Cobuccio Tecnologia: The UK Business Case for In-House IT

Cobuccio Tecnologia has been trending on Google searches in Brazil, and almost everyone who comes across the name wants the same answer: what does this company do, and why does a financial group from the interior of Minas Gerais maintain its own data processor instead of outsourcing everything? The question might seem niche, but it represents the most expensive IT decision any Brazilian company will make in 2026.

TL;DR

• Cobuccio Processadora de Dados e Tecnologia Ltda (trading name Cobuccio Tecnologia) has Brazilian company registration number (CNPJ) 29.794.118/0001-10, was established on 27 February 2018, has a share capital of £1 million, and is based in Monte Belo (MG), Brazil.
• The primary CNAE (Brazilian business activity code) is data processing, application providers, and internet hosting – the classic signature of an internal IT arm, not a generic software house.
• The Brazilian Central Bank made outsourcing more expensive: a £15,000 cap on Pix and TED (Brazilian instant payment and electronic transfer systems) transactions for unauthorised institutions and those accessing the Brazilian National Financial System (SFN) network via IT Service Providers (PSTI), a minimum capital of £15 million for these providers, and an accelerated authorisation deadline to May 2026.
• Brazilian banks are set to invest £50.4 billion in technology in 2026, an 8% increase (FEBRABAN Banking Technology Survey, published on 25 August 2026).
• Bringing IT in-house is not a universal rule: the Cobuccio Tecnologia effect is achieved, for most SMEs, with a development partner and full ownership of the code.

What is Cobuccio Tecnologia and why has the name risen in searches?

Let's start with the public records, as that's what's verifiable. The corporate name is Cobuccio Processadora de Dados e Tecnologia Ltda, Brazilian company registration number (CNPJ) 29.794.118/0001-10, and the registered trading name is Cobuccio Tecnologia (Tec). The company was established on 27 February 2018, has an active registration status, is classified as a Small Business Enterprise (EPP), and declares a share capital of £1 million. Its address is Avenida Jorge Vieira, 257, in Monte Belo, in the south of Minas Gerais, Brazil.

The primary CNAE (Brazilian business activity code) covers data processing, application service providers, and internet hosting services. Secondary activities include custom computer program development, wireless telecommunications services, book publishing, and retail book sales. This combination speaks volumes. Data processing, plus hosting, plus custom software is the typical profile of a company created to serve the operations of its own group, not to compete for contracts in the open market. Cobuccio Tecnologia has, on paper, the profile of internal infrastructure.

The connection to the group and the origin of the interest

Monte Belo is the same city where the Adriano Cobuccio Group is based and from where Ágil operates, a digital personal loan platform managed by Cobuccio Sociedade de Crédito Direto S.A. The group publicly presents itself as a conglomerate with around 30 companies distributed across the three economic sectors, and there is also Cobuccio S/A — Sociedade de Crédito, Financiamento e Investimentos, registered as an institution authorised by the Brazilian Central Bank.

In other words: the same surname, the same city, and a data processing company established in 2018. The relationship between the legal entities is what public records allow us to infer — there is no official statement from the group here regarding its internal IT architecture, and it's important to state that honestly.

The recent interest in the term has two practical origins. The first is recruitment: the group frequently opens selection processes, including administrative and operational vacancies in Teresina (PI) and Monte Belo, and candidates research the name before applying. The second is verification: Ágil itself maintains a public warning on Reclame Aqui (a Brazilian consumer complaint website) stating that it never charges an upfront fee to release a loan, because criminals use the brand in scams. When a financial name becomes a target for fraud, search volume rises accordingly.

Bringing IT in-house is the movement Cobuccio Tecnologia represents

Set aside the specific case for a moment and look at the pattern Cobuccio Tecnologia illustrates. When a group with financial operations establishes a legal entity whose purpose is to process data, host applications, and write custom software, it is making a strategic choice called IT verticalisation: instead of renting the technology that supports the business, it starts to produce it.

The reasons are usually four, and none of them is "because it's cool to have a dev team":

• Roadmap Control. Those who depend on a supplier join the supplier's queue. A change in a parcel calculation rule that would take three internal sprints could take six months under a third-party contract.
• Marginal Cost. Per-transaction licences scale with revenue. A team's payroll scales with the team. Beyond a certain volume, the second curve becomes cheaper than the first.
• Data Ownership. Credit engine, score, behaviour history, and customer base are the real assets of a financial operation. Leaving this within a third-party system is handing over the most valuable part of the company.
• Regulatory Compliance. This is the new reason, and it's what changed everything in 2025 and 2026.

