Criminal Due Diligence in M&A in Brazil (2026): Buyer & Seller Playbook

Criminal due diligence brazil has moved from a compliance afterthought to a deal-deciding discipline for anyone buying or selling a Brazilian company in 2026. Sustained enforcement under the Clean Company Act, active prosecution of executives, and a continuing appetite among regulators for corporate settlements mean that unexamined criminal exposure can destroy value overnight, or hand a buyer inherited liabilities it never priced. This guide takes a position: buyers who treat criminal risk as a first-order workstream, and sellers who prepare a credible remediation narrative before going to market, close better deals.

What follows is a practical playbook, scope decisions, red-flag scoring, SPA clause drafting, escrow mechanics, remediation workflows and clear walk-away tests, written for deal teams who need to act, not theorise.

Executive summary: 5-minute decision guide

If you read nothing else, read this. Criminal exposure in a Brazilian transaction is rarely binary, the question is not “is there risk?” but “can the risk be scoped, priced, allocated and remediated within the deal economics?” The five actions below separate teams that close cleanly from those that inherit litigation.

Five key actions for buyers:

• Scope early. Decide the depth of investigation (compliance review versus full forensic audit) based on sector, geography and counterparties within the first week.
• Preserve evidence. Serve preservation notices and require forensic imaging before information starts moving or being deleted.
• Price the risk. Translate findings into an escrow, holdback or price reduction, not a vague comfort letter.
• Draft specific criminal representations and indemnities. Generic compliance warranties will not survive an enforcement claim.
• Fix your walk-away thresholds in advance. Agree internally what evidence of probable prosecution or uninsurable exposure triggers termination.

Five key actions for sellers:

• Run your own diligence first. A vendor investigation lets you control the narrative and cap surprises.
• Disclose deliberately. Full, documented disclosure narrows warranty exposure and builds buyer trust.
• Cap and time-limit indemnities. Baskets, caps and survival periods are your primary defence.
• Present a remediation plan. A funded, credible compliance upgrade converts a deal-killer into a manageable holdback.
• Control self-reporting rights. Negotiate who decides whether and when to approach regulators.

When to walk (one line): a buyer should walk when evidence points to probable prosecution, management refuses to cooperate, or exposure exceeds combined insurance and escrow capacity.

What is criminal due diligence and why 2026 matters

Criminal due diligence brazil is the structured investigation of a target company’s past and ongoing conduct to identify wrongdoing capable of triggering administrative or criminal enforcement, and to translate that exposure into deal terms. It sits alongside, but is distinct from, general legal and financial due diligence: it looks specifically for bribery, fraud, money laundering, environmental crime, tax offences and the executive conduct that can attach personal and corporate liability.

The scope is broad because the sources of risk in Brazil are broad. They include improper payments to public officials, off-book accounts, offshore intermediaries, prior leniency or cooperation agreements, active investigations by the Ministério Público Federal (MPF) or Polícia Federal, and administrative proceedings before the Controladoria-Geral da União (CGU). Each of these can crystallise into fines, contract debarment or reputational collapse for an acquirer.

Why does 2026 sharpen the picture? Enforcement remains intense, and regulators continue to pursue corporate settlements and successor accountability. The Clean Company Act (Law No. 12.846/2013) and its implementing Decree No. 8.420/2015 establish strict administrative liability of legal persons for acts against public administration, with fines calculated on gross revenue and the possibility of leniency agreements that reward disclosure and cooperation. Because that liability can follow the company, not just the individuals, a buyer that ignores it can acquire the penalty along with the business. This is precisely why M&A criminal due diligence has become a gating item rather than a box-tick.

Legal background: corporate criminal liability and enforcement in Brazil

Two regimes matter, and deal teams must keep them separate. The first is administrative liability under the Clean Company Act; the second is criminal liability under the Brazilian Penal Code (Decreto-Lei No. 2.848/1940). Conflating them is the most common error in acquisition criminal risk Brazil analysis.

Under Law No. 12.846/2013, a legal person is strictly and objectively liable for corrupt acts against domestic or foreign public administration, no proof of individual intent is required to sanction the company. Sanctions include fines and, in the judicial sphere, measures such as suspension of activities and prohibition from receiving public incentives and from contracting with the public sector. Decree No. 8.420/2015 details how fines are calculated, how compliance programmes are assessed as mitigating factors, and how leniency agreements are negotiated.

Criminal liability, by contrast, generally attaches to individuals, directors, officers and employees, for offences defined in the Penal Code and special statutes. Corporate criminal liability of legal persons in Brazil is recognised in defined areas (notably environmental crime under Law No. 9.605/1998), which is why executive liability in deals is a distinct and personal concern. Criminal investigations follow the Code of Criminal Procedure (Decreto-Lei No. 3.689/1941), which governs seizure, search and the admissibility of evidence, rules that shape how a buyer’s investigators must preserve material.

