The Technical Compliance Guide for Betting Platforms in the Brazilian Market

The Brazilian sports betting market is no longer a promise; it is a regulated reality. In less than two years, the country rose to the position of fifth-largest betting market in the world, with estimated revenue of US$ 4.1 billion (approximately R$ 22 billion) according to consultancy Regulus Partners. The Federal Revenue Service collected R$ 5.89 billion from the taxation of sports betting and online gaming in just the first five months of 2026, an 85.9% increase compared to the same period the previous year.

The numbers are impressive, but the landscape is not solely one of opportunity. The Secretariat of Prizes and Bets (SPA) has authorized 187 platforms to operate legally in the country, while more than 27,000 illegal websites have been blocked by Anatel (Brazil’s telecommunications agency). The message is clear: technical compliance is not a competitive advantage; it is a prerequisite for existence.

For operators, fintechs, and technology companies that develop or maintain betting platforms, the question is no longer whether they need to be compliant, but how to translate a complex regulatory framework into concrete software requirements. With the 2026 FIFA World Cup driving demand to unprecedented levels (projections indicate a volume close to R$ 200 billion in tournament-related bets), every week without compliance represents operational, fiscal, and reputational risk.

This guide brings together everything CTOs, product managers, and compliance officers need to know to build or adapt a platform that meets Brazilian regulation.

The legal framework: the rules every platform must know

Betting regulation in Brazil is not limited to a single law. It is structured in layers: one main federal law, dozens of technical ordinances, and complementary rules that continue to be published. Understanding this regulatory architecture is the first step toward translating legal obligations into product requirements.

Law 14,790/2023 is the central regulatory framework. Enacted in December 2023, it defines the conditions for operating fixed-odds betting within national territory: mandatory authorization from the Ministry of Finance, a licensing fee of up to R$ 30 million (valid for 5 years), the requirement for a Brazilian partner holding at least 20% of the company’s share capital, and the implementation of anti-money laundering policies, responsible gaming measures, and sports integrity controls. It is this law that assigns the SPA the authority to oversee and sanction operators.

Ordinance SPA/MF No. 722/2024 supplements the law with technical and security requirements for betting systems. Key requirements include: mandatory use of the bet.br domain, data centers with ISO 27001 certification, five-year data backup, a control program with critical component authentication, and certification by SPA-accredited laboratories. This is the ordinance with the greatest impact on engineering teams.

Ordinance SPA/MF No. 1,143/2024 specifically addresses anti-money laundering and counter-terrorism financing (AML/CTF), defining KYC procedures, transaction monitoring, and reporting to COAF (Brazil’s Financial Activities Control Council).

Ordinance SPA/MF No. 1,231/2024 establishes responsible gaming guidelines and advertising limits, including the prohibition of communications that suggest betting as a source of income.

Complementary Law 224/2025 introduced two significant changes: a gradual increase in the GGR tax rate (13% in 2026, 14% in 2027, 15% in 2028) and joint liability for all agents that facilitate unlicensed betting, including financial intermediaries, digital platforms, and technology providers.

Ordinance MESP No. 31/2025 regulates the oversight of operator websites by the Ministry of Sports, establishing a technical team for periodic platform analysis.

Regarding data protection, Brazil’s General Data Protection Law (LGPD, Law 13,709/2018) applies in full. Ordinance 722 requires databases to be replicated within Brazilian territory and grants the regulator secure, unrestricted access to systems. For bettor taxation, IN RFB 2,191/2024 sets a 15% income tax rate on prizes, withheld at source by operators.

The table below summarizes the technical impact of each regulation:

The 7 technical pillars of compliance for betting platforms

Understanding the legislation is necessary but not sufficient. The real challenge lies in translating each legal obligation into software features, integrations, and automated controls. Below, we detail the seven technical pillars every platform must implement.

1. User identification and verification (KYC)

KYC (Know Your Customer) is the first compliance barrier. Since January 2025, all licensed platforms must complete full verification before a bettor’s first deposit.

The process involves three layers of validation. The first is personal data collection: full name, CPF (Brazil’s individual taxpayer ID), date of birth, email, and mobile phone number with country and area codes. The platform must validate the CPF structure, name format, and email format at the time of registration, before proceeding to more costly verification steps.

