Compliance and Investigations: the highlights that marked October 2026.

National Highlights

New social and environmental requirements strengthen compliance in export operations

In September 2026, the Brazilian Chamber of Foreign Trade (Camex) approved, through CEC Resolution No. 17/2026, the Social and Environmental Analysis Report for Export Operations (RASOE), issued through the Agro Brasil + Sustentável Platform. The report consolidates information from different federal public databases to demonstrate the socio-environmental status of rural establishments, covering aspects related to environmental and land regularity, deforestation, environmental embargoes, labor under conditions analogous to slavery, and overlaps with protected areas, among other indicators. The initiative seeks to provide greater security and transparency to Brazilian agribusiness export operations, facilitating the demonstration of compliance with socio-environmental requirements that are increasingly present in international markets. In this context, the instrument may assist exporters in addressing requirements such as those established under the European Union Deforestation Regulation (EUDR).

RASOE, however, does not constitute a certification of compliance nor does it replace the due diligence obligations required by importing jurisdictions, and operators remain responsible for assessing the requirements applicable to each market.

For Brazilian exporters, the implementation of RASOE represents an opportunity to enhance traceability mechanisms and demonstrate the social and environmental compliance of their supply chains. However, its use should be accompanied by an assessment of the specific requirements applicable in destination markets, particularly in light of regulations such as the EUDR.

In this context, reviewing supplier due diligence procedures, social and environmental monitoring mechanisms, and the governance of information used in export operations becomes particularly relevant, given challenges related to the quality and updating of public databases, traceability across supply chains involving multiple suppliers, and the definition of RASOE’s operational aspects. Adopting these measures can help mitigate regulatory and reputational risks and preserve access to international markets.

Compliance in the AI Era: New Risks, Controls and Responsibilities

The growing adoption of artificial intelligence by organizations is transforming not only the profile of corporate risks, but also the way compliance programs are structured and operated. Risks related to data protection, confidentiality, intellectual property, bias and discrimination, information security, and the improper use of AI tools increasingly require an approach integrated with traditional risk management frameworks. In this context, standards such as ISO 37301 are gaining relevance by providing a framework based on the continuous identification of risks, definition of responsibilities, implementation of controls, and monitoring of their effectiveness.

The future of compliance, therefore, is likely to involve an increasingly close combination of governance and technology. Rather than simply creating specific policies for artificial intelligence, organizations should assess how these tools affect their risk matrices, decision-making processes, internal controls, and third-party relationships. Reviewing compliance programs from this perspective may include mapping the use of AI, defining governance and accountability rules, updating internal policies, assessing technology providers, and establishing monitoring and incident response mechanisms. This approach allows innovation to be incorporated into business strategy responsibly, particularly in light of the evolving regulatory landscape and increasing scrutiny of the corporate use of AI systems.

At the same time, artificial intelligence offers opportunities to enhance the effectiveness of compliance programs, particularly by automating monitoring processes, analyzing large volumes of information, identifying risk patterns, and supporting due diligence procedures. However, the adoption of these tools should be accompanied by clear governance, validation, and human oversight criteria to ensure their responsible use and strengthen organizations’ ability to prevent, detect, and respond to potential risks.

Due diligence in transformation: compliance in the face of sophisticated illicit structures

The increasing use of seemingly legitimate corporate structures by organized crime is expanding the challenges faced by compliance programs. Formally established companies, with valid registrations, clearance certificates, and actual business operations, may be used for money laundering, concealment of assets, or other illicit activities. This scenario highlights the limitations of due diligence processes based exclusively on registration and documentary checks and reinforces the need for a broader assessment of the risks associated with customers, suppliers, business partners, and other third parties.

In this context, Know Your Customer, Supplier and Partner (KYX) processes are likely to play an increasingly strategic role. The approach should be proportionate to the level of risk and, in higher-risk situations, may require Enhanced Due Diligence (EDD) procedures, with greater scrutiny of corporate structures, beneficial owners, source of funds, transaction history, and potential economic or behavioral inconsistencies. The effectiveness of these controls also depends on continuous monitoring capable of identifying relevant changes in a third party’s risk profile and red flags that a purely documentary review might not capture.

For companies, this scenario underscores the importance of reviewing third-party due diligence and monitoring procedures, particularly in business relationships involving complex corporate structures, intermediaries, or higher-risk operations. Adopting due diligence measures proportionate to the risks identified, together with mechanisms to identify ultimate beneficial owners and investigate red flags, can help prevent the establishment or continuation of business relationships with structures linked to illicit activities.

International Highlights

DOJ intensifies enforcement against corporate fraud and expands incentives for whistleblowers

In October 2026, the U.S. Department of Justice (DOJ) announced two initiatives that reinforce its strategy for detecting and combating corporate fraud: the creation of the Fraud Whistleblower Incentive Program (WHIP) and the issuance of Directive 26-12: Corporate Enforcement in the Fight Against Fraud. Although the initiatives rely on different mechanisms, both signal an increased emphasis on detecting misconduct and holding companies accountable for fraudulent conduct.