The enforcement architecture involves several bodies acting in parallel: the MPF prosecutes crimes and negotiates cooperation and plea arrangements; the Polícia Federal investigates; and the CGU leads administrative anti-corruption enforcement, alongside the Advocacia-Geral da União (AGU) in civil recovery. Leniency agreements and cooperation (colaboração premiada) can materially reduce exposure but also create paper trails, a prior agreement discovered in diligence is a significant signal.

Can a buyer inherit criminal liability? Practical realities and case law

The short answer is yes, but with important distinctions. On the administrative side, the Clean Company Act expressly contemplates that, in cases of merger or acquisition, the successor’s liability may extend to payment of fines and full compensation for damage caused, limited (except in cases of simulation or evident intent to defraud) to the value of the assets transferred. That is why successor liability is treated as a live risk in every serious diligence exercise.

On the criminal side, the position is narrower. Criminal punishment is personal in character, and prosecution primarily targets the individuals who committed offences. However, the practical exposure for an acquirer is real in several ways:

• Continued conduct. If unlawful practices persist after closing, the buyer’s own management becomes exposed.
• Corporate reuse. Where the acquired entity is the vehicle through which offences occurred and continues to operate, enforcement pressure attaches to that entity.
• Administrative debarment. Even without criminal conviction of the buyer, the target can be barred from public contracts, a commercial catastrophe for certain businesses.

Successor and predecessor liability questions are ultimately shaped by the courts. The jurisprudence of the Superior Tribunal de Justiça (STJ) on corporate and successor liability, and the constitutional and procedural rulings of the Supremo Tribunal Federal (STF) on due process, should be reviewed for any high-risk target. The practical takeaway is unambiguous: assume administrative exposure can follow the deal, and structure the contract accordingly, rather than relying on the personal nature of criminal punishment to protect the acquirer.

Pre-deal: designing investigation scope and preserving evidence

Scope is the single most consequential decision in criminal due diligence brazil. Over-scope and you burn time and goodwill; under-scope and you miss the exposure that later detonates. The choice runs along a spectrum.

Choosing the depth of investigation

• Limited compliance review. Appropriate for low-risk targets: policy review, screening of key counterparties, sanctions and PEP checks, and management questionnaires.
• Enhanced review. For medium-risk targets: transaction sampling, third-party intermediary analysis, and targeted interviews.
• Full investigative audit. For high-risk targets, public-sector exposure, prior investigations, offshore structures: forensic accounting, email review, custodian interviews and document imaging.

Sources to examine include accounting books and ledgers, contracts with intermediaries and agents, email and messaging archives, board and committee minutes, prior audit and internal-investigation reports, and any correspondence with MPF, CGU or the Polícia Federal.

Preserving evidence and respecting procedure

Preservation must start before information can be altered. Practical steps: issue a litigation-hold notice, require forensic imaging of key custodians’ devices, maintain a documented chain of custody, and record the custodian list. Because the Code of Criminal Procedure governs how evidence is seized and admitted, a poorly handled internal investigation can compromise material a buyer later needs. Coordinate the forensic team’s methodology with counsel from the outset.

Privilege and confidentiality require care. Communications with counsel and professional-secrecy obligations, reinforced by the Statute of the Bar (Law No. 8.906/1994) and Ordem dos Advogados do Brasil (OAB) ethics rules, must be respected, and cross-border data transfers and data-protection considerations under the Lei Geral de Proteção de Dados (LGPD) planned before documents move. Build a vendor checklist covering forensic imaging capability, Portuguese-language review capacity, data-protection compliance and demonstrable independence.

Red flags checklist, what kills deals

Not every finding is fatal. Score each red flag by severity so the deal team can react proportionately.

• Prior leniency or cooperation agreement (High). Signals admitted misconduct and ongoing obligations that transfer.
• Active criminal probe into executives (High). Personal exposure and reputational contagion.
• Suspicious payments to intermediaries or offshore vehicles (High). Classic bribery and laundering indicator.
• Missing or incomplete books and records (High). Prevents pricing of risk and suggests concealment.
• Public-sector contract dependency plus weak controls (Medium). Debarment risk to core revenue.
• Undocumented facilitation payments (Medium). Systemic control failure.
• Weak or paper-only compliance programme (Medium). Reduces mitigation credit under Decree 8.420/2015.
• Isolated, remediated historical breach (Low). Manageable with disclosure and warranty.

Any cluster of High flags moves a deal toward the walk-away analysis below.

