Short answer. Brazil is not replacing every existing CNPJ. It is expanding the identifier so that the first 12 positions may contain numbers and uppercase letters, while the two check-digit positions remain numeric. Existing CNPJs remain valid and unchanged. The new format is for new registrations, with the federal systems scheduled to enter production on July 27, 2026 and the first alphanumeric CNPJ scheduled for July 31, 2026.
The change is legally narrow but operationally broad. A company with a numeric CNPJ may never receive a new number and still fail when it tries to onboard, invoice, pay or report a new supplier, customer or subsidiary whose CNPJ contains letters. The correct project is therefore not a cadastral renumbering exercise. It is an end-to-end review of every system and process that treats a Brazilian corporate tax identifier as a number.
This guide reflects the official material available on July 26, 2026. It distinguishes the legal format from system-specific implementation schedules, which can differ across eSocial, EFD-Reinf, e-Financeira, electronic invoices and private platforms.
The implementation calendar
| Date | Official event | Practical consequence |
|---|---|---|
| October 15, 2024 | RFB Normative Instruction 2,229/2024 was issued | The 14-position alphanumeric format was added to the CNPJ regulation |
| October 25, 2024 | The normative instruction entered into force | The legal rule existed before operational issuance began |
| July 23, 2026, 9:00 p.m. to July 25, 7:00 a.m. | The CNPJ database was limited to consultation | Registration updates and changes were suspended |
| From July 25, 2026, 7:00 a.m. | The database became unavailable for final migration procedures | Integrations depending on the federal CNPJ database could be unavailable |
| July 27, 2026, 7:00 a.m. | Federal systems are scheduled to enter production | Applications consuming Receita Federal services must be able to receive the new format |
| July 31, 2026 | The first alphanumeric CNPJ is scheduled to be implemented | Real alphanumeric identifiers begin entering business workflows |
The dates above come from Receita Federal’s current Alphanumeric CNPJ project calendar. They are not a promise that every public and private platform will follow one identical deployment date. Each integration owner should confirm the applicable technical note, schema and production calendar.
What the law actually changed
The governing CNPJ regulation is RFB Normative Instruction 2,119/2022. RFB Normative Instruction 2,229/2024 added a sole paragraph to article 2 providing that the CNPJ will adopt a 14-position alphanumeric format, as described in Annex XV, with implementation planned from July 2026.
The CNPJ remains the national registration identifier administered by Receita Federal. The reform does not, by itself:
- create a new tax, tax regime or type of legal entity;
- change an existing company’s tax rates, corporate form or registration status;
- replace a valid CNPJ that has already been assigned;
- encode the state, legal nature, industry or tax treatment in the new letters;
- eliminate the need to verify whether an identifier belongs to an active and duly registered entity.
The inclusion of letters expands the available combinations. It does not change the substantive tax profile of the registered entity.
The exact 14-position format
The visual mask remains familiar:
XX.XXX.XXX/XXXX-DV
The underlying content changes as follows:
| Positions | Function | Permitted content |
|---|---|---|
| 1-8 | CNPJ root, identifying the entity | Digits 0-9 and uppercase letters A-Z |
| 9-12 | Establishment order, distinguishing head office and establishments | Digits 0-9 and uppercase letters A-Z |
| 13-14 | Check digits | Digits 0-9 only |
An official technical example is:
- formatted:
12.ABC.345/01DE-35 - unformatted:
12ABC34501DE35
The identifier still has 14 positions without punctuation and 18 characters when displayed with the standard punctuation. Leading zeroes remain significant. A database or spreadsheet that converts the value to a number can therefore corrupt both old and new CNPJs.
Receita Federal’s April 2026 questions and answers also clarifies three points that matter for system design:
- Numeric and alphanumeric CNPJs will coexist.
- Assignment is progressive and random, so a new registration may occasionally still receive an entirely numeric CNPJ.
- A numeric-root entity can receive a new establishment with letters in the four-position establishment order.
Do not classify an identifier as “legacy” or “new” by its registration date alone. Validate the actual value received.
Existing companies: no renumbering does not mean no work
An entity that already has a CNPJ does not need to request a replacement or amend its registration merely because of the new format. That is the cadastral answer.
The systems answer is different. Receita Federal expressly warned that applications consuming its services may fail if they are not adapted. A company can keep 12.345.678/0001-95 and still need to process a counterparty such as 12.ABC.345/01DE-35.
This distinction affects:
- supplier and customer master data;
- accounts payable, accounts receivable and treasury;
- ERP and tax-engine validations;
- CRM, e-commerce and marketplace onboarding;
- bank, payment, Pix, KYC and anti-fraud flows;
- NF-e, CT-e, NFS-e and other electronic tax documents;
- eSocial, EFD-Reinf, SPED and other reporting files;
- customs, logistics and trade-compliance platforms;
- contracts, purchase orders, withholding records and tax certificates;
- data warehouses, reconciliation reports and third-party APIs.
The highest-risk defect is a function that “sanitizes” the CNPJ by deleting every non-digit. That logic worked when punctuation was the only non-numeric content. It now deletes legally valid letters and changes the identifier.
