Cobuccio Tecnologia: Why Companies Are Building In-House IT

Cobuccio Tecnologia surged in Google searches in Brazil, and almost everyone looking for that name wants the same answer: what does this company do, and why does a financial group from rural Minas Gerais, Brazil, maintain its own data processor instead of outsourcing everything? The question seems niche, but it represents the most expensive IT decision any Brazilian company will make in 2026.

TL;DR

• Cobuccio Processadora de Dados e Tecnologia Ltda (trade name Cobuccio Tecnologia) has Brazilian corporate tax ID (CNPJ) 29.794.118/0001-10, was founded on 02/27/2018, has share capital of R$1 million (approx. $200,000 USD), and is headquartered in Monte Belo, Brazil.
• Its primary business activity code (CNAE) is data processing, application service providers, and internet hosting — the classic signature of an in-house IT arm, not a generic software house.
• The Brazilian Central Bank made outsourcing more expensive: a R$15,000 (approx. $3,000 USD) cap on Pix and TED transactions for unauthorized institutions and those accessing the National Financial System (SFN) network via IT Service Providers (PSTI), a minimum capital of R$15 million (approx. $3 million USD) for these providers, and an accelerated authorization deadline to May 2026.
• Brazilian banks will invest R$50.4 billion (approx. $10.08 billion USD) in technology in 2026, an 8% increase (Febraban Banking Technology Survey, released on 08/25/2026).
• Bringing IT in-house is not a universal rule: the Cobuccio Tecnologia effect is achieved, for most SMEs, with a development partner and full code ownership.

What is Cobuccio Tecnologia and Why Its Name Surged in Searches

Let's start with public records, as that's what's verifiable. The corporate name is Cobuccio Processadora de Dados e Tecnologia Ltda, Brazilian corporate tax ID (CNPJ) 29.794.118/0001-10, and the registered trade name is Cobuccio Tecnologia (Tec). The company was founded on February 27, 2018, has an active registration status, is classified as a Small Business (Empresa de Pequeno Porte), and declares share capital of R$1 million (approx. $200,000 USD). Its address is Avenida Jorge Vieira, 257, in Monte Belo, southern Minas Gerais, Brazil.

The primary business activity code (CNAE) is data processing, application service providers, and internet hosting services. Secondary activities include custom computer program development, wireless telecommunications services, book publishing, and retail book sales. This combination speaks volumes. Data processing, plus hosting, plus custom software is the typical setup for a company created to serve the group's own operations, not to compete for contracts in the open market. On paper, Cobuccio Tecnologia has the profile of internal infrastructure.

The Group Connection and the Origin of Interest

Monte Belo is the same city where the Adriano Cobuccio Group maintains its base and from where Ágil operates, a digital personal loan platform managed by Cobuccio Sociedade de Crédito Direto S.A. The group publicly presents itself as a conglomerate with around 30 companies distributed across the three economic sectors, and there is also Cobuccio S/A — Credit, Financing, and Investment Society, registered as an institution authorized by the Brazilian Central Bank.

In other words: the same surname, the same city, and a data processing company founded in 2018. The relationship between the legal entities is what public records allow us to infer — there is no official statement from the group here about its internal IT architecture, and it's honest to state that.

Recent interest in the term has two practical origins. The first is recruitment: the group frequently opens recruitment processes, including administrative and operational positions in Teresina, Brazil, and Monte Belo, and candidates research the name before applying. The second is verification: Ágil itself maintains a public warning on Reclame Aqui (a Brazilian consumer complaint website) alerting that it never charges upfront fees to release loans, because criminals use the brand in scams. When a financial name becomes a target of fraud, search volume also increases.

Bringing IT In-House: The Trend Cobuccio Tecnologia Embodies

Set the specific case aside for a moment and look at the pattern Cobuccio Tecnologia illustrates. When a group with financial operations establishes a legal entity whose purpose is to process data, host applications, and write custom software, it is making a strategic choice called IT verticalization: instead of renting the technology that supports the business, it starts producing it.

The reasons are usually four, and none of them are "because it's cool to have a dev team":

• Roadmap Control. Those who depend on a vendor get in the vendor's queue. A change in a payment calculation rule that would take three internal sprints could take six months under a third-party contract.
• Marginal Cost. Per-transaction licenses scale with revenue. The payroll for a team scales with the team. Beyond a certain volume, the second curve becomes cheaper than the first.
• Data Ownership. Credit engines, scores, behavior history, and customer bases are the real assets of a financial operation. Leaving this within a third-party system is handing over the most valuable part of the company.
• Regulatory Compliance. This is the new reason, and it's what changed everything in 2025 and 2026.

