Brazil 2025 Licensing Guide: bet.br Domains, Approved Sports, and Tax Basics in Plain English

Introduction

Brazil’s regulated online betting market went live on January 1, 2025, ushering in a new era of legal sports betting in the country. Under the landmark Lei 14.790/2023, known as the “Lei das Bets,” the government authorized 66 companies to operate legal online betting platforms .

This regulatory overhaul is aimed at protecting bettors and ensuring the industry operates under strict oversight. Key features of this new regime include the exclusive use of .bet.br domain names for licensed platforms, a hefty R$30 million authorization fee, and a comprehensive list of approved sports and events allowed for betting .

In this guide, we’ll break down everything you need to know about Brazil’s 2025 betting license – from how to obtain one to tax obligations, compliance rules, and more – all in simple, easy-to-understand terms.

Whether you’re an operator looking to launch a new sportsbook, an affiliate marketer, a payment processor, or an investor, this guide will walk you through the licensing types, .bet.br domain requirements, approved sports, tax structure, and compliance basics of Brazil’s regulated market. By the end, you’ll have a clear understanding of what it takes to obtain a Brazil betting license and how to stay compliant in 2025 and beyond.

Understanding Brazil’s 2025 Betting License Structure

Brazil’s new betting law created a structured licensing system administered by the Secretariat of Prizes and Bets (SPA) within the Ministry of Finance. Under Lei 14.790/2023, only authorized companies can legally operate fixed-odds betting in Brazil .

The SPA is the regulatory authority responsible for issuing licenses, monitoring operations, and enforcing compliance in the betting sector . There are currently two types of licenses available:

Definitive vs. Provisional Licenses Explained

• Definitive License: A definitive license is the full operating license for an online betting company. It means the operator has fully complied with all requirements and is authorized to legally offer betting services in Brazil for the full license term. As of October 2025, 14 companies have been granted definitive licenses . These include major brands like Superbet, MGM, SportyBet, Betano, and others that have met all criteria.
• Provisional License: A provisional license is a temporary approval for companies that have met most requirements but still have some pending documentation or technical certifications to finalize. The Ministry initially granted 52 provisional licenses alongside the 14 definitive ones, totaling 66 authorized operators . Provisional license holders can begin operating, but they must complete any remaining compliance tasks within a specified timeframe (typically 30–60 days) to convert to a definitive license . If they fail to do so, their provisional license can be revoked.

Below is a comparison of the two license types:

• Key Differences: The main difference is that provisional license holders are still under review – they must complete additional audits, technical checks, or provide missing documents to become definitive. Risk factors include the possibility of license revocation if requirements aren’t met on time . In contrast, definitive license holders are fully approved and can operate without further interim conditions. All approved operators must pay the R$30 million authorization fee regardless of license type.

What SPA (Secretariat of Prizes and Bets) Controls

The SPA has broad regulatory authority over the betting industry. It functions as the regulatory body and licensing authority, with an internal structure including a Subsecretariat for Authorization, Monitoring, Inspection, and Sanctioning Actions . In practical terms, SPA’s powers include:

• Licensing and Approval: SPA approves all applications for betting licenses and can grant or deny authorization based on compliance with the law .
• Ongoing Monitoring: Once licensed, operators are under continuous oversight. SPA conducts periodic audits and reviews to ensure ongoing compliance with regulations.
• Blacklist Enforcement: The SPA maintains a blacklist of unauthorized operators. If an unlicensed entity is detected, SPA can instruct ISPs and payment providers to block access and transactions to those platforms . This helps crack down on illegal betting sites.
• Fine Imposition: SPA has the authority to impose fines for violations. Penalties can be significant (we’ll discuss fines in detail later), and SPA can enforce them administratively.
• Cooperation with Ministry of Finance: The SPA also works closely with the Ministry of Finance for tax collection and customs matters related to the industry.

In summary, SPA is the one-stop regulator for Brazil’s betting market. It issues licenses, monitors operations, and ensures all rules are followed – from technical standards to advertising and player protection. Operators must remain in good standing with SPA to keep their license valid.

The .bet.br Domain Requirement Explained

One of the most notable new rules is that only betting websites using the “.bet.br” domain are legal in Brazil. This requirement is designed to help consumers distinguish official, regulated platforms from illegal sites. Here’s what you need to know:

Why Only .bet.br Domains Are Legal

Starting January 1, 2025, all licensed betting operators must use a .bet.br domain for their websites and apps . This was mandated by Normative Instruction 11/2024, which came into force as part of the regulatory framework. The .bet.br domain is a special Brazilian domain reserved for approved betting companies. The goal is twofold:

• Consumer Protection: By requiring all legal operators to use the same .br domain, the government makes it easy for players to identify official betting sites. This prevents confusion and helps protect consumers from fraud or scams by illicit operators.
• Enforcement: It also allows authorities to more easily enforce the ban on illegal sites. Anatel (Brazil’s telecom regulator) has been instructed to block any website not using .bet.br or listed as unlicensed. In fact, Anatel began blocking over 2,000 unauthorized domains in October 2024, months before the official launch . This preemptive action helped eliminate many rogue betting sites before the legal market opened.

Importantly, the law permits only one .bet.br domain per licensed brand. Each operator can operate up to three distinct brands (e.g. different betting site names or apps) under a single license, but each brand must have its own unique .bet.br domain . This means a company could have “brand1.bet.br”, “brand2.bet.br”, etc., but not share the same domain for multiple brands.

