How to verify whether a company is trustworthy: a practical due diligence guide

Before doing business with any company, whether as a customer, supplier, or partner, it is essential to verify that it is trustworthy. In Brazil, there are more than 67 million business records, and not all of them correspond to legitimate companies. In this guide, we cover the 7 essential due diligence checks you can run for free to protect your business.

Why verify a company before doing business?

Skipping verification can lead to financial losses, legal problems, and reputational damage. Common situations that a simple lookup could have prevented:

• Paying a supplier that cannot issue tax invoices because its CNPJ (Brazil's national company registration number) is non-compliant or closed
• Signing a contract with a shell company (recently opened, no capital, fictitious address)
• Partnering with a company facing lawsuits or government sanctions
• Buying from a company whose CNAE (registered economic activity code) does not match the product it offers
• Losing a public tender because you subcontracted an irregular company

The good news is that registration data for Brazilian companies is public, and platforms like Inddex let you look up this information quickly and in an organized way.

7 essential due diligence checks

1. Registration status: is the company active?

The first and most important check. The registration status shows whether the company is operating normally with the Receita Federal (Brazil's federal tax authority). Only do business with companies whose status is "Ativa" (active).

2. Opening date: how long has the company existed?

The activity start date reveals the company's age. While new companies can be perfectly legitimate, a company that is only days or weeks old deserves extra scrutiny in high-value deals. Scammers frequently open disposable CNPJs to run quick frauds.

There is no absolute rule, but treat the following as warning signs:

• A company less than 6 months old offering high-value products or services
• A new company that already appears as a supplier on large contracts
• An opening date inconsistent with what the company claims on its website or sales material

3. Share capital: is it compatible with the business?

The share capital is the declared investment in the company. While it does not necessarily reflect current net worth, share capital that is far too low for the size of the operation is a warning sign. A company presenting itself as a large construction firm with share capital of R$ 1,000, for example, deserves deeper investigation.

4. Address: does the location actually exist?

Check whether the address registered under the CNPJ corresponds to a real place of business. On Inddex, the full address is displayed on the company profile. Warning signs:

• A residential address for an activity that should have commercial premises
• The same address shared by dozens of different companies (it may be a legitimate virtual office, but it is worth investigating)
• An address in a different state from where the company claims to operate
• An incomplete address or one with clearly fictitious data

5. Economic activity (CNAE): does it match what they offer?

The registered CNAE (Brazil's National Classification of Economic Activities) must be compatible with the products or services the company offers. A company that sells software but is registered as a food retailer, or a financial consultancy registered as a beauty salon, are clear signs of irregularity.

Check both the primary CNAE and the secondary ones. It is normal for companies to have secondary CNAEs covering complementary activities, but the declared primary activity must match the actual business.

6. Partners and ownership structure: who are the owners?

The ownership structure reveals who controls the company. On Inddex, you can see the full name, partial CPF (Brazil's individual taxpayer ID), and role of each partner. Points to watch:

• Partners with a history of closed or non-compliant companies (look up the CPF on Inddex)
• Very young partners (possible misuse of documents)
• Many companies linked to the same partner across different industries
• Frequent partner changes over short periods

7. Compliance: sanctions, lawsuits, and debts

Beyond the basic registration data, full due diligence includes checking:

• CEIS (Registry of Disreputable and Suspended Companies): companies penalized by public agencies
• CNEP(National Registry of Punished Companies): sanctions applied under Brazil's Anti-Corruption Law
• CEPIM (Registry of Barred Private Nonprofit Entities): entities barred from receiving voluntary government transfers
• PGFN(Procuradoria-Geral da Fazenda Nacional, Brazil's National Treasury Attorney General's Office): outstanding debts owed to the federal government
• Lawsuits: civil, labor, and criminal cases in the courts

Inddex brings together enrichment data that complements the Receita Federal registration records, making a broader verification easier in a single place.

How to use Inddex for full due diligence

Inddex lets you run all of the checks above in just a few minutes:

1. Go to the search page and type the company's CNPJ or name
2. Check the registration status (visual indicator at the top of the company profile)
3. Review the opening date, address, CNAE, and share capital in the registration data
4. Analyze the complete ownership structure with each partner's role
5. Look up the available compliance and enrichment data

Warning signs (red flags)

A combination of multiple warning signs should set off maximum alert. Treat the following as serious red flags:

Complementary tools

Beyond Inddex, other sources can complement your verification:

• Reclame Aqui:Brazil's consumer complaints platform, showing the company's reputation, complaint history, and resolution rate
• Procon: complaints filed with Brazilian consumer protection agencies
• Protest registries: debt instruments protested against the company (unpaid debts)
• State courts: case lookups to check lawsuits involving the company
• Portal da Transparência:Brazil's transparency portal listing contracts and agreements with the federal government

Frequently asked questions

Can I verify a company using only its name?

Yes. On Inddex, name search works with both the legal name (razão social) and the trade name (nome fantasia). You do not need to know the CNPJ to run a lookup — just type the company name on the search page.

Is the lookup data reliable?

Yes. Inddex uses only official data from Brazil's Receita Federal, updated monthly as new datasets are published. It is the same data available on the official certificate issued by the Receita.

Can a company have "Ativa" status and still be fraudulent?

Yes, it is possible. "Ativa" status only means the company is in good standing with the Receita Federal. That is why full due diligence involves multiple checks — registration status is necessary, but not sufficient. Review all 7 points in this guide for a safer assessment.

Do I need to pay for company due diligence?

Basic registration data (status, address, CNAE, partners, share capital) is public and can be looked up for free on Inddex. For deeper checks such as compliance, protests, and lawsuits, there are specialized services that aggregate this information. Learn more about how to look up a CNPJ in the dedicated article.