The CPF (Cadastro de Pessoas Físicas, "Register of Natural Persons") is Brazil's individual taxpayer number, an 11-digit identifier issued by the Receita Federal, the federal tax authority. Every Brazilian citizen and many foreigners with tax, property, banking or work ties to Brazil hold one, and it is needed for almost every financial activity in the country, from opening a bank account to receiving a salary.
Although it began as a tax number, the CPF has become Brazil's de facto national identifier. It plays a role similar to a tax information number (TIN) in other countries and is often compared with the US Social Security Number (SSN). Its counterpart for companies is the CNPJ (Cadastro Nacional da Pessoa Jurídica).
CPF in plain terms
Think of a membership number at a large club that runs everything: the bank, the pharmacy loyalty scheme, the phone company and the tax office. You give the same number at every desk, and each one uses it to find your file. If two people share a name, the number tells them apart.
The CPF is that number for life in Brazil. People recite it at checkouts, write it on contracts and use it to receive instant transfers. Because so many systems hang off the same number, it is very convenient, and it also makes the number valuable to fraudsters who want to pretend to be someone else.
Format and administration
A CPF is written as eleven digits in the pattern 000.000.000-00. The first nine digits are the registration number and the last two are check digits calculated from the others, which lets systems catch typing errors. The ninth digit indicates the tax region where the number was first issued.
The Receita Federal manages registrations, corrections and status. A CPF can be "regular" or flagged as suspended, cancelled or pending, for example when a holder has not filed required tax returns, and banks and merchants routinely check this status. Brazilians can request a number free of charge, and foreigners can obtain one through Brazilian consulates or authorised agents.
From tax number to national identifier
Law 14,534 of 11 January 2023 made the CPF the single and sufficient number for identifying citizens in public databases. Under the law, documents issued by public bodies, civil registries and professional councils must carry the CPF, and new identity documents use the CPF as their identification number. The new national identity card follows this approach. The change supports Brazil's wider digital identity agenda by letting government systems link records through one key.
In finance, the CPF is the anchor of know your customer (KYC) processes. Banks, payment institutions and brokers record it at onboarding, check it against Receita Federal data during identity verification (IDV) and use it in reporting to tax and financial-crime authorities. Because the CPF is personal identifiable information (PII), its handling is also governed by Brazil's general data-protection law (LGPD).
The CPF and Pix
The CPF is one of the key types used in PIX, the instant payment system run by the Banco Central do Brasil since November 2020. A Pix "key" is an alias that points to a bank or payment account. Individuals can register their CPF, a mobile number, an email address or a random key; companies can use their CNPJ. Paying someone by CPF is common because the number is already known and is unique to that person.
This link between identity and payments makes it easy to check that money is going to or coming from the right person, which is valuable for fraud control and for account-to-account (A2A) payments generally. It also explains why stolen CPF data and borrowed accounts, the raw material of the mule (bank) account, are a recurring problem.
Role in Brazil's betting rules
Law 14,790 of December 2023 created Brazil's licensed market for fixed-odds sports betting and online games, supervised by the Secretariat of Prizes and Bets (SPA) of the Ministry of Finance; the regulated market opened on 1 January 2025. Only adults may bet, and operators must identify each player, which in practice ties every betting account to the player's CPF.
The payment rules build on that link. Under SPA Ordinance 615 of 2024, deposits and withdrawals move only by electronic transfer, such as Pix, between the operator's transactional account and an account previously registered by the bettor, held at an institution authorised by the central bank. Cash, boletos, cheques, credit cards, crypto-assets and payments from third parties are not allowed. These rules keep player funds inside the payments perimeter and make each flow traceable to one CPF. They also give a clear route for returning balances if an operator loses its gambling license and has to follow a wind-down plan.
Brazilian rules also require banks and payment institutions not to serve unlicensed betting operators, leading to offboarding of illegal sites' accounts. Critics note that demand for betting does not disappear when legal channels close, and that some play moves to offshore sites and the grey economy, where CPF-based controls do not apply.
Comparison with other identifiers
Unlike the US Individual Taxpayer Identification Number (ITIN), which exists for people who cannot get an SSN, the CPF is used by residents and non-residents alike. Its broad use in commerce, payments and public services has made it central to financial inclusion in Brazil, since a person with a CPF and a phone can open a digital account and receive Pix transfers. The trade-off is a large concentration of risk on one number, which has made CPF data a frequent target in leaks and fraud schemes.