How to Register Your .bet.br Domain

If your company is approved for a license, you must register a .bet.br domain for your brand immediately after receiving approval. The process is as follows:

1. Apply for the domain through registro.br: After your license is granted, you will receive a notification from SPA. You then need to go to the official Brazilian domain registry site registro.br to request the .bet.br domain for your brand . This is done via the Núcleo de Informação e Coordenação do Ponto BR (NIC.br) platform.
2. Verification by SPA: The SPA will verify that the domain you are requesting matches the authorized brand name listed in the official operator list . If the domain name and brand name correspond, SPA will approve the registration.
3. Annual renewal: The .bet.br domain registration is valid for one year and must be renewed annually . You will need to pay an annual fee and re-register the domain each year to keep it active. Failure to renew could result in the domain being released for another company.
4. Timeline: It’s crucial to apply for the domain immediately after receiving your license approval. Operators are expected to migrate their websites/apps to the .bet.br domain as soon as possible. There is no grace period – the .bet.br domain requirement is strict, and failure to comply could be seen as a regulatory violation.

By following these steps, you ensure your platform’s domain is in compliance from day one. Remember, using any domain other than .bet.br is illegal in Brazil for betting services . This domain rule is not just a formality; it’s a key part of how the government will monitor and police the market.

Brazil’s Approved Sports and Events List for 2025

Not all sports or events are open for betting in Brazil. The new law and regulations specify which sports and competitions are eligible for fixed-odds bets. This list includes traditional sports, esports, and even virtual sports, but with certain conditions. Here’s a breakdown of what’s allowed:

Traditional Sports Approved for Betting

The initial regulations authorized a wide range of traditional sports for betting. The approved sports list includes major sports like:

• Football (Soccer) – All professional football leagues and competitions are allowed. This covers domestic leagues in Brazil, as well as international leagues and tournaments (e.g. Premier League, Champions League) that meet criteria.
• Basketball – Both men’s and women’s basketball competitions are permitted.
• Tennis – Grand Slams, ATP, WTA tournaments, and other tennis events are approved.
• Mixed Martial Arts (MMA) – Professional MMA bouts (UFC and other sanctioned events) can be bet on.
• Volleyball – Both indoor volleyball and beach volleyball competitions are allowed.
• Motor Sports – Car racing (Formula 1, IndyCar, etc.), motorcycle racing, and rally events are included.
• Horse Racing – All horse races and races on horse tracks are approved.

In-play betting (betting on events while they are happening) is permitted for these approved sports, but with certain restrictions. For example, some markets might be disabled once an event has started to prevent manipulation. The SPA closely monitors betting patterns and can restrict bets on certain markets if there are suspicions of irregular activity . Overall, Brazil’s approved sports list is quite comprehensive, covering a broad spectrum of popular sports in the country.

Esports and Virtual Sports Regulations

Recognizing the rise of esports, Brazil has also approved certain esports games and tournaments for betting. The Ministry of Sport updated the list in April 2025 to include more esports titles that were previously excluded . Here are the key points on esports:

Approved Esports Games

As of April 2025, Counter-Strike, Valorant, and Fortnite are now allowed for betting . These were previously excluded from the initial list (which only included esports recognized by the IOC). The new rule explicitly allows tournaments of these games, provided they have licensing or authorization from the game’s developer or owner . In other words, the game publisher or rights holder must approve the tournament for it to be bettable.

IOC Recognition Not Required

In the updated list, the requirement that tournaments be recognized by the International Olympic Committee (IOC) was removed . This means popular esports like CS:GO, Valorant, and Fortnite – which aren’t Olympic sports – are now on the table. However, tournaments must still be official and sanctioned by the game’s organizers.

Other Esports

The original approved list included a few IOC-recognized esports (e.g. StarCraft, League of Legends for a time, and others) . Those remain approved, but the Ministry indicated it will continue to update the list as new esports gain prominence . For instance, if a new esport is recognized by a major international body, it could be added later.

Virtual sports (computer-generated races or games) are also included, but with some caveats. The law allows virtual horse racing, virtual soccer, and other virtual sports as long as they meet criteria of randomness and have been authorized by the operator. Essentially, virtual sports that are offered by licensed operators (often using random number generators) are allowed, but they must be clearly distinguishable from real events.

It’s worth noting that amateur or junior events are not allowed. The law prohibits betting on sports events with only amateur or junior athletes, or events where minors compete exclusively (except in mixed events with adults) . This is to protect youth and prevent underage participation in betting markets.

Market Restrictions and Yellow Card Rules

While a long list of sports is approved, there are some restrictions on betting markets for certain events. Brazil has adopted what are sometimes called “yellow card rules” for soccer and possibly other sports:

• Yellow/Red Card Betting: Betting on the exact timing or occurrence of yellow or red cards in a match is limited or prohibited in many leagues . The law explicitly prohibits bets on events in which minors participate exclusively, which could include youth leagues . For adult competitions, the SPA has the authority to restrict or ban markets that pose manipulation risks, such as cards or goal scorers in-play.
• SPA Oversight: The government closely monitors betting patterns. If it suspects unusual betting activity (for example, an unusually high volume of bets on a particular market minutes before a goal is scored), it can step in. The SPA and Ministry of Sport have mechanisms to block or restrict bets in such cases . This is to maintain the integrity of sports.
• Live Betting Limits: For live betting, some markets might be disabled once an event has started. For instance, live betting on a match’s goals or corners might be stopped once play begins to prevent manipulation.
• Match-Fixing Prevention: If an investigation into match-fixing is ongoing for a specific match, the SPA can order the operator to freeze or limit bets on that match until the investigation is concluded . This is another layer of integrity protection.

