AML/KYC obligations, including transaction monitoring and suspicious activity reporting, even if they lack a local office.
What Merchants Should Know:
Merchants in Brazil should partner exclusively with PSPs that demonstrate compliance with COAF regulations to ensure security and regulatory adherence. PSPs must secure appropriate registration with COAF before servicing clients in Brazil’s financial ecosystem.
Licenses Overview under Conselho de Controle de Atividades Financeiras (COAF)
In Brazil, the Conselho de Controle de Atividades Financeiras (COAF) oversees AML/KYC compliance across financial sectors but does not issue traditional money transmitter or banking licenses. However, entities operating as payment service providers (PSPs) and money transmitters must ensure adherence to COAF’s regulations alongside obtaining relevant licenses from sector-specific authorities. Merchants should confirm their PSP partners are fully compliant with COAF rules.
| License Name | Purpose | Who Needs It | Key Requirements |
|---|---|---|---|
| Money Transmitter License | Authorizes the transfer of funds and value | PSPs, fintechs, money remitters | AML compliance, registration, surety bond, local presence |
| State Bank License | Licensing for full banking operations | Banks, de novo banks | Capital requirements, governance, consumer protections |
| Payment Institution License | Enables payment processing, e-money issuance | PSPs, payment institutions | AML program, operational controls, minimum capital |
While COAF itself doesn’t issue payment licenses, strict AML/KYC measures enforced by COAF are critical. PSPs and money transmitters must maintain continuous compliance to avoid fines and reputational harm in Brazil. Always check for active licenses combined with COAF registration.
Licensing Process with Conselho de Controle de Atividades Financeiras (COAF)
Obtaining a license or registration approval from Conselho de Controle de Atividades Financeiras (COAF) in Brazil requires a disciplined approach focused on AML and KYC compliance. Early preparation of corporate governance documents, compliance programs, and financial disclosures is critical to navigate COAF’s rigorous oversight effectively.
Step-by-Step Application
- Pre-Application Preparation – compile detailed AML/KYC policies, governance frameworks, and appoint compliance officers experienced with Brazilian regulations.
- Application Submission – submit required registration forms and declarations to COAF, including risk assessments and internal controls.
- Background Checks & Compliance Review – COAF conducts thorough evaluations of management integrity, compliance effectiveness, and transaction monitoring systems.
- Approval & Registration Confirmation – upon meeting all regulatory requirements, COAF issues a registration certificate, enabling lawful financial operations.
- Ongoing Monitoring & Reporting – maintain continuous AML reporting and cooperate with COAF’s intelligence requests to ensure ongoing compliance.
⏳ Timelines & Fees at a Glance
- Typical review duration: 60–90 days
- Registration fees: Vary by sector and transaction volume, generally moderate
- Financial stability and AML program robustness are key non-monetary prerequisites
Early engagement with COAF compliance guidelines and proactive AML program audits can significantly streamline your application and reduce review cycles.
Compliance & Supervision by Conselho de Controle de Atividades Financeiras (COAF)
Holding a license overseen by the Conselho de Controle de Atividades Financeiras (COAF) in Brazil requires payment providers to uphold continuous compliance beyond the initial authorization. COAF enforces ongoing obligations that strengthen anti-money laundering (AML) and know-your-customer (KYC) frameworks, critical to maintaining market trust and long-term operational integrity within Brazil’s financial ecosystem.
Key Compliance Obligations
- AML/KYC Frameworks – Maintain and update AML and KYC procedures aligned with COAF’s standards to detect and prevent illicit activities.
- Suspicious Transaction Reporting – Submit timely Suspicious Transaction Reports (STRs) for any detected irregular or high-risk operations.
- Ongoing Employee Training – Conduct regular training sessions to ensure staff understand AML risks and reporting duties.
- Customer Due Diligence (CDD) – Implement comprehensive customer identification and verification processes on an ongoing basis.
- Record Keeping – Retain transaction and customer records securely for at least five years to enable audits and investigations.
- Transparency and Disclosure – Ensure clear communication of compliance policies and customer rights, enhancing consumer protection.
- Regulatory Reporting – Adhere to all periodic reporting requirements specified by COAF and other linked authorities.
Supervision & Oversight
| Supervision Activity | Frequency | Key Focus |
|---|---|---|
| Risk-based on-site audits | Periodic, risk-driven | AML/KYC controls, record accuracy |
| Compliance inspections | Scheduled and ad-hoc | Reporting completeness, operational controls |
| Regulatory reporting review | Quarterly/Annual | Submission timeliness and correctness |
COAF’s supervision includes systematic inspections and risk-based audits, emphasizing timely STR filings and effective AML controls. Non-compliance risks fines, license revocation, or other regulatory restrictions, making continuous adherence imperative.