The Brazilian Central Bank made technology outsourcing more expensive

Here is the context that transforms "bringing IT in-house" from a preference into a risk calculation. On 5 September 2025, after a series of cyber-attacks on financial institutions, the Brazilian Central Bank announced a cap of £15,000 per Pix and TED (Brazilian instant payment and electronic transfer systems) transaction for unauthorised payment institutions and also for those connecting to the Brazilian National Financial System (SFN) network via IT Service Providers (PSTI). Approximately 79 institutions were immediately affected.

The package went beyond the cap. PSTIs now face a minimum capital requirement of £15 million, in addition to new governance and risk management criteria, with a four-month deadline for compliance and the risk of de-registration in case of non-compliance. And the final deadline for unauthorised payment institutions to apply for authorisation was brought forward from December 2029 to May 2026.

Translated into business language: the regulator looked at the technology supplier chain of the financial system and concluded that it was the weak link. From then on, outsourcing the connection layer incurred an explicit cost: literally a £15,000 limit per operation. A structure like Cobuccio Tecnologia ceases to be a luxury and becomes a compliance variable.

Why the regulator reached this conclusion

The incidents justify the strictness. In August 2025, Sinqia reported that approximately £710 million in unauthorised B2B transactions passed through its Pix environment, with about £669 million from HSBC and £41 million from SCD Artta; the Brazilian Central Bank managed to block around £589 million, roughly 83% of the total. Preliminary forensics pointed to the use of legitimate credentials from the company's own IT suppliers.

This was not an isolated case. In January 2026, Banco do Nordeste suspended Pix after an incident involving a technology service provider, in an episode linked to the exposure of digital certificates from JD Consultores. In March 2026, BTG Pactual resumed Pix after preventively suspending the service due to an attack that diverted around £100 million.

The pattern repeats: the intruder doesn't break into the bank; they enter through the supplier. This is exactly the same mechanism we described in the case of the Shai-Hulud infected NPM packages and the GitHub compromise via a malicious VS Code extension. The software supply chain is currently the most profitable attack vector.

The numbers that explain the race for in-house technology

The FEBRABAN Banking Technology Survey, conducted by Deloitte and published on 25 August 2026 in its 34th edition, shows the scale of the movement. And PwC Brazil's 2026 Digital Credit Fintechs Survey shows the same behaviour at the lower end of the market.

Indicator	Value	Source
Banks' investment in technology in 2026	£50.4 billion (+8% over £46.8 billion in 2025)	Febraban/Deloitte
Growth in IT budget over 5 years	+58%	Febraban/Deloitte
Investment in AI, Analytics, and Big Data	£3 billion in 2026 (+8%)	Febraban/Deloitte
Investment in cloud migration	£3.9 billion (+30%)	Febraban/Deloitte
Banks treating GenAI as a high priority	68%	Febraban/Deloitte
Banks with low maturity in GenAI	72%	Febraban/Deloitte
Credit granted by fintechs in 2025	£53.8 billion (+51%)	PwC Brasil
Fintechs already effectively using AI	62%	PwC Brasil
Fintechs planning to implement or expand AI in 2 years	96%	PwC Brasil
Fintechs planning new investments in cybersecurity	23%	PwC Brasil

Notice the most revealing contradiction in the table: 68% of banks place generative AI as a high priority, but 72% admit low maturity in the topic. Priority without maturity is exactly the scenario where companies buy expensive platforms and cannot operate them. It's also the scenario where deciding alone "we're going to create our own technology company" often goes wrong. Copying the model of Cobuccio Tecnologia without having the volume and the problem that justifies it is expensive.

Build or buy: how to decide without copying the Cobuccio Tecnologia model

The most common mistake is to read a case like Cobuccio Tecnologia's and conclude that every company should open its own software house. It shouldn't. The decision has objective criteria.

When building makes sense

Build when the system is the product or defines the margin. Credit engine, dynamic pricing, logistics routing, collection rules, matching algorithm. If the competitive differentiator lies in the code, outsourcing the code is outsourcing the differentiator. Add to that volume: when the per-transaction licence already costs more than two developers per month, the maths has flipped.

The second criterion is regulatory. If your sector requires traceability, log retention, environment segregation, or access auditing — healthcare, education, finance, legal sectors — having direct control over the infrastructure reduces compliance risk instead of increasing it.

When buying is the right decision

Buy everything that is a commodity. Fiscal ERP, payroll, corporate email, antivirus, payment gateway, invoice issuer. Rewriting these systems is burning budget to achieve a worse result than what's available on the market, with the added burden of becoming responsible for maintaining legal updates forever.