Overall, Brazil’s approved sports list is quite extensive, covering the most popular sports. Operators should ensure they only offer betting on the sports and events listed in the official regulations. The Ministry of Sport and SPA will periodically update the list as needed, so operators must stay informed of any changes. By offering bets only on approved sports, operators avoid legal issues and contribute to the integrity of the sports they cover.

Tax Structure: What Operators and Players Actually Pay

One of the key considerations for any betting operator is the tax structure. Brazil’s new regime includes both operator taxes and player taxes. Understanding these is crucial for financial planning and compliance. Below we break down the tax obligations for licensed operators and the withholding tax on players’ winnings.

Operator Tax Obligations

Operators in Brazil’s regulated market face several taxes:

GGR Tax

The primary tax on operators is a tax on Gross Gaming Revenue (GGR). GGR is the total revenue from bets minus payouts. Under the law, a 12% tax is imposed on GGR . This tax is paid on a monthly basis. For example, if a sportsbook has R$100 million in bets and pays out R$70 million in winnings, its GGR is R$30 million, and it would owe 12% of that (R$3.6 million) as tax to the government . This tax is collected by the government and is separate from the operator’s income tax.

Authorization Fee

Operators must pay a one-time authorization fee of R$30 million to obtain the license . This fee is non-refundable and covers the initial authorization. It’s a significant upfront cost – about $5.5 million USD at current rates – but it’s a one-time expense for a five-year license. Payment must be made within 30 days of receiving approval notification .

Emergency Fund

In addition to the R$30M fee, each operator must also set up an emergency fund of R$5 million . This fund is held in reserve to cover any potential claims or to ensure continuity of operations if needed. It’s like a security deposit.

Other Taxes

Operators are also subject to corporate income tax on their net profits (currently around 15–25% depending on income bracket) and other standard taxes (social contributions, municipal taxes, etc.). These are in addition to the 12% GGR tax. Additionally, if the operator engages in any import or export of goods or services (for example, paying software fees abroad), there may be customs duties or VAT considerations.

The following chart provides a high-level overview of the tax structure for operators.

It’s important to budget for these costs. The authorization fee and emergency fund are one-time requirements, while the GGR tax is ongoing. Operators must remit the 12% GGR tax to the government each month by the due date (typically around the 15th of the following month for the previous month’s activity). Failure to pay taxes on time can result in penalties or interest charges.

It’s worth noting that Brazil’s government is exploring increasing the tax rates in the future. In October 2025, a new law raised the GGR tax from 12% to 18% . This change, which took effect in October 2025, is part of a broader fiscal measure. Operators should be aware of such changes and plan accordingly. Always check the latest official sources for any updates on tax rates.

Player Withholding Tax

When players win money from bets, Brazil imposes a withholding tax on those winnings. This means the operator is required to withhold a portion of the prize money before paying it out to the player. Here’s how it works:

Winning Tax Rate

The tax on player winnings is 30% of the net prize . Net prize means the amount the player actually wins minus any stake they put in (or it could be calculated as total payout minus total bets, depending on interpretation). This 30% tax is withheld at source – meaning the operator deducts 30% of the winning amount when paying out the prize .

Thresholds and Exemptions

There is a threshold exemption for smaller winnings. Initially, prizes below R$2,259.20 were exempt from withholding tax . In 2025, the exemption was adjusted to R$2,112.00 per month . If a player’s monthly net winnings (or annual, depending on how it’s calculated) are below the exemption amount, the operator does not withhold any tax. For winnings above this threshold, 30% is withheld. It’s important to note that the 30% is a flat rate – there are no higher tax brackets for big winners; the 30% is the rate for all winnings over the threshold.

Reporting and Payment to Tax Authorities

The operator is responsible for reporting and paying this 30% tax to the tax authorities (Receita Federal) on behalf of the player . Essentially, the operator will keep the 30% and remit it to the government, and only pay the remaining 70% to the player. The operator must maintain records of all payouts and the withheld taxes, and file regular returns to the tax department.

CPF Requirement

Players are required to provide their CPF (Brazilian tax ID) when registering on the platform . This is to ensure that the correct person is identified for tax purposes. The operator will use the CPF to associate the player with the tax withheld.

Monthly Winnings Data

Operators are mandated to report monthly data on player winnings and taxes withheld to the government. This data is shared via the SIGAP system (Sistema de Gestão de Apostas) that the SPA uses for monitoring . This helps the government track gambling activity and tax revenues.

It’s important for players to be aware of this tax. If a player wins a large sum, the operator will pay them only 70% of it, keeping 30% for the tax authorities. For example, if a player wins R$10,000, the operator might pay them R$7,000 and remit R$3,000 to the tax office. Players can still declare these winnings on their income tax returns, but the 30% already withheld can be credited against their liability.

It’s worth noting that some experts and operators are lobbying to reduce this tax or change how it’s calculated, but as of 2025, the 30% withholding remains in effect. Players should also be mindful that if they win big, they may still owe additional income tax on their overall earnings (the 30% is a withholding, not a final tax). The government allows players to report gambling winnings on their annual IRPF tax return and potentially get some tax back or pay more if their total income puts them in a higher bracket.

