Private security rules in Brazil: Polícia Federal, CNV and Lei 14.967

One federal regulator: the Polícia Federal

Private security (segurança privada) in Brazil is regulated at federal level. Under Lei nº 14.967/2024, providing private security services requires prior authorization from the Polícia Federal (PF), which also controls and inspects the sector. The PF grants and renews company authorizations, inspects premises and posts, approves uniforms and weapons, registers security professionals, issues their national identification document and applies penalties. The PF may delegate part of its inspection work to state security departments, but states cannot create their own fees or fines.

There is no individual permit a guard can hold and sell to any client. A vigilante is a registered professional who must be employed by a PF-authorized security company or by an organization with an authorized in-house (orgânico) security service. The law prohibits private security provided on a self-employed or cooperative basis. For employers, that means two things are always checked together: your company’s authorization for the service, and each vigilante’s course, registration and identification card.

This guide is for owners and operations managers of security companies. It is not legal advice; rules change, so confirm anything important with the Polícia Federal.

What changed: Lei 7.102/1983 versus Lei 14.967/2024

Lei 14.967/2024, the Estatuto da Segurança Privada e da Segurança das Instituições Financeiras, was published on September 10, 2024, took effect on publication and revoked Lei 7.102/1983. It is regulated by Decreto nº 13.012 of June 9, 2026. The comparison below was checked against the statutes on planalto.gov.br and the PF’s official pages on October 18, 2026. Where a figure is not stated officially, the table says so.

Key rules for employers, old law and new law
Topic	Lei 7.102/1983 (revoked)	Lei 14.967/2024 and Decreto 13.012/2026
Vigilante minimum age	21	21 (vigilante and vigilante supervisor); 18 for monitoring supervisors, external technicians and electronic systems operators
Schooling	4th grade of primary school (quarta série do primeiro grau)	Completed ensino fundamental for vigilantes; completed ensino médio for supervisors. Not required of professionals who had already completed their course when the law took effect
Training	Training course at an authorized school; curriculum set by the ministry	At least 200 hours for the formação course and 50 hours for updating (atualização) and improvement courses, at a PF-authorized school
Criminal record	No registered criminal record	No record for intentional (doloso) crimes and not serving a sentence. The decree requires clearance certificates from five courts for the places lived in over the last five years
Identification	Prior registration with the PF	Single national identification document issued electronically by the PF, valid 2 years, mandatory on duty
Refresher frequency	Not stated in the Act	Not stated in the law or decree. The PF’s service page says course certificates are valid 2 years, and a CNV requires reciclagem to be up to date
Company authorization	Reviewed annually; the PF portaria in force required the review request at least 60 days before expiry	Renewed every 2 years (every 5 years for electronic monitoring companies). The PF must decide within 30 days and the filing receipt acts as a temporary renewal
Minimum paid-in capital	100,000 Ufir	R$730,000 for security companies; one quarter of that for unarmed firms doing only patrimonial and event security; R$2,920,000 for cash transport; plus R$146,000 per additional service
Administrative penalties	Warning, fine of 500 to 5,000 Ufir, temporary suspension, cancellation	Warning, fine of R$1,000 to R$15,000 (up to triple in some cases), cancellation of authorization
Unauthorized security	No specific criminal offence in the Act	Closure order and fines for clandestine providers; organizing, providing or offering armed private security without authorization is a crime (1 to 3 years’ detention plus fine)

Capital and fine amounts are updated each year by a PF act in line with the IPCA index (Decreto 13.012, art. 72), so check the current figure before you rely on it. Links to every official page are at the end of this guide.

What is still pending or unclear in October 2026

The new law is in force, but the full rulebook is still being assembled. Decreto 13.012/2026 arrived almost two years after the law, and it leaves many details to PF normative acts. Plan for the following:

Infractions and fine calculation. The decree says the list of administrative infractions and the criteria for setting the amount of a fine will be set by a PF normative act (art. 63). We did not find that act on the PF’s legislation page when we checked.
Old PF rules still listed. Portaria DG/PF nº 18.045/2023, written under the old law, is still listed on the PF’s legislation page. Which of its provisions still apply where they don’t conflict with the new law and decree is not stated officially.
Course rules updated in 2026. The PF issued new acts on course plans, semi-presential teaching and instructor accreditation in June 2026. The PF’s service page for course certificates still lists the old schooling level (5th year of ensino fundamental), which does not match the law’s completed ensino fundamental. Treat the law as the rule.
Adaptation period. Companies already authorized have up to three years from the law’s publication to make the adjustments it requires (art. 60), which runs to September 2027.
Fees. The law’s fee table lists R$43.80 for the national identification document, while the PF’s CNV service page shows R$26.94. Use the amount on the GRU the system generates.

What a vigilante needs before the first shift

Under article 28 of the law, a vigilante must be Brazilian (native or naturalized), at least 21, pass physical, mental and psychological health exams, have completed the formação course at a PF-authorized school, have no criminal record for intentional crimes, be up to date with electoral and military obligations, have completed ensino fundamental, and be hired by an authorized security company or an organization with an in-house service. Enrolment at a school does not require an employment contract.

