Sports Betting Regulation in Brazil: Operator Guide

Sports betting regulation in Brazil stopped being a promise and became operational reality. Law 14.790/2023, sanctioned in December 2023, laid the legal groundwork for the country's fixed-odds betting market, and since 2025 it has been enforced in practice — with licensing, supervision and a set of obligations every operator has to meet. Brazil moved from a legal gray zone to a defined regulatory framework, one that creates real duties for operators but also gives the sector legal certainty it never had before.

For anyone planning to run an online betting site in Brazil, understanding this framework isn't optional homework — it's the starting point of the business itself. Operating without authorization has stopped being a viable shortcut; today it is a legal, financial and reputational risk that can sink a company outright. At the same time, operators who structure themselves within the rules gain access to a far more predictable market, with payment rails, advertising channels and partnerships that were simply closed to unlicensed operations before.

This guide walks through what Law 14.790 demands from an operator in 2026: how licensing works, what role the SPA/MF plays, what KYC, AML and responsible-gambling obligations look like in practice, and what a technology platform needs to deliver to keep an operation compliant day to day. None of this replaces specialized legal counsel — that remains indispensable throughout the process — but it gives operators a complete map for making business and technology decisions with clarity.

Who regulates the market?

The Secretariat of Prizes and Betting of the Ministry of Finance (SPA/MF) is the government body responsible for regulating, authorizing and supervising betting in Brazil. It's the SPA that has issued the complementary rules detailing Law 14.790 — everything from technical platform requirements to advertising rules, responsible gambling and anti-money-laundering standards.

Any operation accepting Brazilian bettors needs SPA/MF authorization, regardless of where the company itself is headquartered. What triggers the licensing obligation isn't the location of the server or the holding company — it's the audience the operation serves. If Brazilians are betting, authorization is required.

Beyond the SPA, other bodies participate in the regulatory ecosystem. COAF (the Council for Financial Activities Control) receives reports on suspicious transactions as part of AML obligations. ANPD (the National Data Protection Authority) supervises personal data handling under the LGPD. And the Central Bank, while its role is indirect, shapes the sector through Pix rules and the relationship between operators and payment institutions. In practice, an operator doesn't answer to a single regulator — it answers to a set of authorities whose requirements all have to be satisfied at the same time.

SPA's role in ongoing oversight

Authorization isn't a one-time event that gets resolved once and never revisited. The SPA/MF maintains continuous oversight of licensed operators, which means compliance has to be sustained across the entire life of the operation. Periodic reporting, audits, integration with monitoring systems, and the capacity to respond to regulator requests are all part of running a properly licensed betting business. A platform that meets requirements on licensing day but can't sustain them operationally puts the authorization itself at risk.

What Brazil's regulation requires operators to have

Obtaining and keeping a betting license in Brazil involves corporate, financial and technical requirements, and they interact with each other: having an incorporated company doesn't help if the platform fails technical requirements, and having a strong platform doesn't help if the corporate structure isn't in order. Here are the main pillars.

A Brazilian legal entity

The operating company must be incorporated in Brazil as a limited liability company (Ltda.) or a corporation (S.A.), with an active CNPJ and a national headquarters. Foreign groups that already operate in other markets typically need to incorporate a dedicated Brazilian entity for local operations, which involves setting up a corporate structure, a shareholder base and, in many cases, local-ownership requirements defined in regulation.

This requirement carries an important practical consequence: the operator becomes subject to Brazilian jurisdiction on tax, labor and regulatory matters. Local accounting, tax obligations and director liability stop being abstractions and become part of the cost and risk of doing business.

Proof of financial capacity

The regulation requires proof of financial solidity. That includes accounting documentation, financial statements and, in some cases, specific guarantees set out in complementary SPA/MF rules. The goal is to make sure the operator can honor payouts, withdrawals and regulatory obligations, protecting bettors from undercapitalized operations.

There's also the licensing fee itself — the outorga — whose cost and conditions are defined by the regulation. Because the specific amounts and rules can be updated through SPA rulings, operators should confirm them with legal counsel against the current rules before projecting the investment. The business point is straightforward: entering the regulated Brazilian market is a capital decision, not just a technology decision.