Step-by-Step: How to Apply for a Brazil Betting License

If you’re planning to launch a legal betting operation in Brazil, you’ll need to go through the application process with the SPA. The process is rigorous and involves multiple stages. Here’s a step-by-step guide on how to apply for a Brazil betting license, including eligibility, documentation, and the timeline:

Eligibility Requirements Before You Apply

Before you even submit an application, there are some key eligibility requirements you must meet:

• Be a Brazilian Company (Local Incorporation): The applicant must be a company incorporated in Brazil . This means you cannot simply be a foreign company opening a branch; you need to establish a Brazilian legal entity (e.g. a Limited Liability Company or Public Company) to hold the license. The company must have its headquarters and administrative offices in Brazil.
• Local Ownership: At least 20% of the company’s share capital must be owned by a Brazilian citizen or company . This is a local ownership rule to ensure some stake in the business is held by Brazilians. Foreign operators can still apply, but they must form a local subsidiary that meets this ownership requirement.
• Financial Stability: You must demonstrate financial stability. This includes having sufficient capital and liquidity. Minimum capital requirements are not explicitly published, but applicants should have adequate funds to cover the R$30 million authorization fee and operational costs. Additionally, you must provide a financial reserve (as mentioned earlier, R$5 million emergency fund) . The SPA will likely review your financial statements to ensure you can sustain the business.
• Other Criteria: You should also have a clean regulatory record – meaning no prior convictions or regulatory violations related to gambling. The SPA will conduct background checks on key personnel and the company. They also look for things like good corporate governance, compliance experience, and a viable business plan.

Documentation Checklist

To apply, you’ll need to submit a comprehensive set of documents. The SPA has provided detailed requirements, but in summary, you should prepare:

• Corporate Registration Documents: Proof of incorporation (Certificate of Incorporation), bylaws, and any amendments. Also documents showing the shareholder structure (who owns what percentage) to verify the 20% Brazilian ownership.
• Financial Statements: Recent financial statements (balance sheet, income statement) to demonstrate financial health. You may need to show that you have at least R$30 million available to pay the authorization fee and R$5 million for the emergency fund.
• Proof of Reserves: A bank statement or document showing that the R$5 million emergency fund is deposited and ready .
• Operational Plan: A detailed business plan for your betting platform. This should outline your operations model, target audience, marketing strategy, and how you will comply with all regulations (including AML/KYC policies, responsible gaming measures, etc.).
• Technical Certification: Proof that your platform’s software and systems meet the technical requirements set by SPA. This could include a certification report from an approved testing laboratory demonstrating that your betting software is secure, has random number generators for games, etc. . The Ministry of Finance’s regulations require that all games offered have a random outcome and that the system meets security standards.
• Key Personnel Documentation: Criminal background checks or certifications for key management (directors, CEO, etc.) to ensure they have no disqualifying records. Also resumes or profiles of key technical staff.
• Responsible Gaming Policy: A copy of your Responsible Gaming policy (how you will promote player protection, responsible gambling awareness, etc.). This is a mandatory requirement .
• Other Legal Documents: This may include tax clearance certificates (showing no outstanding taxes), a certificate of good standing from the trade registry, and any other documents the SPA might request.

It’s advisable to engage legal counsel experienced in Brazil’s gambling regulations to help compile and organize these documents. The SPA expects a thorough and compliant application – any missing or incomplete documents can delay the process.

The Application Timeline

The application process is not quick, and you should plan for it to take several months:

1. Submit Application via SPA Online Portal: Once your documents are ready, you submit the application through the SPA’s online system (SIGAP). This is a digital platform where you fill out forms and upload the required documents . The SPA will review your submission.
2. Background and Compliance Review: After submission, the SPA will conduct a background check and compliance review. This includes checking your financial status, legal compliance, and possibly interviewing your team or performing on-site visits. This stage can take several months – sometimes 6–12 months or more if there are many applications.
3. Technical Assessment: If the background check is satisfactory, the SPA will then focus on the technical aspects. This involves examining your betting system’s compliance with the technical standards (as outlined in the ordinances). They may request you have your platform tested by a certified lab. This is a critical step – if your system isn’t certified or doesn’t meet requirements, the application will be denied.
4. Approval Notification: If the SPA approves your application, they will notify you with an approval letter. At this point, you will also receive the authorization fee invoice for R$30 million .
5. Pay the Authorization Fee: You must pay the R$30 million authorization fee within 30 days of receiving the approval notification . This fee is non-refundable and is a condition of the license.
6. Receive License and Begin Domain Registration: Once the fee is paid, the SPA will issue your licensing certificate. With the license in hand, you can then proceed to register your .bet.br domain (as discussed earlier) .
7. Integration with SIGAP: Before you can start operations, you must integrate your platform with the SIGAP monitoring system . This involves connecting your systems so that the SPA can monitor all bets, player transactions, and compliance in real time. The SPA will provide the necessary APIs or instructions for this integration.

It’s important to note that there is no grace period for compliance. The SPA expects you to implement all requirements (like domain, integration, etc.) before you start taking bets. Starting operations without proper authorization or before meeting all requirements is illegal and will lead to penalties.

Timeline Estimates: The entire process can take anywhere from 6 to 12 months depending on how smoothly your application goes. The first round of applications (for the initial batch of licenses) opened in mid-2024 and saw the first licenses issued by late 2024. If you apply later, expect a longer wait. It’s wise to start the process as early as possible.

If you have questions or need clarification during the application, you can reach out to the SPA’s team. The SPA has indicated they will assist applicants and provide guidance on meeting requirements. Engaging a local legal consultant is highly recommended to navigate this complex process successfully.