The second layer is document validation. Accepted documents include RG (national ID card), CNH (driver’s license), CIN (National Identity Card), and passport, with front and back photo submission. Some platforms may also request proof of address or income.

The third layer is biometric authentication through real-time facial recognition. Brazil is one of the few countries in the world to require mandatory facial biometrics for bettors, placing the national regulation among the most rigorous globally.

Beyond these three layers, the system must cross-reference user data against restricted databases: the PEP (Politically Exposed Persons) list, the SPA exclusion list (which includes operator employees, regulatory public servants, athletes, referees, coaches, and sports agents), and SIGAP (the Betting Management System), which automatically blocks Bolsa Família and BPC beneficiaries by CPF.

From a technical standpoint, the platform must also implement human interactive proof mechanisms (captcha) to prevent automated bot registrations.

2. Anti-money laundering (AML/CTF)

AML obligations go well beyond initial registration. Ordinance 1,143/2024 translates federal anti-money laundering legislation into sector-specific procedures for the betting industry, aligned with COAF guidelines.

Operators must maintain active registration with COAF, conduct annual risk assessments, and operate a continuous transaction monitoring system capable of automatically identifying and flagging atypical patterns. If a bettor consistently makes transactions just below reporting thresholds, for example, the system must be able to recognize this structuring as suspicious behavior.

The regulation also drastically restricted accepted payment methods. Credit cards, cryptocurrencies, bank slips, checks, cash, and third-party payments are expressly prohibited. Pix (Brazil’s instant payment system) became the predominant method, with a requirement for 24/7 automated processing and withdrawal settlement within 120 minutes.

Any indication of event or result manipulation must be immediately reported to the Ministry of Finance and the Public Prosecutor’s Office, as stipulated in Article 35 of Law 14,790.

3. Data protection (LGPD)

Betting platforms process a significant volume of sensitive personal data: identity documents, facial biometrics, banking details, betting history, and behavioral patterns. The LGPD applies in full, and the ANPD (National Data Protection Authority) may impose fines and sanctions for non-compliance.

In practice, this translates into specific technical requirements. Bettor consent must be explicit and granular for each processing purpose. A cookie policy is mandatory; Ordinance 722 determines that bets cannot be placed if the user does not accept the cookie policy, and that no cookie may contain malicious code.

Regarding data localization, Ordinance 722 requires that databases be replicated within Brazilian territory, continuously updated to ensure uniformity. Storage outside Brazil is only permitted in countries that have International Legal Cooperation Agreements with Brazil, covering both civil and criminal matters, and in compliance with Article 33 of the LGPD. The regulator must have secure, unrestricted access to systems, both remotely and on-site.

4. Infrastructure and information security

Ordinance 722 establishes a high bar for technology infrastructure requirements. The data center used by the operator must hold ISO 27001 certification, the international information security standard covering system authentication, transaction encryption, and data protection.

In terms of availability, the minimum acceptable SLA is 99.9% uptime. For live betting, odds update latency must remain below 500ms; anything above that degrades user experience and leads bettors to abandon the market. This requires high-availability cluster architecture, automatic load balancing, and failover configured to redundant servers.

The use of the bet.br domain is mandatory for all electronic betting channels. The system must also be capable of detecting VPN usage, man-in-the-middle attacks, and OS-level tampering. Software installed on the user’s device must not disable antivirus programs or alter firewall rules.

Third-party service contracts must include all relevant security requirements, with annual monitoring and review. Third-party access rights must be revoked upon contract termination.

5. Auditing, logging, and traceability

Full traceability is one of the principles that permeates the entire regulatory framework. The betting system must maintain and back up all data for a minimum period of five years. This includes records of bets placed, payments to bettors, taxes collected, betting account movements, security events (successive failed logins, system outages), and operator data.

Article 33 of Law 14,790 stipulates that systems must be auditable, with unrestricted, continuous, real-time access made available to the Ministry of Finance whenever requested. In practice, this means the SPA can query operational data at any time without prior notice.