Why foreign companies should treat this as a transaction issue
Foreign groups face three common exposure points.
A new Brazilian vehicle
A multinational incorporating a new Brazilian Ltda or S.A. after implementation may receive an alphanumeric CNPJ. The same is true for other entities and establishments that obtain a new registration under the rollout.
The corporate file, bank onboarding, foreign-capital registration, accounting setup, certificates, invoicing and intercompany systems must all carry the exact same identifier. A letter removed at the global master-data layer can later appear as a rejected Brazilian invoice, an unmatched bank record or a failed filing.
New establishments and reorganizations
The first eight positions identify the entity’s root and the next four identify an establishment. The four-position order can now contain letters. A group with a numeric head-office CNPJ can therefore encounter an alphanumeric establishment identifier.
Systems should also stop using /0001 as a permanent proxy for “head office.” Receita Federal’s FAQ states that /0001 continues to indicate the head office when the CNPJ is initially generated, but that association is not permanent: an establishment with another order can later become the head office. Head-office status is a cadastral attribute, not a reliable inference from the suffix.
This matters when choosing between a Brazilian branch and subsidiary and when later changing the group’s establishment structure.
Counterparties, even when the group does not change
The earliest failure may come from outside the group. A new supplier can have letters in its CNPJ before the foreign-owned subsidiary changes anything internally. If the procurement portal rejects that supplier, the tax team may not see the problem until an invoice or payment is blocked.
Testing must therefore cover incoming and outgoing data, not only the group’s own registration.
Check-digit validation: what developers need to change
A format check and a check-digit calculation are different controls.
For an unformatted value, the shape can be expressed as:
^[A-Z0-9]{12}[0-9]{2}$
That expression confirms only that the first 12 positions are alphanumeric and the last two are numeric. It does not confirm that the check digits are correct, that the CNPJ was actually issued or that the entity is active.
The official check-digit method continues to use modulus 11, but alphanumeric characters must first be converted. Receita Federal’s rule assigns each character its ASCII decimal value minus 48. Digits therefore retain their ordinary values, while A = 17, B = 18 and so on through Z = 42.
For the first check digit, apply weights 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2 to the converted 12-position base. For the second, append the first check digit and apply 6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2. In each step, if the sum modulo 11 is 0 or 1, the check digit is 0; otherwise it is 11 minus the remainder.
The official base 12ABC34501DE produces check digits 35. The complete test vector is therefore 12ABC34501DE35.
Implementation teams should use Receita Federal’s official check-digit manual and reference files as the controlling specification. A third-party library should not be accepted merely because it recognizes the new regex; it must be tested against official vectors and both formats.
A defensible data model
The canonical CNPJ should be stored as text, not as an integer or floating-point value.
A robust internal model normally follows these rules:
- store 14 unformatted characters in an uppercase text field;
- preserve leading zeroes;
- permit
A-Zonly in the first 12 positions and digits only in the last two; - apply punctuation for display, not as the database key;
- retain the original inbound value in logs when integrations fail;
- use the full 14-position CNPJ for an establishment and the first eight positions only where the applicable official schema expressly requests the root;
- keep head-office or branch status in a separate field obtained from authoritative registration data;
- distinguish mathematical validity from registration existence and cadastral status.
Do not expand the character set casually. The official format uses the 26 unaccented uppercase letters A-Z, not accented letters, spaces, hyphens inside the unformatted value or visually similar Unicode characters.
Government systems do not all share one technical calendar
The federal CNPJ database is central, but each reporting or document ecosystem publishes its own layouts.
Examples available at the date of this guide include:
- eSocial: its technical documentation lists CNPJ-alphanumeric XSD schemas for production from July 1, 2026.
- EFD-Reinf: Technical Note 03/2026 and replacement XSD files were published for the 2.1.2 layouts, with production and restricted-production deployment in July.
- National NFS-e: Technical Note 009 changes CNPJ fields from numeric to character type.
- e-Financeira: the SPED notice schedules its production adaptation for September 15, 2026, to avoid interference with first-semester reporting.
This is why a generic statement that “the government is ready” is not enough for audit evidence. The company should retain the exact version, schema, environment and production date used for every material integration.
The same applies to private vendors. Obtain written confirmation from ERP, payroll, tax, banking, payment and onboarding providers. A marketing statement saying “CNPJ alphanumeric supported” is weaker than a tested version number and an accepted payload.
Practical migration checklist
1. Inventory every occurrence
Search application schemas, database columns, spreadsheets, file layouts, validation libraries, API contracts, ETL jobs, report filters and user-interface masks. Include systems outside Brazil if they hold Brazilian counterparties.
Look specifically for:
- numeric database types such as
BIGINT; - digit-only regular expressions;
- functions that remove
[^0-9]; - fixed assumptions that the root or establishment order is numeric;
- joins that cast CNPJ to a number;
- spreadsheets that drop leading zeroes;
- suffix rules that equate
/0001with head office; - API specifications declaring the field as
integer.