Compliance Essentials: KYC, AML, and Data Storage

Running a licensed betting business in Brazil comes with strict compliance requirements to protect consumers and prevent illegal activities. Key areas include Know Your Customer (KYC), Anti-Money Laundering (AML) measures, and data storage and privacy compliance. Here we outline these essential compliance points:

KYC Thresholds and Verification Requirements

KYC is the process of verifying the identity of your customers. In Brazil’s regulated market, all players must be verified and have their identity confirmed. Key points on KYC:

• CPF Mandatory: Players are required to provide their CPF (Cadastro de Pessoas Físicas), which is the Brazilian taxpayer ID . The operator must verify the CPF against official databases to ensure it’s valid and belongs to the player. This is to link the player to their tax information for the withholding tax discussed earlier.
• Facial Recognition (Proof of Life): For players, facial recognition verification is required as part of the onboarding process . This means the player must submit a selfie or use a facial recognition feature during registration to confirm that they are a real person. This helps prevent underage or fraudulent accounts.
• PEP Screening: Operators are expected to perform PEP (Politically Exposed Person) screening. This means checking if any player (or customer) is a government official or has high public profile, as these are typically restricted from betting. Enhanced due diligence is required for such individuals.
• Document Verification: While not explicitly stated, many operators also verify documents like ID cards or passports to match against the CPF. If the player doesn’t have a CPF (for example, foreigners who might not have one), special provisions may apply, but generally CPF is the key ID.
• Transaction Thresholds: There are specific thresholds for mandatory KYC for transactions. The SPA’s rules (Ordinance 615/2024) state that if a bet or transaction exceeds R$2,000 (approximately $370), or if a deposit or withdrawal exceeds R$50,000 (about $9,200), the operator must perform enhanced verification for that transaction . Enhanced verification could include additional identity checks, maybe verifying the source of funds for very large deposits. This is to detect money laundering.
• Ongoing KYC: Beyond initial onboarding, operators must maintain KYC records and can perform periodic checks. If a player hasn’t bet in a long time but tries to withdraw a large sum, the operator might need to re-verify their identity.

Overall, KYC in Brazil is very stringent. All players are verified before account activation. This not only helps with compliance but also improves security and trust for players, as it prevents fraud and underage betting.

COAF Reporting and SAR Obligations

Anti-Money Laundering (AML) is a major focus of the new regulations. Brazil has a Financial Activities Control Council (COAF) that oversees AML compliance in the financial sector. For betting operators, this translates to:

• SAR Reports: Operators must file Suspicious Activity Reports (SARs) to COAF for any transactions that seem suspicious. This includes things like very large deposits or withdrawals that don’t match the player’s usual betting patterns, or any unusual activity that could indicate money laundering, fraud, or other illegal finance. If, for example, a player suddenly deposits a huge sum and then immediately withdraws most of it, that’s a red flag and should be reported.
• Zero-activity Reports: Even if no suspicious activity is detected, operators must submit zero-activity reports periodically. In other words, if nothing unusual happens in a given period, you still have to report that nothing was reported. This ensures continuous monitoring.
• Real-time Monitoring: The SPA’s SIGAP system is designed for real-time monitoring of transactions . This means the operator’s transactions are constantly fed to the government’s monitoring system. If any flagged transaction occurs, it triggers an alert. The operator must respond to those alerts promptly.
• COAF Oversight: COAF will review these reports and can conduct audits. Operators should be prepared for on-site inspections to verify their AML controls.
• Penalties for Non-Compliance: Non-compliance with AML/KYC can lead to heavy penalties. The law provides for penalties of up to R$2 billion for certain serious violations . This is one of the highest penalties in the world for financial crimes, highlighting how seriously Brazil takes AML.

To meet these obligations, operators typically implement AML software and processes. They analyze transaction data for anomalies and maintain records of all transactions for at least 5 years (in line with data retention rules) . Additionally, operators are required to train their staff on AML best practices and have a compliance officer or team dedicated to this.

LGPD Data Privacy Compliance

Operators must also comply with Brazil’s General Data Protection Law (LGPD), which is analogous to the EU’s GDPR. Key points for betting operators:

• LGPD Oversight: The Brazilian Data Protection Authority (ANPD) will monitor compliance with LGPD . Any personal data collected from players (names, addresses, CPF, betting history, etc.) must be handled in compliance with LGPD.
• Data Storage: The law requires that personal data be stored securely. Operators must ensure encrypted storage of data and have appropriate security measures to prevent breaches. Additionally, the SPA’s regulations specify that player data must be stored in Brazil . This means you cannot simply host player databases on servers abroad without explicit approval. The law likely allows foreign servers under certain conditions (with cooperation agreements), but generally data should reside in Brazil.
• Consent and Purpose Limitation: Operators must have explicit consent from players for collecting and using their personal data. For example, you need players’ consent to collect their biometric data (like facial recognition) for identity verification. The data should only be used for the purpose it was collected (e.g. verifying identity, not selling it to third parties).
• Transparency: Provide clear privacy policies to players, informing them what data you collect and how you use it.
• Player Rights: Under LGPD, players have rights to access their data, correct it, or delete it. Operators must implement processes to handle these requests.
• Local Data Processing: While LGPD is broad, the betting context means any data related to bets (which is personal data) should be processed within Brazil. If you use any third-party service (like an analytics provider) that handles data, ensure they also comply with LGPD.

By adhering to LGPD, operators not only avoid hefty fines (LGPD fines can be up to 2% of global revenue) but also build trust with players who are increasingly concerned about data privacy.