The Brazilian Central Bank Made Technology Outsourcing More Expensive

Here's the context that transforms "bringing IT in-house" from a preference into a risk calculation. On September 5, 2025, after a series of cyberattacks on financial institutions, the Brazilian Central Bank announced a cap of R$15,000 (approx. $3,000 USD) per Pix and TED transaction for unauthorized payment institutions and also for those connecting to the National Financial System Network (SFN) via IT Service Providers (PSTI). Approximately 79 institutions were immediately impacted.

The package went beyond the cap. IT Service Providers (PSTI) became subject to a minimum capital requirement of R$15 million (approx. $3 million USD), in addition to new governance and risk management criteria, with a four-month deadline for compliance and the risk of de-authorization in case of non-compliance. And the final deadline for unauthorized payment institutions to request authorization was moved up from December 2029 to May 2026.

Translating into business terms: the regulator looked at the financial system's technology supply chain and concluded it was the weakest link. From then on, outsourcing the connection layer began to have an explicit cost: literally a R$15,000 (approx. $3,000 USD) limit per operation. A structure like Cobuccio Tecnologia ceases to be a luxury and becomes a compliance variable.

Why the Regulator Reached This Conclusion

The incidents justify the rigor. In August 2025, Sinqia reported that approximately R$710 million (approx. $142 million USD) in unauthorized B2B transactions passed through its Pix environment, with approximately R$669 million (approx. $133.8 million USD) from HSBC and R$41 million (approx. $8.2 million USD) from SCD Artta; the Brazilian Central Bank managed to block about R$589 million (approx. $117.8 million USD), roughly 83% of the total. Preliminary forensics pointed to the use of legitimate IT vendor credentials from the company itself.

It was not an isolated case. In January 2026, Banco do Nordeste (Bank of the Northeast) suspended Pix after an incident involving a technology service provider, in an episode linked to the exposure of JD Consultores' digital certificates. In March 2026, BTG Pactual resumed Pix after preventively suspending the service due to an attack that diverted about R$100 million (approx. $20 million USD).

The pattern repeats: the attacker doesn't break into the bank; they enter through the vendor. It's exactly the same mechanism we described in the case of NPM packages infected by Shai-Hulud and the compromise of GitHub by a malicious VS Code extension. The software supply chain is currently the most profitable attack vector.

The Numbers Explaining the Race for In-House Technology

The Febraban Banking Technology Survey, conducted by Deloitte and released on August 25, 2026, in its 34th edition, shows the scale of the movement. And PwC Brazil's 2026 Digital Credit Fintechs Survey shows the same behavior at the lower end of the market.

Indicator	Value	Source
Bank investment in technology in 2026	R$50.4 billion (approx. $10.08 billion USD) (+8% over R$46.8 billion in 2025)	Febraban/Deloitte
Growth in IT budget over 5 years	+58%	Febraban/Deloitte
Investment in AI, Analytics, and Big Data	R$3 billion (approx. $600 million USD) in 2026 (+8%)	Febraban/Deloitte
Investment in cloud migration	R$3.9 billion (approx. $780 million USD) (+30%)	Febraban/Deloitte
Banks treating GenAI as a high priority	68%	Febraban/Deloitte
Banks with low maturity in GenAI	72%	Febraban/Deloitte
Credit granted by fintechs in 2025	R$53.8 billion (approx. $10.76 billion USD) (+51%)	PwC Brazil
Fintechs already effectively using AI	62%	PwC Brazil
Fintechs planning to implement or expand AI in 2 years	96%	PwC Brazil
Fintechs planning new investments in cybersecurity	23%	PwC Brazil

Notice the most revealing contradiction in the table: 68% of banks prioritize generative AI, but 72% admit low maturity in the topic. Priority without maturity is precisely the scenario where companies buy expensive platforms and can't operate them. It's also the scenario where deciding alone "we're going to create our own technology company" often goes wrong. Copying Cobuccio Tecnologia's model without having the volume and the problem that justifies it is expensive.

Build or Buy: How to Decide Without Copying the Cobuccio Tecnologia Model

The most common mistake is to read a case like Cobuccio Tecnologia's and conclude that every company should open its own software house. They shouldn't. The decision has objective criteria.

When Building Makes Sense

Build when the system is the product or defines the margin. Credit engines, dynamic pricing, logistics routing, collections workflows, matching algorithms. If the competitive differentiator lies in the code, outsourcing the code is outsourcing your competitive edge. Add to that volume: when the per-transaction license already costs more than two developers per month, the math has flipped.

The second criterion is regulatory. If your sector requires traceability, log retention, environment segregation, or access auditing — healthcare, education, finance, legal — having direct control over the infrastructure reduces compliance risk instead of increasing it.

When Buying is the Right Decision

Buy everything that is a commodity. Fiscal ERP, payroll, corporate email, antivirus, payment gateway, invoice issuer. Rewriting these systems is burning budget to achieve a worse result than what's available on the market, with the added burden of becoming responsible for maintaining legal updates forever.

