New regulation of iGaming in Brazil

1) The whole picture and timeline

Basic Law: Law No. 14 was adopted on December 30, 2023. 790/2023 (regulates fixed odds, online betting and "online gaming"), which triggered full sector regulation.
By-law package 2024: a series of orders of the Ministry of Finance through the Secret of Prizes and Betting (SPA/MF) - including No. 827/2024 (authorization/licenses), No. 615/2024 (payments), No. 1. 231/2024 (advertising/marketing), No. 1. 143/2024 (AML/CTF), №1. 475/2024 (details of transition period and requirements).
Transition period: up to 31. 12. 2024; from 01. 01. 2025 only legal entities authorized in Brazil that have submitted applications on time can work.
Market launch: January 1, 2025 - the start of the legal market; the first pool of full licenses was issued (14 were mentioned), the rest - temporary permits until the final certification.

2) Licensing: who, how and under what conditions

• A local company + at least 20% of the capital belongs to a Brazilian resident.
• Authorization fee: BRL 30 million (for 5 years).
• Financial stability: BRL 5 million financial reserve + minimum BRL 30 million authorized capital/net assets.
• Terms of consideration: landmark up to 150 days after submission.

General: betting exchanges and virtual sports are also allowed; fantasy sports are separated separately within the bylaws.

3) Payments and financial flows (strictly)

• Only electronic transfers through institutions approved by the Central Bank of Brazil: PIX, TED, debit/prepaid cards, intrabank transfers.
• Prohibited: cash, credit cards, boletos, crypto assets, transfers from non-registered/third accounts, any "intermediaries" outside the perimeter of the Central Bank.
• Movement of funds only between the player's account and the operator's transaction account; p2p transfers are not allowed.

4) Advertising and Responsible Gambling (RG)

Advertising standards: Order No. 1. 231/2024 + CONAR Code (Appendix X) - socially responsible communication, prohibition of the exploitation of gullibility, protection of minors. A broad ban on the use of acting celebrities/influencers, tightening timings and carriers.
Age/protection: playing with 18 +, extended RG requirements (limits, warnings, denial of service to the vulnerable, age verification/biometrics at registration).
Blocking illegal immigrants/supervision: measures are active to block unlicensed sites and control communications.

5) Taxes and fiscal burden

Operators: 12% of GGR (separately to corporate taxes) - from 01. 01. 2025; the effective aggregate rate may be higher including other taxes and contributions. For 2025, the discussed increase to 18% did not pass (in the fall of 2025, the initiative was removed/weakened).
Players: 15% personal income tax on winnings; FTS rules/regulatory instructions apply (threshold-exemption and methodology - according to published explanations; for sports betting - deduction can be considered for each winning bet, and for online games - for net session total). The operator acts as a withholding tax agent.

6) AML/CTF, integrity and data

AML/CTF: mandatory policies and internal controls (KYC/eKYC, COAF, suspicious transaction reports, training and audits), enshrined in Law 9. 613/1998 and SPA/MF profile orders (including No. 1. 143/2024).
Betting integrity: procedures to prevent match fixing and other manipulation (including official data requirements for live/settlement - where applicable).
Privacy and information security: requirements for PII protection, data incidents and the IT continuum are included in the license terms (policy-as-evidence).

7) What really changed in 2025

Only local authorized companies: foreign operators without submission/permission are illegal.
Domain. br, biometrics and hard KYC: emphasis on unambiguous identification and pruning of minors/vulnerable.

Money rails "white": no credit cards/cache/crypto, only channels approved by the Central Bank, direct transfers "igrok↔operator."

Advertising "without stars": significant restrictions on the use of influencers/athletes and on time-slots broadcasts.

8) Operator readiness checklists

8. 1 Definition of Ready

• Legal entity in Brazil (≥20% - Brazilian capital), beneficiaries and KPs tested.
• Capital/net assets BRL 30 million, reserve BRL 5 million; willingness to pay BRL 30 million fee.
• AML/RG Policies/Advertising/Data/Incidents; a rate integrity plan; evidence artifacts.
• Payment architecture under No. 615/2024 (PIX/TED/debit/prepaid, bans - credit cards/crypto/boletos/third parties).
• Technical controls: SDLC, audit/penetration tests, observability, DR/BCP, logging without unnecessary PII.

8. 2 Definition of Done

• Platform and integration certification; stable Time-to-Wallet metrics, authorizations, alerts.
• Included tax and regulatory reports (GGR taxes, deductions of 15% per player).
• Ads match # 1. 231/2024 and CONAR; library of approved templates, audit of affiliates.

9) Typical risks and mitigation

10) Input roadmap (example 90-180 days)

M1-M2: incorporation/capital structure (20%), gap analysis for AML/RG/advertising/payments, preparation of artifacts.
M2-M3: filing under No. 827/2024, setting up payment rails under No. 615/2024, contracts with CUS/anti-fraud providers.
M3-M4: platform certification, RG pilots/advertising, fiscal contours (12% GGR/IRPF holds).
M4-M6: final authorization/input, KPI control, internal compliance/security audit.

Brief conclusion

Brazil has launched a large, highly regulated market with local SPA/MF authorization, high financial sustainability thresholds, strict payment and advertising rules and an evidence-first requirement under RG/AML/IS. Key markers: 12% GGR for the operator, 15% personal income tax on player wins, credit card/crypto/boletos ban, PIX/TED as a basis. The success of the entry depends on a reliable legal structure, transparent payment architecture, mature technical controls and accurate marketing within the SPA/MF orders.