2. Classify by business consequence
Prioritize any failure that can block a tax document, payroll event, customs operation, bank account, supplier payment, customer onboarding or statutory filing. A dashboard filter is important, but it is not the same risk as an NF-e rejection.
3. Correct storage, validation and transport together
Changing the front-end mask is not enough. The database, API gateway, message bus, downstream vendor and reconciliation layer must preserve the same 14 characters.
4. Test both valid formats and invalid edge cases
At minimum, test:
| Test | Expected result |
|---|---|
| Existing numeric CNPJ with leading zero | Accepted and preserved exactly |
12.ABC.345/01DE-35 |
Accepted; normalized to 12ABC34501DE35 if the interface supports normalization |
| Correct shape with wrong check digits | Rejected |
| Letter in either check-digit position | Rejected |
| Numeric root with alphanumeric establishment order | Accepted when check digits are valid |
| Alphanumeric root with numeric establishment order | Accepted when check digits are valid |
| Lowercase user input | Normalized only where the interface policy permits; official outbound value should be uppercase |
| Unicode lookalike or accented character | Rejected |
| Mathematically valid but unregistered test CNPJ | Must not be treated as proof of an existing entity |
Receita Federal provides a free alphanumeric CNPJ simulator that generates and validates fictitious identifiers locally in the browser, with up to 1,000 generated registrations per user. Use fictitious test data in non-production environments; do not present a mathematically valid test identifier as a real taxpayer.
5. Obtain evidence from third parties
For each critical vendor, record:
- supported product and version;
- date deployed to production;
- accepted masked and unformatted input;
- check-digit implementation;
- relevant government schema version;
- successful end-to-end test evidence;
- escalation contact and rollback procedure.
6. Monitor production without corrupting data
Create alerts for length errors, validation failures, API 4xx responses, document rejections and unmatched counterparty records involving CNPJ fields. Preserve the original payload. Do not “fix” a rejection by stripping letters, replacing them with zeroes or entering a convenient numeric CNPJ.
What to do when a transaction fails
If a workflow fails after the rollout:
- Capture the exact CNPJ received, including its original formatting and case.
- Confirm that the value has 14 unformatted positions and numeric check digits.
- Validate it against the official modulus-11 method.
- Identify where the value changes between source, interface, database and destination.
- Check the destination’s current schema and production version.
- Preserve audit logs and reprocess only after the identifier passes unchanged end to end.
- If a fiscal document or statutory filing is involved, coordinate the correction with the responsible tax and software teams before using a manual contingency.
The company should never substitute another entity’s CNPJ or invent a numeric equivalent. A technical workaround that changes taxpayer identity creates a larger tax and documentation problem than the original system rejection.
Board and management questions
Management does not need to review the check-digit code, but it should obtain clear answers to five questions:
- Can the group receive and preserve a 14-position alphanumeric CNPJ in every critical system?
- Can a new Brazilian entity or establishment complete registration, banking, invoicing and reporting without manual substitution?
- Have critical vendors produced version-specific evidence?
- Has the group completed end-to-end tests using official fictitious vectors?
- Is there an incident owner for rejected invoices, payments and filings during the first weeks?
For foreign-owned groups, ownership should normally sit across tax, finance, IT, procurement, treasury, payroll and legal. Treating the change as an isolated accounting configuration leaves too many entry points uncovered.
FAQ
Will existing Brazilian companies receive a new CNPJ? No. Existing CNPJs remain valid and unchanged. The new format is assigned progressively to new registrations.
Can a company with an old numeric CNPJ ignore the project? No. It may need to process an alphanumeric CNPJ belonging to a new customer, supplier or establishment.
How many characters does the new CNPJ have?
Fourteen without punctuation, exactly as before. The first 12 positions may contain 0-9 and A-Z; the last two remain numeric check digits.
Does an alphanumeric CNPJ change the company’s taxes? No. It is an identifier-format change. Tax regime, legal form, rates and filing duties continue to depend on the applicable substantive rules.
Can a new CNPJ still be entirely numeric after July 2026? Yes. Receita Federal says assignment is random and progressive, so an entirely numeric value can still occur.
Can a numeric-root company have a branch CNPJ containing letters? Yes. The four-position establishment order may be alphanumeric even when the eight-position root is numeric.
Does /0001 always prove that an establishment is the head office?
No. It indicates the head office at initial generation, but head-office status can later move to an establishment with another order. Use authoritative cadastral data.
Does a valid check digit prove that the company exists? No. It proves only mathematical consistency. Confirm issuance, legal name and cadastral status through an authoritative source.
Sources and legal status
Sources reviewed: RFB Normative Instruction 2,119/2022, as amended, Receita Federal’s Alphanumeric CNPJ project page and implementation calendar, the April 2026 official questions and answers, the official check-digit manual and reference files, Receita Federal’s July 2026 system notice, the EFD-Reinf notice, eSocial technical documentation, the NFS-e Technical Note 009 notice, and the e-Financeira adaptation notice.
This article provides general legal and tax information as of July 26, 2026. It is not legal, tax or systems advice for a specific implementation. Confirm the current official schema, environment and rules before filing, issuing a tax document or changing production systems.