The WHIP provides for rewards ranging from US$10,000 to US$30,000 for information that leads to criminal charges involving certain categories of fraud. By allowing payments at earlier stages of enforcement proceedings, the initiative increases incentives for individuals with knowledge of potential misconduct to report directly to the authorities, reinforcing the importance of accessible, reliable and effective internal whistleblowing channels. In parallel, Directive 26-12 establishes an enforcement approach described as “aggressive, all-tools” and directs greater attention to fraud involving health care, government procurement and functions, tax matters and international trade, including tariff evasion and imports associated with forced labor. The Directive also preserves incentives for voluntary self-disclosure, cooperation with authorities and prompt remediation of misconduct.

The initiatives reflect the strengthening of mechanisms to detect and combat corporate fraud in the United States, combining greater incentives for whistleblowing with enforcement guidelines targeting priority sectors and conduct. For companies exposed to U.S. jurisdiction, this landscape reinforces the importance of assessing the effectiveness of internal whistleblowing channels, investigation procedures, and response and remediation protocols. The ability to promptly identify, investigate and remediate potential violations, as well as to assess whether voluntary self-disclosure may be appropriate, can be particularly relevant in light of the criteria considered by the DOJ when evaluating corporate conduct.

International sanctions increase compliance challenges in Brazil

The expansion of U.S. designations related to criminal organizations has changed the compliance and enforcement landscape for Brazilian companies, increasing the need to assess not only direct counterparties, but also beneficial owners, intermediaries, and the ultimate destination of products and funds. At an event held in São Paulo, experts highlighted that companies may need to strengthen their controls to ensure that even seemingly innocuous products are not diverted to organizations subject to the U.S. sanctions regime, underscoring the growing importance of end-user due diligence procedures.

This scenario takes on an additional dimension given the extraterritorial reach of sanctions administered by OFAC, particularly where transactions have a nexus with the U.S. financial system. Exposure may arise, for example, from international payments, relationships with financial institutions, sponsors, or foreign investors, requiring increased attention to counterparties’ ownership structures and payment chains.

In this context, sanctions screening, beneficial ownership identification, and third-party due diligence procedures become particularly relevant to mitigating the risks of transactions being blocked or rejected, as well as de-risking measures by financial institutions.

Potential impacts may extend to the Brazilian sports sector. Football clubs and Sociedades Anônimas do Futebol (SAFs) face specific areas of exposure due to international sponsorships, foreign investments, and international player transfers. A club does not necessarily need to be formally sanctioned to face practical consequences: links between counterparties or ownership structures and blocked persons may result in banking restrictions, disruptions to international payments, and impacts on commercial and sponsorship relationships.

For Brazilian companies with international operations, the expansion of U.S. sanctions reinforces the importance of assessing direct and indirect exposure to sanctioned persons and entities, taking into account counterparties’ ownership structures, beneficial owners, and any potential nexus between transactions and U.S. jurisdiction. Reviewing sanctions screening procedures, third-party due diligence and escalation protocols, together with an assessment of applicable contractual provisions, can help mitigate legal, financial and reputational risks arising from potentially restricted business relationships.

OFAC updates guidance on transactions subject to sanctions

On October 26, 2026, the Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury updated 11 Frequently Asked Questions (FAQs) concerning the blocking and rejection of transactions and the related reporting obligations. The revisions are part of the authority’s ongoing efforts to update its guidance and seek to clarify how financial institutions should proceed when handling payments involving blocked persons or transactions prohibited under different U.S. sanctions programs.

One of the key aspects of the update is the distinction between “blocking” and “rejecting.” In general, a transaction must be blocked when a blocked person or entity has an interest in the funds involved. In such cases, the funds must be placed in a segregated, interest-bearing account and reported to OFAC. By contrast, when a transaction is prohibited under applicable sanctions but there is no blockable interest in the funds, the transaction must be rejected and returned to the originator, without being processed for the benefit of the beneficiary.

OFAC also clarified certain aspects concerning reporting and documentation requirements. As a general rule, both blocked and rejected transactions must be reported through the OFAC Reporting System (ORS) within ten business days, together with the relevant supporting documentation. The FAQs also distinguish between a customer merely inquiring about the possibility of carrying out a transaction and an actual payment instruction, a distinction that is relevant in determining when blocking, rejection, and reporting obligations arise.

For companies, the update reinforces the importance of internal procedures capable of properly distinguishing between transactions that must be blocked and those that must be rejected, as well as adequate sanctions screening, alert review, recordkeeping, and timely compliance with reporting obligations. The revisions also highlight the need for coordination between compliance functions and the teams responsible for payment processing, so that potential sanctions issues can be identified and addressed before transactions are completed.

CGU Observatory

In October 2026, the CGU opened administrative liability proceedings (PARs) involving the following agencies and sectors:

Agencies involved:

_Office of the Comptroller General of the Union (CGU);

_Ministry of Justice and Public Security;

_Ministry of Finance.

Object of the Facts:

_Fraud involving an administrative contract entered into with the Brazilian Public Administration;

_Irregularities or fraud involving agreements or similar arrangements;

_Irregularities or fraud in public procurement procedures or contracts;

_Fraud in public procurement procedures conducted by the Brazilian Public Administration;

_Payment or offer, directly or indirectly, of an undue advantage to a Brazilian public official or a related third party;

_Financing, funding, sponsorship or subsidization of unlawful acts under the Brazilian Anti-Corruption Law (Law No. 12,846/2013).

Want to understand how these matters impact your business? Our Compliance and Investigations team is ready to help you navigate them.