Also buy when the requirement has not yet stabilised. It makes no sense to custom-build a process that will change three times in the next six months. Use a ready-made tool, let the process mature, and only then evaluate bringing it in-house.

The hybrid model, which most should adopt

In practice, almost no one builds everything. The design that works is: buy the base, build the differentiation layer, and keep integrations under your own control. The critical point is integration — that's where the business truly lives, and that's where you cannot depend on third-party schedules. Maintaining APIs, webhooks, and synchronisation routines in code you control provides 80% of the benefits of verticalisation at a fraction of the cost.

The pitfalls of setting up an IT arm

Before signing the articles of association for your own Cobuccio Tecnologia, consider what usually goes wrong. I've seen each of these items happen in real operations during my fifteen-odd years delivering projects in Brazil and abroad.

1. The real cost is not just the salary. Add payroll taxes, holiday pay, on-call shifts, software licences, staging environment, backup, monitoring, and the management time of whoever coordinates the team. The multiplier typically ranges between 1.8 and 2.2 times the nominal payroll.
2. Bus factor of one. A critical system written by one person who documented nothing is a ticking time bomb. Demand documentation and peer review from the first commit, not after the first scare.
3. Roadmap hijacked by operations. Without a clear separation between maintenance and evolution, the internal team spends 100% of its time firefighting, and nothing new is delivered.
4. Your own team becomes a supply chain. Every installed dependency, every editor extension, every package from the public registry is an attack surface — that's how the incidents mentioned above began.
5. Silent obsolescence. Internal software without an update plan becomes legacy in three years. Someone needs to own the lifecycle, or you swap supplier dependence for dependence on code that no one understands anymore.

The SME path: the Cobuccio Tecnologia effect without opening a new company registration number

The good news is that the benefits of verticalisation do not require a separate legal entity, an IT payroll, and a server room. They require three things: code ownership, infrastructure control, and a team that understands your business.

This is the arrangement we've built at Agathas Web since 2008. In practice, it works like this:

• Custom code and client ownership. No rented platform where the client loses the system if they stop paying. The repository belongs to the client, the documentation belongs to the client, the decision to switch partners remains with the client.
• Controlled infrastructure. Linux servers, Redis cache, cloud environments with versioned deployment and rollback. If you prefer to keep everything on your own machines or migrate to managed cloud, the choice remains open — as we discussed in the Azure Linux case, the distribution and hosting model have become an architectural decision, not a matter of preference.
• Integrations via official channels. Customer service and billing via the official WhatsApp API, with a verified account, instead of a makeshift solution prone to blocking. This is very valuable for credit operations, collections, and after-sales.
• Automation with AI where there is measurable return. Service triage, document classification, call summarisation. The point is to apply AI agents in concrete processes, not to buy an AI licence just to avoid being left out.
• Internal training with Moodle. Groups that hire in volume — as the open vacancies in Teresina and Monte Belo show — need to train quickly and standardise procedures. A well-configured Moodle environment solves this better than a PDF manual.

Checklist: 7 questions before creating your own technology company

1. Which part of your system is a competitive differentiator and which is a commodity? If you can't separate them, it's not time yet.
2. How much do you currently pay in per-transaction licences and how does that number scale if revenue doubles?
3. If your main supplier suffers an incident tomorrow, how many days will operations halt?
4. Do you have someone internally capable of reviewing technical decisions, or will you depend on the judgment of those you are hiring?
5. Is there a regulatory requirement in your sector that depends on direct control of data, logs, or environments?
6. What is your documentation and continuity plan if the key person leaves in six months?
7. Do you need a new company registration number, or do you need code ownership and a stable partner? In most cases, it's the second option — the Cobuccio Tecnologia effect without the corporate structure.

Conclusion: key takeaways from Cobuccio Tecnologia for your business

What makes Cobuccio Tecnologia an interesting case is not its size — it's an EPP with £1 million in share capital in a city in Minas Gerais, Brazil. It's the timing and the interpretation. A data processing company established in 2018, within the perimeter of a group with regulated financial operations, is now precisely on the right side of a regulation that made relying on third parties more expensive for critical technology layers.

The lesson Cobuccio Tecnologia leaves is not "start your own IT company." The lesson is: identify which piece of your technology you cannot afford to outsource, and bring only that piece in-house — with your own code, controlled infrastructure, and someone responsible for maintenance. For the rest, buy ready-made and rest easy.

If you're at this crossroads and want a second opinion on what makes sense to bring in-house for your operation, get in touch. A thirty-minute conversation often saves six months of wrong decisions.