Investment funds have once again taken center stage in the debate on anti-money laundering. The Banco Master case exposed the use of layered structures, funds, and offshore vehicles to conceal the origin and destination of funds, and Operation Carbono Oculto, in August 2025, revealed the infiltration of organized crime into the financial market through funds and fintech companies that operated with “pocket accounts,” making it difficult to identify the ultimate beneficiaries. Added to this domestic situation is the FATF’s intensified monitoring of Brazil following the latest mutual evaluation and, since May 2026, the U.S. government’s designation of Comando Vermelho and the PCC as terrorist organizations, accompanied by sanctions against Brazilian individuals and companies. This is a regime distinct from the FATF, with no formal interface with its lists, but one that increases the reputational and correspondent banking costs for the entire national financial system.
The regulatory response came on two fronts, both in 2026 and now in effect: CVM Resolution No. 245/2026, which amended CVM Resolution No. 50/2021 to impose enhanced due diligence on structures linked to jurisdictions listed by the FATF, and RFB Normative Instruction No. 2,290/2025, which revised the beneficial ownership regime under the CNPJ and established a monthly reporting requirement regarding fund shareholders. This bulletin outlines the current regulatory framework, what has changed, and what administrators, managers, distributors, and investors need to do.
The current framework
Law No. 9,613/1998, which established the crimes of money laundering or concealment of assets, rights, and funds, imposed on obligated entities the duties to identify customers, maintain up-to-date records, record transactions, and report suspicious transactions to COAF. Law No. 12,683/2012 eliminated the exhaustive list of predicate offenses—any criminal offense now qualifies as a predicate offense—and expanded the list of regulated entities. At the administrative level, Article 12 of Law No. 9,613/1998, as amended by Law No. 12,683/2012, provides for a warning, a fine, temporary disqualification, and revocation or suspension of authorization for those who fail to comply with these duties.
In the financial market, BCB Circular No. 3,978/2020 is the central AML/CFT regulation: it adopts a risk-based approach, requires the classification of customers by risk profile and the identification of the ultimate beneficial owner, and BCB Circular Letter No. 4,001/2020 lists the transactions and situations that may constitute indications of money laundering, which are subject to reporting to COAF, including investment transactions.
In the capital markets, the CVM has regulated this matter since CVM Instruction No. 301/1999, which was superseded by CVM Instruction No. 617/2019 and consolidated in CVM Resolution No. 50/2021, which applies to administrators, managers, distributors, custodians, and other participants. The regulation requires a PLD/FTP policy, internal risk assessment, classification of clients according to each institution’s own methodology, and identification of the beneficial owner, the individual who ultimately controls the client or on whose behalf the transaction is conducted, with enhanced monitoring in cases where such identification is not possible (Art. 16). The funds, in turn, have their legal basis in Articles 1,368-C through 1,368-F of the Civil Code, introduced by Law No. 13,874/2019, and their regulatory framework in CVM Resolution No. 175/2022, whose Annex II allocates between the manager and the custodian the duties of validating and verifying the collateral for the FIDC’s credit rights—the point at which the chain of asset ownership connects to the chain of liability beneficiaries. ANBIMA’s self-regulatory framework, which is mandatory for participating institutions, rounds out the picture.
Finally, the registration of the ultimate beneficiary with the Federal Revenue Service, governed by RFB Normative Instruction No. 2,119/2022, became, with the 2025 amendments, the third layer of traceability, alongside supervision by the Central Bank and COAF and regulation by the CVM.
What Changed in 2026
CVM Resolution No. 245/2026: Enhanced Due Diligence and Jurisdictions Listed by the FATF
Issued on July 1 and effective as of July 15, 2026, CVM Resolution No. 245 inserted Article 17-A into CVM Resolution No. 50. This provision extends the enhanced monitoring regime of Article 16 to transactions with non-resident investors domiciled, headquartered, or incorporated in jurisdictions included on the FATF lists, regardless of the risk classification assigned by the institution, and establishes a minimum set of measures: restrictions or additional conditions on establishing a business relationship; limitation, postponement, or refusal of transactions involving higher-risk assets; requirement for additional information and supporting documentation; and termination of the relationship when the risk is deemed unacceptable and unmitigable. Paragraph 2 extends the scope to any customer, whether resident or non-resident, whose corporate structure, chain of control, ultimate beneficial owner, or representative is directly or indirectly linked to these jurisdictions.