Ordinance 722 also requires operators to submit an assessment report issued by a certifying entity recognized by the SPA within 90 days of the authorization act, certifying that all technical requirements have been met. Reference certification standards include GLI-33 (betting software integrity) and BMM Testlabs.

6. Responsible gaming

Bettor protection is an operational obligation with direct product implications. The platform must implement mandatory self-limits on time and wagering amounts, set by the user at the time of registration.

The self-exclusion mechanism must allow bettors to block themselves temporarily or permanently, with mandatory return of remaining balances. Operators that fail to comply with blocking and refund rules may face administrative sanctions and loss of authorization.

The system must monitor behavior in real time, detecting atypical gaming patterns (increasing volumes, unusual frequency, extended sessions) and applying automatic containment measures: user alerts, forced pauses, and, in extreme cases, access blocks.

The “18+” warning is mandatory across all interfaces. The legislation prohibits the registration of minors, individuals diagnosed with gambling disorder, sports executives, referees, and professional athletes.

7. Control program and integrity

Ordinance 722 requires the betting system to operate a software called “control program”, which oversees compliance with all regulatory requirements through a specific algorithm and defined functions. This program must authenticate the validity of all critical components each time the software is started.

For online games, certification of random number generators (RNG) by independent laboratories is mandatory, ensuring results are fair and free from algorithmic manipulation.

Regarding sports integrity, operators must join national or international monitoring bodies and operate systems capable of identifying suspicious patterns in real time. When there is a sudden drop in odds for a particular event, for example, the system should be able to automatically flag the behavior for review.

Building a platform that meets all of these pillars requires more than coding capability: it demands squads with experience in sector-specific regulation, data security, and complex integrations. NextAge assembles dedicated full-stack squads for high-complexity software projects, with contractual SLAs, AI-assisted code review, and scope predictability from start to finish.

Technical checklist: what your software needs

Before submitting the platform for certification or initiating the authorization process with the SPA, review this checklist to ensure no requirement has been overlooked:

• Domain registered under bet.br
• Data center with ISO 27001 certification
• KYC integrated with facial recognition biometrics
• Automatic cross-referencing with CPF, PEP, SIGAP, and SPA restricted lists
• AML system with continuous transaction monitoring and automatic flagging
• Active registration with COAF
• 24/7 automated Pix for deposits and withdrawals (no manual approval)
• Withdrawal settlement within 120 minutes
• Full data backup for a minimum of 5 years
• Control program with component authentication at each startup
• Certification by an SPA-accredited laboratory (GLI, BMM, or equivalent)
• Mandatory self-limits on time and amount set by the bettor
• Self-exclusion mechanism with balance refund
• VPN and man-in-the-middle attack detection
• Cookie policy compliant with LGPD (bets blocked if not accepted)
• 24/7 customer support and ombudsman channel in Portuguese
• Database replicated within Brazilian territory
• Audit reports accessible in real time by the SPA
• Documented IT business continuity plan

Common mistakes that jeopardize the license

Even well-intentioned platforms make missteps that can result in fines, suspension, or revocation of authorization. These are the most frequent errors:

Outsourcing KYC without integration documentation. The chain of responsibility extends to the B2B contract. If the KYC provider does not clearly document how data is processed, stored, and protected, the governance risk falls on the operator.

Storing data exclusively outside Brazil. Ordinance 722 and the LGPD require the database to be replicated within national territory. Operating with data hosted solely on international servers, even in partner countries, violates the uniformity and unrestricted regulator access requirements.

Treating Pix as a manual process. The regulation requires automated processing, 24 hours a day, without human intervention. An operator that relies on manual approval during business hours does not meet the requirement. If the payment provider’s technical proposal does not distinguish between manual and automated Pix, it is a red flag.

Failing to separate risk management from CRM. Mature platforms integrate behavioral betting data (preferred sports, frequency, average ticket size) with marketing segmentation. When the two systems operate in isolation, risk management becomes reactive and retention campaigns lose timing: a promotion sent 12 hours after the behavior that justified it is already a missed opportunity.

Ignoring the IT business continuity plan. Ordinance 722 requires operators to prepare a formal plan to address vulnerabilities and risks in critical components of the betting infrastructure. Not having this document is a direct violation.

