Lei 15.358/2026, What Businesses Must Do Now: a Corporate Compliance Guide (2026)

Lei 15. 358/2026 corporate compliance Brazil is now the defining concern for every general counsel and compliance officer at companies operating in the country. Published on 24 March 2026 in the Diário Oficial da União, the statute, formally titled the Marco Legal do Combate ao Crime Organizado, rewrites the rules on how organised crime is defined, investigated, and punished, with direct consequences for corporate entities. The new organised crime law Brazil 2026 expands the categories of criminal conduct that can attach to businesses, introduces sweeping powers for the seizure of digital assets Brazil authorities can now repurpose, and raises the personal exposure of executives who fail to implement adequate controls.

This guide delivers the practical, prioritised steps that in-house legal teams need to take in the first 90 days, and flags the constitutional challenges already underway.

Executive Summary: What GCs Must Do Now

Lei nº 15.358/2026 entered into force upon its publication in the DOU on 24 March 2026. It consolidates, expands, and in several respects replaces the framework that previously governed organised crime in Brazil, creating new offence categories, broadening definitions of criminal organisations, and granting authorities explicit power to seize, freeze, and repurpose assets, including cryptocurrency and digital tokens held by custodians. For corporates, the statute’s most consequential features are its widened net for corporate criminal liability Brazil, the reduced evidentiary thresholds for emergency asset measures, and the creation of integrated databases that allow rapid cross-referencing of corporate structures with known criminal networks.

Four immediate priorities for the next 90 days:

1. Governance escalation. Brief the board and audit committee on Lei 15.358/2026 exposure within 30 days. Secure a mandate to update the compliance programme.
2. Risk mapping. Conduct a gap analysis of existing anti-crime and AML policies against the statute’s new definitions and offence categories.
3. Asset custodian review. Audit all relationships with crypto custodians, escrow agents, and payment intermediaries to ensure rapid response to seizure orders.
4. Engage experienced criminal counsel. Retain or brief specialist Brazilian criminal-law advisors who can guide the internal-investigation protocol and represent the company if enforcement action materialises.

What Lei 15.358/2026 Is, Quick Statutory Summary for Business

The Marco Legal do Combate ao Crime Organizado is the most comprehensive overhaul of Brazil’s criminal-organisation framework since Law 12.850/2013. It was enacted to address the evolving structure of criminal groups, particularly factions and militias, that operate through layered corporate vehicles, digital-finance channels, and cross-border logistics networks. The law introduces or materially amends provisions in the following areas:

• New and expanded offence categories. The statute creates specific offences for the financing, logistical support, and digital facilitation of organised-crime groups, with penalties that can be applied cumulatively.
• Broader organisational definitions. The concept of domínio social estruturado extends the reach of organised-crime prosecution to entities, including legitimate businesses, that exercise structured social control in defined territories or economic sectors.
• Asset seizure and repurposing. Authorities may now seize and repurpose assets, including digital assets, used in or derived from organised-crime operations, under reduced procedural thresholds.
• Integrated criminal databases. The law mandates the creation of cross-agency databases that map corporate structures, beneficial ownership chains, and financial flows linked to organised-crime investigations.

Key Definitions That Matter for Business

Corporate Exposures and Executive Risk Under the New Law

Corporate criminal liability Brazil has operated under a dual-track system: direct liability of the legal entity (primarily under environmental and anti-corruption statutes) and individual liability of officers and directors. Lei 15.358/2026 materially expands the second track. Executives who fail to implement or maintain effective compliance controls can face personal criminal exposure where their omissions facilitated, even passively, the operations of an organised-crime group. The law does not require proof that the executive personally benefited; wilful blindness or systemic negligence in oversight may suffice.

The practical effect, as legal commentators have noted, is to shift the burden onto management to prove that adequate preventive measures were in place. Industry observers expect prosecutors to test these provisions aggressively in the financial and logistics sectors, where organised-crime infiltration has been well documented.

Examples of Business-Facing Risk Scenarios

• Fintechs and payment institutions. A digital-payments company whose onboarding process fails to detect that a merchant account is controlled by a criminal faction could face investigation for facilitation. Executives responsible for compliance sign-off may be personally charged.
• Logistics and transport operators. A haulage company that subcontracts drivers or routes through intermediaries linked to militia-controlled territories risks classification under the domínio social estruturado framework, even if the company itself had no direct knowledge of the criminal link.
• Real estate developers. Development projects financed through intermediary structures that channel funds from organised-crime sources expose both the corporate entity and the signing directors to asset forfeiture and criminal charges.