The practical effect stems from the current composition of the FATF’s enhanced monitoring list, which includes the British Virgin Islands and Monaco—jurisdictions frequently used in the asset structures of Brazilian residents. A holding company or trust in the British Virgin Islands (BVI) within the chain of a Brazilian shareholder is now, by law, subject to the measures set forth in Article 17-A. We discussed this provision in detail in our July 2026 Client Alert.
RFB Normative Instruction No. 2,290/2025: e-BEF and the Administrator’s Monthly Obligation
Effective as of January 1, 2026, RFB Instruction No. 2,290 established the Digital Final Beneficiary Form (e-BEF), which must be filed within thirty days of registration with the CNPJ or of any change in the final beneficiaries and, if there are no changes, annually, by the last day of the calendar year (Art. 55-A of RFB Instruction No. 2,119/2022). The ultimate beneficiaries are now included in the entity’s registration data with the CNPJ (Art. 55-C), and proof of e-BEF submission is required whenever the law mandates tax compliance, including for registration, changes, or deregistration with the CNPJ (Art. 55-E).
For investment funds, the rule is different and is often misunderstood: funds regulated by the CVM remain exempt from reporting beneficial owner information (Art. 54, § 1, V). In contrast, managers and financial institutions that distribute shares on behalf of and at the direction of their clients must report monthly to the Federal Revenue Service—with a reference date of the last business day of the month and submission by the fifth business day of the following month—through the e-CAC National Collection system, the identification, net assets, and number of units and unitholders for each fund, class, and subclass; and, for each unitholder, their identification, the distributor acting on behalf of and at the direction of the client, the classification, type, quantity, and value of the shares (Art. 54, §§ 6 and 7). The format and the initial submission date are still pending regulation. Therefore, it is not the fund that files the report: it is the manager who is responsible for the monthly submission of the unitholder database.
Two exceptions directly apply to cross-border structures. Entities domiciled abroad whose purpose is to invest funds in the financial and capital markets, as well as typical vehicles for non-resident investors, must file the e-BEF on a phased schedule (Annex XVI), effective January 1, 2027, and funds established to hold assets from supplementary pension plans or personal insurance policies domiciled abroad, effective January 1, 2028. Global custodians without significant influence over a Brazilian entity shall provide the information only upon request, within thirty days, extendable for an equal period (Art. 55, §§ 3 and 11). It is also worth noting that the managers of a foreign entity are not considered ultimate beneficial owners, except when there is no natural person who meets the criteria (Art. 53, § 3, and Art. 54, § 4), and that nominal partners and participants in a silent partnership are always considered beneficial owners, regardless of their share in the special equity (Art. 53, § 4).
For silent partnership companies, the impact is more profound than it appears. The SCP’s legal structure remains intact because the e-BEF is not public: the nominal partner continues to enter into contracts in his or her own name, and the participant remains liable only to the nominal partner, without appearing before third parties (Articles 991–996 of the Civil Code). What ends is the lack of transparency vis-à-vis the tax authorities, and without the safeguards that apply to other types of corporations: all participants must be disclosed, regardless of their ownership stake (Art. 53, § 4). The SCP is also not included in the phased implementation schedule set forth in Article 55-G; thus, it has been subject to these requirements since January 1, 2026—before large limited liability companies, which will not be subject to them until 2027. Since the e-BEF requires the digital signature of the entity and of each ultimate beneficiary registered with the CPF (Art. 55-A, § 3) and must be resubmitted within thirty days upon each change, the SCP used as a fundraising vehicle—with dozens of participants joining and leaving—now bears a permanent registration burden greater than that of a regulated fund, which is exempt from the form and whose administrator provides the information without the unitholder having to sign anything. The message of the rule is clear: investor pooling is pushed into the regulated sphere, where there is an administrator, a manager, and a responsible director to answer for the entire chain.
