The history of gaming in Brazil has gone through various stages. From the total prohibition of gambling in the 1940s to the selective legalization of certain types of betting, such as poker, Brazil has experienced legislative swings. The debate on regulating online sports betting has been constant since 2018 — and as of 2025, the regulated market is fully operational.
The sports betting market in Brazil now operates under a federal licensing framework. Despite land-based casinos remaining prohibited, the federal government grants licenses to online casinos and sports betting platforms under the oversight of the Secretariat of Prizes and Betting (SPA).
Who is affected
Fixed-odds betting operations are a form of gambling where individuals place bets on the outcomes of sport events or virtual online gaming events. Under Brazilian regulations, online games are defined as “electronic platforms that allow virtual betting on games with outcomes determined by the future results based on the random generation of numbers, symbols, figures, or objects specified in the game’s rules.” These online games fall within the scope of fixed-odds betting operations and are subject to specific regulations and oversight.
Similarly, the law addresses fantasy sports, which are described as virtual competitions based on the real-life performance of individuals. It’s important to note that engaging in fantasy sports activities may not require prior authorization, according to the law.
Current regulatory framework
Brazil’s online gambling market has evolved through a clearly defined legislative timeline. Understanding this chronology is essential for any operator seeking a license or compliance officer assessing obligations in 2026.
2018–2023: Debate and approval of Law 14,790
The debate on regulating fixed-odds sports betting began in 2018. After years of congressional discussion, Law No. 14,790 was approved in December 2023, primarily regulating fixed-odds betting. Key provisions include:
- Only operators authorized by the Central Bank may offer payment services.
- Players may only transfer funds to a bank account based in Brazil.
- The law was enacted to curb illegal gambling, recover tax revenue, and attract international operators.
December 2023: Creation of the SPA
The Secretariat of Prizes and Betting (SPA), housed within the Ministério da Fazenda, was formally created as the dedicated federal regulator for the new market. The SPA replaced the previously mentioned “National Gaming and Betting Secretariat” and holds full regulatory, licensing, and enforcement authority.
2024: Key ordinances published
The SPA published three foundational ordinances that define technical and operational requirements for all licensed operators:
- Ordinance SPA/MF Nº 722/2024: Technical requirements, including mandatory biometric Face Match for player onboarding and authentication.
- Ordinance Nº 1,143/2024: AML/CFT obligations, SISCOAF reporting, and know-your-customer standards.
- Ordinance Nº 1,231/2024: Responsible gambling, self-exclusion mechanisms, and advertising restrictions.
1 January 2025: Regulated market opens
The Brazilian regulated gambling market officially opened on 1 January 2025. As of August 2025, 78 operators hold federal licenses covering 138 active brands. The transition from an unregulated market to a licensed framework is now complete.
2026: Enforcement and real-time compliance
Regulatory focus in 2026 has shifted to enforcement, market integrity, and full integration with the SIGAP portal for real-time reporting. Operators without active SIGAP connectivity risk license suspension.
Non-compliance penalties include fines of up to BRL 2,000,000,000, revocation of authorization, a prohibition on new ownership authorization for up to 10 years, and disqualification from acting as director in any lottery entity for up to 20 years.
KYC and biometric requirements under Ordinance 722/2024
Ordinance SPA/MF Nº 722/2024 establishes the technical baseline for player identity verification in Brazil. For technology providers and operators alike, this ordinance defines the minimum biometric and KYC standards that must be met to obtain and retain a license.
Mandatory Face Match
Unlike many jurisdictions that still accept document-only KYC, Brazil’s 2025+ framework requires facial recognition as part of the onboarding flow. A player cannot be fully onboarded by submitting an identity document image alone — a biometric Face Match against a live selfie is mandatory.
- The face match must confirm the applicant matches the identity document presented.
- Passive or active liveness detection is required to prevent spoofing with printed photos or video replays.
- PAD (Presentation Attack Detection) certification is required for any liveness solution deployed.
CPF verification against Receita Federal
All players must be verified against the Receita Federal’s CPF database in real time. The CPF is Brazil’s federal taxpayer identification number and serves as the unique identifier linking a player to their real-world identity. The verification must confirm:
- CPF is active and valid.
- Name and date of birth match the CPF record.
- The CPF is not associated with any prohibited or suspended player profile.
Age verification: 18+ mandatory
Operators must verify that players are at least 18 years old before allowing any betting activity. This is enforced at onboarding via documentary verification cross-referenced against CPF data. Failure to enforce age restrictions carries direct legal consequences for the operator.
Multi-accounting prevention
Ordinance 722/2024 requires that each CPF is associated with only one active player account per operator. Biometric 1:N authentication — checking a new face against all enrolled faces in the system — is the standard technical approach to prevent multi-accounting and bonus abuse.