Payment Methods and Financial Restrictions

The new regulations in Brazil also dictate which payment methods are allowed for deposits and withdrawals. Here’s what you need to know about payments in the legal betting market:

• Approved Payment Methods: The law explicitly bans credit cards for betting transactions . Using credit cards is prohibited to prevent players from borrowing money to bet (which can lead to debt issues). Only debit cards, prepaid cards, Pix, and bank transfers are allowed for deposits and withdrawals . Pix, Brazil’s instant payment system, is now a mandatory payment method – players can deposit and withdraw via Pix, which is very convenient.
• Transaction Limits: There may be limits on transaction amounts. While not specified in the main law, some guidelines might cap how much can be deposited or withdrawn in one go. Typically, Pix allows instant transfers up to a certain limit, and bank transfers are usually unlimited but processed in days.
• Payment Providers: Any payment processor or payment service provider (PSP) that works with betting operators must be authorized by the Central Bank . So, if you use a payment gateway, ensure they have the necessary licenses. Additionally, all payment providers must register with the SPA to ensure they comply with the regulations.
• Real-time Reporting: All transactions (deposits, withdrawals, bets) must be reported in real-time via SIGAP . This means the operator’s payment system feeds transaction data to the government’s monitoring system. It’s part of the anti-money laundering and transparency efforts.
• Withdrawal Processing: Players can withdraw their funds at any time, and the operator has to pay out within a specified timeframe. The law mandates that players receive their withdrawals within up to 120 minutes of requesting them . This is a strong consumer protection measure to ensure prompt payouts.

In practice, this means:

• A player logs out their account, requests a withdrawal, and the money should appear in their bank or Pix account within 2 hours.
• If it takes longer, the operator could face penalties or scrutiny.

It’s important for operators to have robust payment infrastructure to meet this 2-hour requirement. Using Pix helps achieve this, as Pix transfers are near-instant.

Another important point is that cash and other non-electronic methods are also prohibited. You cannot accept cash deposits or pay out prizes in cash . All transactions must be electronic. This is to avoid cash handling issues and make everything traceable.

To sum up, only Pix, debit cards, and prepaid cards are allowed for deposits and withdrawals. Credit cards and other non-electronic methods are strictly forbidden. This not only ensures financial security but also aligns with the government’s goal of fully tracking and regulating money flows in the betting market.

Marketing and Affiliate Compliance Rules

Promoting a betting platform comes with rules to ensure it’s done responsibly and within legal bounds. Brazil’s regulations cover advertising, marketing, and affiliate program compliance. Here are the key points:

Advertising Restrictions You Must Follow

• 18+ Warning: All advertising must prominently display a warning that gambling is only allowed for adults 18+. Typically, this is shown as a banner or pop-up when the site loads. The regulations likely require a clear “Proibido para menores de 18 anos” (prohibited for those under 18) notice on all promotional materials .
• Responsible Gaming Messaging: Operators must include responsible gaming messages in their ads. This could be information about how to gamble responsibly, where to seek help for problem gambling, etc. Essentially, the ads should not be misleading or overly enticing in a way that could encourage irresponsible behavior.
• Minors Protection: Advertising cannot target minors . This means no ads on kids’ websites, no social media ads targeting teens, and no sponsorship of events that are primarily aimed at young audiences. The law and regulations emphasize protecting youth from gambling exposure.
• Influencer and Endorsement Rules: If the operator uses influencers or celebrities in promotions, there are restrictions. They must clearly indicate that the person is an ambassador or endorser and that they are of legal age. Also, the content should not glamorize gambling or suggest it’s a way to get rich quickly.
• False Promises Banned: It’s illegal to make false or misleading claims in ads. For example, “Guaranteed wins” or claims of superior odds are not allowed. Also, terms like “free” should be used carefully – e.g., if you say “free bet,” it should truly be free with no strings attached. The law prohibits any false advertising that could mislead consumers.
• Normative Ordinance 1,902: This ordinance (published in December 2024) immediately enforced certain advertising restrictions even before the market launch . It’s a directive from the SPA that betting companies must comply with right away. This likely covers things like not advertising on channels frequented by minors, not using certain types of ads, etc. Operators should review this ordinance for the latest specifics.

In essence, any advertising for the betting site should be transparent, responsible, and targeted at adults. It should include warnings about the risks and encourage players to bet responsibly.

Affiliate Registration and Partner Requirements

If you have an affiliate marketing program (where affiliates promote your site and earn commissions for new players), there are specific rules for affiliates:

• Mandatory Registration: All affiliates must register with the licensed operator . The operator is responsible for keeping a registry of all its affiliates. This helps the government track who is promoting which licensed site.
• Affiliate Liability: Affiliates are jointly liable for promoting illegal betting platforms. If an affiliate promotes an unlicensed site or engages in illegal activities, both the operator and the affiliate can face penalties. This is to ensure affiliates only promote authorized brands.
• Documentation: Operators should have documentation from affiliates (contracts, links, etc.) to prove they are legitimate partners. They also need to maintain records of any affiliate marketing materials to ensure they comply with advertising rules.
• Penalties for Affiliates: The regulations don’t spell out specific penalties for affiliates, but since they are jointly liable, affiliates could be fined or face legal action if they promote unlicensed sites. Also, affiliates could be blocked from using the operator’s tracking system if they violate rules.
• Grey Redirects: The law prohibits affiliates from using grey redirects or misleading links. Essentially, an affiliate must know where the link they are promoting leads to. If it’s a landing page that doesn’t clearly state it’s a betting site or doesn’t show the “18+” warning, that could be an issue.
• Disclaimer Requirements: Any content that affiliates publish (blog posts, social media posts, etc.) must include a disclaimer about gambling risks and that they are an affiliate. They should also disclose if they have a relationship with the operator.