Failure to comply results in the suspension of the CNPJ registration and the prohibition on conducting transactions with financial institutions (account transactions, financial investments, and obtaining loans), preceded by a formal notice granting a thirty-day period to comply (Art. 56, main provision and § 3). Late filing subjects the entity to the fine provided for in Art. 57, I, of Provisional Measure No. 2,158-35/2001 (Art. 56, § 4), and false information constitutes, in theory, the crime of false declaration (Art. 55-D).
Who Benefits from Information: Confidentiality, Access, and Cooperation Among Regulators
The e-BEF is not a public registry. Unlike the list of partners and managers—which appears on the CNPJ registration certificate and in the Federal Revenue Service’s public databases—data on ultimate beneficial owners are part of the entity’s records (Art. 55-C) under tax confidentiality regulations and, since it involves data on individuals, under the General Data Protection Law, which is in line with international standards. An investor who discloses their structure to the Federal Revenue Service does not disclose it to the market. What the FATF demands of Brazil is something else: the 2023 mutual evaluation identified, as the main deficiency, a largely incomplete database of ultimate beneficial owners. The e-BEF is the response to this criticism.
The value of the information therefore lies in cross-referencing, and the framework for cooperation in this regard already exists. Article 198, paragraph 2, of the National Tax Code (CTN) authorizes the exchange of confidential information between the Federal Revenue Service and other public administration agencies through an agreement; Article 28 of Law No. 6,385/1976, as amended by Law No. 10,303/2001, provides that the Central Bank, the Securities and Exchange Commission (CVM), the Federal Revenue Service, SUSEP, and PREVIC maintain a system for exchanging information related to the oversight they exercise in the securities market, and its sole paragraph expressly excludes confidentiality as an impediment to such exchange; Complementary Law No. 105/2001 extends the duty of confidentiality to the Central Bank and the CVM and regulates communication between them and with COAF; and Law No. 9,613/1998 designates COAF as the central hub for reports of suspicious transactions. What changes in 2026 is the raw data: with the monthly information on shareholders provided by managers and distributors, the Federal Revenue Service will now have a shareholder-by-shareholder overview of the fund industry, with a level of detail that the periodic reports to the CVM lack. When overlaid with the e-BEF data on corporate unitholders, the National Financial System’s Client Registry maintained by the Central Bank, and the e-Financeira database, this overview makes it possible to cross-reference, for a single individual, what they report to the tax authorities, what they hold in funds, and what they transact in accounts—which is exactly what recent cases have shown was missing.
For the market, there is only one practical consequence: the same person must be listed identically in all databases. Any inconsistency between what the administrator reports monthly to the Internal Revenue Service, what the distributor has on file in its shareholder registry, and what appears in the-BEF of the holding company holding the shares is no longer invisible and becomes detectable through cross-checking; once detected, it tends to be referred back to the service provider in the form of a request for clarification, a report to COAF, or disciplinary proceedings. Due diligence regarding the beneficial owner—which until now was the responsibility of each institution individually—is now verifiable from the outside.
Who is responsible for what?
The question posed in the title is answered, to a large extent, by the allocation of responsibilities. Under CVM Resolution No. 50, the administrator, manager, distributor, and custodian are each obligated parties, with their own PLD/FTP policies and a statutory director accountable to the CVM. In distribution on a “for account and order” basis, the duty to identify and exercise due diligence regarding the unit holder rests with the distributor, who must keep the administrator informed; the distributor is also now responsible for the monthly reporting obligation to the Federal Revenue Service. The regulatory chain does not allow for any link without an owner: each service provider is responsible for the duties assigned to it by the regulation, subject to the sanctions set forth in Article 12 of Law No. 9,613/1998, as amended, and to the CVM’s sanctioning proceedings.
