Individual Taxpayer Registry

The organisation maintains Brazil’s Individual Taxpayer Registry, known as the CPF, which assigns a unique eleven‑digit identification number to every citizen and resident for tax and administrative purposes. It issues, updates and validates CPF numbers, ensuring that each identifier is linked to accurate personal data such as full name, date of birth and address. The registry serves as a foundational reference for federal, state and municipal government agencies, enabling the processing of tax returns, social benefits and public service eligibility. Private sector entities, including banks, employers and retailers, rely on the CPF to verify customer identity, open accounts, conduct credit checks and comply with anti‑money‑laundering regulations. By providing a single, nationwide identifier, the organisation supports the integration of fiscal, electoral and healthcare systems across the country. Its operations are governed by the Brazilian Federal Revenue Service, which operates under the Ministry of Economy and establishes the legal framework for CPF issuance and use.

The scale of the registry is evident from the 2021 data breach that exposed approximately 223 million CPF records, indicating that the database covers virtually the entire adult population and a significant portion of minors. This extensive reach distinguishes the CPF as one of the largest national identification systems in the world, surpassing many comparable tax‑ID programmes in terms of absolute coverage. The organisation’s core competency lies in maintaining the integrity and confidentiality of a high‑volume, high‑sensitivity dataset that is continuously accessed by millions of transactions daily. Structurally, the CPF function is housed within the Federal Revenue Service, a federal agency that is fully owned and funded by the Brazilian government, with no private shareholders or subsidiaries involved in its core registry operations. This governmental ownership ensures that the CPF remains a public good, subject to statutory oversight and accountability mechanisms designed to protect personal data.