For operators, it’s crucial to vet your affiliates. You should require them to adhere to the same advertising standards as you do. It’s recommended to have an affiliate agreement that outlines these compliance requirements and the penalties for non-compliance.

In summary, marketing and affiliate programs must be run in compliance with the law. Operators are on the hook for ensuring all their promotional efforts – whether direct or through partners – are legal, transparent, and not targeting minors. This protects both the operator and the industry from reputational harm and legal issues.

Responsible Gaming Requirements

Responsible gaming (RG) is a key pillar of Brazil’s new regulations. The law and SPA’s rules mandate that operators implement measures to promote safe gambling and protect vulnerable players. Here are the main responsible gaming requirements:

Self-Exclusion Program

All operators must provide a self-exclusion feature on their platform . Players should be able to temporarily or permanently self-exclude themselves from betting. This means they can freeze their account and not log in for a period or indefinitely. The operator must honor these requests and ensure the player cannot create a new account during the exclusion period.

Deposit, Loss, and Time Limits

The regulations encourage players to set their own limits on how much they deposit or bet, and how long they play . While not mandatory that the operator sets these for them, operators should offer tools for players to set deposit limits, loss limits, and session time limits. Some regulators in other countries require operators to impose maximum losses or sessions, but Brazil’s rules so far emphasize player-controlled limits. However, regulators are “considering mandatory caps” to prevent excessive losses , so operators should be prepared for that possibility.

Re-Authentication (Reality Check)

If a player is inactive for a certain period (e.g., 30 minutes of inactivity), the platform should prompt a re-authentication . This is like a reality check to ensure the person playing is still the account holder and hasn’t been left unattended (which could be a sign of a problem gambler).

Problem Gambling Tools

Operators should have tools to identify and assist problem gamblers. This can include offering links to counseling services, providing information on how to recognize signs of gambling addiction, and perhaps conducting periodic risk assessments on players (though this is not explicitly mandated, it’s good practice).

Staff Training

The company’s staff who interact with players (customer support, marketing, etc.) should be trained in responsible gaming and ethical behavior. They should know how to respond to players who may be at risk.

Dedicated Responsible Gaming Page

The website should have a clear “Responsible Gaming” page or section with information about self-exclusion, helplines, and tips on betting responsibly .

Player Protection Measures

The SPA’s rules mention protecting consumers from financial harm and ensuring transparency . This could mean measures like not allowing someone with a high debt or known issues to bet excessively, or providing clear information about odds and payouts so players aren’t misled.

By implementing these measures, operators not only comply with the law but also demonstrate a commitment to player well-being. Responsible gaming is not just a regulatory checkbox; it’s important for the long-term sustainability of the industry and for avoiding reputational damage.

Enforcement, Penalties, and the Appeals Process

Compliance isn’t just about following rules; it’s also about knowing the consequences of non-compliance and how to address issues if they arise. Here we outline the penalties for violations and the process if a license is revoked or suspended:

Fines and License Suspension

The law sets out severe penalties for non-compliance. Some key points:

• Maximum Penalties: The law provides for penalties of up to R$2 billion for serious violations . This is an extremely high fine – roughly $350 million USD – and is intended to act as a deterrent for major infractions.
• Other Penalties: For less severe violations, fines can be in the range of tens of millions of reais. The exact amounts are detailed in the law but aren’t publicly published here. In general, smaller violations (like minor compliance slips) might result in fines of R$10 million or more.
• License Suspension: If an operator is found to be in material non-compliance, the SPA can suspend the license temporarily . A suspension means the operator must stop operations until the issue is resolved. The SPA can also fine the operator during suspension.
• Revocation: If violations are serious or repeated, the SPA can revoke the license, effectively shutting down the business . Revocation is the most severe penalty and typically happens after multiple warnings or for things like facilitating illegal betting or money laundering.
• Blacklist and Blocking: Unlicensed operators are added to a blacklist and have their domains and payment channels blocked . Additionally, social media platforms that allow advertising for unlicensed betting sites can be fined up to 2% of their annual revenue . This is a new provision targeting platforms that promote illegal gambling.
• Individual Penalties: In addition to corporate penalties, individuals involved in violations (like executives) could face personal fines or even legal action (criminal or civil) depending on the nature of the violation.

It’s clear that Brazil is serious about enforcement. The SPA has a dedicated enforcement team and will take action swiftly against non-compliant operators. This not only protects consumers but also ensures a level playing field for legitimate operators.

Appeal Process and Administrative Procedures

If a company believes it has been treated unfairly or if its license is suspended or revoked, it has the right to an appeal process:

• First Instance Appeal: The SPA has a Subsecretariat for Sanctioning Actions that handles initial appeals . If the SPA decides to fine or revoke a license, the operator can contest the decision through this subsecretariat. They will review the case and may uphold, modify, or reverse the decision.
• Right to Appeal: Operators have the right to appeal any adverse decision. They must typically file an appeal within a specified timeframe (e.g., 15 or 30 days from the notification of the decision).
• Documentation and Evidence: To appeal, the operator should provide evidence of compliance efforts or other mitigating factors . For example, if the fine was due to a minor oversight, the operator might present evidence that they’ve since corrected the issue and are compliant going forward.
• Timeline: The SPA will have timelines for each stage of the appeal process. They will notify the operator of the appeal decision, which could be favorable or unfavorable.
• Higher Levels: If the operator is still not satisfied, there may be a higher-level appeal or review by a higher authority. In Brazil’s administrative law system, there can be further appeals to administrative courts, but those are beyond the immediate SPA process.

