What the SPA does
The Secretariat of Prizes and Betting sits inside the Ministry of Finance and centralizes the regulation of fixed-odds betting, commercial promotions, charitable raffles, and federal lotteries. Internally, it is split into three subsecretariats with distinct roles: the Subsecretariat of Authorization, which reviews and grants licenses; the Subsecretariat of Monitoring and Oversight, which tracks licensed operators' day-to-day activity; and the Subsecretariat of Sanctioning Action, which investigates and applies penalties when an operator falls out of compliance.
In practice, the SPA does not stop at the moment a license is granted. It keeps ongoing oversight over licensed operators — requesting periodic reports, auditing systems, and acting against non-compliant operators, including offshore platforms that accept Brazilian players without authorization, which are subject to access blocking and banking restrictions.
The SPA and Law No. 14,790/2023
Law No. 14,790/2023 created the structure of the regulated market, but left it to the SPA to turn that structure into operational rules. It is the SPA that issues the ordinances detailing how each legal obligation must be met in practice — for example, SPA/MF Ordinance No. 722/2024, which spells out facial biometric verification requirements for KYC; SPA/MF Ordinance No. 1,143/2024, which sets the anti-money-laundering policies and internal controls; and SPA/MF Ordinance No. 1,231/2024, as amended by SPA/MF Ordinance No. 2,579/2025, which details the mandatory responsible-gaming tools and created centralized self-exclusion. That design — the law sets the structure, ordinances detail the execution — is what lets Brazil's betting regulation evolve without needing a new law for every technical adjustment.
The SPA also works alongside other bodies: it coordinates with COAF on anti-money-laundering obligations and, through SPA/MF Normative Instruction No. 22/2025, requires operators to query the SIGAP barred-persons module for the restrictions tied to social-program beneficiaries. Operators do not answer to the SPA alone, but the SPA is the central point that stitches these requirements into a single licensing regime.
What is the SPA's responsibility, and what is the operator's?
The distinction matters because conflating the two roles sets the wrong expectation about who resolves what.
| SPA's responsibility | Operator's responsibility |
|---|---|
| Grant and review the federal authorization | Maintain the corporate, technical, and financial requirements that justified the license |
| Issue ordinances that detail the law | Implement those requirements in the platform and internal processes |
| Audit and supervise licensed operations | Produce and provide auditable reports on request |
| Apply sanctions for non-compliance | Sustain compliance continuously, not just on licensing day |
| Set sector-wide rules (advertising, responsible gaming, KYC, AML) | Execute those rules in the technology and in daily operations |
The SPA defines what has to exist; the platform and the operator are the ones who make sure it works in practice, player by player. A granted license is not a permanent approval — it is the starting point of an oversight relationship that continues for as long as the operation stays live.