Brazil CPF verification API: check digits, fiscal regions and Receita Federal status

Field layout of the 11-digit CPF

Fiscal region codes

• 1 DF, GO, MS, MT, TO
• 2 AC, AM, AP, PA, RO, RR
• 3 CE, MA, PI
• 4 AL, PB, PE, RN
• 5 BA, SE
• 6 MG
• 7 ES, RJ
• 8 SP
• 9 PR, SC
• 0 RS

Response contents of a Brazil CPF verification API

A parse result tells you whether a number is well formed. A verification response tells you whether the person in front of the camera owns it. deepidv runs one session: document capture with OCR and the AI document fraud check, face liveness with a 1:1 match to the document photo, the Receita Federal status check, PEP and sanctions screening, and an optional 1:N match that flags the same face behind a second account.

• One decision per session, with an outcome for every step, delivered by webhook (session.status.verified, session.status.rejected, session.status.failed).
• A reason for every non-pass outcome, separating malformed input, a record that was not found, a mismatch between document and record, and a registry that did not answer.
• Portuguese accents are preserved as captured.
• A signed verification receipt with a UTC timestamp per step, anchored on Base L2 with zero personal data on chain, checkable at proof.deepidv.com.

Computing the check digits

1. First check digit: multiply the first nine digits by 10, 9, 8 down to 2, and sum.
2. Take the remainder of the sum divided by 11. If it is below 2, the digit is 0; otherwise it is 11 minus the remainder.
3. Second check digit: multiply the first ten digits by 11 down to 2, sum, and apply the same rule.
4. Reject numbers with all eleven digits the same, such as 111.111.111-11. They pass the arithmetic and are never issued.

Receita Federal status checks

The Receita Federal registration status (situação cadastral) is one of: regular, suspensa, pendente de regularização, cancelada, titular falecido or nula. Only regular should pass onboarding without review. Personal data is processed under the LGPD.

Liveness, face match and Brazilian rules

The Carteira de Identidade Nacional (CIN) uses the CPF as its number and carries a QR code; the older state RG and the CNH driving licence are still in use. deepidv captures each in a single shot, runs the AI document fraud check, then liveness and a face match. Licensed fixed-odds betting operators must validate the CPF and use facial recognition at registration under Portaria SPA/MF No. 722/2024. Arbiter drafts reports to COAF for review.

How deepidv runs Brazil verification

deepidv is a verification engine and agentic compliance suite built from the ground up, without third-party verification APIs underneath. The engine is SOC 2, ISO 27001 and PCI DSS certified, and deepidv is a member of DIACC and the AVPA. Luna, the verification agent, builds and sends Brazil verification workflows from the platform or from any LLM through MCP. Arbiter, the compliance agent, maps the workflow to the Central Bank of Brazil requirements, monitors accounts after onboarding and drafts suspicious transaction reports for COAF for your team to review.