Selling software and SaaS into Brazil: taxes and entry models

The short answer

Selling software into Brazil without a local presence means every licence payment crosses the border carrying withholding tax, PIS/COFINS-Importação, municipal service tax, and, in some cases, an additional charge on maintenance and updates. A local seller carries none of these on the payment itself. That gap, not any single rule, is the real argument for a Brazilian entity, a distributor, or a partner structure over direct cross-border sales.

Taxes on a cross-border licence payment, current system

Checked against the primary acts on 23 September 2026.

Tax	Rate	Applies to	Basis
IRRF (withholding)	15% for an ordinary jurisdiction; 25% for a jurisdiction on the privileged-tax or offshore list	Payments abroad for software licences	SC Cosit 107/2023; the privileged-tax list runs under IN RFB 1.037/2010
CIDE-Remessas	10%	Maintenance and update services without new licensing; not the licence payment itself, except where technology transfer is involved	SC Cosit 107/2023
PIS/COFINS-Importação	9.25% nominal (1.65% + 7.6%), effectively 10.4-10.7% of contract value once grossed up with ISS and the contributions themselves in the base	Software licensing, regardless of how it was acquired	SC Cosit 107/2023
ISS (municipal)	2-5%, set by the municipality	Software treated as a service for ISS purposes	LC 116/2003, article 1 §1, article 6 §2, article 8, item 1.05
IOF-câmbio	3.5%	The foreign exchange transaction itself	Decreto 6.306/2007 article 15-B XXI, as worded by Decreto 12.499/2025 (in force from publication, 11 June 2025), rate raised by Decreto 12.466/2025

The historical split between "software de prateleira" (shrink-wrapped software) and "software sob encomenda" (custom software) no longer matters for tax purposes; all code is treated as a service.

What the total actually comes to

At IRRF 15%, an ordinary jurisdiction not on the privileged-tax list: 30.4-33.7% of contract value without CIDE-Remessas, 40.4-43.7% with it, rounded on this page to 30-44%. Measured against what the vendor actually nets, with the buyer bearing the taxes through a gross-up clause, the range runs 35.7-39.6% without CIDE-Remessas and 47.5-51.4% with it, rounded to 36-51%. A wider "35-48%" range, and a claim that around 80% of software importers cannot take any credit, circulate in industry commentary without an official Receita statistic behind them, and are not repeated as figures here.

Credits exist only for PIS/COFINS-Importação, and only for a company on the non-cumulative regime, typically Lucro Real, where the expense qualifies under Lei 10.865/2004 article 15. A local seller has none of IRRF, CIDE-Remessas or IOF on the payment itself, which is the core argument, in the source material behind this page, for choosing a local entity or a reseller over selling directly.

Tax treaties: what this page does not state

Brazil has double tax treaties with a number of countries, and a treaty can change the withholding rate below the general 15% figure. This page states only the general case, a country without a treaty, and does not publish specific treaty rates or a country list, since the underlying research did not cover them with a source this page trusts. Check the Receita Federal's own list of treaties for your specific country, and confirm the treaty rate with your own tax adviser, before pricing a deal off the general figures above.

From 2027

Under LC 214/2025, ISS and PIS/COFINS are gradually replaced by IBS and CBS on the schedule described on tax reform. No CBS rate has been approved as of 24 September 2026; a 15 December 2026 deadline for the Senate to approve the reference rate is reported in secondary sources, not confirmed against the law text (see tax reform). IOF at 3.5% is not touched by the reform. Credits broaden under the new system: IBS and CBS paid on import become creditable against the importer's own liabilities, for both Lucro Real and Lucro Presumido, which should lower the effective burden once the new rate is known, though by how much cannot be stated without that rate.

LGPD and moving data across the border

LGPD (Lei 13.709/2018), articles 33-36, sets the framework for international data transfers, detailed by Resolução CD/ANPD nº 19/2024, published 23 August 2024 with a 12-month transition, fully in force since 23 August 2025. The EU and EEA are recognised as adequate destinations (Resolução ANPD 32/2026, from January 2026); the US, UK and China are not, and for any other country, adequacy should be assumed absent unless ANPD states otherwise.

Standard contractual clauses, using the model text in Annex II to Resolução 19/2024, are the main practical mechanism for a foreign SaaS vendor, built directly into the contract with the Brazilian counterparty. Two other mechanisms exist but need prior ANPD approval and suit different situations: Normas Corporativas Globais, an intra-group mechanism comparable to Binding Corporate Rules, none of which had been approved as of February 2026; and specific contractual clauses for a one-off transfer.

Data localisation in Brazil is not required. A SaaS product hosted entirely outside the country is legally workable with the right contractual wrapping in place; sign the standard contractual clauses with your Brazilian counterparty before processing any personal data, not after.

Fines under LGPD article 52 run up to 2% of the entity's revenue in Brazil, capped at R$ 50 million per infraction. Enforcement so far has been mild: the largest monetary sanction on record is R$ 14,400 against Telekall Infoservice in July 2023, for processing without a legal basis and no DPO; other recorded cases involve public bodies without a fine attached. Control of international transfers formally tightened from 23 August 2025 onward.