Specialized posts need more than the basic course. The formação course qualifies a vigilante for surveillance; improvement (aperfeiçoamento) courses, still commonly called extensão, qualify them for services such as cash transport, armed escort and personal security, and each has its own updating course. The employer must provide and pay for the rights the law gives vigilantes, including a PF-approved uniform, protective equipment, group life insurance and legal assistance for acts done on duty. Collective agreements may set 12-hour shifts followed by 36 hours of rest.

Course certificate. Issued by the authorized school once the PF has registered the class in GESP. The PF’s service page says these certificates are valid for 2 years.
Reciclagem (atualização). At least 50 hours. The law and decree don’t state how often it must be done, but in practice it follows the 2-year certificate validity: the PF will not issue a CNV unless reciclagem is up to date.
CNV (Carteira Nacional de Vigilante). The national identification card, valid for 2 years since Portaria 18.045/2023 cut it from 5 (cards issued under the old term stay valid until they expire). The vigilante must carry it on duty, and it serves as civil identity.
Criminal record certificates. From the Federal, State, Federal Military, State Military and Electoral courts, covering where the person lived in the last five years. Under the decree, a person indicted or prosecuted for an intentional crime incompatible with the profession can be refused.

Company authorization and renewal

A security company must be a limited liability company or a closed corporation whose corporate purpose matches the security services it will provide. The PF reviews the proposed business name and draft constitutive act before registration at the Junta Comercial. Authorization then depends on the fully paid-in minimum capital, adequate premises approved by a PF inspection (vistoria) and security certificate, group life insurance for the staff, clean criminal record certificates for partners and managers, and tax and labour compliance.

Everything runs through GESP (Gestão Eletrônica de Segurança Privada), the PF’s online system. Companies log in only with an ICP-Brasil digital certificate (e-CNPJ, with A3 recommended); attorneys log in after the company registers them as procuradores. Before filing a request, such as a renewal or a new activity, the company must have an update process approved in the previous 30 days.

Renewal every 2 years. Security companies, training schools and in-house services renew every 2 years, electronic monitoring companies every 5. Renewal requires proof that you still meet the requirements and that any penalties have been paid. The PF must decide within 30 days, and the filing receipt then works as a temporary renewal. The new law and decree don’t set a minimum filing lead time; file well before expiry so the receipt protects you.
Start-up notices. Report the start of activity to the state public security department within 10 working days, and update your data in the PF system within 5 working days of the authorization being published.
Authorized services only. An authorization covers specific services (patrimonial surveillance, events, cash transport, escort, personal security and so on). Each additional service adds R$146,000 to the minimum capital, and an unarmed firm doing only patrimonial and event security qualifies for the reduced capital only while it stays unarmed.
Federal fees. The law’s fee table lists R$2,190 for an operating authorization and R$4,380 for inspecting a provider’s premises, among others.

How to verify a vigilante and a security company

Clients can check a security company too. The PF’s Certificado de Regularidade service is free, open to anyone and immediate: enter the company’s CNPJ and razão social. The PF notes that a contracting party can be held responsible if it contributes in any way to criminal offences committed by an irregular provider, and the law forbids contracting models that skip a prior check of the provider’s formal regularity.

1Collect the documents. CPF, CNV, the formação certificate, any improvement certificates and the latest reciclagem certificate, with copies on file.
2Use the PF’s public consultation. The PF publishes a “Consulta de vigilante e instrutor credenciado” page that links to an online status check. We could not load the tool itself when testing, so confirm which fields it asks for. If a vigilante has lost their certificate, the PF website issues a declaration of their type and status (declaração de tipo e situação de pessoa).
3Check the CNV’s QR code. CNVs are issued as PDF files with a QR code for checking authenticity, and may be printed on paper or PVC.
4Confirm the record in GESP. When you request the CNV, GESP looks the vigilante up by CPF and requires a regular status with reciclagem up to date. A refusal there is a warning sign.
5Keep proof and re-check. Save a dated screenshot or PDF of each check, and repeat it at every reciclagem and CNV renewal.

Porteiros, vigias and access controllers are not vigilantes

Brazilian buildings and businesses employ many porteiros, vigias and controladores de acesso. The law does not create a profession for them: they are not private security professionals, have no PF course or CNV, and are not covered by a company’s PF authorization. The law and decree mark out what they may do:

Doorkeeping is excluded. The in-house security rules do not apply to access control at building entrances, “typical portaria services”, as long as no firearms are used (Lei 14.967, art. 25, §5).
Support tasks are excluded. A company’s own employees doing administrative, operational or support work, such as stock checks, customer service or watching internal systems, are not clandestine security, provided they don’t perform activities reserved for vigilantes (Decreto 13.012, art. 64, §4).
Patrimonial surveillance is reserved. Protecting property and people is vigilância patrimonial, a private security service under article 5 of the law. Done without PF authorization, it is clandestine: the PF issues a closure order, seizes unauthorized equipment and fines individuals R$1,000 to R$10,000 and companies R$10,000 to R$30,000.
Armed and unauthorized is a crime. Organizing, providing or offering private security with firearms without authorization, as an owner or partner, carries 1 to 3 years’ detention plus a fine (art. 50).
No freelance vigilantes. A registered vigilante working shifts on their own account, or through a cooperative, is providing security in a way the law prohibits, however valid their CNV.

