In 2026, Brazil is one of the largest regulated markets for sports betting and online casino games worldwide. In the first full year of regulated operations, the sector generated approximately BRL 37 billion in gross gaming revenue and around BRL 9.95 billion in direct federal revenue. More than 187 operators have received authorisation from the Secretariat of Prizes and Betting of the Ministry of Finance, known as SPA/MF, to operate in the country.

For foreign operators, the most important point is not market size. It is the regulatory change. Since 1 January 2025, the former offshore operating model has ended. Platforms that previously accepted Brazilian bettors under Malta, Curacao or Gibraltar licences without a local presence now need express SPA authorisation, a Brazilian legal structure and full compliance with Brazilian law.

This guide covers the decisions that should be made before market entry: corporate structure, licensing, tax, payments, compliance and responsible gaming.

The new legal framework: what Law No. 14,790/2023 changed

Law No. 14,790, enacted on 29 December 2023, is the turning point. It defined fixed-odds betting, including sports betting and online casino games, as a lottery modality expressly permitted in Brazil. It ended decades of legal uncertainty and created the mandatory licensing regime administered by the SPA.

The framework was implemented during 2024 through ordinances governing each operational area:

Operating outside this framework can result in fines of up to BRL 2 billion per violation, blocking of websites, apps and bank accounts, and the legal inability to process payments through the Brazilian financial system.

Corporate structure: what the law requires from a foreign operator

The first condition for a SPA licence is a Brazilian legal entity. A betting operator cannot serve Brazil through the foreign company alone. The rules require a Brazilian subsidiary or local company formed under Brazilian law as a Limited Liability Company, or Ltda., or a Corporation, or S.A., with its registered office and effective management in Brazil.

The sector-specific feature that distinguishes betting from most activities open to foreign capital is the mandatory ownership composition. Law No. 14,790/2023 requires at least 20% of the operators share capital to be held by a Brazilian partner. A foreign operator may hold up to 80%, but cannot hold 100%.

This requirement has immediate practical implications:

• Identifying and formalising the 20% Brazilian partner is a strategic decision, not an administrative formality. The partner must meet SPA integrity requirements and will be subject to background checks during authorisation.

• The articles of association should clearly address approval thresholds, exit mechanisms and governance between the foreign parent and local operation. Even as a minority holder, the local partner has corporate rights that need to be contractually managed.

• Directors responsible for the operation must be individuals domiciled in Brazil and meet SPA suitability standards, including the absence of final criminal convictions and links to unauthorised operators.

The licensing process: steps and cost

Authorisation to offer fixed-odds betting in Brazil costs BRL 30 million per licence and is valid for five years. It permits up to three commercial brands, or skins, within the same economic group. The process is managed through the SPA/MF SIGAP system and broadly involves:

1. Defining the scope of activity: sports betting, online gaming, land-based operations or a combination.

2. Incorporating the Brazilian Ltda. or S.A. with appropriate capital and governance, including a Brazilian partner holding at least 20%.

3. Reporting foreign capital to the Central Bank through the applicable foreign investment system after the required registrations.

4. Preparing the legal and technical dossier for submission through SIGAP.

5. Obtaining platform technical certification, with a report issued by an accredited laboratory, within the first 90 days after authorisation.

6. Demonstrating the financial reserve in government securities required under the SPA framework.

7. Registering the .bet.br domain, the only domain legally permitted for federally authorised operators in Brazil.

8. Starting operations only after publication of the authorisation in the Official Gazette and notifying the start of activities under SPA/MF Normative Instruction No. 35/2025.

The BRL 30 million licence fee is the floor, not the full cost of entry. Operators also need to fund technical certification, compliance infrastructure, platform localisation and the financial reserves required by the regulator. In practice, entry into Brazil is a mid-to-large-scale project.

