Business Contracts Corporate Law Data Privacy Dispute Resolution Intellectual Property International Labour and Employment Tax and Customs Law All Practice Areas

Fabiano Deffenti Vanessa Ribeiro T. Borges Roberto La Laina Gabriela Conca Jessica Domingues de Araujo All Team Members

PT·EN Contact Us

Legal Guides / Customs and Trade

Brazil’s Authorised Economic Operator Program

New rules in force from 15 April 2026

Portaria COANA 187/2026, published 7 April 2026, implements the revised Brazilian OEA framework under IN RFB 2,318/2026, introducing a simplified certification track and a fresh admissibility rules package.

Brazil’s OEA Program gives certified operators a material advantage in customs clearance speed and risk profile

The Brazilian Authorised Economic Operator Program (OEA) is the national implementation of the World Customs Organisation’s SAFE Framework of Standards. It certifies supply chain participants who demonstrate high customs compliance and supply chain security, granting expedited processing, reduced inspection rates and recognition under Mutual Recognition Agreements with foreign customs administrations.

As of January 2026, the program acquired statutory status through Complementary Law 225/2026 (the Taxpayer Bill of Rights). It operates under the Federal Revenue Department and is administered by COANA. The primary legislative basis is IN RFB 2,318/2026, in force since 26 March 2026, replacing IN RFB 2,154/2023.

Certification Modalities

Who can be certified and at what level

OEA-Conformidade (OEA-C)

Three levels: Essential, Qualified, Reference

OEA-C Essential is an introductory track for export trading companies with no on-site validation visit. Qualified is the standard level; Reference is the highest tier, requiring Confia or Sintonia A+ status, granting tax deferral and near-guaranteed green channel access. Minimum direct-import share for importers was reduced from 85% to 60%.

OEA-Security (OEA-S)

Supply chain security focus

Certifies operators against the full Security Criteria set (criteria 8-14), covering cargo, transport and physical facility security, training and crisis management, with reduced inspection rates and expedited processing.

OEA-Integrated

Complementary whole-of-government framework

Not a separate certification tier; it is the framework through which agencies like Secex, ANVISA and MAPA grant agency-specific benefits to operators already OEA-certified. Under Portaria Secex 485/2026, OEA-Integrated Secex now covers all three OEA-C levels, subject to RFB terms.

Operators may hold both OEA-C and OEA-S simultaneously. Certification is granted per legal entity (CNPJ) and per function.

Eligible supply chain participants

Importer (Importador)

Exporter (Exportador)

Carrier (Transportador)

Freight Agent (Agente de carga)

Maritime Agent (Agência marítima)

Warehouse Operator (Depositário)

Port Operator (Operador portuário)

Airport Operator (Operador aeroportuário)

Export Customs Warehouse (Redex)

OEA-C Reference applications open from 15 April 2026. Companies may apply for the highest tier of OEA-C certification, designed to integrate with the Confia and Sintonia programs, offering tax deferral on import duties and near-guaranteed green channel access. Applicants must hold a Confia certification or an A+ rating in Programa Sintonia.

Mutual Recognition Agreements in force. OEA certification in Brazil is recognised by customs administrations in 20 jurisdictions, including the United States (C-TPAT), Canada (PIP), the European Union (AEO), the United Kingdom, China, Japan, South Korea, and a multilateral regional MRA covering Argentina, Uruguay, Paraguay, Chile, Peru, Bolivia, Colombia, Costa Rica, Guatemala and the Dominican Republic.

Assessment Criteria (Annex II)

The 22 criteria of the revised OEA framework

1-7

General Criteria

Applicable to all modalities and intervenor types

Admissibility (36-month CNPJ history, fiscal regularity, Electronic Tax Domicile, Digital Accounting); compliance history; financial viability; commercial records systems; information security; human resources security; and cooperation and communication with the RFB.