National Register of Prohibited Persons and self-exclusion
Before processing any bet or deposit, operators must perform a synchronous query against the National Register of Prohibited Persons, managed by SIGAP. This register includes:
- Players who have voluntarily self-excluded.
- Individuals subject to court orders restricting gambling participation.
- Players excluded by the SPA for regulatory breaches.
A bidirectional self-exclusion API with SIGAP is required. Any player who requests self-exclusion must be blocked across all operator brands covered by the same license.
Deepfake and injection attack defense
Brazil’s biometric requirements implicitly require protection against digital injection attacks — where a fraudulent actor injects a pre-recorded or AI-generated video stream directly into the camera pipeline, bypassing liveness detection. Certified anti-injection defense is increasingly expected as part of the technical compliance stack.
Economic and social implications
Regulation of sports betting is expected to significantly contribute to tax revenue and employment in Brazil. The licensed market launched in January 2025 with 78 operators and 138 brands — a significant concentration that indicates genuine market confidence in the regulatory framework.
Market estimates for 2024 placed Brazil’s gross gaming revenue (GGR) at approximately BRL 35,000 million, with a GGR tax rate of 12%. Ongoing discussions on tax optimization and enforcement priorities will shape how the market consolidates through 2026 and beyond.
The long-term success of the industry depends on effective enforcement, consumer protection, and maintaining the integrity of the SIGAP-based compliance infrastructure.
Integration strategies of digital identity in betting platforms
Player security and protection of personal information are key aspects of sports betting regulations in Brazil. Ensuring a safe and transparent gaming environment, as well as raising awareness about information security among players, is crucial.
Sector regulations and laws will require institutions to verify the identity of their customers. Implementing an effective identity verification process not only helps comply with KYC (Know Your Customer) and AML (Anti-Money Laundering) regulatory standards but also helps prevent legal sanctions, thus promoting responsible gaming and protecting players.
Facephi’s compliance solutions for the Brazilian market
Facephi offers a purpose-built identity verification stack for the Brazilian gambling market, directly aligned with the requirements of Ordinance SPA/MF Nº 722/2024 and the broader SPA framework.
Regulatory alignment
- Ordinance SPA/MF Nº 722/2024 compliance: Biometric Face Match with PAD-certified liveness detection, meeting the technical onboarding requirements mandated by the SPA.
- Ordinance Nº 1,143/2024 (AML): Sanctions list screening, PEP checks, and SISCOAF reporting integration for full AML/CFT compliance.
- LGPD / Lei 13,709: Personal data processing follows Brazil’s General Data Protection Law, with configurable data retention and consent flows.
Core capabilities for Brazilian operators
- CPF lookup against Receita Federal: Real-time CPF validation to confirm player identity against official government records.
- Face Match with liveness (PAD-certified): Certified presentation attack detection to prevent photo, video, and deepfake spoofing during onboarding.
- 1:N biometric authentication: Multi-accounting prevention by checking each new face against all enrolled player profiles.
- Age verification (18+): Documentary and biometric verification of player age, with regulatory-grade audit trails.
- National Register of Prohibited Persons query: Synchronous integration with SIGAP’s self-exclusion registry before each bet or deposit.
- Advanced Injection Defense: Injection attack defense against AI-generated video streams targeting the camera pipeline.
- Mule account detection: Mule account detection to identify coordinated fraud rings within the player base.
- Behavioural biometrics: Behavioural biometrics for continuous session-level fraud detection beyond onboarding.
For a full overview of Facephi’s solutions for the gaming sector, visit identity verification for online gambling operators, or explore specific use cases including age verification, AML screening, fraud prevention, and biometric KYC onboarding.
Frequently asked questions
The federal license fee is BRL 30 million for a 5-year period covering up to 3 brands. Operators must also maintain a BRL 5 million financial reserve in federal public securities and demonstrate a minimum share capital of BRL 30 million.
The Sistema de Gestão de Apostas (SIGAP) is the SPA’s electronic portal for license applications and real-time regulatory reporting. All licensed operators must maintain active SIGAP connectivity, and the portal manages the National Register of Prohibited Persons.
Yes. Ordinance SPA/MF Nº 722/2024 requires biometric Face Match during player onboarding. Document-only KYC is not sufficient. PAD-certified liveness detection is also required to prevent spoofing attacks.
The Secretariat of Prizes and Betting (SPA), under the Ministry of Finance (Ministério da Fazenda), is the federal regulator. The SPA issues licenses, publishes ordinances, and enforces compliance via the SIGAP portal.
On 1 January 2025, following the approval of Law 14,790/2023 and the publication of key SPA ordinances throughout 2024. As of August 2025, 78 operators held federal licenses covering 138 active brands.