Technical platform compliance

The betting platform has to meet mandatory technical requirements. These are what turn legal obligations into concrete, verifiable, auditable controls:

• KYC (Know Your Customer): identity verification for players, including CPF (national ID), date of birth and proof of residence.
• AML (Anti-Money Laundering): transaction monitoring and reporting of suspicious activity to the relevant authorities.
• Responsible gambling: deposit limits, self-exclusion, risk-behavior alerts and access to help resources.
• Data protection (LGPD): compliance with Brazil's General Data Protection Law in how bettor information is handled.

These four blocks aren't optional modules to switch on when convenient — they're the backbone of a regulated operation, and each one is covered in more depth in the sections below.

Betting integrity

The platform needs mechanisms to prevent result manipulation, suspicious betting patterns and fraud, whether it originates with players or with outside actors. That includes the capacity to detect anomalous patterns, block accounts involved in irregularities, and cooperate with sports-integrity bodies when there are signs of manipulation. Betting integrity is one of the most sensitive points in the regulatory framework, because it connects the operation to public-order concerns and to the credibility of sport itself.

KYC: identifying who's betting

KYC is the first compliance barrier. No regulated operation lets a bettor move money without verifying their identity first. In practice, that means collecting and validating CPF, date of birth and proof of residence, plus confirming the bettor is of legal age and isn't on a self-exclusion list or a list of people barred from betting.

Document verification has to happen before a player's first withdrawal — that's the moment the platform confirms the person behind the account is who they claim to be. A good KYC flow balances two goals that pull in opposite directions: regulatory rigor and user experience. Verification that's too slow or bureaucratic drives away legitimate bettors; verification that's too loose exposes the operation to fraud and sanctions. That's why mature platforms rely on automated verification, CPF validation against official databases, and technology-assisted document checks, reserving manual review for exceptions.

KYC doesn't end at sign-up, either. The regulation allows for re-verification and record updates over the course of the relationship, especially when there's a change in behavior pattern or signs of risk. A platform that treats KYC as a one-time event rather than an ongoing process tends to accumulate compliance gaps.

AML: anti-money laundering

The AML block is what brings a betting operator closest to the world of financial institutions. The logic is the same: moving money requires monitoring, record-keeping and reporting of suspicious operations to the relevant authorities.

In practice, that breaks down into three capabilities. First, transaction monitoring — deposits, withdrawals and bets need to be watched for patterns inconsistent with a bettor's profile, split amounts, circular movements and other risk indicators. Second, record retention — the entire financial history needs to be stored and available for audit for the period set out in regulation. Third, reporting — when there's a well-founded suspicion, the operator has to report it to the relevant authorities, including COAF, within the required timelines and formats.

The table below summarizes how compliance obligations break down across the major regulatory blocks and what each one demands from day-to-day operations.

Read across the rows and the pattern is clear: every compliance area splits into a one-time requirement and a standing obligation that has to run for as long as the operation is live. None of these are checkbox exercises completed once at licensing — they're systems that need to keep functioning under regulator scrutiny indefinitely.

Responsible gambling: protecting the bettor

Responsible gambling is the pillar where Brazil's betting regulation most explicitly shows its consumer-protection dimension. The underlying logic is that betting is an entertainment activity that carries risk, and it falls to the operator to give bettors tools to stay in control.

On the platform, that takes concrete shape. Configurable deposit limits — daily, weekly and monthly — let bettors set their own caps on how much they move. Self-exclusion gives players the ability to voluntarily step away from the platform for a set period, with the guarantee that the system will honor that block. Risk-behavior alerts flag patterns that may indicate a gambling problem, and access to help resources connects bettors to support channels.

From a regulatory standpoint, none of this is a marketing differentiator — these are obligations. A platform that doesn't offer functional self-exclusion, or that fails to respect the limits a bettor configured, is out of compliance regardless of how sophisticated the rest of the operation is. That's why responsible gambling needs to be built into the platform's core rather than bolted on as a peripheral feature.

