Back to home

Fintech · Product Owner · Regulatory compliance

Alphanumeric CNPJ: compliance in a single release

3 platforms. 1 release window. R$22M in transactions protected.

Company and Product

I worked at Dimensa as Product Owner of a 9-person squad (UX, QA, iOS, Android and backend), responsible for mobile apps (iOS and Android), internet banking and control panels for financial institutions, integrated with a BaaS partner (instant payments, wire transfers and boleto).

iOS and Android appsInternet bankingControl panel

Context

In January, Brazil's tax authority announced that starting July 2026, business tax IDs (CNPJs) would include letters, not just numbers. For the platforms of financial institutions that processed R$22M in transactions (instant payments + wire transfers) between January and August, this was a direct risk — alphanumeric IDs would be rejected by existing validations, locking up the operation.

The Challenge

3
platforms: Web, iOS and Android
20+
endpoints in the control panel alone
R$22M
in transactions, instant + wire (Jan–Aug)
1
release window, no rollback
~6 months
between the announcement and the deadline

External dependencies: our banking-as-a-service provider, the tax authority and the central bank. Any misreading of the requirements would become a production bug, with no room to roll back.

My Role

I prioritized the control panel over the apps to reuse the endpoint structure across the other clients and reduce engineering rework — and also because that's where most of the complexity lived (20+ endpoints). I mapped the provider, tax authority and central bank documentation before opening a single ticket. I ran backend and frontend refinement in parallel, and brought QA in early to design test scenarios before development started.

Approach

Investigation→Prioritization→Refinement→Development→QA→Release

Documentation mapped → control panel set as the starting point → backend and frontend refining in parallel → QA scenarios ready before the code → single release, no rollback.

Decisions

1

Start with the control panel, not the apps.

WhyReusing the endpoint structure across the other clients reduced engineering rework; on top of that, that's where the most complexity sat (20+ endpoints), and validating it first reduced risk on mobile.

ImpactLess engineering rework, and mobile behavior that was easier to estimate and test.

2

Map all external documentation before refinement.

WhyThree separate regulatory sources, outside the team's direct control; a misread becomes a wrong requirement.

ImpactRefinement started from verified requirements, not assumptions.

3

QA designing scenarios before development.

WhyA single release with no rollback; anything not mapped in advance would only surface in production.

Impact100% compliance, with no impact on operations.

Results

0
operational blockers
100%
regulatory compliance
R$22M
in transactions protected

Key Takeaway

Bringing the right people in to design scenarios before development made it possible to map out blockers that would otherwise only surface later: bill remittance requirements, cross-platform dependencies, and behavior in online banking and in the apps.

Aligning teams before building stopped being a one-off practice and became the mindset I carry into every new project.