The digital certificate Brazil requires from every operating company is its electronic identity: it issues invoices, files tax returns and signs with full legal effect. For a foreign-owned company, the e-CNPJ certificate is not optional in practice, and getting it can stall when the administrators live abroad. This guide explains the certificate types, who can obtain them and how to organize them from day one.
In brief
- Legal framework
- ICP-Brasil, MP 2,200-2/2001
- Company certificate
- e-CNPJ
- A1 validity
- 1 year
- A3 validity
- 1 to 5 years
- Electronic invoices must be signed with a qualified ICP-Brasil certificate (Law 14,063/2020).
- The e-CNPJ is issued to the company but held by the person registered as responsible for the CNPJ.
- Identity is checked in person with biometrics or by videoconference, which matters for administrators abroad.
- Electronic powers of attorney let accountants file with their own certificates, reducing the need to share the company’s.
What a digital certificate in Brazil is
Brazil’s public key infrastructure, ICP-Brasil, was created by Provisional Measure 2,200-2/2001. The National Institute of Information Technology (ITI) acts as the root authority. Below it, accredited certification authorities issue certificates, and registration authorities check the identity of each applicant.
A document signed with an ICP-Brasil certificate is presumed authentic and complete. Law 14,063/2020 calls this a qualified electronic signature, the highest of its three levels, and accepts it in any electronic interaction with public bodies. In addition, the same law makes the qualified signature mandatory for electronic invoices issued by companies.
Therefore, a certificate is not a matter of convenience. Without one, a new subsidiary cannot issue NF-e invoices, sign its accounting books or reach several government portals under its own identity.
e-CNPJ and e-CPF compared
| Feature | e-CNPJ | e-CPF |
|---|---|---|
| Identifies | The company (its CNPJ) | An individual (his or her CPF) |
| Who requests it | The person registered as responsible for the CNPJ before the Federal Revenue | The individual |
| Main uses | NF-e invoices, company access to e-CAC, tax and payroll transmissions | Personal access to e-CAC, signing as administrator or accountant, Junta filings |
| Survives a change of administrator? | It remains linked to the company, but should be revoked and reissued when the responsible person leaves | Belongs to the person, not the company |
Most foreign-owned companies need both. The company holds an e-CNPJ, and at least one administrator or attorney-in-fact holds an e-CPF to sign corporate acts, bank documents and filings that must bear an individual signature.
Digital certificate types in Brazil: A1, A3 and cloud
| Type | Where the key is stored | Validity | Best for |
|---|---|---|---|
| A1 | A file installed on a computer or server | 1 year | Invoicing systems and ERPs that sign automatically |
| A3 on token or smart card | A cryptographic device | 1 to 5 years | Individuals who sign occasionally |
| A3 in the cloud | A remote secure module, accessed by app | 1 to 5 years | Signers who travel or work from several devices |
The choice is practical. An A1 file can be installed in the ERP so that invoices are signed without human action, which is why most companies use an A1 e-CNPJ. However, the file can be copied, so it needs strict custody. An A3 on a token cannot be copied, but it requires the device to be present. A cloud A3 is useful for a director who travels, because the key is reached through a phone app.
What the company uses it for
- Electronic invoices. NF-e for goods and many NFS-e systems for services require a certificate in the company’s name.
- Federal Revenue. Access to the e-CAC portal, tax compliance certificates, installment plans and responses to notices.
- Accounting and tax filings. The digital bookkeeping (ECD) and tax bookkeeping files are signed with ICP-Brasil certificates, usually by the company’s representative and the accountant.
- Payroll and withholding. eSocial and EFD-Reinf transmissions, often sent by the accountant under a power of attorney.
- Foreign trade. Access to the Portal Único Siscomex for import and export registration.
- Corporate filings and courts. Signature of acts filed with the Board of Trade, electronic court systems and public tenders.
For an overview of the authorities behind these portals, see our guide on Brazilian bureaucracy.
How to get a digital certificate in Brazil with foreign administrators
The e-CNPJ is requested by the individual registered as responsible for the company in the CNPJ. That person must prove his or her identity to the registration authority. As a result, the choice of the responsible person drives the whole process.
Decide who is responsible for the CNPJ
If an administrator lives in Brazil, registering that person as responsible makes certificates, banking and e-CAC access much simpler.
Check the person’s Brazilian records
The responsible person needs a regular CPF, and the data in the CNPJ must match the identity document presented.
