How to Conduct an Internal Criminal Investigation in Brazil (2026): Step‑by‑step Guide for Companies

An internal criminal investigation Brazil companies run must be built on a sound understanding of the current criminal‑procedure framework, corporate‑liability rules, and data‑protection obligations, and must be defensible from the very first hour of a suspected offence. For corporate counsel, compliance officers and in‑house legal teams, the practical consequence is clear: a robust process, grounded in the Código de Processo Penal, the Código Penal, the corporate anti‑corruption regime (Lei 12. 846/2013, the Clean Company Act), and the Lei Geral de Proteção de Dados (Lei 13. 709/2018), must be applied consistently.

This guide sets out a prescriptive, step‑by‑step procedure, from triage and evidence preservation through interviews, legal analysis, remediation and cross‑border coordination, with the tables, timelines and checklists in‑house teams need to act with confidence. It is written to be actionable rather than promotional, and it flags points where Brazilian law remains unsettled so you can adopt a cautious, defensible approach.

Overview, What This Guide Covers and Why a Disciplined Process Matters

This guide is a jurisdiction‑specific procedural manual for running an internal criminal investigation Brazil businesses can rely on. It walks through immediate next steps, mandatory preservation actions, roles and responsibilities, privilege strategy, cross‑border evidence handling, and the decision map for notifying authorities. It is aimed at corporate counsel, compliance officers, in‑house legal teams and the external counsel who support them.

Key Legal Framework and Main Operational Impacts

Brazilian rules on evidence handling flow primarily from the Código de Processo Penal, while corporate exposure for acts against the public administration is governed by Lei 12.846/2013 (the Clean Company Act) and its implementing decree, which provide for leniency agreements and reward effective compliance programmes. Data collection and cross‑border transfers must comply with the LGPD (Lei 13.709/2018), supervised by the Autoridade Nacional de Proteção de Dados (ANPD). Because the enforcement landscape and applicable guidance can evolve, the sensible approach is to preserve broadly, document every decision, and take advice from Brazil‑qualified criminal counsel before narrowing your position, particularly on the handling of electronic and digital assets, where forensic standards are demanding.

When to Use This Guide (Types of Incidents)

Use this guide whenever an internal review surfaces facts that could amount to a criminal offence rather than a mere policy breach. Typical triggers include suspected fraud, bribery or corruption, embezzlement, money laundering, procurement irregularities, market abuse, and misuse of corporate assets. A white‑collar investigation Brazil compliance teams open will frequently begin as an HR or audit matter and only later reveal a criminal nexus, which is precisely why early, disciplined preservation matters. The guide also applies where a whistleblower report, regulatory inquiry, or media exposure signals possible criminal exposure for the entity or its executives.

Eligibility, When an Internal Review Becomes a Criminal Investigation

Not every internal review needs the full apparatus of a criminal investigation. The decision to escalate should be deliberate, documented, and made with legal input, because the moment you treat a matter as criminal you change preservation obligations, privilege strategy and reporting exposure.

Indicators of Criminal Conduct vs. Compliance Breach

Escalate when the facts suggest intent, concealment or personal enrichment rather than negligence or a process failure. Warning signs include falsified documents, off‑book payments, unexplained third‑party intermediaries, deleted communications, unauthorised access to systems, and suspicious asset flows. A compliance breach typically involves a failure to follow an internal control; criminal conduct involves an act that a prosecutor could charge under the Código Penal or special criminal statutes.

Decision Checklist: Escalate to Criminal Internal Investigation

• Intent or concealment. Is there evidence of deliberate wrongdoing or a cover‑up?
• Financial harm or illicit gain. Are funds, assets or advantages flowing improperly?
• Third‑party or public‑official involvement. Does the conduct touch bribery, procurement or public bodies?
• Regulatory exposure. Could the CVM, Banco Central or other supervisors have jurisdiction?
• Evidence destruction risk. Is there an immediate risk that data or documents will be lost?

If two or more boxes are checked, treat the matter as a criminal internal investigation Brazil authorities could scrutinise, and move directly to Step 1 below.

Step‑by‑Step: How to Conduct an Internal Criminal Investigation in Brazil

The following numbered process is the operational core of any internal investigation Brazil companies undertake. Each step lists the immediate actions, the lead and support roles, and the legal checkpoints to observe. The Step/Who/Duration timeline table follows Step 6.

Step 1, Initial Intake and Triage: Secure Facts and Preserve Evidence

The first 24 to 72 hours determine whether an internal criminal investigation Brazil regulators later examine will be defensible. On receiving a credible allegation, log the report, restrict knowledge to a need‑to‑know circle, and issue an immediate legal hold suspending routine document destruction and auto‑deletion.

