{"id":4830,"date":"2026-07-20T01:00:54","date_gmt":"2026-07-20T04:00:54","guid":{"rendered":"https:\/\/nextage.com.br\/blog\/?p=4830"},"modified":"2026-07-03T15:03:21","modified_gmt":"2026-07-03T18:03:21","slug":"technical-compliance-guide-for-betting-platforms","status":"publish","type":"post","link":"https:\/\/nextage.com.br\/blog\/en\/technical-compliance-guide-for-betting-platforms\/","title":{"rendered":"The Technical Compliance Guide for Betting Platforms in the Brazilian Market"},"content":{"rendered":"

The Brazilian sports betting market is no longer a promise; it is a regulated reality. In less than two years, the country rose to the position of fifth-largest betting market in the world<\/a>, with estimated revenue of US$ 4.1 billion (approximately R$ 22 billion) according to consultancy Regulus Partners. The Federal Revenue Service collected R$ 5.89 billion<\/a> from the taxation of sports betting and online gaming in just the first five months of 2026, an 85.9% increase compared to the same period the previous year.<\/p>\n

The numbers are impressive, but the landscape is not solely one of opportunity. The Secretariat of Prizes and Bets (SPA) has authorized 187 platforms to operate legally<\/a> in the country, while more than 27,000 illegal websites have been blocked by Anatel (Brazil’s telecommunications agency). The message is clear: technical compliance is not a competitive advantage; it is a prerequisite for existence.<\/p>\n

For operators, fintechs, and technology companies that develop or maintain betting platforms, the question is no longer whether<\/em> they need to be compliant, but how<\/em> to translate a complex regulatory framework into concrete software requirements. With the 2026 FIFA World Cup driving demand to unprecedented levels (projections indicate a volume close to R$ 200 billion<\/a> in tournament-related bets), every week without compliance represents operational, fiscal, and reputational risk.<\/p>\n

This guide brings together everything CTOs, product managers, and compliance officers need to know to build or adapt a platform that meets Brazilian regulation.<\/p>\n

\"Professional<\/p>\n

The legal framework: the rules every platform must know<\/h2>\n

Betting regulation in Brazil is not limited to a single law. It is structured in layers: one main federal law, dozens of technical ordinances, and complementary rules that continue to be published. Understanding this regulatory architecture is the first step toward translating legal obligations into product requirements.<\/p>\n

Law 14,790\/2023<\/strong> is the central regulatory framework. Enacted in December 2023, it defines the conditions for operating fixed-odds betting<\/a> within national territory: mandatory authorization from the Ministry of Finance, a licensing fee of up to R$ 30 million (valid for 5 years), the requirement for a Brazilian partner holding at least 20% of the company’s share capital, and the implementation of anti-money laundering policies, responsible gaming measures, and sports integrity controls. It is this law that assigns the SPA the authority to oversee and sanction operators.<\/p>\n

Ordinance SPA\/MF No. 722\/2024<\/strong> supplements the law with technical and security requirements for betting systems<\/a>. Key requirements include: mandatory use of the bet.br domain, data centers with ISO 27001 certification, five-year data backup, a control program with critical component authentication, and certification by SPA-accredited laboratories. This is the ordinance with the greatest impact on engineering teams.<\/p>\n

Ordinance SPA\/MF No. 1,143\/2024<\/strong> specifically addresses anti-money laundering and counter-terrorism financing<\/a> (AML\/CTF), defining KYC procedures, transaction monitoring, and reporting to COAF (Brazil’s Financial Activities Control Council).<\/p>\n

Ordinance SPA\/MF No. 1,231\/2024<\/strong> establishes responsible gaming guidelines<\/a> and advertising limits, including the prohibition of communications that suggest betting as a source of income.<\/p>\n

Complementary Law 224\/2025<\/strong> introduced two significant changes: a gradual increase in the GGR tax rate<\/a> (13% in 2026, 14% in 2027, 15% in 2028) and joint liability for all agents that facilitate unlicensed betting, including financial intermediaries, digital platforms, and technology providers.<\/p>\n

Ordinance MESP No. 31\/2025<\/strong> regulates the oversight of operator websites<\/a> by the Ministry of Sports, establishing a technical team for periodic platform analysis.<\/p>\n

Regarding data protection, Brazil’s General Data Protection Law (LGPD, Law 13,709\/2018)<\/strong> applies in full. Ordinance 722 requires<\/a> databases to be replicated within Brazilian territory and grants the regulator secure, unrestricted access to systems. For bettor taxation, IN RFB 2,191\/2024<\/strong> sets a 15% income tax rate on prizes, withheld at source by operators.<\/p>\n