Choose the identification channel
Registration authorities verify identity in person with facial and fingerprint biometrics, or by videoconference in the cases ICP-Brasil rules allow.
Present the documents
Expect the company’s articles and latest amendment, the CNPJ card and the responsible person’s identity document, such as a passport or Brazilian migration ID.
Install and test
Install the A1 in the invoicing system or activate the A3, then test access to e-CAC and the invoicing portal before the first sale.
When nobody responsible for the CNPJ can attend, there are three common solutions. First, appoint a resident administrator and register that person as responsible. Second, schedule the foreign administrator’s identification during a visit and choose a longer-lived A3. Third, rely on electronic powers of attorney so the accountant files with his or her own certificate while the company’s certificate is pending. Our guide on whether foreigners living abroad can be directors explains the representative rules that apply alongside this choice.
gov.br account levels and how they relate
The gov.br account is the federal government’s single login. It has three levels, and many services, including the Federal Revenue’s e-CAC, require silver or gold.
| Level | How it is obtained | Electronic signature |
|---|---|---|
| Bronze | Online form validated against Federal Revenue or social security data, or in person | Not available |
| Silver | Accredited Brazilian bank, or facial recognition against driver’s license records | Available |
| Gold | Facial recognition against electoral records, the national ID card, or an ICP-Brasil certificate | Available |
The link matters for foreign administrators. Every upgrade route relies on Brazilian banks or Brazilian identity databases, except the ICP-Brasil certificate. Consequently, an e-CPF is often the only way for a foreign administrator to reach the gold level and use the free gov.br advanced signature, which the Boards of Trade accept for registration acts.
Electronic powers of attorney for accountants and agents
Sharing the company’s certificate with every service provider is a common but risky habit. Instead, the Federal Revenue lets the company grant an electronic power of attorney in e-CAC. The accountant or agent then accesses the company’s tax records with his or her own certificate, within the services selected and for a defined period.
This approach has three advantages. First, each action is traceable to the person who performed it. Second, the power can be revoked online at any time. Third, the company’s A1 file stays inside its own systems. In addition, the resident legal representative of a foreign partner usually holds an e-CPF to keep the partner’s CNPJ updated. Our guide on CNPJ for foreign companies explains those updates.
Custody, renewal and revocation
- Keep a register. Record each certificate, its holder, type, expiry date and the systems where it is installed.
- Renew early. An expired A1 stops invoicing on the day it lapses. Schedule renewal several weeks ahead, because a new identification may be needed.
- Revoke on departure. When the responsible person or an administrator leaves, revoke the certificate and update the CNPJ before issuing a new one.
- Limit copies. Install the A1 only where needed and protect it with a strong password.
- Align with corporate changes. A change of administrator filed with the Junta should trigger the CNPJ update, the certificate review and the review of e-CAC powers of attorney.
These steps belong in the company’s onboarding checklist. Our guide on opening a business in Brazil shows where certificates fit in the incorporation sequence.
Questions investors ask
Is a digital certificate mandatory for companies in Brazil?
In practice, yes. Electronic invoices must carry a qualified signature with an ICP-Brasil certificate, and the company’s accounting and tax files are also signed with certificates. A company that sells goods or services cannot operate normally without one.
What is the difference between A1 and A3 certificates?
An A1 certificate is a file installed on a computer and is valid for one year. An A3 certificate is kept on a token, smart card or secure cloud module and can be valid for one to five years. A1 suits automated invoicing, while A3 suits individuals who sign personally.
Can a foreigner get an e-CPF?
Yes, provided the person has a regular CPF and passes the identity check of an ICP-Brasil registration authority. A foreigner without Brazilian documents should usually plan an in-person identification with biometrics.
Who can request the e-CNPJ of a Brazilian subsidiary?
The individual registered as responsible for the company in the CNPJ. If that person lives abroad, many groups register a resident administrator as responsible, or schedule identification during a trip to Brazil.
Can my accountant use the company’s certificate?
It is possible but not recommended. An electronic power of attorney in e-CAC lets the accountant use his or her own certificate, keeps actions traceable and can be revoked at any time.
Does a gov.br account replace a digital certificate?
Not entirely. A silver or gold gov.br account gives access to many services and an advanced electronic signature, but electronic invoices and several tax files still require an ICP-Brasil certificate.