Shinier
    Sign In

    What does it mean for a company to be suitable?

    In today's business ecosystem, corporate suitability is no longer an abstract concept associated solely with negative debt certificates. Today, being a suitable company means possessing structured, auditable, and demonstrable integrity in all its relationships with the market, investors, employees, and regulatory bodies.

    According to the guidelines of the Office of the Comptroller General (CGU) in the Integrity Program: Guidelines for Private Companies and the Brazilian Anti-Corruption Law (BRAZIL. Law No. 12,846/2013), corporate integrity requires the company to adopt a set of internal mechanisms for integrity, auditing, encouraging the reporting of irregularities, and effective application of codes of conduct.

    Furthermore, as recommended in the G20/OECD Principles of Corporate Governance (OECD), excellent corporate governance requires the board of directors and executives to act with due diligence (due care) and loyalty, ensuring maximum transparency regarding the corporate structure, risk governance, and equitable treatment of shareholders and stakeholders.

    Legal & Fiscal Integrity

    Full regularity with the Federal Revenue, Boards of Trade, and Labor and Civil Courts. Absence of hidden liabilities and up-to-date clearance certificates.

    Governance & Transparency

    Alignment with OECD principles. Clear disclosure of cap table, shareholder agreements, board decisions, and active management of conflicts of interest.

    LGPD & Ethical Compliance

    Adoption of policies validated by the ANPD, protection against corporate data breaches, and strict compliance with anti-corruption legislation.

    What documents and evidence are included in due diligence?

    When a startup begins negotiations with Venture Capital funds or large enterprise contractors, due diligence acts as the evidentiary filter. The audit reviews documents to confirm the operational and legal suitability of the startup. The regulations of the Securities and Exchange Commission of Brazil (CVM) for the capital markets inspire these prior diligence parameters.

    1. Legal and Corporate Evidence

    • Consolidated Articles of Association or updated Corporate Bylaws.
    • Shareholders' Agreement and cap table spreadsheets (with historical vesting data).
    • Certificates of regularity for tax and social security obligations (Federal Revenue and FGTS CND).
    • Certificates from Civil, Labor, and Criminal Distributors for the headquarters and partners.
    • Proof of intellectual property and trademark registration at INPI (or relevant authority).

    2. Compliance and Security Evidence

    • Code of Ethics and Conduct signed by the team and board of directors.
    • Data Protection Impact Assessment (DPIA/RIPD) in compliance with ANPD (or GDPR) guidelines.
    • Information Security Policy and access control (ISO 27001 or SOC 2 when required).
    • Non-Disclosure Agreements (NDA) and full assignment of Copyrights and Intellectual Property of the source code.
    • Certificate of Non-existence of administrative Sanctions (CEIS and CNEP maintained by the CGU).

    Required Documentation for Non-Refundable Subvention Grants (FAPs & FINEP)

    Raising non-refundable economic subvention funds (such as in notices from FINEP, FAPESP, FAPESC, Centelha, or calls like the 5th Edition of the Mulheres+Tec Program) requires the startup to prove absolute cadastral, legal, and fiscal rigidity.

    Disqualification in public calls often occurs due to formal errors in expired certificates, lack of residence declaration, or divergence of addresses. Below we detail the standard list required by state and federal development agencies with instructions and links for immediate issuance (applicable to Brazilian context):

    1. Joint Negative Certificate of Federal Debts and Active Union Debt

    Proves fiscal regularity with the Federal Revenue and the General Counsel to the National Treasury (PGFN). Mandatory for any public transfer.

    Issue at Federal Revenue

    2. Negative Debt Certificate with the State Treasury

    Proves regularity with ICMS and state taxes in the company's headquarters state (e.g., SAT in Santa Catarina or Sefaz in São Paulo).

    Access State Treasury (E.g., SAT SC)

    3. Negative Debt Certificate with the Municipal Treasury

    Issued directly on the City Hall portal where the company has its fiscal address, proving payment of ISSQN and municipal fees.

    Consult City Hall / Redesim

    4. Negative Certificate of Labor Debts (CNDT)

    Issued by the Superior Labor Court (TST). Certifies the absence of pending issues in definitively judged labor executions.

    Issue CNDT at TST

    5. Certificate of FGTS Regularity (CRF Caixa)

    Demonstrates that the startup is up to date with the Severance Indemnity Fund (FGTS) contributions for its formalized employees.

    Consult CRF at Caixa

    6. Consultation of Sanctions and Ineligible Companies (CEIS / CGU)

    Statement issued on the CGU Transparency Portal proving that the company is not suspended from bidding or contracting with the Public Administration.

    Consult CEIS on Transparency Portal

    7. Updated Company Address Proof

    Energy, water, internet bills, or lease agreement (maximum 3 months). If not own property, a Declaration from the Owner with a notarized signature is required.

    📌 Maximum validity: 90 days

    8. Legal Representative's Proof of Residence

    Recent bill in the name of the founder/legal representative. If residing in a third party's property, attach the corresponding Residence Declaration.

    📌 As per CNPJ representative

    9. Regularity in Accountability (DART / CGE)

    Proof of compliance regarding previously received state funds (e.g., DART System of the State Comptroller General).

    Consult DART (CGE/SC)

    10. Consultation in the State Penalty Registry (CADPEN)

    Statement by CNPJ certifying the absence of sanctions in the state government supplier registry.

    Consult CADPEN

    Is your startup ready to pass the due diligence of large clients and public grants?

    Avoid losing high-value B2B contracts or being disqualified in a subvention notice due to an expired certificate. At Shinier Accelerator, we help founders structure corporate governance, regulatory compliance, and technology architecture ready for enterprise audits.

