- Home
- Practice areas
- iGaming and Sports Betting
- iGaming Compliance
Betting compliance in Brazil: AML/CFT, KYC and responsible gambling
An approved policy is not enough. Brazil's regulator asks for evidence that the program works, bet by bet, and operators that cannot prove it are held accountable.
Betting compliance in Brazil is the set of policies, controls and records a licensed operator must keep running to prevent money laundering, identify players, protect those who gamble and prove all of it to the SPA/MF, the federal betting regulator. Engage counsel before applying for authorization, when changing products or payment providers, and whenever an inspection starts.
Betting compliance in Brazil is no longer good practice: it is a condition to operate. Law 14,790/2023 (Brazil's fixed-odds betting and online gaming law) only allows fixed-odds betting and online games to be offered by operators authorized by the Secretariat of Prizes and Betting of the Ministry of Finance (SPA/MF), and that authorization depends on integrity programs that must work every day.
The core rule is SPA/MF Ordinance 1,143 of July 11, 2024, which governs the prevention of money laundering, terrorist financing and the proliferation of weapons of mass destruction (AML/CFT). It requires an internal policy, an annual risk assessment, risk-based player verification, bet monitoring and reporting of suspicious transactions to COAF (Brazil's financial intelligence unit). Add to that the responsible gambling rules of SPA/MF Ordinance 1,231/2024 and the centralized self-exclusion created by SPA/MF Ordinance 2,579/2025.
Our approach is practical: inspectors do not ask whether a policy exists, they ask how it was applied in a given case. That is why we design the program from the real operation, with owners, routines and records that hold up in an inspection or a sanctioning proceeding.
When to call a lawyer
Authorization or renewal ahead
The SPA/MF reviews AML/CFT, responsible gambling and integrity policies as a requirement. Generic documents copied from another market tend to trigger requests for information and delays.
Alerts without completed analysis
Ordinance 1,143/2024 sets 30 days from the bet to complete the analysis of selected transactions. A monitoring backlog is a liability that grows on its own.
New product, market or payment provider
A new game, vertical or payment partner changes the risk profile. The rule requires that risk to be identified and mitigated before launch, not after.
Notice from the SPA/MF or a banking partner
A regulator's letter, questions from a payment institution or an information request from an authority signal that the program is about to be tested closely.
What happens when it is left for later
- Sanctioning proceedings under Law 14,790/2023 and SPA/MF Ordinance 1,233/2024, with penalties ranging from warnings and fines to suspension and revocation of the authorization.
- Money laundering exposure when the operator fails to report a suspicious transaction to COAF on time, with consequences for directors and officers in charge.
- Loss of payment and banking partners that now ask for evidence of controls: Complementary Law 224/2025 (a federal tax law that also raised the levy on betting) made institutions that, after notice, process transactions for unauthorized operators jointly liable, which tends to make the financial sector more selective.
- A bet accepted from a minor under 18 because of an onboarding failure, a circumstance that aggravates the penalty under the sanctioning regime and causes immediate reputational damage.
How we work
Operational diagnosis
We map products, onboarding journeys, payment methods, suppliers and affiliates, and compare each flow with the requirements of Law 14,790/2023 and the SPA/MF ordinances.
Internal risk assessment
We build the annual risk matrix required by Ordinance 1,143/2024, covering players, business model, employees, suppliers, contractors and products.
Policies and procedures
We draft or review the AML/CFT policy, risk-based KYC procedures, checks on politically exposed persons, responsible gambling and integration with centralized self-exclusion.
Monitoring and reporting routine
We define bet selection criteria, an analysis flow within 30 days, internal escalation and reporting to COAF by the business day after the analysis is completed, with every decision recorded.
Training, testing and follow-up
We train teams, test the program by sampling, track new ordinances and defend the operator when an inspection or sanctioning proceeding begins.
What you receive
- Diagnostic report with gaps ranked by risk and priority.
- Internal risk assessment matrix, ready for annual review.
- AML/CFT policy and procedures manual for KYC, monitoring and COAF reporting.
- Responsible gambling policy aligned with Ordinance 1,231/2024 and centralized self-exclusion.
- Training plan and periodic testing script with an evidence template.
Why the firm
iGaming as a flagship practice
Betting is one of the firm's specialties, handled by partner Gabriel Oliveira across regulatory, contractual and advertising matters.
Compliance aligned with contracts and advertising
The clause with the KYC provider, the affiliate agreement and the AML/CFT policy are designed together, so liability sits where it should.
Advisory and litigation in one team
The team that designed the program knows its choices and can defend them if the SPA/MF opens a sanctioning proceeding.
Illustrative scenario
Hypothetical scenario, for illustration only. A licensed operator launches an online casino vertical and integrates a new payment provider in the same quarter. The risk team starts receiving more alerts than it can analyze, and some analyses exceed the deadline set by the ordinance. In a situation like this, the work starts by updating the risk matrix to include the new product and partner, continues with recalibrating bet selection criteria and redefining owners, and ends with a clear record of every decision. The goal is for the operator to show, at any time, what was analyzed, by whom and with what conclusion.
A hypothetical scenario, shown only to illustrate our method. Every case depends on its own facts.Frequently asked questions
What is betting compliance in Brazil?
Betting compliance in Brazil is the program of policies, controls and records a licensed operator keeps to comply with Law 14,790/2023 and SPA/MF ordinances. It covers AML/CFT, player identification, responsible gambling, sports integrity and information security. The key point is evidence that it works, not the mere existence of documents.
What are the AML/CFT obligations for betting operators?
They are set out in SPA/MF Ordinance 1,143/2024: an internal policy, an annual risk assessment, risk-based player verification, checks on politically exposed persons, bet monitoring and periodic training. Analyses of selected transactions must be completed within 30 days of the bet. Inspection of these rules has applied since January 1, 2025.
When must an operator report to COAF?
The operator must report to COAF, through the SISCOAF system, by the business day after completing an analysis that identifies signs of money laundering or terrorist financing. If no report is made during the year, the rule requires a statement of non-occurrence. That is why the internal flow needs defined deadlines and owners.
How does centralized self-exclusion work in Brazil?
Centralized self-exclusion is a platform run by the SPA/MF that blocks a player from registering and betting with all authorized operators. It was created by SPA/MF Ordinance 2,579/2025, which amended Ordinance 1,231/2024. Operators must display a prominent access link and integrate their systems with the platform.
Does a foreign operator need a Brazilian compliance program?
Yes. To operate in Brazil, a foreign group needs a legal entity incorporated in Brazil and authorized by the SPA/MF, subject to the same AML/CFT and responsible gambling rules. Global group policies are a good starting point, but they must be adapted to Brazilian rules and to COAF reporting.
How long does it take to build the compliance program?
It depends on the size of the operation and on what already exists. An operator with mature global policies starts from a different point than a company still applying for authorization. That is why the first step is a diagnosis that sets scope, priorities and a realistic timeline.
Related matters
Would your compliance program withstand an inspection?
Talk to the firm's iGaming team. We start with a diagnosis of your operation and show clearly what needs to be fixed first.