September 08, 2026 · Erick Mathias + Silvana Santos
AEO certification in Brazil: evidence and control readiness
Brazilian AEO certification is formal recognition by the Federal Revenue Service of Brazil that an international supply-chain stakeholder meets the criteria, requirements and rules of the Authorized Economic Operator Programme. Participation is voluntary, but the controls must work continuously rather than exist only for the application.
Preparation should answer three questions: which criteria apply, how each control reduces a real risk, and which evidence demonstrates that the control works. The same logic supports both initial certification and ongoing monitoring.
What are the Brazilian AEO certification routes?
| Route | Focus | Eligible applicants |
|---|---|---|
| OEA-Security (OEA-S) | International supply-chain security | Eligible stakeholders defined by programme regulations |
| OEA-Compliance (OEA-C) | Customs compliance and management of noncompliance risk | Importers and exporters |
OEA-C includes Essential, Qualified and Reference levels. The Essential level has a specific audience and requirements, so eligibility should be checked against current official rules before the project is designed.
AEO and ISO 9001 are not equivalent. A management system may support documents, competence, audits, risks and actions, but the Brazilian AEO assessment follows its own customs criteria.
Which criteria must be demonstrated?
The Federal Revenue Service groups criteria into three classes.
General criteria
Depending on the route and level, these cover admissibility, compliance history, financial viability, commercial record management, information security, human-resources security, cooperation and communication.
Security criteria
For OEA-S, these include security leadership, risk assessment and improvement; cargo and transport security; physical security; education and awareness; business-partner management; and crisis and incident recovery.
Customs compliance criteria
Depending on the OEA-C level, these include goods description and tariff classification, origin, foreign-exchange aspects, tax base, exemptions and suspensions, indirect operations, professional competence and customs risk management.
A document list alone does not prove these criteria. The assessment must demonstrate that the process is implemented, understood and producing verifiable results.
How to prepare for AEO certification in six steps
1. Define the route and scope
Confirm the company’s supply-chain role, covered operations, sites, partners and eligible routes. Without this boundary, projects tend to create generic controls or evidence that does not address applicable requirements.
2. Perform a fact-based self-assessment
Compare every requirement with current practice and classify it as met, partly met, not met or not applicable. Identify the evidence supporting each conclusion.
Do not mark a requirement as met solely because a procedure exists. Sample a recent operation, interview people, review records and confirm how the control performed during an exception.
3. Prioritize risks and gaps
Link each gap to the risk it is intended to control: customs error, unauthorized access, cargo tampering, unavailable records, vulnerable partner or communication failure.
Assign an owner, deadline, action, expected evidence and effectiveness check. Our quality risk management guide provides a practical framework.
4. Build an evidence matrix
| Field | Question it answers |
|---|---|
| Criterion and requirement | What must be demonstrated? |
| Process and owner | Where does the control operate and who owns it? |
| Related risk | Which event does the control prevent, detect or reduce? |
| Governing document | Which current rule defines execution? |
| Record or evidence | What proves actual application? |
| Location and access | Where is the source and who can review it? |
| Date and version | Does it represent the correct period? |
| Gap and action | What still needs to be addressed? |
This link among requirement, control and outcome makes self-assessment auditable and easier to update.
5. Submit the application
The Federal Revenue Service states that applications are filed through the AEO System in Brazil’s Single Foreign Trade Portal. The process includes applicant actions such as self-assessment, application and designation of a contact point, followed by analysis from the responsible AEO team.
Before submission, check that answers, attachments and observed practice are consistent. Contradictory documents and context-free records create rework during validation.
6. Design maintenance from day one
Do not design controls only for initial approval. Establish how changes, incidents, indicators, reviews, training and actions will be monitored after certification.
What evidence can support the AEO matrix?
| Area | Examples of evidence |
|---|---|
| Record management | change trail, retention, access, integrity and recovery of commercial records |
| Information security | policy, access profiles, user review, incidents, backups and tests |
| Human resources | role criteria, hiring, termination, access and awareness records |
| Physical and cargo security | inspections, access control, seals, incidents and control tests |
| Business partners | selection criteria, risk assessment, contracts, monitoring and deviations |
| Customs compliance | tariff, origin, tax and transaction reviews plus verification records |
| Competence | competence matrix, training, assessment and professional updates |
| Customs risks | identification, analysis, controls, treatment, residual risk and monitoring |
| Improvement | audits, incidents, causes, corrective actions and effectiveness checks |
Evidence must be relevant, verifiable and linked to the reviewed period. Our guide to objective evidence in ISO 9001 uses a different framework but explains useful traceability principles.
What happens after certification?
The Federal Revenue Service defines monitoring as permanent follow-up of programme criteria, requirements and rules. Revalidation follows the official process and may be brought forward according to monitoring results.
The company should therefore control:
- corporate, operational, site, system and owner changes;
- changes in routes, products, volumes and critical partners;
- security incidents and customs nonconformities;
- updates to risks and controls;
- effectiveness of training and corrective actions;
- indicators and audit results;
- communications and requests from the AEO team.
The AEO contact point needs authority, access to information and a monitoring routine. If maintenance depends on one person remembering dates, evidence will become fragile over time.
Common preparation mistakes
- copying another company’s procedures without adapting them;
- producing documents only to answer the questionnaire;
- storing evidence without requirement, date and owner links;
- assessing business partners once without continued monitoring;
- recording incidents without cause analysis or effectiveness checks;
- keeping parallel spreadsheets with different versions;
- treating certification as finished after approval.
Good preparation does not attempt to present a perfect company. It demonstrates that risks are understood, controls are applied and failures produce traceable responses.
How a management system supports the AEO programme
Konvéz Quality connects documents, risks, suppliers, audits, incidents, nonconformities and action plans. In an AEO context, this preserves the relationship among criterion, owner, evidence and result.
A partner assessment can be linked to a supply-chain risk, followed by an incident, action, deadline and effectiveness check in one history. This does not replace the official AEO System or the authority’s analysis; it organizes the operation supporting the submitted answers.
For the broader architecture, read QMS for carriers, freight forwarders and foreign trade.
Official sources
- Federal Revenue Service of Brazil — AEO certification
- Federal Revenue Service — How to become an AEO
- Federal Revenue Service — Certification steps
- Federal Revenue Service — Monitoring and revalidation
- World Customs Organization — SAFE and AEO
Updated on 8 September 2026. Consult current official rules and materials before selecting a route or submitting an application.
Frequently asked questions
What is AEO certification in Brazil?
It is formal recognition by Brazil's Federal Revenue Service that an international supply-chain stakeholder meets the criteria, requirements and rules of the Brazilian Authorized Economic Operator Programme.
What is the difference between OEA-S and OEA-C?
OEA-S evaluates supply-chain security controls. OEA-C evaluates customs compliance controls and is intended for importers and exporters, subject to the applicable levels and requirements.
Is AEO certification mandatory in Brazil?
No. Participation is voluntary, and not joining the programme does not prevent a company from conducting regular foreign trade operations.
What evidence is required for AEO certification?
Evidence depends on the route, business role and applicable criteria. It may include procedures, commercial records, risk assessments, training, access controls, partner reviews, customs checks, incidents and corrective actions.
Does the work end when certification is granted?
No. Brazil's Federal Revenue Service continuously monitors certified operators and may revalidate certification. Controls must remain effective, relevant changes must be communicated and continuing compliance must be demonstrated.