    Compliance Audit Kit

    Templates and checklists for the code of ethics, LGPD policies, and governance ready to pass the procurement of large corporations and public notices.

    Access tools

    Valuation & Cap Table Audit

    Evaluation and organization of your corporate structure, vesting rules, and cap table aligned with VC and market standards.

    Simulate Valuation

    Enterprise Acceleration

    Direct mentoring with experts to prepare your pitch, data room, and compliance for B2B sales, public notices, and VC fundraising.

    Talk to an expert

    How to evaluate partners, suppliers, and high-risk clients?

    A startup's suitability directly depends on the integrity of the entities with which it does business. Under the Anti-Corruption Law (BRAZIL. Law No. 12,846/2013), the liability of legal entities is objective, covering acts committed by third parties contracted in their interest or benefit. Furthermore, the CGU guidelines (Integrity Program) emphasize that third-party due diligence is indispensable.

    To mitigate reputational and legal risks, the startup must implement a risk assessment matrix based on 4 strategic pillars:

    Evaluation of Partners and Co-founders

    Check backgrounds for financial illicit acts, pending tax issues, active non-compete clauses with ex-employers, and a history of corporate litigation.

    Critical IT and SaaS Suppliers

    Require proof of data security (encryption and backups), contracts with guaranteed SLAs, and verification in public registries of penalties (CEIS and CNEP).

    Commercial Partners and Channels

    Evaluate whether brokers, representatives, and distribution partners interact with public agents on behalf of the startup. Include an anti-corruption clause with summary termination in case of illicit acts.

    High-Risk Clients (KYC)

    Apply Know Your Customer (KYC) rules. Verify the origin of funds to avoid being involuntarily used in money laundering schemes or fraud.

    What minimum compliance controls does a startup need?

    One of the main doubts founders have is believing that compliance requires heavy and expensive structures. On the contrary, the CGU Integrity Program and the recommendations of the OECD emphasize proportionality: the program must be appropriate to the company's size, revenue, and risk level.

    For early-stage and growth-stage startups, the indispensable minimum controls are structured around 5 lean pillars:

    01

    Practical Code of Conduct and Ethics

    An objective document that defines the rules of the game: zero tolerance for bribes, harassment, conflicts of interest, gifts, and inappropriate use of company assets and data.

    02

    Visible Commitment from Top Management (Tone at the Top)

    Founders must actively demonstrate and communicate the company's ethical values. Compliance needs to be championed in alignment meetings and daily decision-making.

    03

    Reporting and Whistleblowing Channel

    A mechanism (confidential form or secure email) for employees and third parties to report suspected illicit acts or ethical deviations without fear of retaliation.

    04

    Periodic Training and Awareness

    Quick onboarding training and annual sessions focused on information security, respect for LGPD, and ethical conduct in B2B sales and government relations.

    05

    Financial Controls and Approval Limits

    Segregation of duties for payments: mandatory double approval for transfers and clear spending limits by department to prevent deviations.

    How do LGPD, anti-corruption, and governance connect?

    Compliance cannot be viewed in isolated silos. In the tech startup ecosystem, compliance with the LGPD/GDPR, the rules of the Anti-Corruption Law, and the practices of Corporate Governance (OECD) converge to form the company's reputational shield.

    Below we explain how these three axes overlap and interact in the startup's day-to-day operations:

    LGPD & ANPD

    Regulates the lifecycle of personal data. Requires data governance, consent or valid legal basis, data minimization, and DPIA elaboration.

    Focus: Data Subject Privacy & Cybersecurity.

    Anti-Corruption Law

    Prevents fraud, favoritism, bribes, and the vitiation of public tenders. Evaluates the integrity program and the fairness of commercial operations.

    Focus: Integrity in Public and Private Relations.

    Governance & OECD / CVM

    Ensures the fiduciary duty of directors, accountability, protection of minority shareholders, and long-term sustainability before stakeholders.

    Focus: Transparent Decision Making & Value Creation.

    How to register decisions and conflicts of interest?

    In the fast-paced environment of a startup, it's common for founders and executives to make hiring or partnership decisions involving related parties (family members, other companies owned by partners, etc.). However, from the perspective of the OECD Governance Principles, the lack of formal registration of conflicts of interest represents a serious governance failure.

    To protect the startup and ensure traceability in future due diligences, adopt the following protocol:

    Annual Conflict Declaration Form

    All partners, directors, and key leaders must fill out an annual declaration reporting corporate participations in other companies, relatives who are suppliers or clients, and possible links with public agents.

    Abstention from Voting and Formalization in Minutes

    Whenever a contract involves related parties, the conflicted partner or director must declare the impediment, abstain from discussions and voting, and formally register the abstention in the meeting minutes.

    Related Party Transactions Policy

    Contracts with suppliers linked to partners must prove strictly commutative market conditions (arm's length principle), accompanied by at least 3 competing quotes.

    Record of Partners/Board Meeting Minutes

    Maintain a centralized and digitally signed repository of all strategic decisions of the startup: budget approvals, pivots, key hires, and the issuance of debt or equity.

    Integrity checklist for enterprise sales, fundraising, and public grants

    Use the interactive checklist by component below to verify your startup's evidentiary readiness:

    Readiness for Enterprise Contracts

    Federal, State, and Municipal CNDs valid in the last 30 days.
    Privacy Policy and Terms of Use updated and aligned with LGPD/GDPR guidelines.
    Penetration testing report (Pentest) and business continuity plan.
    Formal Code of Conduct with specific anti-corruption clauses (Law No. 12,846/2013).
    Proof of an appointed Data Protection Officer (DPO).

    Referências