1. Secure and freeze access to relevant systems, mailboxes and shared drives.
2. Suspend automated deletion, retention rotation and backup overwrite cycles.
3. Preserve system logs, access logs and audit trails before they age out.
4. Identify and ring‑fence custodians and their devices, without tipping off subjects where lawful.
5. Record every preservation decision with a timestamp and a responsible owner.

Do not begin interviewing subjects or collecting data in an ad hoc way at this stage, premature, undocumented collection is a common route to challenges over evidence integrity.

Step 2, Appoint the Investigation Team and Define Scope

Assemble a team that combines legal, forensic and human‑resources expertise while protecting independence. A typical team includes in‑house counsel or the general counsel, external criminal counsel, forensic IT specialists, and, where discipline may follow, HR. For matters implicating senior management or the board, appoint external criminal counsel to lead, both to reinforce independence and to strengthen the case for confidentiality over the work product.

• Conflicts. Screen team members for any personal or reporting‑line conflict with the subjects.
• Independence. The higher the seniority of the subject, the greater the need for external, independent leadership.
• Scope. Define the allegations, time period, custodians, systems and jurisdictions in a written scope memo, and treat it as a living document.

Confirm reporting lines, usually to a designated board committee or the general counsel, so findings are insulated from those who might be implicated.

Step 3, Preservation and Evidence Collection

Evidence preservation Brazil courts will accept depends on forensic rigour and an unbroken chain of custody. Use forensic imaging rather than manual copying, and document who collected what, when, from where, and how it was stored. Electronic evidence, email, server and cloud data, messaging apps and mobile devices, should be captured with tools that preserve metadata and hash values so integrity can be demonstrated later.

• Forensic imaging. Create verified bit‑level images of relevant devices and repositories.
• Chain of custody. Maintain a signed evidence log for every item from collection to storage.
• Cloud and messaging. Coordinate with cloud providers and mobile examiners to capture WhatsApp, Telegram and backup data that sits outside corporate email.
• Data protection. Align collection with the LGPD’s lawful‑processing requirements so that preservation does not itself create liability.

For digital assets and cryptocurrency holdings, apply the most conservative custody standard available, engage specialists able to preserve wallet and transaction data with integrity, and record your reasoning.

Step 4, Interviews and Statements

Plan interviews only after the documentary picture is substantially collected, so that questioning is evidence‑led. Sequence interviews from peripheral witnesses toward central subjects, and prepare a written interview plan for each. Deliver a clear “corporate warning” (an Upjohn‑equivalent caution) explaining that counsel represents the company, not the individual, that the conversation is confidential to the company, and that any confidentiality protection belongs to the company alone.

• Confidentiality protocol. Ensure counsel leads or attends interviews to support the protected character of the record.
• Documentation. Prepare counsel memoranda of interviews rather than verbatim transcripts where confidentiality protection is a priority; follow a consistent rule.
• Recording. Decide a single recording policy in advance and apply it uniformly; obtain consent where required.
• Executive interviews. Treat senior‑executive interviews as the most sensitive stage, brief the board committee before and after.

Never coerce, mislead or promise immunity to interviewees; improper technique can taint the investigation and expose the company to separate claims. Bear in mind that individuals retain their constitutional right to silence and to be assisted by their own lawyer.

Step 5, Legal Analysis and Regulatory / Criminal Nexus

Map the established facts to potential offences under the Código Penal and special criminal statutes, and assess corporate liability where it applies, including administrative and civil liability of the legal entity under Lei 12.846/2013 for acts against the public administration. Consider materiality: whether the conduct is isolated or systemic, whether controls failed, and whether senior management knew or should have known. This analysis determines regulatory exposure before the CVM or Banco Central, the strength of any cooperation or leniency position, and the remediation the board must approve.

Where the law is unsettled, for example on the precise reach of particular asset‑tracing or seizure measures, adopt a cautious reading, document the alternatives considered, and take a formal opinion from Brazil‑qualified counsel.

Step 6, Reporting, Remedial Actions and Remediation Plan

Convert findings into decisions. Prepare a factual report for counsel and a summary for the board, then agree remedial action: disciplinary measures, control fixes, recovery of assets, and, where advantageous, cooperation or a leniency agreement. The decision to notify authorities should be made by the general counsel and board with external counsel, weighing statutory reporting obligations against the mitigation available through cooperation.

• Discipline. Apply HR measures consistently and defensibly.
• Remediation. Fix the control gaps that allowed the conduct.
• Cooperation. Assess whether a leniency agreement (for administrative liability under Lei 12.846/2013, typically negotiated with the Controladoria‑Geral da União or the relevant public entity) or cooperation with the Ministério Público reduces sanction exposure.