Defences and Mitigation, Role of Robust Compliance

While the organised crime law Brazil 2026 does not create an explicit statutory safe harbour for companies with compliance programmes, Brazilian jurisprudence and the existing anti-corruption framework (Lei 12.846/2013) recognise the existence and effectiveness of a compliance programme as a material mitigating factor in sentencing and in the negotiation of leniency agreements. Legal analysts writing in ConJur have emphasised that companies with documented, functioning compliance systems will be better positioned to argue against the imposition of the harshest penalties, and to resist the extension of personal liability to senior management.

The likely practical effect is that Lei 15.358/2026 corporate compliance Brazil will become a core governance requirement, not a discretionary investment. Boards that can demonstrate a documented chain of compliance, risk assessment, training records, monitoring logs, incident response, will have a materially stronger defence posture.

Asset Measures, Seizure, Preservation and Repurposing of Cash, Property, and Digital Assets

One of the most consequential provisions of the Marco Legal do Combate ao Crime Organizado concerns the seizure of digital assets Brazil authorities can now execute. The law provides explicit statutory authority for the emergency freezing and subsequent forfeiture of cryptocurrency, tokenised securities, and other digitally represented rights. This fills a gap in prior legislation, which addressed physical property and bank accounts but left digital assets in a grey zone.

The statute permits emergency seizure orders, without prior notice to the asset holder, where there is reasonable suspicion that the assets are proceeds of, or instrumentalities used in, organised-crime activities. Judges may authorise these orders on an ex parte basis, and the new integrated databases allow authorities to identify and trace digital-asset flows across exchanges and custodians in near-real time.

Once seized, assets can be repurposed: sold at auction, transferred to law-enforcement agencies for operational use, or, in the case of digital assets, converted to fiat currency and allocated to public-security budgets. The standard for permanent forfeiture (perdimento) is a final criminal conviction, but assets may remain frozen throughout the duration of proceedings, which in Brazilian criminal cases can extend for years.

Crypto and Custodial Assets, Operational Response Checklist

Companies holding digital assets on their balance sheets, or operating as custodians for clients, should treat asset-seizure preparedness as an immediate compliance priority. Early indications suggest that authorities intend to exercise these powers broadly in the initial enforcement phase.

Internal Investigations Under Lei 15.358/2026, Privilege, Cooperation, and Evidence Handling

Conducting internal investigations Brazil in the wake of this legislation requires careful navigation of privilege rules, data-protection obligations, and the boundaries of voluntary cooperation with authorities. Unlike common-law jurisdictions, Brazil does not recognise a broad attorney-client privilege that shields all communications between in-house counsel and the business. Privilege in Brazil attaches primarily to communications with external advogados acting in a specifically retained advisory or defence capacity.

This distinction becomes critical under Lei 15.358/2026, which empowers investigators to request, and in some cases compel, the production of internal documents, interview transcripts, and digital communications as part of organised-crime investigations. Companies that conduct internal investigations without proper privilege protocols risk involuntary disclosure of sensitive findings that could be used against the entity and its officers.

Privilege Risk Matrix

When to Suspend or Pivot an Internal Investigation

There are circumstances under which continuing an internal investigation may create more risk than it mitigates. Companies should consider suspending or pivoting their approach when:

• Authorities have initiated a formal criminal investigation (inquérito policial) into the same facts, continued internal activity risks document-spoliation allegations or obstruction claims.
• Interview subjects indicate they may invoke the right to silence or have retained personal defence counsel, further questioning without procedural safeguards may taint the evidence.
• Cross-border data-transfer restrictions (including LGPD requirements) create a conflict between responding to a Brazilian authority request and complying with data-protection obligations in another jurisdiction.
• The investigation uncovers evidence of serious criminal conduct that triggers mandatory reporting obligations, at this point, the company must consult criminal counsel before any further steps.

Immediate Compliance Checklist, The 90-Day Action Plan for Corporates

The criminal compliance checklist 2026 below provides a structured, prioritised action plan for companies responding to Lei 15.358/2026 corporate compliance Brazil requirements. Each item identifies the responsible owner, the recommended deadline, and the evidence that demonstrates completion.

Reporting Obligations, Law-Enforcement Interaction, and Cooperation Strategy

Lei 15.358/2026 does not introduce a general mandatory self-reporting obligation for corporates. However, companies in regulated sectors, financial institutions, payment processors, crypto exchanges, already face reporting duties under existing AML/CFT legislation, and the new statute’s expanded definitions of organised-crime conduct effectively widen the universe of suspicious activities that must be reported. Industry observers expect regulators such as COAF (Conselho de Controle de Atividades Financeiras) to issue updated guidance that aligns existing reporting triggers with the statute’s new offence categories.

