Brazil sportsbook platform requirements: what the law and the SPA ask of the system
Short answer
Brazil regulates fixed-odds betting through Law 14,790/2023 and a stack of ordinances issued by the Ministry of Finance's Secretariat of Prizes and Betting (SPA/MF). The law itself already shapes the platform: identity checks that require facial-recognition technology, money that may move only through transactional accounts at Brazilian institutions authorised by the Central Bank, bettor funds held as separate patrimony, a record of every operation, and a user-activated time-limit feature with fixed options. The technical rules sit in Ordinance SPA/MF 722/2024 and the ordinances beside it, published in the Diário Oficial da União and indexed by the regulator. The parts the SPA restates on its own pages are a five-year backup of all bettor and operation data, updated at least every 24 hours and integrity-tested at least every seven days, standardised transmission to SIGAP, the bet.br domain, and certification by entities the SPA has authorised. This page is engineering reading of public texts, not legal advice.
On this page
This page is an engineering reading of published regulatory texts, not legal advice, and it says nothing about which operators hold authorisations. Confirm every requirement for your own case with Brazilian counsel. Sources read on 2026-09-23; the ordinances are amended often, and the regulator's own index is the place to check what is current.
Where the rules live
The SPA publishes its own index of the legislation for fixed-odds betting, links each item to the Diário Oficial da União and keeps it current — the page carried "Atualizado em 21/09/2026" when it was read.[3] That index, not a summary written elsewhere, is where a platform team should start, because ordinances in this area are amended several times a year: Ordinance 1.231/2024 alone has been altered repeatedly since it was issued.[3]
| Document | Date | What the index says it covers |
|---|---|---|
| Lei nº 14.790 | 29 December 2023 | "Regulamenta a exploração da aposta de quota fixa e inclui os jogos online nessa categoria"[3] |
| Portaria SPA/MF nº 300 | 23 February 2024 | "Estabelece os requisitos para homologação das entidades certificadoras de plataformas de apostas e jogos online"[3] |
| Portaria SPA/MF nº 615 | 16 April 2024 | "Estabelece regras gerais para transações de pagamento na operação de modalidade lotérica de apostas de quota fixa"[3] |
| Portaria SPA/MF nº 722 | 2 May 2024 | "Estabelece regras gerais para o funcionamento dos sistemas de apostas e de fornecimento de dados para o Sigap na operação de modalidade lotérica de apostas de quota fixa"[3] |
| Portaria SPA/MF nº 827 | 21 May 2024 | "Estabelece as regras para que as empresas operadoras de apostas que quiserem operar de forma legal no mercado nacional possam solicitar autorização"[3] |
| Portaria SPA/MF nº 1.143 | 11 July 2024 | "Dispõe sobre políticas, procedimentos e controles internos de prevenção à lavagem de dinheiro, do financiamento do terrorismo e da proliferação de armas de destruição em massa"[3] |
| Portaria SPA/MF nº 1.231 | 31 July 2024 | "Estabelece regras e diretrizes para o jogo responsável e para as ações de comunicação e marketing, e regulamenta os direitos e deveres de apostadores e de agentes operadores"[3] |
What the law itself requires of the system
These come from the consolidated text of Law 14,790/2023 on the Planalto site. Each one lands in the platform long before the technical ordinances are opened.
| Requirement in the law | What the platform has to do |
|---|---|
| Identity procedures must verify that the bettor's identity is valid, "exigida a utilização da tecnologia de identificação e reconhecimento facial", including checking the information against public and private databases where necessary (art. 23, caput and §1)[1] | A registration flow that calls a face-match and document provider and blocks activation until it returns, rather than a check bolted on afterwards |
| Identity must also be confirmed through channels given at sign-up, "tais como, e-mail, serviço de mensagens curtas (short message service - SMS) ou aplicativos de mensagens" (art. 23, §2)[1] | A verified-contact state on the account, and a confirmation step that can be re-run |
| Operators must monitor bettor activity to identify gambling harm "desde o momento em que uma conta é aberta", on spend, spending patterns, time played, behaviour indicators, bettor-led contact and use of gambling-management tools (art. 23, §3)[1] | Behavioural signals computed from the ledger and session data from the first deposit, not a report produced monthly |
| A user-activated time-limit feature with at least the options "24 (vinte e quatro) horas", "1 (uma) semana", "1 (um) mês" and any other period the bettor may reasonably request, up to six weeks (art. 23, §4)[1] | A pause state on the account with scheduled expiry, enforced at login and at bet acceptance |
| Transactional accounts and any financial service that lets a bettor deposit, withdraw or receive prizes may be offered only by "instituições brasileiras autorizadas a funcionar pelo Banco Central do Brasil" (art. 22, caput)[1] | A cashier restricted to authorised institutions, with the institution recorded on every movement |
| Bettors' funds in those accounts "constituem patrimônio separado", do not answer for the operator's obligations and do not form part of its assets in bankruptcy or judicial recovery (art. 22, sole paragraph)[1] | A ledger that keeps player balances separable and reconcilable against the transactional account at any moment, not netted into company cash |
| The operator, and the financial and payment institutions it contracts, must keep "o registro de todas as operações realizadas, incluídos as apostas realizadas, os prêmios auferidos, e os saques e depósitos nas contas transacionais" (art. 24)[1] | Bets, prizes, deposits and withdrawals designed as first-class records with their own fields — not reconstructed later from application logs |
