Brazil’s .BR Registration and Tax ID Prerequisites

The .br country-code top-level domain (ccTLD) is the digital identity of Brazil on the internet, managed and regulated by the Brazilian Network Information Center (NIC.br). As one of the most tightly regulated ccTLDs in Latin America, .br domain registration is subject to a unique and rigorous set of rules, particularly concerning the identification and taxation status of the registrant. Unlike many other ccTLDs that allow foreign or anonymous registration with minimal documentation, Brazil’s .br registry imposes strict prerequisites, including the mandatory use of a Brazilian tax identification number. These requirements reflect Brazil’s broader regulatory environment, which emphasizes legal traceability, tax compliance, and national digital sovereignty.

The most significant prerequisite for registering a .br domain is the requirement to possess a valid CPF (Cadastro de Pessoas Físicas) or CNPJ (Cadastro Nacional da Pessoa Jurídica), which are Brazil’s official tax identification numbers for individuals and legal entities, respectively. The CPF is issued to Brazilian citizens and residents for personal tax purposes, while the CNPJ is assigned to companies and organizations operating within Brazil. These identifiers are not merely bureaucratic formalities—they are central to all financial, legal, and administrative transactions in the country, and their integration into domain registration reflects the Brazilian government’s approach to ensuring full accountability for digital operations.

For individual registrants, a valid CPF is mandatory and must be matched against the federal tax database to ensure authenticity. The CPF must belong to a living, eligible Brazilian citizen or resident, and cannot be borrowed or substituted. For legal entities, a valid CNPJ is required, and the entity must be in good standing with the Receita Federal (Brazil’s federal tax authority). When submitting a domain registration request, NIC.br verifies the tax ID against the national databases to confirm that the entity is legally recognized and capable of entering into digital service agreements under Brazilian law.

Foreign individuals or companies seeking to register .br domains face additional hurdles. Unlike many other ccTLDs, Brazil does not offer an open registration policy for non-residents or foreign entities without a local presence. To register a .br domain, a foreign entity must either establish a registered legal presence in Brazil—such as a subsidiary or representative office with a valid CNPJ—or engage a local trustee or proxy service that holds the domain on behalf of the foreign principal. These local agents typically operate under formal power-of-attorney arrangements and must comply with Brazilian law as if they were the registrant. The trustee model introduces both legal and operational risk, as the foreign entity does not hold direct ownership of the domain and must rely on contractual enforcement mechanisms to safeguard its rights.

The CPF/CNPJ requirement also ties domain registration to tax visibility. Because all domain registrants are identifiable through national tax records, their digital operations can be more easily audited by tax authorities. This is especially relevant for commercial websites, e-commerce businesses, and platforms offering goods or services in Brazil. The link between domain registration and tax ID serves as a compliance mechanism for VAT (ICMS) enforcement, cross-border digital service taxation, and anti-money laundering measures. It also allows for coordinated enforcement actions, such as domain suspension for entities found to be in violation of tax or consumer protection laws.

Another unique feature of Brazil’s .br registry policy is its structured use of second-level domains. Unlike many countries that allow direct registration at the top level (e.g., example.br), NIC.br requires registrations under predefined second-level categories. These include .com.br for commercial entities, .org.br for nonprofit organizations, .net.br for internet service providers, and dozens of others covering professional and institutional sectors. Each second-level domain carries specific eligibility criteria tied to the registrant’s tax classification and registered activities. For example, a law firm may register under .adv.br only if its CNPJ reflects a legally recognized legal services entity. This structured system reinforces the integration of tax and regulatory status into the domain name framework and helps limit domain misuse or misrepresentation.

In addition to identification and tax compliance, NIC.br imposes content neutrality and operational responsibility on registrants. The organization reserves the right to revoke domain names used in bad faith or that violate national laws, including laws related to consumer protection, electoral communications, hate speech, and data protection. Because registrant data is already tied to tax records, enforcement is streamlined, and abusive registrants can be quickly identified and held accountable. This regime has led to relatively high levels of trust in the .br namespace, which is seen domestically as a reliable and secure digital environment.

From a contractual standpoint, domain registrants must agree to the Registro.br terms of service, which include clauses affirming their responsibility for legal compliance and the accuracy of provided tax information. False or outdated tax ID submissions can result in denial or cancellation of domain registrations. Moreover, domain renewals are contingent upon the ongoing validity of the associated CPF or CNPJ. If a company dissolves or a CPF becomes inactive, NIC.br may place the domain into a redemption state, and if no corrective action is taken, the domain may be canceled and made available for re-registration.

For international brand owners seeking to operate in Brazil, the .br requirements necessitate careful planning. Many multinationals establish local subsidiaries expressly for the purpose of domain registration, marketing localization, and regulatory compliance. Others engage law firms or specialized IP agencies to act as registrant proxies while maintaining internal control over DNS configuration and branding. However, this workaround is not a long-term substitute for local establishment, especially as Brazil continues to expand its enforcement of the Digital Law (Marco Civil da Internet) and the General Data Protection Law (LGPD), both of which impose obligations that presuppose a legal nexus with Brazilian authorities.

In conclusion, the .br ccTLD represents a uniquely regulated domain namespace that reflects Brazil’s emphasis on legal traceability, national digital sovereignty, and fiscal accountability. The mandatory use of CPF and CNPJ numbers embeds domain registration into the broader legal and tax infrastructure of the country, ensuring that digital actors are visible and answerable to the state. While this approach imposes barriers for foreign registrants and limits anonymous digital operations, it also creates a safer and more structured environment for domestic users and businesses. As the global domain name system becomes more entwined with questions of jurisdiction, security, and compliance, Brazil’s model offers a powerful example of how national identity systems can be leveraged to govern the digital landscape within a sovereign legal framework.

The .br country-code top-level domain (ccTLD) is the digital identity of Brazil on the internet, managed and regulated by the Brazilian Network Information Center (NIC.br). As one of the most tightly regulated ccTLDs in Latin America, .br domain registration is subject to a unique and rigorous set of rules, particularly concerning the identification and taxation…