Market Entry
Marinho de Gusm?o
·
Brazilian market entry rarely fails for lack of ambition. It fails because the regulatory questions were asked after capital, technology and operating commitments had already been made.
Regulatory due diligence maps the legal and regulatory risks that apply to the intended operation before the business commits to an irreversible structure. It is not a checklist exercise. It determines whether the proposed model is lawful, viable and sustainable, and whether the cost and timing of compliance have been reflected in the business case.
Why regulatory diligence comes before the commercial decision
In lower-complexity jurisdictions, companies often validate the market opportunity first and fit the legal structure around it later. Brazil requires the opposite sequence in many sectors.
Foreign-investment restrictions: some activities remain subject to constitutional or statutory limits that are not eliminated by incorporating a Brazilian entity. In April 2026, the Supreme Federal Court confirmed that Brazilian companies controlled by foreign capital are subject to the rural-land restrictions applicable to foreign companies.
Successor liabilities: a buyer may inherit tax and employment liabilities under Articles 132 and 133 of the National Tax Code and Article 448-A of the Labor Code. Indemnities and escrow protect the parties commercially; they do not bind tax authorities, employees or regulators.
Non-compressible approvals: sector licenses and competition approvals have statutory timelines. A transaction that requires CADE clearance cannot be accelerated simply because the commercial closing date has been announced.
The six workstreams
1. Is the activity open to foreign capital?
The first question is viability, not corporate form. Brazil applies different levels of restriction: absolute prohibitions in narrowly defined activities, ownership caps in certain sectors, and prior-authorization regimes for areas such as financial institutions, border-zone activity and regulated funds. The controlling capital behind a Brazilian entity can be as relevant as the entity's nationality.
2. Is CADE notification required?
Where entry occurs through an acquisition, Brazilian merger-control analysis is a condition precedent to closing when the statutory thresholds are met. The thresholds apply to the economic groups, not merely to the target or purchaser in isolation. Transactions executed abroad can require notification when the groups have sufficient economic presence in Brazil.
Closing before approval - known as gun jumping - can result in fines and the invalidity of the acts performed. The statutory review period can reach 240 days, with a possible extension in complex cases.
3. What liabilities are being acquired?
A liability review is often the diligence workstream most likely to change the transaction price or structure. Key areas include:
Tax: assessments, tax installment plans, disputed tax credits and incentives that may be revoked.
Employment and social security: misclassification, overtime practices, FGTS and social-security contributions, and liabilities that may follow a business succession.
Environmental and regulatory: deficient permits, unfulfilled conditions and a history of agency enforcement that can follow the asset or operation.
Representations, warranties and escrow should be calibrated using the findings. They are not a substitute for finding and pricing the risk before closing.
4. Does the proposed corporate and capital structure fit the regulation?
The choice between a limited liability company, a corporation, a local subsidiary, a joint venture or another structure affects licensing, foreign-investment registration and governance. Certain regulated businesses require local ownership or Brazilian incorporation; others permit foreign ownership but require a Brazilian legal representative, specific governance, local headquarters or a regulated operating entity.
Foreign direct investment must be structured and registered in accordance with the applicable Central Bank rules so that remittances, repatriation and corporate records can be supported. The funding path should be designed before the first transfer, not reconstructed after it.
5. Which licenses must be obtained before launch?
A CNPJ is not an operating license. Depending on the sector, the business may need authorization from the Central Bank, the Ministry of Finance, Anvisa, Anatel, ANM, ANEEL, CVM, CADE, the municipality or environmental authorities before it can start the intended activity.
The diligence should identify each approval, its authority, estimated timing, technical prerequisites, governance requirements, cost and the consequence of operating without it. Launch planning should follow that map.
6. Is the data, privacy and compliance model aligned with Brazilian law?
Brazil's General Data Protection Law (LGPD) applies to personal-data processing involving individuals in Brazil, even before the foreign company has a CNPJ. GDPR compliance is useful but does not replace an LGPD analysis, particularly for legal bases, data-subject rights and international transfers.
The compliance scope may also include AML rules, anti-corruption controls, banking secrecy, cybersecurity and sector-specific duties. A local privacy and compliance operating model should be designed at the same time as product and technology deployment.
Due diligence is also a pricing tool
Regulatory diligence does not exist to find reasons not to enter Brazil. It gives management a complete view of compliance cost, timetable and residual risk. In an acquisition, that view informs valuation, indemnity design and escrow. In an organic entry, it converts an aspiration into an executable market-entry plan.
Conclusion
Before a foreign business commits capital or announces an entry, it should have answers on market openness, CADE exposure, inherited liabilities, corporate compatibility, operating licenses and the compliance and data framework. Those answers determine feasibility, time and cost.
This article is for general information only and is not a substitute for legal advice on a specific matter.
Official sources
Can a foreign company enter Brazil without regulatory due diligence?
It can, but the cost usually appears later: a restructuring to meet an unmapped requirement, acquired liabilities or a license that blocks operations after launch. Regulatory diligence is not always a formal legal requirement, but it is a material risk-management exercise.
Is regulatory due diligence the same as legal due diligence?
Legal due diligence is broader and can include corporate, contractual, real-estate and litigation review. Regulatory diligence is a focused workstream on licenses, regulators, sector rules and foreign-investment restrictions. In regulated industries, it is often the workstream that drives the entry timetable.
Is CADE approval always required for Brazilian M&A?
No. Prior notification is required only when the applicable turnover thresholds are met by the economic groups involved. Even transactions below the thresholds should be assessed for competition risk, and transactions that do require clearance must not close before approval.
Does incorporating a Brazilian company remove foreign-investment restrictions?
Not necessarily. In several sectors, the origin and control of the capital remain relevant. A Brazilian entity can be treated as foreign-controlled for specific regulatory purposes, including rural-land rules.
What if a business operates without the required license?
The consequence depends on the sector, but it can include administrative fines, suspension of the activity, loss of banking access and, in some circumstances, exposure for directors. The relevant license map should be completed before launch commitments are made.
How does the LGPD apply before the company has a Brazilian CNPJ?
The LGPD regulates processing involving people in Brazil, not only entities incorporated in Brazil. A foreign company collecting data through a website, app or pre-launch form may already be within scope.
Share this article