Required Documents, Checklist and Preservation Priorities

A structured legal hold and a clear collection plan are the backbone of any corporate internal investigation Brazil regulators may later test. Preserve first and cull later: it is far safer to over‑preserve than to lose data that turns out to be material. Assign a single evidence custodian to own the log and ensure that every category below is captured with its metadata intact. The table sets out the priority document and data types, why each matters, and who should collect it.

Timeline and Deadlines, Reporting Windows and Limitation Triggers

Timing discipline protects both evidence and legal position. Internal milestones should be fixed early and tracked against the scope memo. As a working framework, complete initial preservation within 24 to 72 hours, deliver an initial factual update within 7 to 14 days, and target a final report within 30 to 90 days depending on complexity and data volume.

Statutory limitation periods (prescrição) vary by offence and turn on factors such as the maximum penalty and procedural events; they can be interrupted or suspended by specific acts as set out in the Código Penal. Because a delayed investigation risks both spoliation of evidence and complications with limitation, engage counsel early to map the relevant periods to the offences under review. For cross‑border elements, mutual legal assistance requests routed through Brazil’s central authority (within the Ministério da Justiça e Segurança Pública) can take months, so identify foreign‑evidence needs at the outset rather than late in the process.

On authority notification, the timing decision is driven by two questions: whether a statutory or regulatory reporting obligation has been triggered, for instance before the CVM in securities matters, or reporting to COAF where anti‑money‑laundering duties apply, and whether voluntary cooperation or a leniency agreement materially reduces sanction exposure. Both questions should be answered with counsel before any external disclosure.

Costs and Fees, Expected Budgets and Procurement Tips

Budget realistically and procure deliberately. Issue a short RFP for forensic vendors covering data volume, cloud environments, mobile devices and turnaround, and agree a clear scope with external counsel, fixed fees for defined phases where possible, hourly where scope is genuinely open. Build in contingency for scope expansion, which is common once collection begins. The ranges below are indicative planning benchmarks only, will vary significantly by matter, and should be confirmed by quotation; complex, multinational or crypto‑involved matters sit at the upper end or beyond.

Handling Digital Assets and Cryptocurrency Evidence

Digital assets require particular care in any internal criminal investigation Brazil authorities may later review. Identify, preserve and, where lawfully required, secure crypto holdings and wallet data under a defensible custody standard, and coordinate with financial‑supervision guidance where relevant. Concrete actions to embed into your playbook:

• Update legal‑hold templates. Reflect rigorous evidence‑handling expectations and broaden preservation to digital assets and wallet data.
• Build a crypto custody protocol. Define how the company identifies, preserves and secures digital assets during an investigation, engaging qualified forensic specialists.
• Maintain the cooperation decision map. Align it with current leniency and cooperation options and record the criteria for escalation.
• Revise playbooks and training. Ensure the compliance, legal and IT teams know the steps before an incident, not during one.

Because the applicable rules and guidance may evolve through subsequent regulation and case law, verify the current position against official sources and take advice before relying on any single reading.

Cross‑Border Investigations and Data Transfers

Cross‑border investigations Brazil companies conduct add layers of complexity: foreign evidence, multiple authorities, and data‑transfer constraints. Where evidence sits abroad or a foreign authority is involved, mutual legal assistance channels, routed through Brazil’s central authority within the Ministério da Justiça e Segurança Pública, are the formal route, and they take time. Coordinate early with external counsel in each relevant jurisdiction and preserve data locally while formal requests are pending.

Data transfers must rest on a lawful basis consistent with the LGPD and any applicable ANPD rules on international transfers, so document the legal ground for any transfer and apply appropriate safeguards. A practical international preservation checklist:

• Identify foreign‑located data early and issue local preservation notices in each jurisdiction.
• Confirm the transfer basis before moving personal data across borders.
• Assess timing of formal assistance requests and initiate them as soon as the need is clear.
• Maintain one chain of custody across jurisdictions to preserve admissibility.
• Coordinate messaging with local counsel to avoid conflicting positions before different authorities.

Confidentiality, Professional Secrecy and Interview Strategy

Confidentiality in an internal investigation Brazil teams rely on rests principally on lawyer professional secrecy (sigilo profissional) under the Estatuto da Advocacia (Lei 8.906/1994) and the OAB rules, rather than on a broad common‑law “attorney‑client privilege.” This protection is real but fact‑dependent, so it must be actively managed. Communications with a qualified lawyer for the purpose of legal advice, and the lawyer’s own work product, attract protection; the involvement of counsel strengthens the position. Pure internal fact‑gathering, disconnected from legal advice, may not be fully protected, which is why routing sensitive investigative work through external counsel is a practical safeguard rather than a formality.