Transaction pricing of criminal risk, valuation, insurance and escrow

Once identified, risk must be quantified and mechanically allocated. The tools are valuation adjustment, escrow, holdback and insurance.

Valuation. Where exposure is quantifiable, for example, a potential administrative fine benchmarked to gross revenue under the Clean Company Act, model a realistic range and reflect it in price or a dedicated indemnity, rather than absorbing it silently.

Escrow and holdback sizing. Size escrow to the realistic downside, not the best case. A tiered structure works best: an immediate holdback funds urgent remediation, while a secondary, longer-dated escrow covers latent liabilities and pending regulatory outcomes.

Insurance. Directors’ and officers’ (D&O) and professional indemnity policies commonly contain crime and fraud carve-outs, meaning deliberate wrongdoing is often excluded. Buyers should confirm valid cover, understand exclusions, and secure seller cooperation in any claim. Representations and warranties insurance rarely covers known criminal exposure. Treat insurance as a supplement to escrow, never a substitute.

Contract toolkit, warranties, indemnities, remedial covenants and settlement language

This is where criminal due diligence brazil converts into enforceable protection. Findings that are not translated into precise SPA language are, in practical terms, worthless to a buyer. The negotiation runs clause by clause, and each has a buyer ask and a predictable seller response.

Sample criminal exposure representation (buyer-favour)

A buyer should push for specific, standalone representations rather than a general compliance warranty. Illustrative (example only, not legal advice) language:

“The Company and each of its officers, directors and employees has not, in connection with the business: (a) been the subject of any criminal investigation, indictment or proceeding; (b) entered into any leniency, cooperation or plea agreement with any authority, including the MPF or CGU; (c) received or made any improper payment to any public official; and there are no facts likely to give rise to any of the foregoing.”

The value lies in specificity: naming leniency agreements, active investigations and improper payments closes the ambiguity a general warranty leaves open.

Seller response: narrow knowledge qualifier and cap drafting

Sellers will seek to soften scope. Expect requests for a knowledge qualifier, ideally defined as “actual knowledge of named senior management after reasonable enquiry”, together with survival limits, a de minimis threshold, a basket (tipping or deductible) and an aggregate cap linked to the purchase price. The negotiation is a trade: buyers concede breadth on low-risk reps to hold the line on the specific criminal representations, which should carry a longer survival period and, ideally, sit outside the general cap.

Indemnity waterfall and escrow schedule: worked example

Consider a deal at a purchase price of R$200 million where diligence identifies a potential Clean Company Act exposure modelled at up to R$30 million. A workable structure:

• Tier 1, immediate holdback of R$10 million for urgent remediation and known defence costs, released as remediation milestones are certified.
• Tier 2, special escrow of R$20 million covering the identified criminal/administrative exposure, released on the earlier of (i) formal regulator closure or (ii) a defined long-stop date.
• General warranty escrow of a smaller percentage for ordinary breaches, with a standard survival period.
• Waterfall order: claims for pre-closing criminal conduct draw first on the Tier 2 special escrow, then on the Tier 1 holdback, before any recourse to the general escrow or seller directly.

The special escrow is the mechanism that lets an otherwise risky deal close: it funds the exposure without forcing the buyer to trust an unsecured indemnity. Figures above are illustrative only and should be calibrated to each transaction.

Cooperation clause: scope, limits and fee recovery

A criminal indemnity is only as good as the seller’s post-closing cooperation. Buyers should require a covenant obliging the seller to make witnesses available, produce documents, support forensic review and assist in any regulator engagement. Sellers will insist on reasonable-request limits, temporal boundaries and fee-shifting for excessive demands. A balanced clause defines the scope, sets a reimbursement mechanism and ties material breach of the cooperation covenant to loss of indemnity defences.

Also standard in the toolkit: an express criminal indemnity for fines, remediation costs and legal defence; a seller termination trigger where a material criminal fact emerges before closing; and a clause allocating authority over any settlement or self-report, the most contested item, discussed below.

Post-closing remediation and enforcement response playbook

Closing is not the end of criminal risk management; it is the start of remediation. Post-closing remediation Brazil workflows should be pre-agreed in the SPA and executed immediately.

• Integrate compliance. Roll the target into the acquirer’s compliance programme, enhanced controls also count as mitigating factors under Decree 8.420/2015.
• Take immediate remedial steps. Suspend problematic intermediaries, tighten payment controls, and preserve evidence generated by ongoing operations.
• Decide the regulator posture. Choose deliberately between self-disclosure, potentially unlocking leniency and cooperation credit before the MPF or CGU, and a defensive strategy. This decision should follow the settlement-authority clause negotiated in the SPA.
• Manage parallel proceedings. Administrative (CGU) and criminal (MPF) tracks can run simultaneously; coordinate defence so that admissions in one do not prejudice the other.
• Coordinate cross-border. Where foreign authorities have jurisdiction, synchronise Brazilian and overseas strategy to avoid inconsistent positions.

