Less than two months remain before the Contribution on Goods and Services (CBS) replaces PIS and Cofins. After spending 2026 in sandbox and testing phases, January 2027 marks the moment this shift hits corporate balance sheets: a buyer’s tax credit will now be tied to actual tax collection at the preceding stage of the supply chain. This rule stems from Complementary Law 214/2025, which regulated Constitutional Amendment 132/2023 and introduced CBS and IBS (Tax on Goods and Services).
The practical fallout is immediate. Dealing with a non-existent, inactive, or defaulting supplier issuing non-compliant invoices is all it takes to compromise the buyer's credit eligibility. “Leaving systems updates to the last minute will cause severe friction in sales pipelines and open critical security loopholes,” warns Murilo Cantarino, Chief Financial Officer at Certta, an intelligent verification hub.
To unpack how these changes impact procurement, fraud prevention, and corporate tax workflows, Conecta sat down with tax intelligence and digital identity specialists: Ana Maciel, Tax Intelligence Specialist at Systax, who analyzes tax theory and vendor master data hygiene; and from Certta, CFO Murilo Cantarino, who monitors cash flow exposure and fraud vectors, alongside Product Manager Matheus Castro, who designs supplier validation architectures within procurement and invoice-issuance pipelines. Check out the full interview below.
What to Verify in Your Supplier Base Before January
Conecta: Under Complementary Law 214/2025, a tax credit only materializes if the tax was paid at the previous stage. How does this reshape procurement for buyers?
Ana Maciel: Companies are essentially forced to become auditors of their own supply chains, and taking an undue credit can lead to joint and several liability. When your right to claim a credit depends entirely on a third party paying their taxes, profiling and vetting that supplier beforehand becomes a survival requirement.
Conecta: Is every supply chain irregularity outright fraud?
Ana Maciel: Not every mistake stems from bad faith. I have seen phone cases misclassified as eyeglass cases simply because their NCM (Mercosur Common Nomenclature) codes differ.
These nomenclature codes are foundational because they determine the tax treatment applied to foreign trade and manufactured product outflows. If an NCM is reported incorrectly, the tax treatment is distorted from the start, and tax credits fail on both ends of the transaction.
Conecta: What shifts in cash flow and fraud prevention operations under the Tax Reform?
Murilo Cantarino: Knowing whether a supplier actually exists and operates now has a direct bearing on bottom-line liquidity. This transition will keep anti-fraud teams on high alert until new pipelines and validation protocols stabilize. It firmly places the digital identity of buyers and sellers at the core of the financial architecture.
The Tax Transition from a Fraud Prevention Perspective
Conecta: Why does a tax transition create fertile ground for fraud?
Murilo Cantarino: Major transitions inherently generate systemic uncertainty and operational seams: new taxes enter, old ones are phased out, checkout and e-invoicing workflows change, and vendor onboarding and payment integrations are reconfigured. Fraudsters routinely exploit these migration windows, when automated rule engines are still being calibrated and internal teams are unsure what baseline activity looks like.
Conecta: What are the primary threats on the radar?
Murilo Cantarino: The risk manifests across two distinct vectors. The first is direct social engineering, leaning on the confusion surrounding the new regime. A fraudulent invoice claiming to collect the “new tax” arriving via email, for instance, can easily pass as legitimate to untrained personnel. The second vector lies deep inside the supply chain itself: ghost vendors, paper companies, or suppliers who fail to remit the assessed taxes.
Schemes using shell entities to generate illicit ICMS and PIS/Cofins tax credits have repeatedly triggered federal and state tax enforcement sweeps. What changes now is the severity of the financial risk: the tax compliance of your vendor directly dictates your company’s cash flow.
Conecta: Which registration and transactional red flags stand out, and which surface exclusively during onboarding?
Matheus Castro: Irregular suppliers leave forensic trails at two distinct stages: during onboarding, prior to the initial purchase order, and across ongoing operations once execution begins. Disregarding these signals has become costlier, as IBS and CBS credits strictly depend on taxes settled upstream, and invoices containing discrepancies will face systematic rejection.
During onboarding, the most frequent warning signs include:
- CNPJ corporate tax ID statuses other than “Active” with the Federal Revenue (e.g., Suspended, Inapt, Discharged, or Null). An "Inapt" status usually flags an entity that stopped filing mandatory declarations or was unlocatable at its registered address;
- Entities incorporated very recently relative to the contract’s monetary scale, or whose registered economic activity (CNAE) bears no relation to the goods being procured;
- Discrepancies between addresses listed across the Federal Revenue, state tax registries (Sintegra), and company disclosures, or physical locations hosting disproportionate volumes of registered businesses, as well as missing or inactive State Registrations (IE) for merchandise vendors (which leads to immediate invoice rejections);
- Corporate officers tied to an extensive network of sequentially opened and shuttered entities, ownership restructuring occurring immediately prior to contract bidding, or partners appearing on sanctions or restrictive lists;
- Tax regimes misaligned with transaction volume, such as a Microentrepreneur (MEI) billing enterprise-scale invoices;
- Irregularities on clearance certificates (CNDs) and banking details routed to unrelated third-party individuals or entities—the precise vector where fraud converts into liquid cash.
