Company background check: what to verify before signing

Company background check is not the same as personal background check. You're not just validating whether the CNPJ exists — you're verifying if the company is in good standing, who really controls it, and what risks it carries. Part of this search comes from compliance or HR looking for a background check provider. The other part wants to know exactly what to verify on a CNPJ before closing a deal. Here we cover both.

What is company background check (KYB)

KYB stands for Know Your Business. It's the process of identifying, validating, qualifying and monitoring legal entities before and during the business relationship. While KYC (Know Your Customer) asks "is this person who they claim to be?", KYB asks something more complex: "does this company really exist, is it in good standing, who really controls it and what risks does it carry?". In practice, a complete KYB includes the KYC of the people who control the company — because it doesn't help if the company is clean if whoever runs it is a PEP, sanctioned or under investigation.

Six layers you need to verify

• Registration and tax status: active CNPJ, compliance with the Federal Revenue Service, CNAE compatible with actual operations.
• Activity and capacity: company size and operating history compatible with the volume or complexity of the contract you will sign.
• Corporate structure: who are the declared shareholders, how long they've been with the company, whether they appear in multiple other companies (shell indicator).
• Ultimate beneficial owner: the natural person who, ultimately, controls or benefits from the company — even behind holdings and layered structures.
• Risk and compliance: inclusion in sanctions lists (CEIS, CNEP, OFAC, UN), whether there are PEPs among shareholders, lawsuits in civil/criminal/labor spheres, protests or debts.
• Continuous monitoring: alerts when something relevant changes — CNPJ deactivation, shareholder changes, new litigation, list updates — during the entire relationship.

Three scenarios that kill deals (or companies)

The ghost supplier: active CNPJ, invoice issued, payment made — and delivery never arrives. Total and direct loss. The shareholder no one knows about: the hidden beneficial owner might be a PEP, sanctioned or under investigation. The Anti-Corruption Law holds your company liable for their actions, with fines up to 20% of revenue. The outdated registration: the supplier was verified years ago; today it's irregular, with CNPJ deactivated or shareholders changed — and no one knows. These situations cost money. A single criminal group created over 330 shell companies and caused approximately R$ 110 million in losses to the financial system, according to Federal Police data. In a country with 65 million CNPJs, the question becomes obvious: how many CNPJs entered your database this year without complete verification?

How to detect a shell company

A shell company leaves signals it can't hide at the same time. Look for: recent incorporation with share capital incompatible with the operation being sold; non-existent address or shared by dozens of other CNPJs; shell shareholders appearing in multiple different companies; CNAE incompatible with actual activity (a "consulting" company that has five CNPJs each with a different sector); lack of operating history and anomalous links in the economic group (shareholders who only appear in that company). None of these signals alone is condemnation. All together? Mandatory investigation.

Regulatory framework: why you need to do this

KYB has multiple legal bases in Brazil. Central Bank Circular nº 3.978/2020 requires, for PJ customers of regulated institutions, identification and verification of the ultimate beneficial owner and understanding of control structure, with continuous due diligence. Law nº 9.613/1998 (Money Laundering Prevention and Terrorist Financing Law) treats shell companies as the classic money laundering vehicle. Law nº 12.846/2013 (Anti-Corruption Law) imposes strict liability for the acts of third parties — your suppliers, partners, sellers in your marketplace — making third-party due diligence the primary risk mitigation. Law nº 14.133/2021 requires integrity checks (CEIS, CNEP) in public procurement chains. If you work in finance, compliance, procurement or marketplace, one thing is certain: the regulator expects you to know who is on the other side of the contract.

How to choose a verification provider

If you're looking for a company background check provider, there are some criteria. First: data coverage. A good KYB crosses registration status (Federal Revenue in real-time), corporate filings (Commercial Registers), ultimate beneficial owner and economic groups, sanctions (CEIS, CNEP, OFAC, UN), PEPs among shareholders, litigation in civil, criminal and labor spheres, financial restrictions (protests, debts, negative credit), and media mentions. Second: audit trail. Each approval needs to generate documented evidence with rationale, source and date — ready for audit, certifications and Anti-Corruption Law. Third: integration with your systems. If you have ERP, procurement system or marketplace, the solution should integrate via API for batch approval and continuous monitoring. Fourth: post-contract monitoring. Snapshots age; video doesn't. A good KYB sends automatic alerts when something relevant changes — corporate, tax, judicial or lists — without needing new manual triggers. Fifth: speed. Shell company approval must be an automatic barrier; good supplier approval needs to be fast — minutes, not weeks.

From CNPJ to ultimate beneficial owner in one workflow

A well-designed KYB platform works like this: you send CNPJs individually, in batch or via integration with your ERP or procurement system. The platform validates registration and tax status, CNAE, address, size and capacity compatible with the contract. Then it deepens — QSA, economic group, ultimate beneficial owner, sanctions, PEP, litigation and media mentions, with company and shareholders in a single workflow. The result is a structured dossier from the CNPJ surface to the natural person who actually controls the business, ready for approval in minutes. After that, continuous monitoring: the platform sends automatic alerts of any relevant change during the entire relationship. This is the concept behind solutions like KYB Guep — turning manual investigation into a single, documented and continuous workflow.

Company background check is the opposite of signing blind. It's knowing who is on the other side of the contract — before signing, throughout the relationship, and with documented evidence for when the regulator or auditor asks what you did to mitigate the risk. In a country with 65 million CNPJs and rising fraud volumes, the difference between quick approval and blind approval can be measured in financial loss and legal liability.