The table below summarizes the technical impact of each regulation:<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n
Regulation<\/th>\nMain requirement<\/th>\nSoftware impact<\/th>\n<\/tr>\n<\/thead>\n
Law 14,790\/2023<\/td>\nAuthorization, KYC, AML, responsible gaming<\/td>\nEnd-to-end compliance architecture<\/td>\n<\/tr>\n
Ordinance 722\/2024<\/td>\nbet.br domain, ISO 27001, 5-year backup<\/td>\nInfrastructure, security, auditing<\/td>\n<\/tr>\n
Ordinance 1,143\/2024<\/td>\nAML\/CTF, COAF reporting<\/td>\nTransaction monitoring engine<\/td>\n<\/tr>\n
Ordinance 1,231\/2024<\/td>\nSelf-limits, self-exclusion<\/td>\nResponsible gaming module<\/td>\n<\/tr>\n
CL 224\/2025<\/td>\nJoint liability<\/td>\nFull chain traceability<\/td>\n<\/tr>\n
LGPD<\/td>\nData in Brazil, consent<\/td>\nData governance, cookie policy<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

The 7 technical pillars of compliance for betting platforms<\/h2>\n

Understanding the legislation is necessary but not sufficient. The real challenge lies in translating each legal obligation into software features, integrations, and automated controls. Below, we detail the seven technical pillars every platform must implement.<\/p>\n

1. User identification and verification (KYC)<\/h3>\n

KYC (Know Your Customer) is the first compliance barrier. Since January 2025, all licensed platforms<\/a> must complete full verification before a bettor’s first deposit.<\/p>\n

The process involves three layers of validation. The first is personal data collection: full name, CPF (Brazil’s individual taxpayer ID), date of birth, email, and mobile phone number with country and area codes. The platform must validate the CPF structure, name format, and email format<\/a> at the time of registration, before proceeding to more costly verification steps.<\/p>\n

The second layer is document validation. Accepted documents include RG (national ID card), CNH (driver’s license), CIN (National Identity Card), and passport, with front and back photo submission. Some platforms may also request proof of address or income.<\/p>\n

The third layer is biometric authentication through real-time facial recognition. Brazil is one of the few countries in the world to require mandatory facial biometrics<\/a> for bettors, placing the national regulation among the most rigorous globally.<\/p>\n

Beyond these three layers, the system must cross-reference user data against restricted databases: the PEP (Politically Exposed Persons) list, the SPA exclusion list (which includes operator employees, regulatory public servants, athletes, referees, coaches, and sports agents), and SIGAP (the Betting Management System), which automatically blocks Bolsa Fam\u00edlia and BPC beneficiaries<\/a> by CPF.<\/p>\n

From a technical standpoint, the platform must also implement human interactive proof mechanisms (captcha) to prevent automated bot registrations.<\/p>\n

2. Anti-money laundering (AML\/CTF)<\/h3>\n

AML obligations go well beyond initial registration. Ordinance 1,143\/2024 translates federal anti-money laundering legislation<\/a> into sector-specific procedures for the betting industry, aligned with COAF guidelines.<\/p>\n

Operators must maintain active registration with COAF, conduct annual risk assessments, and operate a continuous transaction monitoring system capable of automatically identifying and flagging atypical patterns. If a bettor consistently makes transactions just below reporting thresholds, for example, the system must be able to recognize this structuring as suspicious behavior.<\/p>\n

The regulation also drastically restricted accepted payment methods. Credit cards, cryptocurrencies, bank slips, checks, cash, and third-party payments are expressly prohibited<\/a>. Pix (Brazil’s instant payment system) became the predominant method, with a requirement for 24\/7 automated processing and withdrawal settlement within 120 minutes.<\/p>\n

Any indication of event or result manipulation must be immediately reported to the Ministry of Finance and the Public Prosecutor’s Office, as stipulated in Article 35 of Law 14,790.<\/p>\n

3. Data protection (LGPD)<\/h3>\n

Betting platforms process a significant volume of sensitive personal data: identity documents, facial biometrics, banking details, betting history, and behavioral patterns. The LGPD applies in full, and the ANPD (National Data Protection Authority) may impose fines and sanctions for non-compliance.<\/p>\n