Trigger the seller’s cooperation covenant and indemnities early and in writing, and notify insurers promptly to preserve coverage.

Walk-away tests: when buyers should say no in criminal due diligence brazil

A disciplined buyer decides its thresholds before emotion and sunk costs take over. Walk away when any of the following is present and cannot be cured:

• Probable prosecution. Evidence indicates a criminal charge or debarment is likely, not merely possible.
• Uncooperative management. The seller or target leadership refuses meaningful cooperation or obstructs the investigation.
• Uninsurable, un-escrowable exposure. Quantified risk exceeds the combined capacity of insurance and any escrow the seller will accept.
• Deal-destroying remediation. The cost or operational disruption of remediation eliminates the deal’s rationale.
• Material adverse conduct. Ongoing wrongdoing that the buyer would be continuing post-closing.

Simple decision tree: Is the exposure quantifiable? If no, and it cannot be scoped, walk. If yes, can it be covered by escrow plus insurance? If no, walk or renegotiate price. If yes, will the seller cooperate on remediation and reporting? If no, walk. If yes, close with remediation and a special escrow.

Comparison table, Buyer vs Seller: who does what, when

This dimension-by-dimension comparison is the practical heart of the playbook. It shows where interests conflict and where they can be bridged.

Practical negotiation checklist & timeline for a 90-day closing

1. Days 1–10 (scope and preserve): agree investigation scope; issue preservation notices; appoint forensic vendor; screen counterparties and executives.
2. Days 11–30 (investigate): conduct document review and interviews; identify and score red flags; model quantifiable exposure.
3. Days 31–55 (allocate): draft specific criminal reps and indemnities; size escrow tiers; confirm insurance position and carve-outs.
4. Days 56–75 (negotiate): resolve knowledge qualifiers, caps, cooperation covenant and settlement-authority clause; finalise the indemnity waterfall.
5. Days 76–90 (close): confirm remediation plan, fund escrow, execute the SPA, and set the post-closing integration calendar.
6. Post-closing to Day 180: integrate compliance, execute remediation milestones, manage any regulator engagement, and administer escrow releases against agreed triggers.

Assign an owner to each task, buyer, seller, escrow agent or monitor, so nothing falls between the parties.

Key statutes and regulator guidance (quick reference)

• Law No. 12.846/2013 (Clean Company Act): strict administrative liability of legal persons; fines and leniency framework.
• Decree No. 8.420/2015: fine calculation, compliance-programme assessment and leniency procedure.
• Penal Code (Decreto-Lei No. 2.848/1940): core criminal offences relevant to executives.
• Code of Criminal Procedure (Decreto-Lei No. 3.689/1941): seizure, search and evidence rules that shape investigations.
• Law No. 9.605/1998 (Environmental Crimes Act): a principal basis for criminal liability of legal persons.
• MPF and CGU guidance: enforcement practice, cooperation and leniency agreements.
• STF and STJ jurisprudence: due-process, corporate and successor-liability rulings to review for high-risk targets.

Conclusion

Criminal due diligence brazil is no longer optional in serious M&A, it is the workstream that determines whether a deal closes cleanly, closes with protection, or should not close at all. The disciplined buyer scopes early, preserves evidence properly, quantifies exposure, and converts findings into specific representations, tiered escrow and enforceable cooperation covenants. The disciplined seller runs its own diligence, discloses deliberately, caps and times its indemnities, and arrives with a funded remediation plan. Both sides benefit from clear, pre-agreed walk-away thresholds and a decision framework applied without sentiment. Handled this way, criminal risk becomes a priced, allocated and managed variable rather than a hidden liability, and that is the difference between a value-creating transaction and an inherited crisis.

This guide is for general information and does not constitute legal advice; consult qualified counsel for any specific transaction. You can also find a criminal lawyer, Brazil through the Global Law Experts directory.

Sources

1. Presidency (Planalto), Law No. 12.846/2013 (Clean Company Act)
2. Presidency (Planalto), Decree No. 8.420/2015
3. Presidency (Planalto), Brazilian Penal Code (Decreto-Lei No. 2.848/1940)
4. Presidency (Planalto), Code of Criminal Procedure (Decreto-Lei No. 3.689/1941)
5. Ministério Público Federal (MPF)
6. Controladoria-Geral da União (CGU)
7. Supremo Tribunal Federal (STF)
8. Superior Tribunal de Justiça (STJ)
9. Ordem dos Advogados do Brasil (OAB)
10. OECD, Anti-Corruption and Corporate Liability