Once operations go live, flags manifest as invoices that mismatch registration files, missing IBS/CBS fields, bank account modification requests shortly before payment runs, abnormal invoice amounts, split orders structured to skirt approval thresholds, and long-dormant suppliers suddenly billing heavy volumes.
Conecta: What registration data points require special scrutiny?
Matheus Castro: A company profile is merely a snapshot in time. Over months, records decay: a CNPJ can become inapt, a managing partner can exit, or tax clearance certificates expire. Thorough verification must examine not only what the vendor declares against official registries, but also the identity and authority of whoever submits the onboarding dossier. This means validating, via biometric proof-of-life and document verification, whether that person is a legitimate partner or authorized attorney-in-fact, alongside confirming the forensic authenticity of uploaded files, such as articles of incorporation and bank verification letters.
One critical note: alphanumeric CNPJs are not a sign of fraud. Since July 31, 2026, the Federal Revenue has been issuing alphanumeric formats for newly registered entities, while legacy numeric identifiers remain valid. Treat these as newer businesses and run standard checks against the Federal Revenue database. Otherwise, your rule engines risk blocking legitimate partners.
Conecta: Does the supplier's tax regime carry commercial weight?
Matheus Castro: It directly influences net unit pricing, even when compliance is spotless. Suppliers under the Simples Nacional regime generate reduced IBS and CBS credits for corporate buyers unless they specifically elect to remit taxes under the regular regime. While this is not an irregularity, your ERP must capture and tag the exact tax regime accurately.
The Implementation Playbook for the Tax Reform
Conecta: Where should organizations start their preparation?
Ana Maciel: Start with clean, deduplicated, and fully updated vendor master data, ensuring product fiscal classifications and tax codes are thoroughly reviewed. The core challenge is lead time: comprehensive registry sanitization projects typically take two to six months to complete. The roadmap relies heavily on technology: companies need integrated systems capable of managing both the legacy and the new regime in tandem, hooked directly into real-time electronic invoice processing. Without that infrastructure, maintaining visibility over legitimate credits and eligibility timelines is impossible.
Conecta: Does the remediation scope end inside IT and ERP systems?
Ana Maciel: It extends far beyond software. Enterprises will have to renegotiate master service agreements with vendors and buyers, while upskilling operational teams that may have never handled tax-sensitive workflows. The Reform also elevates tax strategy out of the back office and onto the CFO’s executive agenda, positioning it as a key pillar of corporate strategy. Organizations that master the new tax credit dynamics can turn fiscal efficiency into a sharp competitive moat, either by lowering final market prices or expanding net margins.
Conecta: How can companies embed screening into procurement workflows and e-invoicing pipelines?
Matheus Castro: The golden rule is to run exhaustive screening once during vendor onboarding, followed by lightweight contextual checks on every transaction, blocking only what presents actual compliance friction. This establishes four continuous verification gates from purchase order to payment:
- Onboarding / Accreditation (prior to the first purchase order): Full validation against the Federal Revenue, state tax registries (Sintegra), tax regimes, corporate shareholding, clearance certificates, restrictive screening lists, representative proof of identity, and bank account ownership. Results are logged with an expiration stamp and referenced across future orders.
- Purchase Order Execution: A millisecond API call verifying that the CNPJ remains active, no new sanctions have surfaced, and onboarding validity is active.
- Inbound Electronic Invoice Validation: Inbound XML payloads are reconciled against the accredited vendor master data (CNPJ, legal name, state tax ID, and address). The IBS and CBS tax tags must be populated consistently with the supplier’s regime. Any variance is automatically routed to an exceptions queue, and the tax credit is withheld until reconciled.
- Disbursement / Payment: The highest-risk vector for payment diversion fraud. The receiving bank account must belong strictly to the vendor’s registered CNPJ. Any recent bank account modification must trigger out-of-band verification, such as direct callback verification to a previously vetted contact.
The same principles protect sales teams. Validating client master data prior to outbound invoice generation (active CNPJ, State Registration, address, and tax regime) prevents state treasury (SEFAZ) rejections, and a rejected invoice is blocked cash flow.
Conecta: How do organizations prevent risk screening from becoming an operational bottleneck?
Matheus Castro: I recommend a traffic-light governance model: Green clears the transaction immediately; Yellow flags an administrative discrepancy that can be cleared within an agreed SLA; and Red halts the workflow immediately. Red flags should be reserved strictly for fatal conditions, such as inactive corporate registrations, active trade sanctions, or third-party bank accounts. Because official clearance certificates carry explicit validity windows, systems should never waste calls re-running valid queries. When urgent procurement arises, exception protocols can bypass holds, provided an accountable business owner signs off and audit logs capture the rationale.