Practical steps to preserve confidentiality:

• Lead through counsel. Have external criminal counsel direct sensitive collection, analysis and interviews.
• Label and segregate. Mark confidential legal work product clearly and restrict distribution to the need‑to‑know circle.
• Control disclosure. Recognise that sharing protected material with third parties or authorities can undermine confidentiality; make disclosure decisions deliberately.
• Separate roles. Keep the legal investigation distinct from routine HR processes to avoid diluting protection.

For interviews, deliver the corporate warning, keep counsel memoranda rather than casual notes, apply a consistent recording policy, and treat executive interviews as the highest‑risk stage. Never suggest that the protection belongs to the individual, it belongs to the company, and the individual should be told so plainly and reminded of their right to independent counsel.

Common Pitfalls and How to Avoid Them

• Late preservation. Waiting to issue a legal hold lets logs and messages age out, preserve within 72 hours.
• Broken chain of custody. Ad hoc collection undermines admissibility, use forensic imaging and a signed evidence log.
• Blurring HR and legal roles. Running discipline and the criminal investigation together weakens confidentiality, keep them separate.
• Improper interview technique. Coercion, promises of immunity or inconsistent recording taint the record, plan and standardise, and respect the right to silence.
• Mismanaging confidentiality. Failing to involve counsel or over‑distributing memos invites loss of protection, lead through counsel and restrict access.
• Ignoring cross‑border timing. Discovering foreign‑evidence needs late derails the timeline, map jurisdictions at the start.
• Overlooking digital assets. Treating crypto as an afterthought risks loss and preservation failures, build custody steps in from day one.

Comparison Table, Internal vs. External Investigation

Deciding whether to run the matter internally or engage external counsel and forensic vendors turns on independence, confidentiality and defensibility. As a rule of thumb, the more senior the subject and the greater the litigation or regulatory exposure, the stronger the case for external leadership.

Final Report, Board Briefing and Remediation

The final report is where the investigation earns its keep. Structure it around the scope, the methodology, the facts established, the evidence relied on, the legal analysis, and the recommendations, keeping the detailed factual and legal analysis under professional secrecy where possible. Prepare a separate summary for the board that conveys the findings and the recommended actions without unnecessarily exposing sensitive legal reasoning.

Remediation is not optional. Approve and implement disciplinary measures, control fixes and, where relevant, asset recovery, then monitor to confirm the fixes hold. Where cooperation or a leniency agreement is advantageous, execute the strategy through counsel. Document board sign‑off and the monitoring plan so the company can demonstrate a serious, good‑faith response, a factor that carries weight with authorities, and which an effective compliance programme and remediation can help mitigate under the Clean Company Act.

For companies that need experienced support, you can find a criminal lawyer in Brazil to lead or advise on the investigation.

Appendix: Templates and Checklists

To operationalise this guide, maintain a standard set of templates that your team can deploy within hours of an allegation. At minimum, keep a legal‑hold notice, an evidence log and chain‑of‑custody form, an interview plan with the corporate warning script, a scope memo template, and a cooperation/leniency decision map. Keeping these ready, reviewed by counsel and version‑controlled is the single most effective way to compress response time and ensure that any internal criminal investigation Brazil regulators later examine reflects a disciplined, defensible process from the first hour.

Conclusion

Running an internal criminal investigation Brazil companies can defend is a discipline, not an improvisation: preserve fast, lead through counsel, document everything, and let the Código de Processo Penal, the Clean Company Act (Lei 12.846/2013) and the LGPD shape your evidence handling, digital‑asset custody and cooperation decisions. The steps, tables and checklists above give in‑house teams a repeatable process, from triage to board briefing and remediation, that protects both the evidence and the company’s legal position. Where the law is unsettled, adopt the cautious approach and take advice from Brazil‑qualified criminal counsel before you commit. Build the playbook now, so that when an allegation lands, your first 72 hours are decisive rather than reactive.

Sources

1. Presidency of the Republic, Planalto (federal laws)
2. Ministério Público Federal (MPF)
3. Polícia Federal (PF)
4. Supremo Tribunal Federal (STF)
5. Superior Tribunal de Justiça (STJ)
6. Ordem dos Advogados do Brasil (OAB)
7. Comissão de Valores Mobiliários (CVM)
8. Banco Central do Brasil (BCB)
9. Autoridade Nacional de Proteção de Dados (ANPD)
10. Controladoria‑Geral da União (CGU)