The day your company became part of a law it never read

IntroductionAn external fact that does not ask permission to enter

In May 2026, the regulatory environment surrounding Brazilian companies changed. Most of them have not yet noticed.

In late May 2026, the United States government classified two Brazilian criminal factions, the Primeiro Comando da Capital (PCC) and the Comando Vermelho (CV), as terrorist organizations. It sounds like public security news, a police matter. The risk for companies, however, lies precisely there: this classification is not just about crime, it is about money and contracts. And anything involving money and contracts ends up reaching whoever moves funds and signs contracts, which today is almost every company.

The intent of this article is not to frighten anyone. It is to explain, clearly and without jargon, what this decision means in practice: which sectors it touches, how the international system discovers who is involved and, above all, why many companies that today say "this is not about me" also run a risk. In fact, that may be the most dangerous sentence a company can repeat right now, and throughout the text the reason becomes clear.

We write from the viewpoint of those who work with the subject every day: combating cybercrime and terrorism and intelligence applied to protecting organizations. Our goal is to offer companies, class associations, sector groups and public managers an honest information base, so each can draw their own conclusions about their level of exposure.

Section 1What actually changed, in simple terms

The United States uses two legal labels for groups it considers terrorist, and the PCC and CV received both: FTO (Foreign Terrorist Organization) and SDGT (Specially Designated Global Terrorist). More important than memorizing these acronyms is understanding the consequence they trigger.

In practice, the comfortable border separating "organized crime" from "the company that just does business" collapsed. When a payment, a contract, a freight or a supplier touches, even distantly, an entity linked to these factions, that act may come to be treated under an anti-terrorism law, and no longer only under ordinary criminal law.

Section 2Primary and secondary sanctions: the difference that decides who is hit

There is a point most analyses do not explain well. There are two types of sanction, and it is the difference between them that determines whether a Brazilian company "with nothing to do with the U.S." is exposed or not.

Primary sanctions

They apply to those within the legal reach of the United States: American persons and companies and anyone who uses the country's financial system, which in practice includes almost everyone operating in dollars. For them, doing business with a designated party means asset freezes, a ban on operating and criminal risk for material support.

Secondary sanctions

This is where the game changes for Brazil. Secondary sanctions target third parties who are not American, such as a Brazilian company, when that company deals with a designated entity. The message is direct: if you do business with someone on the list, you may end up on the list too. You do not need a headquarters, a partner or an account in the United States to feel the effect. It is enough to depend, at some point, on the global financial system, and virtually every company depends on it.

Section 3Why "checking a list" is not enough: the 50% Rule

Many companies imagine that protecting themselves is simple: just check whether the client's or supplier's name appears on some official sanctions list. It is not quite so. There is a rule, known as the 50% Rule, that expands the reach of the sanction silently.

That is why real protection is not the one-off gesture of "checking a list." It is the ability to see who is behind each client, supplier and partner, and to do so continuously, since ownership structures change all the time.

Section 4Who is affected: the three groups of sectors

Not all sectors are reached in the same way. To make this clear, it helps to split the economy into three groups: those hit directly, those hit indirectly and those that suffer both effects at once. The classification below is only analytical and educational. It serves for each organization to locate itself, not to point fingers.

Each sector's position may vary according to the company's profile, such as use of dollars, exports, ownership structure and supplier chain. The table is a starting point, not a verdict.

Examples by sector: illustrative scenarios

The cases below are hypothetical and illustrative, created only to show how the mechanism works. None of them describes a real company.

Section 5How the system discovers who is involved

A common question is: "but how would anyone find out?" The answer is a bit uncomfortable, because the discovery channels are many, automatic and interconnected. There need not be a targeted investigation for a company's name to surface.

The most common path begins at the bank. Since almost every international operation passes, at some point, through a correspondent bank in the United States, that is where automatic filters compare each transaction against the sanctions lists and risk patterns. Added to that filter are the suspicious activity reports that financial institutions themselves are required to file, the data analysis done by authorities, the information that listed companies must disclose to regulators, investigative journalism and cooperation between countries. There is also a little-known detail: there are programs that pay million-dollar rewards to whistleblowers. With that, the incentive for an employee, a competitor or a former partner to report an irregularity becomes high and very concrete.

Section 6Why "this is not about me" is the riskiest sentence

For most companies, the first impact will not arrive as a criminal case. It will arrive silently, through the reaction of their own partners: the bank that closes the account "as a precaution," the card machine that raises the fee or withholds the receivable, the insurer that excludes coverage, the supplier who, already contaminated, passes the risk along. None of that waits for a sentence. The market usually moves before the courts.

That is why the sentence "this is not about me" is so risky: it confuses two different things, not being at fault and not being exposed. A company can be entirely reputable and still be hit because it did not see in time a risk that was already in its chain. Having no involvement protects the company from fault, but it does not protect it from the consequences.

Section 7The questions every organization should be able to answer

It is not for this article to tell anyone what to do. It is only to propose a few honest questions. If your organization answers all of them calmly and with documented evidence, it is probably on a good path. If it stumbles on any, that is exactly where your exposure lives.

None of these questions is about technology or about buying a product. They all concern a single capability: continuous visibility, knowing before the market what exists in your own chain.

ConclusionThe difference is in seeing in time

The designation of the PCC and CV as terrorist organizations is, above all, a fact of the environment. It does not ask permission to enter the reality of companies, does not separate those who read the law from those who did not, and does not wait for each organization to realize it is exposed before taking effect. That effect has already begun.

There is no reason to panic, but every reason for clarity. The organizations that will get through this scenario with less turbulence are not necessarily those that fear the most nor those that spend the most. They are the ones that see better: they know who is in their chain, notice a shift in risk before the bank and the insurer, and can prove, with documents and not with rhetoric, that they act with diligence.

In this context, doing nothing is also a choice: that of discovering the risk later and in the worst way. Every institution, association and company reading this text already has enough information to ask a simple and slightly uncomfortable question: am I seeing what I need to see? The answer, and what to do with it, belongs to each one. The question, from now on, belongs to all.

INCC resourceA starting point for your organization

To help with this first step, INCC developed a self-assessment tool on the topic. It does not replace legal analysis nor deliver a definitive diagnosis, but it works as a starting point for your organization to better understand where it may be exposed and which questions to take to the compliance team and legal department.