This logic is not new. As early as 1997, CMN Resolution No. 2,451—now repealed—required institutions to designate an administrator responsible for managing third-party funds, unaffiliated with the institution’s other activities, who would be reported to the Central Bank and the CVM and who would sign a declaration assuming responsibility for any situations indicating fraud, negligence, recklessness, or malpractice in the administration of those funds. The responsible officer under CVM Resolution No. 50 and the allocation of duties among service providers under CVM Resolution No. 175 are direct descendants of this approach: at each link in the chain, a specific individual is held accountable.
In civil law, Article 1.368-D, II, of the Civil Code allows regulations to limit the liability of service providers—toward the fund and among themselves—to the fulfillment of each party’s specific duties, without joint and several liability. The contractual and regulatory delineation of these duties has thus ceased to be a mere formality: it is this delineation that defines who is liable to the fund and the unit holders when due diligence fails at any link in the chain. In FIDCs, the same reasoning applies to the allocation, between the manager and the custodian, of the duties to validate and verify the collateral.
What to Do
For administrators, managers, distributors, and custodians, the first step is to review the PLD/FTP policy and the risk matrix in light of Article 17-A, cross-referencing the list of shareholders with the FATF lists—updated in February, June, and October— and tracing ownership chains back to the natural person, paying close attention to indirect links. Identifying the true ultimate beneficial owner is a step-by-step process, not a single registration field: one starts with the shareholder and moves up through the corporate structure to the natural person who exercises control or on whose behalf the transaction is conducted; the criteria of IN RFB No. 2,119 apply: nominal partners and SCP participants are always ultimate beneficiaries, while managers of a foreign entity are only considered so in the absence of a qualifying natural person; Documentary proof—not merely a declaration—of the source of funds is required; and when the chain cannot be traced, the enhanced monitoring provisions of Article 16 of CVM Resolution No. 50 apply. The mitigation measures adopted—and, in cases of termination, the impossibility of mitigation—must be documented: the absence of an audit trail creates exposure in both directions, due to omission and improper termination. At the same time, it is necessary to prepare the monthly flow of information from unitholders to the Federal Revenue Service, which involves systems, coordination between the administrator and distributors acting on behalf of and under the direction of the fund, and monitoring of Cocad’s Declaratory Act, which will establish the format and start date. Service agreements and regulations should be reviewed to precisely define the duties of each service provider and, in the case of FIDCs, to establish procedures for verifying collateral and conducting due diligence on the chain of assignors.
For investors and families with assets held abroad, it is important to identify the entities established in the listed jurisdictions, begin organizing the documentation regarding the source of funds and ultimate beneficial owner—which will be required during the onboarding process and during registration reviews—and evaluate, on a case-by-case basis, the advisability of restructuring, weighing the costs of reorganization, tax implications, and the generally temporary nature of a jurisdiction’s inclusion on the “gray list.” Foreign investment vehicles registered with the CNPJ must file the e-BEF starting January 1, 2027, and structures involving silent partnerships must consider that all their partners are ultimate beneficial owners for registration purposes.
Conclusion
Brazil has a sufficient regulatory framework to enable the tracing of the origin of funds and the identification of their owners at each stage, from the shareholder’s account to the underlying assets. The security of transactions, however, does not stem from the regulations themselves, but rather from their implementation: from the due diligence policy that is effectively enforced, the audit trail that verifies it, and clarity regarding who is accountable for each stage. The supervisory challenge posed by the large number of market participants remains, and it is precisely this challenge that shifts the primary responsibility to service providers. In an environment where regulators and the international market have begun to view layered structures with suspicion, documented due diligence is no longer merely a compliance cost but has become a condition for market access.
Our Capital Markets and Banking, Corporate, and Tax Law teams are available to assist with reviewing policies and service agreements for funds, ensuring compliance with the new reporting requirements of the Federal Revenue Service, and evaluating investment structures that may be affected by the new rules.
Author:
Fabíola Augusta Cavalcanti – fcavalcanti@araujopolicastro.com.br