With over 19 years in the market and more than 600 delivered projects (including platforms for companies in the betting sector), NextAge applies its NextFlow AI methodology to safeguard every stage of development with AI-assisted code review. Errors that compromise licenses are identified and corrected before reaching production.

Trends for 2026-2027: what lies ahead

The regulatory environment for the Brazilian betting market is far from static. Anyone building platforms for this sector must anticipate changes and design flexible architectures.

Taxation will increase gradually. CL 224/2025 raised the GGR tax rate to 13% in 2026, with projections of 14% in 2027 and 15% in 2028. This requires continuous optimization of automated financial and accounting processes.

Betting advertising may face additional restrictions. Bill 2985/2023, approved by the Senate in May 2025, proposes banning active athletes and influencers from promoting bets and restricting advertising in stadiums. The bill is currently under consideration in the Chamber of Deputies.

Joint liability for technology providers is now a reality. CL 224/2025 recognizes that all agents facilitating unlicensed betting may be held legally accountable, including software houses, payment providers, and digital platforms. It is not enough for the operator alone to be compliant; the entire ecosystem shares responsibility.

Artificial intelligence applied to compliance is gaining traction. Predictive monitoring systems identify suspicious patterns before they materialize into fraud; automated onboarding tools reduce verification time without sacrificing security; anomaly detection engines analyze massive transaction volumes in real time.

Ordinance MESP 31/2025 provides for the development of a sports operations integrity platform, with potential public-private partnerships. Operators should prepare for new integrations with government APIs as this infrastructure evolves.

Frequently asked questions

What is compliance for betting platforms in Brazil?

Compliance for betting platforms is the set of policies, technical controls, and operational processes that ensure conformity with Law 14,790/2023, ordinances from the Secretariat of Prizes and Bets (SPA/MF), and the LGPD. It encompasses everything from bettor identity verification (KYC) and anti-money laundering (AML) to infrastructure requirements, data protection, responsible gaming, and mandatory technical certifications.

What are the main technical requirements of Ordinance 722/2024?

Ordinance SPA/MF 722/2024 requires operators to use a bet.br domain, maintain data centers with ISO 27001 certification, perform full data backups for a minimum of five years, operate a control program with critical component authentication at each startup, and obtain certification from SPA-accredited laboratories. It also mandates that databases be replicated within Brazilian territory and that the regulator have unrestricted, real-time access to systems.

Is facial recognition mandatory on betting platforms?

Yes. Brazil requires biometric verification through real-time facial recognition as part of the KYC process, before the first deposit. This requirement places Brazilian regulation among the most rigorous in the world and serves as a barrier against identity fraud and underage access.

Which payment methods are allowed for sports betting in Brazil?

The regulation prohibits credit cards, cryptocurrencies, bank slips, checks, cash, and third-party payments. Pix is the primary method and must operate on an automated basis, 24 hours a day, with withdrawal settlement within 120 minutes. The goal is to ensure financial traceability and prevent over-indebtedness.

What happens if a platform fails to meet compliance requirements?

Sanctions include fines of up to 10% of monthly revenue, temporary suspension of the operating license, and permanent revocation in cases of repeat offenses. Under Complementary Law 224/2025, liability extends to financial intermediaries, technology providers, and digital platforms that facilitate irregular operations.

How much does it cost to obtain a betting license in Brazil?

The licensing fee can reach R$ 30 million, valid for five years, with the possibility of renewal. In addition to the fee, the company must have an active CNPJ (Brazilian corporate registration), a Brazilian partner holding at least 20% of the share capital, and must demonstrate financial and technical capacity to operate.

Do foreign betting platforms need local certification in Brazil?

Yes. Even if the technology provider is an international company, betting and online gaming software must be audited and certified by independent laboratories accredited by the SPA to prove it meets the technical and security requirements of Brazilian law.

If your company needs to develop or adapt a betting platform to meet Brazilian regulation, NextAge is the technical partner to turn regulatory complexity into reliable code. Dedicated full-stack squads, contractual SLAs, a proprietary methodology with integrated AI, and proven experience in the sector. Schedule a no-commitment conversation.