It’s important to note that during any appeal, the license remains in force unless suspended. So, an operator appealing a fine or suspension can continue operating while the appeal is pending.

Operators should always seek legal counsel when dealing with enforcement actions. A good attorney can help compile the necessary documentation and represent the company in appeals. The key is to cooperate with SPA’s inquiries and demonstrate a commitment to rectify any issues, as this can often help mitigate penalties.

Supplier and Software Provider Registration

Beyond the operator themselves, software providers, payment processors, data centers, and other suppliers that support the betting business also need to comply with certain regulations:

• Supplier Licensing: Any company that provides software for the betting platform (e.g., a sportsbook software provider), a payment processing service, or even a data center that hosts the platform must register with the SPA . They are not required to get a full license like an operator, but they need to be on the SPA’s radar. This registration ensures that the provider’s systems also meet security and integrity standards.
• RNG Certification: For software providers, especially those offering casino games or slot machines, the random number generators (RNGs) must be certified. The SPA’s regulations require that all games offered have a random outcome and are certified by an approved testing agency . The Ministry will likely only approve software from providers that have these certifications.
• Platform Audits: The SPA will conduct technical compliance checks on suppliers as well. This means they might audit the software provider’s systems or require documentation that their systems meet the regulatory requirements.
• Integration with SIGAP: It’s likely that software providers will need to integrate their systems with the SIGAP monitoring system as well . For example, a sportsbook software may need to send data to SIGAP about bets and outcomes in real-time.
• B2B vs B2C: The regulations treat B2B (business-to-business) and B2C (business-to-consumer) providers differently. B2B providers might be required to register their services rather than obtain a full license, but they still have to meet the same technical and security standards as an operator’s own systems.

It’s a new aspect of regulation that suppliers must also comply. This is to ensure that the entire ecosystem – from software to payments – is safe and regulated. Operators should choose suppliers that are willing and able to comply with these requirements.

In practice, a software provider might need to submit documentation proving their system’s security, have their RNG tested by an approved lab, and possibly allow the SPA to audit their servers or code. Payment processors must also register and adhere to the same AML rules as the operator (since they handle sensitive financial transactions).

Overall, the registration and oversight of suppliers is an important part of Brazil’s comprehensive approach to regulation. It ensures that even the backend components of the betting platform meet the same high standards as the platform itself.

Conclusion: Your Next Steps for Brazil 2025

Brazil’s 2025 online betting market is officially open for business, but it comes with a rigorous regulatory framework. To operate legally and successfully in Brazil, operators, affiliates, and other stakeholders must understand and adhere to all the rules outlined in this guide. Here’s a quick recap of the key points:

• Licensing: Obtain a license from the SPA. Only definitive or provisional license holders can legally offer betting services . Prepare for a thorough application process, including a Brazilian company with 20% local ownership, financial stability, and technical certification of your platform.
• .bet.br Domain: Use only the .bet.br domain for your website/app . Register this domain through registro.br as soon as you get approval. This domain requirement is non-negotiable and will help you stand out as a legal operator.
• Approved Sports and Events: Offer bets only on the sports and events on the approved list . This includes most mainstream sports and some esports (with updated rules). Stay updated with any changes to the approved list.
• Tax Obligations: Budget for the R$30 million authorization fee and the 12% GGR tax . Also be prepared to withhold 30% of player winnings above the exemption . Keep accurate records for tax reporting.
• Compliance Basics: Implement robust KYC/AML measures – verify all players with CPF and facial recognition, report suspicious transactions, and ensure all personal data is stored securely in Brazil . Also, use only authorized payment methods (Pix, debit, prepaid) and never credit cards .
• Marketing and Affiliates: Promote your platform responsibly – include 18+ warnings, avoid targeting minors, and ensure any affiliate partners are also compliant. Affiliates must register with you and follow the same rules.
• Responsible Gaming: Provide self-exclusion options, set limits, and promote safe gambling . This not only keeps players safe but helps build a good reputation.
• Penalties and Appeals: Be aware of the severe penalties for non-compliance . Operate cleanly to avoid fines, license suspension, or revocation. If issues arise, use the appeal process and cooperate with authorities.
• Supplier Registration: If you use external suppliers (software, payment, etc.), ensure they are registered with the SPA and meet the same standards . A strong supply chain is part of your compliance.

Your Next Steps: If you’re planning to enter Brazil’s market, start by forming a Brazilian company and meeting the local ownership and capital requirements. Gather all the necessary documentation and engage legal counsel to guide you through the application process. Remember, obtaining a license can take several months, so start early. Ensure your platform is built to meet the technical standards (e.g., have it tested and certified by a recognized lab). Once licensed, you’ll need to quickly implement all the compliance measures – from KYC and AML to the responsible gaming tools.

The Brazilian betting market offers huge potential, but success will come to those who operate within the law and with integrity. By following this guide and staying up-to-date with any regulatory changes, you can navigate the 2025 licensing landscape in Brazil with confidence. The SPA’s website and official gazette (DOU) are excellent resources for the latest rules. Good luck, and may your business be both successful and compliant in Brazil’s exciting new regulated betting market!