Practical line If the job description says patrol, protect, deter or respond, staff it with registered vigilantes under your PF authorization. If it says receive, register and open the door, unarmed, it can be portaria. Labelling a vigilante’s job as portaria does not change what the person is doing on post.

The expiry trap

Two dates run out on every vigilante: the course certificate (renewed by reciclagem) and the CNV. Both last two years, but they rarely expire on the same day, and the CNV can’t be reissued unless reciclagem is up to date. PF rules already require vigilantes on post to have their training and life insurance within their validity period (Portaria 18.045/2023). A vigilante whose reciclagem lapsed on Friday is not qualified for Saturday’s night shift.

Track both dates with alerts at 120, 90, 60 and 30 days, and block armed and patrimonial posts from the day either one expires until the new document is on file. Use this tracker if you are still on a spreadsheet:

Vigilante compliance tracker and alert rules

VIGILANTE COMPLIANCE TRACKER (one row per vigilante)

Vigilante | CPF | Post / client | Course on file (formação + any extensão) | Last reciclagem (atualização) date | Course certificate expires | CNV issued | CNV expires | Criminal record certificates (date) | Group life insurance active | Verified on PF consultation (date) | Next action

ALERT RULES
120 days before course expiry -> book the reciclagem at an authorized school
                                 (the PF’s service page estimates up to 60 working days
                                 for schools to register course certificates)
90 days before                -> confirm enrolment date; check criminal record
                                 certificates are current for enrolment
60 days before                -> confirm course completed; check the record in GESP
30 days before                -> escalate to manager; plan cover for this vigilante’s posts
On course or CNV expiry       -> no armed or patrimonial posts until the new course
                                 and a new CNV are on file

CHECK BEFORE EVERY NEW ASSIGNMENT
[ ] Course and CNV valid for the whole shift (not just the start)
[ ] The extensão matches the post (e.g. escolta armada, transporte de valores, segurança pessoal)
[ ] Vigilante employed by your company (no freelancers, cooperatives or agency temps)
[ ] Post is covered by your company’s PF authorization for that service

What getting it wrong can cost

For authorized providers and in-house services, the law sets three administrative penalties: a warning, a fine of R$1,000 to R$15,000, or cancellation of the operating authorization. Fines can be raised up to three times if they would be ineffective given the offender’s economic situation, or where the conduct involves discrimination. The old law’s temporary suspension no longer exists. The PF can also agree a termo de compromisso de conduta; for a security provider, the decree sets a R$15,000 payment within 30 days and correction of the failures within 30 days.

Clients are exposed too. Anyone who contracts private security in breach of the law can face the same penalties, and the PF orders unauthorized security to stop immediately. Renewal of your own authorization depends on proof that penalties have been paid, so an unpaid fine can become a renewal problem two years later. The commercial risk is often larger: an incident on a shift covered by an unqualified guard is hard to defend with clients and insurers.

How GuardDesk handles vigilante documents

GuardDesk keeps each vigilante’s course certificates, reciclagem date and CNV with their expiry dates, and checks them before a shift is assigned: a dispatcher can’t give a post to a vigilante whose course or CNV won’t be valid on that date. When a document nears expiry, the affected shifts show up as exceptions before they become a problem.

Questions owners ask

Is Lei 7.102/1983 still in force?

No. Lei 14.967/2024, the Estatuto da Segurança Privada, revoked it and took effect when it was published on September 10, 2024. Decreto 13.012 of June 9, 2026 regulates the new law, and several details are left to PF normative acts. Companies already authorized have until September 2027 to make the adjustments the law requires.

What is the CNV and how long is it valid?

The Carteira Nacional de Vigilante is the vigilante’s national identification card, issued by the Polícia Federal. It is valid for 2 years and must be carried on duty. The employer (or the union) requests it in GESP; the vigilante must have reciclagem up to date, and the PF’s service page lists a fee of R$26.94.

How often must a vigilante do reciclagem?

The law sets a minimum of 50 hours for updating courses but doesn’t state how often. The PF’s service page says course certificates are valid for 2 years, and a CNV can’t be issued unless reciclagem is up to date, so in practice it is every 2 years.

Can a porteiro or vigia do security work?

Unarmed doorkeeping and access control at a building entrance is not regulated as private security. Protecting property or people is patrimonial surveillance, which needs a PF-authorized company and registered vigilantes. Doing it without authorization is clandestine security, and doing it armed is a crime for the owners or partners.

How can a client check that a security company is authorized?

Use the PF’s free Certificado de Regularidade service on gov.br with the company’s CNPJ and razão social; the result is immediate. Ask the company for each vigilante’s CNV as well, and check its QR code.

Sources

General information for security firm owners and managers, not legal advice. Rules change: confirm with the regulator or your lawyer before relying on them. Checked October 14, 2026.

Private security rules in Brazil: an employer’s guide to the Polícia Federal, the new Statute and the CNV