In practice, this translates into specific technical requirements. Bettor consent must be explicit and granular for each processing purpose. A cookie policy is mandatory; Ordinance 722 determines that bets cannot be placed if the user does not accept the cookie policy<\/a>, and that no cookie may contain malicious code.<\/p>\n

Regarding data localization, Ordinance 722 requires that databases be replicated within Brazilian territory<\/a>, continuously updated to ensure uniformity. Storage outside Brazil is only permitted in countries that have International Legal Cooperation Agreements with Brazil, covering both civil and criminal matters, and in compliance with Article 33 of the LGPD. The regulator must have secure, unrestricted access to systems, both remotely and on-site.<\/p>\n

4. Infrastructure and information security<\/h3>\n

Ordinance 722 establishes a high bar for technology infrastructure requirements. The data center used by the operator must hold ISO 27001 certification<\/a>, the international information security standard covering system authentication, transaction encryption, and data protection.<\/p>\n

In terms of availability, the minimum acceptable SLA is 99.9% uptime<\/a>. For live betting, odds update latency must remain below 500ms; anything above that degrades user experience and leads bettors to abandon the market. This requires high-availability cluster architecture, automatic load balancing, and failover configured to redundant servers.<\/p>\n

The use of the bet.br<\/strong> domain is mandatory for all electronic betting channels. The system must also be capable of detecting VPN usage, man-in-the-middle attacks, and OS-level tampering. Software installed on the user’s device must not disable antivirus programs or alter firewall rules.<\/p>\n

Third-party service contracts must include all relevant security requirements, with annual monitoring and review. Third-party access rights must be revoked upon contract termination.<\/p>\n

5. Auditing, logging, and traceability<\/h3>\n

Full traceability is one of the principles that permeates the entire regulatory framework. The betting system must maintain and back up all data for a minimum period of five years<\/a>. This includes records of bets placed, payments to bettors, taxes collected, betting account movements, security events (successive failed logins, system outages), and operator data.<\/p>\n

Article 33 of Law 14,790 stipulates that systems must be auditable, with unrestricted, continuous, real-time access<\/a> made available to the Ministry of Finance whenever requested. In practice, this means the SPA can query operational data at any time without prior notice.<\/p>\n

Ordinance 722 also requires operators to submit an assessment report issued by a certifying entity<\/a> recognized by the SPA within 90 days of the authorization act, certifying that all technical requirements have been met. Reference certification standards include GLI-33 (betting software integrity) and BMM Testlabs.<\/p>\n

6. Responsible gaming<\/h3>\n

Bettor protection is an operational obligation with direct product implications. The platform must implement mandatory self-limits on time and wagering amounts<\/a>, set by the user at the time of registration.<\/p>\n

The self-exclusion mechanism must allow bettors to block themselves temporarily or permanently, with mandatory return of remaining balances. Operators that fail to comply with blocking and refund rules may face administrative sanctions and loss of authorization.<\/p>\n

The system must monitor behavior in real time, detecting atypical gaming patterns (increasing volumes, unusual frequency, extended sessions) and applying automatic containment measures: user alerts, forced pauses, and, in extreme cases, access blocks.<\/p>\n

The “18+” warning is mandatory across all interfaces. The legislation prohibits the registration of minors, individuals diagnosed with gambling disorder, sports executives, referees, and professional athletes<\/a>.<\/p>\n

7. Control program and integrity<\/h3>\n

Ordinance 722 requires the betting system to operate a software called “control program”<\/a>, which oversees compliance with all regulatory requirements through a specific algorithm and defined functions. This program must authenticate the validity of all critical components each time the software is started.<\/p>\n

For online games, certification of random number generators (RNG) by independent laboratories<\/a> is mandatory, ensuring results are fair and free from algorithmic manipulation.<\/p>\n

Regarding sports integrity, operators must join national or international monitoring bodies<\/a> and operate systems capable of identifying suspicious patterns in real time. When there is a sudden drop in odds for a particular event, for example, the system should be able to automatically flag the behavior for review.<\/p>\n

\n

Building a platform that meets all of these pillars requires more than coding capability: it demands squads with experience in sector-specific regulation, data security, and complex integrations. NextAge<\/a> assembles dedicated full-stack squads for high-complexity software projects, with contractual SLAs, AI-assisted code review, and scope predictability from start to finish.<\/p>\n<\/blockquote>\n

Technical checklist: what your software needs<\/h2>\n

Before submitting the platform for certification or initiating the authorization process with the SPA, review this checklist to ensure no requirement has been overlooked:<\/p>\n