8-14

Security Criteria

OEA-Security; also applicable to OEA-C Qualified and Reference

Security vision and risk assessment; cargo security (ISO 17,712 seals, VVTT protocol); transport security (GPS tracking); physical facility security; training and awareness; commercial partner management; and crisis management and incident recovery.

15-22

Compliance Criteria

OEA-Conformidade certification, importers and exporters

Goods classification and rules of origin; foreign exchange controls; customs valuation; tax immunities and benefits; indirect operations; professional qualification; and customs risk management.

The Certification Process

From application to authorisation: key stages

The steps below reflect the process for applications lodged from 15 April 2026 under Portaria COANA 187/2026.

Pre-application

Eligibility and modality assessment

Confirm the applicable modality and CNPJ. For OEA-C Essential, six admissibility items are waived at application stage under Portaria COANA 187/2026, but compliance remains mandatory.

Application lodgement

Filing the Requerimento de Certificação OEA (Annex I)

Filed in the OEA System, including modality, supply chain function, CNPJ, company profile (Annex III) and evidence of Annex II compliance, plus a Terms of Undertaking.

120-day validation clock

Validation procedure by the EqOEA

The OEA Management Team has 120 days from formalisation to complete validation, which may include requests for clarification and on-site visits.

Authorisation

Authorisation certificate (Ato Declaratório Executivo)

Successful validation results in a published authorisation act. OEA-C Essential operators then have 180 days to upload evidence of General Criteria compliance.

Ongoing

Monitoring, revalidation and appeals

Operators are subject to continuous monitoring against the full Annex II matrix. Rejections or exclusions may be appealed, with appeals distributed to an independent EqOEA team.

Practical Implications

What Portaria COANA 187/2026 means in practice

New from 15 April 2026

The simplified OEA-C Essential track

Six categories of admissibility evidence no longer need uploading at application stage, but the waiver is procedural only; full documentation is due within 180 days of authorisation.

Key compliance point

The 180-day post-authorisation window

This period does not suspend monitoring; it should be treated as the outer limit for formal upload, not a grace period.

Reading the rules together

IN RFB 2,318/2026 and the Portaria

The Portaria is a subordinate implementing instrument; the IN governs the legal framework, modalities, eligibility and exclusion rules. Both must be read together.

Cybersecurity (Criterion 5)

IT security requirements are more prescriptive

13 specific requirements including formalised policy, vulnerability testing, role-based access and equipment sanitisation; validation looks for written policies, not just working systems.

DUIMP and digital readiness

OEA certification and the DUIMP

OEA-certified status improves risk-scoring and accelerates release under Brazil’s single import declaration system; inconsistencies between DUIMP data and OEA submissions can trigger adverse findings.

ISO 17,712 seals (Criterion 9)

High-security seal standards are mandatory and audited

Operators must use ISO 17,712 seals, maintain audit trails and follow the VVTT protocol; partners managing seals must meet the same standard.

Get advice

Pursuing OEA certification in Brazil?

Whether assessing eligibility, preparing a first application under the new framework or managing an existing certification through transition, early legal advice reduces preparation time.

OEA readiness checklist

✓Modality and level confirmed (OEA-C Essential / Qualified / Reference; or OEA-S)

✓Supply chain function(s) and target CNPJ identified

✓36-month CNPJ registration and activity requirements verified

✓Fiscal regularity (CND/CPEND) confirmed

✓Electronic Tax Domicile and Digital Accounting active

✓5-year compliance history reviewed, incidents documented

✓Cybersecurity policy formalised with annual review cycle

✓ISO 17,712-compliant seal program in place with VVTT protocol

This page is a summary only and does not constitute legal advice.

Brazilian lawyers for foreign companies, investors and law firms.

Sao Paulo

Rua Quintana, 887/32
Sao Paulo SP 04569-011, Brazil
+55 11 5505 2485
info@deffenti.com

Brisbane

Level 34, 1 Eagle Street
Brisbane QLD 4000, Australia
+61 7 3040 9301
info@deffenti.com

Links

Legal Guides Practice Areas Team Terms of Use