INPI software registration: not mandatory, still worth doing

Copyright protection for software is automatic under Lei 9.609/1998, running 50 years, so INPI registration is not a legal requirement. It is still worth doing early, before signing licence contracts: the process is fully digital, needs source code and a technical description, and a certificate typically issues in 7 business days, with fee discounts for small businesses. It strengthens your position in a licensing dispute or in proving rights, which is easier to establish before a dispute than during one.

Other regulators that do not apply, and one that might

INMETRO has no mandatory technical certification for pure software. ANATEL is relevant for telecom equipment; a pure app with no radio module usually does not need it, though a video-conferencing product bundled with hardware should be checked case by case. The Banco Central does not certify software, but it regulates how financial institutions use technology and cloud providers, under Resolução CMN 4.983 and the more recent Resolução CMN 5.274 of 18 December 2025, which tightens minimum controls and mandates annual testing; a SaaS contract with a bank as the customer faces enhanced compliance review, and a banking-regulation lawyer is worth bringing in at the presale stage rather than after a term sheet exists. Whether ANVISA rules apply to software as a medical device was not researched for this page: no data.

Public procurement

Lei 14.133/2021 lets a foreign company without a Brazilian entity formally bid on a public tender; at the bid stage in electronic tenders a CNPJ is not required and initial document translations need no notarisation, and a consortium with a local company is not a legal requirement. Winning the tender changes that: sworn translation, apostille or consular legalisation of corporate documents, and proof of tax and labour regularity are then required. A margem de preferência (preference margin) for domestically produced IT and automation goods and services runs under Lei 8.248/1991 and Lei 14.133/2021 article 26, regulated by Decreto 11.890/2024, prioritising nationally produced technology first, then non-PPB national technology, then PPB products that are not fully national; no single percentage figure for software and IT services specifically was found in the source material: no data.

Entry models, compared

Model	Timeline	What it opens	What it costs
Direct sales, no entity	Weeks	Fast pilots, private-sector deals	Payment taxes of 30-44% of contract value; price loses to local sellers; procurement needs legalisation after winning; harder to build a long relationship with a large buyer
Local entity (Ltda)	Registration itself runs on the periods described on company formation; a non-resident founder's own bottleneck sits in CPF, legalisation and account-opening steps, not the registration	Public tenders, local hiring, Lei de Informática benefits where PPB applies, a stronger reputation signal	Ongoing compliance: accounting, labour law, corporate reporting; no automatic tax break just for localising
Distributor or reseller	Weeks to months	A ready customer network with no structural investment	Shared margin; less control of price and customer experience; larger distributors tend to focus on hardware and boxed software rather than complex enterprise products
System integrator	Months to a first joint project	Access to large corporate and public buyers, with the integrator handling localisation, support and compliance	A long sales cycle; dependence on the partner's own priorities, including the risk it favours a competitor
White label / OEM	Months	Fast scaling through a trusted brand	Loss of your own brand visibility; limited control of the product roadmap
Joint venture	Several months to a year	Access to PPB and Lei de Informática benefits with local production or R&D, shared risk	The longest, most capital-intensive route, with real IP risk on any technology transfer

An investor visa (VIPER) starts at R$ 150,000 in investment with a duty to hire Brazilian professionals; this is an immigration route, not a company-formation requirement, and does not set the minimum capital for an ordinary Ltda, which is not fixed by law.

Lei de Informática and PPB

Lei 8.248/1991 supports companies investing in R&D and production of IT, automation and telecom goods. Its production-process benchmark (PPB) mechanism was designed for hardware; its applicability to pure software is unclear, and the source material for this page found no firm answer either way. Since 1 April 2020 the benefit runs as a Crédito Financeiro proportional to R&D investment, offset against IPI, II, PIS, COFINS, CSLL and IR, with a regional multiplier, for example 3.24 in the Northeast. There is no lever here for a pure licence-export model without local presence; it fits a local R&D centre or joint production instead.

Sources

• Cross-border licence taxation: SC Cosit 107/2023 and IN RFB 1.037/2010, normas.receita.fazenda.gov.br, confirmed 23 September 2026. LC 116/2003, planalto.gov.br. IOF: Decreto 6.306/2007 consolidated text, Decreto 12.499/2025, Decreto 12.466/2025, all planalto.gov.br.
• LGPD and data transfer: Lei 13.709/2018, articles 33-36; Resolução CD/ANPD 19/2024 and 32/2026, gov.br/anpd. Enforcement figures and SCC transition detail via secondary summaries (Confidata, Mayer Brown).
• INPI registration: Lei 9.609/1998; process detail via a secondary source (Migalhas).
• Banco Central technology regulation: Resolução CMN 4.983 and 5.274/2025, via secondary summaries (Okai, ConvergênciaDigital).
• Public procurement: Lei 14.133/2021, article 26; Lei 8.248/1991; Decreto 11.890/2024.
• Entry models and Lei de Informática: business-practice research compiled from multiple secondary sources (PwC Brasil, Geosync, Grownt, gov.br/mdic), not primary acts in every case.

Facts verified 23-24 September 2026, drawing on research dated 7-9 September 2026 for market and entry-model detail. Tax treaty rates are not covered; confirm your specific country's treaty before pricing a cross-border deal.