Also buy when the requirements haven't stabilized. It makes no sense to build custom a process that will change three times in the next six months. Use an off-the-shelf tool, let the process mature, and only then evaluate bringing it in-house.

The Hybrid Model, Which Most Companies Should Adopt

In practice, almost no one builds everything. The working model is: buy the foundation, build the differentiation layer, and keep integrations under your own control. The critical point is integration — that's where the business truly lives, and that's where you cannot depend on third-party schedules. Maintaining APIs, webhooks, and synchronization routines in code you control provides 80% of the benefits of verticalization at a fraction of the cost.

The Pitfalls of Building an In-House IT Arm

Before signing the articles of incorporation for your own 'Cobuccio Tecnologia,' consider what usually goes wrong. I've seen each of these items happen in real operations during my fifteen-plus years delivering projects in Brazil and abroad.

1. The real cost isn't just salary. Add benefits, bonuses, vacation, on-call duty, licenses, staging environments, backup, monitoring, and the management time of whoever coordinates the team. The multiplier usually ranges between 1.8 and 2.2 times the nominal payroll.
2. Bus factor of one. A critical system written by one person who documented nothing is a ticking time bomb. Demand documentation and peer review from the first commit, not after the first scare.
3. Roadmap hijacked by operations. Without a clear separation between support and evolution, the internal team spends 100% of its time putting out fires, and nothing new is delivered.
4. Your own team becomes a supply chain. Every installed dependency, every editor extension, every package from a public registry is an attack surface — that's how the incidents mentioned above began.
5. Silent obsolescence. In-house software without an update plan becomes legacy in three years. Someone needs to own the lifecycle, or you'll trade vendor dependence for dependence on code no one understands anymore.

The SME Path: Achieving the Cobuccio Tecnologia Effect Without a New Legal Entity

The good news is that the benefits of verticalization don't require a separate legal entity, an IT payroll, and a server room. They require three things: code ownership, infrastructure control, and a team that understands your business.

This is the arrangement we've built at Agathas Web since 2008. In practice, it works like this:

• Custom Code and Client Ownership. No rented platform where the client loses the system if they stop paying. The repository belongs to the client, the documentation belongs to the client, and the decision to switch partners remains with the client.
• Infrastructure Under Control. Linux servers, Redis cache, cloud environments with versioned deployment and rollback. If you prefer to keep everything on your own machines or migrate to a managed cloud, the choice remains open — as we discussed in the Azure Linux case, the distribution and hosting model have become an architecture decision, not a matter of preference.
• Integrations via Official Channels. Customer service and billing via the official WhatsApp API, with a verified account, instead of a hack prone to blocking. This is very valuable for credit operations, collections, and after-sales.
• AI Automation Where There's Measurable Return. Service triage, document classification, call summarization. The point is to apply AI agents to concrete processes, not to buy AI licenses just to avoid being left out.
• Internal Training with Moodle. Groups that hire in volume — as the open positions in Teresina and Monte Belo show — need to train quickly and standardize procedures. A well-configured Moodle environment solves this better than a PDF handout.

Checklist: 7 Questions Before Creating Your Own Technology Company

1. Which part of your system is a competitive differentiator and which is a commodity? If you can't separate them, it's not time yet.
2. How much do you currently pay in per-transaction licenses, and how does that number scale if revenue doubles?
3. If your main vendor suffers an incident tomorrow, how many days will your operation be down?
4. Do you have someone internally capable of reviewing technical decisions, or will you rely on the judgment of those you're hiring?
5. Are there regulatory requirements in your sector that depend on direct control of data, logs, or environments?
6. What is your documentation and continuity plan if a key person leaves in six months?
7. Do you need a new legal entity (CNPJ) or do you need code ownership and a stable partner? In most cases, it's the latter — the Cobuccio Tecnologia effect without the corporate structure.

Conclusion: What to Take from Cobuccio Tecnologia for Your Business

What makes Cobuccio Tecnologia an interesting case isn't its size — it's a Small Business (EPP) with R$1 million (approx. $200,000 USD) in share capital in a city in Minas Gerais, Brazil. It's the timing and interpretation. A data processing company founded in 2018, within the perimeter of a group with regulated financial operations, is today exactly on the right side of a regulation that made relying on third parties more expensive for managing the critical technology layer.

The lesson Cobuccio Tecnologia leaves is not "start your own IT company." The lesson is: identify which piece of your technology you cannot afford to outsource, and bring only that piece in-house — with proprietary code, controlled infrastructure, and someone responsible for maintenance. For the rest, buy off-the-shelf and rest easy.

If you're at this crossroads and want a second opinion on what makes sense to bring in-house for your operation, talk to us. A thirty-minute conversation often saves six months of wrong decisions.