To maintain velocity, validation workflows must interface directly with ERPs and supplier portals via APIs, phasing out disconnected spreadsheets that introduce delays and human error. Capturing comprehensive audit trails, documenting queried sources, timestamps, and return payloads, is what equips companies to substantiate due diligence during tax audits.
Conecta: What is the optimal audit cadence, and what triggers ad-hoc alerts?
Matheus Castro: Implement a two-tiered monitoring framework. The first tier is a calendar-based review tied to vendor criticality (determined by transaction volume, recurrence, and operational dependence): critical suppliers undergo continuous or monthly re-evaluations; medium-tier vendors are checked quarterly; and transactional or sporadic vendors are verified on demand upon order issuance. The baseline review cycle follows certificate expirations: 180 days for Federal (Federal Revenue/PGFN) and Labor (TST) clearance certificates, and shorter windows for severance fund (FGTS) records.
The second tier consists of real-time event-driven webhooks, catching issues the day they occur:
- CNPJ changes from Active to Suspended, Inapt, or Discharged, or State Registration cancellations;
- Shifts in registered address, corporate name, CNAE codes, legal structure, or corporate reorganizations generating new CNPJs (demanding fresh onboarding);
- Shifts in and out of the Simples Nacional regime, MEI reclassifications, or suppliers opting into regular IBS/CBS remittance;
- Departures or additions of managing partners, or entries of partners/entities into restrictive lists;
- Expired certificates, newly listed active tax debts, protest filings, reorganization petitions, or bankruptcy filings;
- Bank account modification requests, inbound invoices failing registry checks, missing IBS/CBS fields, and dormant vendors suddenly resuming high-volume billing.
What to Prioritize Before January 2027
Conecta: Given that registry sanitization initiatives require two to six months and January is around the corner, where should unprepared organizations direct their focus?
Matheus Castro: In under sixty days, reviewing your entire vendor directory is neither practical nor necessary. Step one is stopping the bleeding: prevent corrupt, unverified vendor records from entering your ERP. Next, prioritize remediating vendors that pose the highest financial exposure or operational dependencies. Only after securing those segments should you build automated refresh cycles. Cleansing legacy master data is useless if invalid records enter your ecosystem every day.
Secondary initiatives can follow post-January: full onboarding runs for low-spend, tail-end vendors, recurring audit cadences for mid-tier accounts, and advanced automation for the traffic-light engine. Early on, Yellow-flag exceptions can be triaged manually.
One final compliance caveat: vendor onboarding captures personal data. Partner names, tax IDs, and personal addresses fall squarely under privacy regulations (such as LGPD). Collect and retain only the minimal verifiable footprint strictly required for compliance, grounded in transparent, documented legal bases.
Conecta: What specialized technologies support this automation?
Matheus Castro: Solutions like Certta’s Flow, for instance, build no-code onboarding journeys that orchestrate screening sequences, risk-based routing, and manual exception handling. Profile Check and KYB (Know Your Business) engines automate corporate registry, shareholding, sanctions, and litigation queries, while FaceID and DocID authenticate the legal representatives submitting the documentation.
Conecta: Is your supply chain structured for January 2027?
The Tax Reform is just one of several structural shifts underway. Stay tuned to Conecta for ongoing analysis of regulatory compliance, digital identity verification, and anti-fraud architectures built for sustainable operations.
Frequently Asked Questions (FAQ)
1. When does the CBS tax take effect?
A: CBS collection takes full operational effect in January 2027, following initial sandbox testing conducted throughout 2026.
2. How does the Tax Reform change tax credit eligibility?
A: Under the new regime, businesses are only entitled to claim CBS and IBS tax credits if the tax was verified and settled at the preceding stage of the supply chain. A supplier that fails to remit assessed taxes prevents the corporate buyer from claiming the associated credit.
3. What is split payment?
A: Split payment is an automated settlement protocol that segregates the tax liability in real time upon payment execution. The tax fraction routes directly to the tax authority's escrow, while the net balance settles with the merchant, mitigating evasion across commercial chains.
4. How can a business ensure a supplier is compliant for Tax Reform purposes?
A: Confirm that the company's CNPJ is active and that its registered operational activities (CNAE) match the goods or services contracted. Reconcile geographic addresses and historical invoicing trends against the physical scale of the vendor. Newly registered CNPJs, unremitted taxes on invoices, and mismatched NCM classifications serve as immediate red flags.
5. Does an alphanumeric CNPJ indicate fraud?
A: No. The Federal Revenue officially began issuing alphanumeric CNPJs for newly registered legal entities on July 31, 2026. Legacy numerical CNPJs remain fully valid. Treat these as newer business entities, validate them against official Revenue registries, and verify that your ERP, procurement portals, and integrations parse alphanumeric formats without syntax errors.
6. Does the Federal Revenue issue tax collection notices via email or WhatsApp?
A: No. The Federal Revenue never dispatches payment links or tax collection slips via email, SMS, or WhatsApp. Tax liabilities and records must be inspected directly through official government portals (such as e-CAC or gov.br) by manually navigating to the URL. Risk teams should caution employees against emerging social engineering vectors tied to the reform.