Tax: GGR, bettor income tax and allocation of proceeds

The Brazilian model taxes Gross Gaming Revenue, or GGR, meaning total stakes less prizes paid, at progressive rates:

• 13% of GGR in 2026

• 14% in 2027

• 15% from 2028 under Complementary Law No. 224/2025

A significant portion of GGR revenue is allocated to social security, sport, tourism and education. This helps explain the federal focus on ensuring that revenue flows through the regulated market rather than offshore platforms.

For bettors, a 15% income tax applies to annual net winnings above BRL 28,467.20, as updated for 2026. The operator must withhold the tax at source, adding a further tax obligation to the operating model.

Foreign capital contributions for direct investment are also subject to 0.38% IOF on the foreign exchange transaction. The contribution principal is not taxed as income, but the foreign exchange cost should be built into the entry budget.

Payments: what is permitted and prohibited

Brazilian rules are specific and restrictive on payment methods. SPA/MF Ordinance No. 615/2024 permits only:

• Pix

• TED bank transfer

• Debit card

• Prepaid card

Credit cards, bank slips, crypto-assets and third-party deposits are expressly prohibited. Every deposit and withdrawal must be linked to a bank account in the same CPF taxpayer number as the bettor registered on the platform.

That restriction directly affects platform architecture. The payment system needs to integrate with a payment service provider regulated by the Central Bank and able to preserve individual traceability for every transaction.

Compliance: AML/CTF, KYC and responsible gaming

For a betting operator in Brazil, compliance is not a support function. It is a condition for keeping the authorisation. The minimum regulatory structure covers three fronts.

AML/CTF: anti-money laundering and counter-terrorist financing

SPA/MF Ordinance No. 1,143/2024, aligned with Financial Action Task Force standards and Law No. 9,613/1998, requires each operator to maintain a formal AML/CTF programme with written policies, auditable internal controls and a designated responsible professional. Operators must register with Siscoaf, the COAF reporting system, and report suspicious transactions on an ongoing basis. The SPA has also joined the national anti-corruption and anti-money-laundering strategy, which strengthens coordination between authorities.

KYC: know your customer

Bettor onboarding requires facial-recognition technology with liveness checks, real-time document verification and CPF validation. Minors, sanctioned politically exposed persons, people diagnosed with gambling disorder, Bolsa Familia and BPC benefit recipients, and accounts restricted by an administrative or judicial decision are blocked by default. Identity verification must take place before any prize is paid. It cannot be postponed.

Responsible gaming

SPA/MF Ordinance No. 1,231/2024 sets out bettor-protection obligations: self-exclusion tools, user-triggered deposit limits, time-management features and specific advertising restrictions, including limits on content directed at vulnerable audiences. Non-compliance with responsible-gaming rules is treated as a serious breach and can put the authorisation at risk.

LGPD in the betting context

Alongside sector rules, the operator is subject to the LGPD, the Brazilian General Data Protection Law, as an independent controller of data processed in Brazil. A foreign parent data-protection programme, whether based on the European GDPR or United States law, does not replace separate LGPD compliance. The Brazilian subsidiary needs its own programme, an accessible data protection contact point for Brazilian data subjects and an appropriate legal basis for international transfers to parent company servers.

Regulatory agenda for 2026 and 2027

The SPA Regulatory Agenda for 2026 and 2027 anticipates further rules on active supervision, advertising and enhanced responsible-gaming requirements. The sector remains under active regulatory development. Operators entering now need a compliance structure that can adapt to continuous regulatory change, not merely meet the rules already in force.

Executive summary: what to put in place before filing the licence application

This content is for information only and does not replace legal analysis of a specific case. The Brazilian betting regulatory environment remains under active development, with new ordinances and guidance issued regularly. Specialist legal advice is recommended for an up-to-date assessment of each operator situation.

Official sources

• SPA/MF: fixed-odds betting

• SPA/MF: fixed-odds betting legislation

• SPA/MF: how foreign companies can seek authorisation

• SPA/MF: 2026 regulatory agenda