Brazil has finally opened its doors to regulated online gambling, but the message to licensed operators is unmistakable: this is a market built on a foundation of uncompromising integrity and security. The newly legalized iGaming sector is not merely about launching platforms; it’s about adhering to some of the world’s most rigorous compliance standards, with the Secretariat of Prizes and Bets (SPA)—a department of the Ministry of Finance—leading the charge.

Compliance in Brazil is not a simple checklist; it is a fundamental shift toward a culture that permeates every layer of an operator’s organization.

The Tri-Fold Foundation: AML, CTF, and PLD/FTP

The Brazilian regulatory framework, rooted in Law No. 14,790/2023 (the “Betting Law”), puts a relentless focus on preventing financial crime. Operators must establish robust policies and internal controls for three critical areas:

  • Anti-Money Laundering (AML): Preventing funds derived from illegal activity from entering the financial system.
  • Counter-Terrorism Financing (CTF): Blocking the use of platforms to fund terrorist activities.
  • Prevention of the Proliferation of Weapons of Mass Destruction (PLD/FTP): A specialized focus mandated by international financial standards.

Key AML/CTF Obligations

Under SPA/MF Ordinance No 1,143/2024, operators are given sector-specific procedures to implement national financial crime laws:

  • COAF Registration: Operators must register with the Council for Financial Activities Control (COAF), Brazil’s central AML authority.
  • Annual Risk Assessment: A mandatory yearly internal assessment must be conducted to identify risks related to AML and FTP.
  • Designated Compliance Officer: A specific director-level person must be designated as responsible for Integrity and Compliance—a requirement that underscores the seriousness of the mandate.
  • Record Keeping: All records and documents related to these activities must be maintained for a minimum of five years.
  • Suspicious Activity Reporting: Operators are required to develop internal procedures to detect and communicate any suspicious activity directly to COAF via the Siscoaf system.

Player Verification at the Core: KYC Standards

Brazil’s regulations set a high standard for security and player protection through demanding Know Your Customer (KYC) and Customer Due Diligence (CDD) processes.

Mandatory Identification and Screening

The integrity of the system starts at registration. Bettors must verify their identity using their Individual Taxpayer Registration (CPF) number and facial recognition technology upon signup.

  • Prohibited Methods: To ensure transaction transparency, the use of credit cards, cash, and cryptocurrencies for payments is strictly prohibited. All electronic payments must flow through institutions authorized by the Central Bank of Brazil.
  • Politically Exposed Persons (PEPs): Operators must actively screen every bettor to verify if they are a PEP or a close associate, following strict COAF guidelines.
  • Risk Classification: Beyond simple verification, operators are mandated to classify all bettors into risk categories defined in their internal risk assessment, applying due diligence measures proportional to the risk identified.

Technical Compliance: Local Data and System Integrity

The regulatory focus extends deep into the technical architecture, mandating robust system integrity, data protection, and operational security to ensure a fair and accountable betting ecosystem.

Data Center and System Certification

To secure the integrity of the data and operations, the SPA enforces strict rules on infrastructure:

  • Local Hosting: Betting systems and related data must be maintained in data centers located within Brazil. While some remote hosting is possible under specific international agreements, the preference is overwhelmingly local.
  • ISO 27001 Certification: Data centers hosting betting systems are required to hold ISO 27001 certification—a global standard for information security management.
  • Certified Platforms: The betting system itself—both the sports betting and online gaming platforms—must be certified by an SPA-recognized entity (such as Gaming Laboratories International or eCOGRA). These certifications must be revalidated annually.

Security and Network Requirements

To prevent malicious activity and ensure system reliability, operators must adhere to rigorous technical standards:

  • Domain Security: Fixed-odds betting sites must exclusively use the “.bet.br” domain and are required to implement DNSSEC (Domain Name System Security Extensions).
  • Defense Systems: All critical communication must be encrypted, and systems must be protected by an Intrusion Detection/Prevention System (IDS/IPS) and at least one approved application-level firewall to counter threats like DDoS attacks.
  • Disaster Recovery: Operators must adopt a business continuity policy and a disaster recovery plan, supported by an uninterruptible power supply, to guarantee data integrity and system availability.

Ensuring Game Fairness

For online casino games and live studios, fairness is ensured through technical and physical controls:

  • Online game results must be determined by a certified Random Number Generator (RNG).
  • Live game studios require physical security controls and continuous surveillance and recording systems, with footage maintained for a minimum of 90 days.

Shared Regulatory Authority

Compliance is a multi-agency affair in Brazil. While the SPA serves as the primary federal regulator, several other key government and self-regulatory bodies share oversight, including:

  • COAF: The central authority for AML/CTF monitoring.
  • Central Bank of Brazil (BCB): Disciplines payment arrangements and supervises financial institutions.
  • ANPD: The National Data Protection Authority, which oversees compliance with the General Data Protection Law (LGPD), dictating how all user data must be handled.
  • CONAR: The National Advertising Self-Regulation Council, which enforces strict ethical guidelines, particularly for influencer and marketing activities targeting vulnerable persons.

Successfully operating in Brazil requires meticulous adherence to this comprehensive framework, establishing systems and personnel dedicated to ensuring integrity from the player’s CPF registration to the security of the locally hosted data center.

Interested in affiliate marketing within the CIS region?
Learn more on Afftimes.com.