When deciding whether to self-report or cooperate proactively, companies must weigh the potential benefits, reduced penalties, leniency consideration, protection of business continuity, against the risks, including the possibility that voluntary disclosures could accelerate enforcement action or expose the company to civil liability from affected third parties.

Practical Do’s and Don’ts During Raids and Seizures

• Do designate a senior legal representative to interface with authorities on-site and ensure all interactions are documented.
• Do request and retain copies of all warrants, court orders, and property-seizure inventories before any assets leave the premises.
• Do instruct employees to cooperate with lawful requests but to refrain from volunteering information beyond what is specifically demanded.
• Don’t attempt to move, delete, or encrypt digital assets or documents after a seizure order has been served, this can constitute obstruction.
• Don’t permit interviews of employees without the presence of either in-house or external counsel, and advise employees of their right to personal legal representation.
• Don’t make public statements about the raid or seizure without first consulting criminal counsel, premature disclosures can prejudice the company’s legal position.

Compliance Programme Updates, Policy Language and Monitoring to Reduce Exposure

Under the new framework, Lei 15.358/2026 corporate compliance Brazil demands that existing anti-crime and ethics policies be updated to reflect the statute’s expanded definitions and offence categories. Generic anti-corruption language is no longer sufficient. Companies should incorporate specific references to organised-crime facilitation, digital-asset handling, and the domínio social estruturado concept.

Monitoring systems must be recalibrated. Transaction-monitoring rules should be updated to flag patterns associated with organised-crime financing, including rapid cycling of funds through multiple accounts, unusually high volumes of digital-asset transactions with newly onboarded counterparties, and payments to or from entities in territories identified as militia or faction-controlled areas.

Contractual Clauses for Vendor and Partner Exposure, Sample Language

Companies should consider inserting or strengthening the following clauses in vendor, supplier, and joint-venture agreements:

• Organised-crime representations and warranties. “The Counterparty represents and warrants that neither it, its directors, officers, nor any entity within its ownership or control chain has been investigated, charged, or convicted in connection with organised-crime offences under Lei 15.358/2026 or any predecessor legislation.”
• Compliance cooperation. “The Counterparty agrees to cooperate fully with any compliance audit, internal investigation, or regulatory inquiry conducted by or on behalf of the Company in connection with obligations arising under Lei 15.358/2026, including by providing access to records, personnel, and premises upon reasonable notice.”
• Immediate termination trigger. “The Company may terminate this Agreement with immediate effect upon reasonable grounds to believe that the Counterparty has become the subject of an investigation, arrest warrant, or asset-seizure order under Lei 15.358/2026 or related legislation.”

Litigation and Constitutional Risk, What to Watch

Not all provisions of the Marco Legal do Combate ao Crime Organizado are settled law. As reported by ConJur, a professional association has filed a constitutional challenge before the Supremo Tribunal Federal (STF) questioning 19 specific provisions of the statute. The challenged points reportedly include the scope of the domínio social estruturado concept, the breadth of emergency asset-seizure powers, and procedural provisions that critics argue infringe on due-process guarantees.

No injunctive relief or suspension of any provision has been granted as of the date of this publication. However, companies should adopt a conservative compliance posture, treating all provisions as enforceable, while monitoring STF proceedings closely. Early indications suggest that the court may take several months to schedule oral arguments, meaning the statute will operate in its current form throughout most of 2026. Compliance programmes should therefore be built to the full statutory standard, with the flexibility to adjust if specific provisions are later narrowed or struck down.

Appendix, Comparison Table, Timeline, and Compliance Checklist

Reporting and Compliance Obligations by Entity Type

Key Dates and Timeline

For assistance identifying experienced criminal-law counsel in Brazil, consult the Global Law Experts lawyer directory.

Sources

1. Presidency (Planalto), Official Consolidated Law Text (Lei 15.358/2026)
2. Diário Oficial da União (IN.gov.br), DOU Publication of Lei nº 15.358/2026
3. Chamber of Deputies (Portal da Câmara), Consolidated Legislation Page
4. ConJur, Constitutional Challenges to Lei 15.358/2026
5. Migalhas, Legal Analysis and Practitioner Commentary
6. Dimensa, Practical Financial-Sector Compliance Analysis
7. JOTA, Opinion and Legal Analysis on Organised-Crime Definitions
8. Legalcloud, Lei 15.358/2026 Sector Risk Analysis