Data protection and LGPD

Every betting operation processes an enormous amount of sensitive data: identity, documents, financial information and betting behavior. Compliance with Brazil's General Data Protection Law (LGPD) is, therefore, an inseparable part of regulatory compliance.

That means handling bettor data under a proper legal basis, guaranteeing information security, responding to data-subject requests (access, correction, deletion), and maintaining governance over where and how data is stored and shared. The overlap between LGPD and KYC/AML requirements needs careful handling: the same operation has to retain data because regulation requires it while also respecting the LGPD's principles of data minimization and purpose limitation. A well-structured platform resolves that tension through clear governance, rather than forcing the operator to choose between two conflicting obligations.

What your platform needs to have

From a technical standpoint, a regulated operation in Brazil requires a set of capabilities that need to work together and be auditable. The table below lists the essential requirements the chosen platform should deliver.

The central point is that these requirements can't be treated in isolation. A KYC system that doesn't talk to the transaction record, or a responsible-gambling module that doesn't actually block a self-excluded bettor, creates compliance gaps. The platform needs to treat compliance as one coherent system, where each control reinforces the others and all of them feed the reports the SPA can request.

Compliance by design, not a patch

The difference between a sustainable operation and a fragile one comes down to when compliance enters the architecture. Platforms built before the regulation often treat KYC, AML and responsible gambling as layers added on afterward — which creates inconsistencies, maintenance costs and blind spots. Platforms built for the regulated market bake these controls into the core, so compliance is the default configuration, not an exception that has to be manually activated and monitored.

Sports betting vs. casino

Law 14.790/2023 regulates the fixed-odds betting market as a whole — a category that covers both sports betting and online games operated under the same modality. Online casino games (slots, roulette, cards, crash games) fall within this same regulated universe, and the SPA/MF has been progressively detailing the rules that apply to each type of product through complementary regulations.

For operators who want to offer casino alongside sportsbook, staying on top of regulatory updates and making sure the chosen platform can adapt quickly to new requirements is essential. A catalog that combines sports and casino widens both audience and revenue, but it also widens the compliance surface: each game type carries its own integrity, provider and certification particulars. A platform's flexibility to incorporate new products without a compliance rework is, here, a decisive factor in the choice.

Foreign operators in the Brazilian market

Platforms operating from abroad that accept Brazilian players without SPA/MF authorization are subject to blocking by internet service providers, banking restrictions and other sanctions provided for in law. The shutdown of access to payment methods — Pix in particular — is especially severe, because it cuts the operation off from its main channel for deposits and withdrawals in Brazil.

The trend is toward tighter enforcement and further market closure for unlicensed operators through 2026. For foreign groups, the regulatory message is direct: the only sustainable way to serve the Brazilian market is by incorporating a national entity and obtaining authorization. The alternative — operating informally — has stopped being a tolerated gray zone and become an activity subject to concrete sanctions.

Where to start

Getting licensed is a bureaucratic process that requires specialized legal counsel. But the technology decision — which platform to run on — can and should be made in parallel, because how mature a platform's compliance is directly affects both the feasibility and the timeline of market entry.

A white-label platform built for regulatory compliance ships with KYC, AML and responsible-gambling modules already in place, so the operator doesn't have to build them from scratch. That changes the project's math: instead of spending months building and certifying compliance controls, the operator starts from a base already designed for the regulated market and can focus effort on what actually differentiates the business — brand, offer, acquisition and retention.

A platform built for Brazil's regulated market

Nodrus bundles KYC controls, withdrawal approval, risk monitoring and compliance reporting into the admin backoffice, configurable without a dedicated technical team. As a white-label platform, Nodrus can deploy technically in as little as 4 hours, with compliance controls integrated from day one of the operation.

It's worth repeating: no platform replaces the license. Technology delivers the controls the regulation requires, but SPA/MF authorization, incorporating the legal entity, and proving financial capacity remain the operator's responsibility, supported by specialized legal counsel. The platform's role is to make sure that once the license comes through, the operation is technically ready to deliver on everything promised to the regulator.