Enforcement in Practice
COAF has enforced sanctions on payment providers failing to maintain robust AML frameworks or neglecting timely suspicious activity reports, demonstrating a firm regulatory approach that discourages complacency.
⚠️ Providers that only treat compliance as a checkbox exercise risk costly audits and reputational damage under Brazil’s rigorous money transmitter supervision regime.
Merchant Relevance: What Conselho de Controle de Atividades Financeiras Means for You
In Brazil, merchants depend on payment service providers (PSPs) that comply with rules set by the Conselho de Controle de Atividades Financeiras (COAF), the key regulator overseeing AML/KYC efforts across financial activities. While merchants don’t apply for licenses themselves, choosing a licensed PSP is critical for smooth MID onboarding compliance and protecting your business from regulatory and financial risks.
Key Implications for Merchants
- ☑️ Always select PSPs that adhere to COAF regulations to ensure your merchant payment security and reduce compliance burdens.
- ☑️ Licensing verification supports safer settlement of funds, minimizing risk from fraudulent activities and fund mismanagement.
- ☑️ Using a COAF-compliant PSP helps maintain operational stability by avoiding disruptions tied to regulatory enforcement.
- ☑️ Licensed PSPs implement strong AML/KYC procedures, protecting your business from being involved in illicit transactions.
- ☑️ Regular regulatory supervision by COAF enhances the overall security and legitimacy of your payment processing.
Red Flags to Avoid
- PSP not listed or recognized by COAF as compliant with AML/KYC requirements.
- Lack of transparent MID onboarding compliance procedures or unclear customer verification steps.
- Hidden or unpredictable fees related to settlements or transaction processing.
- PSP with a history of enforcement actions or unresolved compliance complaints.
- Vague policies on fraud prevention and risk management.
✅ Merchant Takeaway: Always confirm that your PSP is compliant with COAF regulations; verifying their licensing status is your best defense against the risk of unlicensed providers and ensures ongoing merchant payment security.
PSP Relevance: Licensing & Compliance under Conselho de Controle de Atividades Financeiras
For PSPs seeking to operate in Brazil, compliance with Conselho de Controle de Atividades Financeiras (COAF) requirements is essential, especially regarding AML/KYC obligations. While COAF does not issue payment licenses directly, PSPs must maintain robust anti-money laundering frameworks and adhere to mandatory reporting as part of their licensing requirements under Brazilian regulators. This guide helps PSPs understand how to align operational and compliance efforts with COAF expectations for successful market entry and sustained operation.
Licensing Obligations
- Apply for necessary PSP licensing under Brazilian regulators supervising payment services, ensuring readiness to meet COAF AML/KYC mandates.
- Develop and submit comprehensive AML/KYC policies as part of licensing documentation.
- Designate a compliance officer responsible for AML oversight and regulatory communication, reflecting COAF’s standards.
- Implement systems capable of identifying and reporting suspicious transactions to COAF.
- Maintain evidence of operational capability, including internal controls to manage financial crime risks.
Ongoing Compliance
- File suspicious activity reports (SARs) promptly with COAF as required.
- Conduct continuous employee training on AML/KYC compliance and COAF reporting standards.
- Update COAF and supervisory bodies on any significant changes in ownership, governance, or compliance structures.
- Cooperate fully with COAF investigations and audits as part of regular regulatory oversight.
Establish automated monitoring and reporting solutions from the outset to ensure timely, accurate filings with COAF, minimizing exposure to regulatory penalties.
Risk & Red Flags in Brazil
Engaging with the Conselho de Controle de Atividades Financeiras (COAF) demands rigorous adherence to Brazil’s stringent AML/KYC standards. Many payment providers face regulatory risks for payment providers in Brazil due to common licensing pitfalls such as weak compliance programs or incomplete disclosures, leading to fines or enforcement actions. Early identification and mitigation of these risks are crucial to avoid costly delays in license issuance or escalated money transmitter enforcement actions.
Common Pitfalls
- Incomplete or inaccurate AML/KYC documentation and reporting to COAF.
- Failure to implement robust transaction monitoring systems capable of detecting suspicious activities.
- Delays in submitting mandatory Suspicious Activity Reports (SARs) or other regulatory filings.
- Insufficient internal controls or lack of a dedicated compliance officer familiar with COAF requirements.
- Misrepresentation of beneficial ownership or failure to disclose final controllers.
- Non-compliance with Brazil’s data protection regulations impacting customer information handling.
- Weak training programs on anti-money laundering policies for frontline staff.
Market-Specific Risk: Brazil enforces strict criminal penalties for unlicensed money transmission and non-compliance with COAF’s reporting obligations. The regulator is known for its proactive investigations and collaboration with other law enforcement agencies, increasing the risk exposure for PSPs operating without full compliance.
Bottom Line: Avoiding these red flags is critical for securing your license and maintaining regulatory trust in Brazil.
Comments