| Only companies "constituídas segundo a legislação brasileira, com sede e administração no território nacional" are eligible, and the regulation must require a Brazilian partner holding at least 20% of the capital (art. 7, caput and §1, IX)[1] | A Brazilian legal entity owns the authorisation, the contracts and, in practice, the operational access to the system |
| The fixed authorisation fee is capped at "R$ 30.000.000,00 (trinta milhões de reais)" for the use of three commercial brands per authorisation act (art. 12, sole paragraph), and the authorisation may be granted for five years (art. 5, III)[1] | Brand becomes a dimension of the data model — accounts, wallets, limits, reports — because three brands share one authorisation |
The regulator restates the brand rule in its own words: companies pay an authorisation fee of R$30 million, "Cada outorga permite que a empresa tenha até três marcas (bets)", and a company that wants more brands must pay a new one, valid for five years.[2] It also states plainly that only Brazilian companies may operate, and that a foreign group must set up a national subsidiary with a CNPJ, headquarters in Brazil, Brazilian statutory directors and a Brazilian partner holding at least 20% of the capital.[2]
What the regulator says about the platform rules
On retention, the SPA states that operators must keep an updated backup "pelo prazo mínimo de cinco anos, de todos os dados relativos aos apostadores e às operações", under Annex I of Ordinance 722/2024, that "A atualização dos dados deve ocorrer ao menos a cada 24 horas" and that integrity and correspondence "devem ser testadas a cada sete dias, pelo menos".[2] Three separate engineering obligations sit in that sentence: retention, a backup cadence, and a scheduled restore-and-compare test whose result somebody has to be able to show.
On the security requirements of Ordinance 722/2024, the SPA lists "controle para prevenção de acesso não autorizado (inclusive por funcionários das empresas de apostas), proteção contra hackers, localização segura de servidores, backup e alteração de dados, plano e fornecimento de energia ininterrupta, plano de continuidade de negócios, entre outros".[2] The parenthesis is the one to design for: the control has to hold against the operator's own staff, which makes privileged access, segregation of duties and an audit trail over back-office actions part of the platform rather than of company policy.
On identity and money, the SPA states that every bettor has to be identified with documents and a "sistema de reconhecimento facial com prova de vida", and has to register a bank or payment account in their own name that is "a origem e o destino de todos os recursos que enviar ou receber da empresa de apostas"; operators are forbidden to accept deposits from any other bank account, and deposits or prizes in cash or by boleto are prohibited.[2] In the platform this is a closed loop: a registered instrument per bettor, name and document matching on both legs, and no payment method outside the permitted set.
On the public face of the system, the SPA states that authorised companies use the Brazilian internet domain "com a extensão 'bet.br'".[2] On certification, it states that from 1 January 2025 operators may only offer online games "encaminhados via Sigap e certificados pelas cinco entidades certificadoras habilitadas pela SPA" — certification is a gate on the catalogue, not a document filed once — and the requirements those certifying entities are authorised against are set by Ordinance SPA/MF 300/2024.[2][3] On supervision, it states that the sports-betting and online-game platforms may be accessed by the SPA "de forma remota ou presencial, para fins de supervisão" from 1 January 2025.[2]
Reporting to SIGAP
Reporting is an integration, not a spreadsheet. The SPA states that operators must transmit "informações padronizadas sobre os apostadores, dos dados agregados do agente operador, das apostas e das carteiras de apostadores, conforme o Manual Sigap",[2] and its SIGAP page publishes the pieces a team needs to build against: a first-access manual, a technical manual for "envio e validação de dados", a guide to "integração ao SIGAP e envio de dados via API", a data model and XSD files.[4] XSD schemas mean the submission is validated against a contract the regulator owns, so field-level changes on your side become releases on a schedule you do not control.
Building to these rules
None of this is exotic engineering once it is written into the design before the first line of code: a ledger with the required fields and a separable player balance, a registration flow that owns identity and the registered payment instrument, a responsible-gambling service with pause states and scheduled expiry, an access model that assumes the insider threat, and a reporting pipeline built against the regulator's schemas. It becomes expensive when it is added afterwards to a platform that was designed elsewhere — which is why the market count is one of the first cost drivers on what a sportsbook platform costs. What settlement does when a match peaks is in settlement lag at match peaks, and the responsible-gambling side is in responsible gaming technology.
What this page does not cover. The article-by-article technical annexes of Ordinance 722/2024, and the detail of Ordinances 1.143/2024 and 1.231/2024, are published in the Diário Oficial da União and reached from the regulator's own index.[3] They are not summarised here, because summarising a text this page has not read in its official source would be worth less than a link to it.
Frequently asked questions
Law 14,790/2023 and the SPA/MF ordinances indexed by the regulator: 300/2024 on authorising certifying entities, 615/2024 on payment transactions, 722/2024 on how betting systems work and how data reaches SIGAP, 827/2024 on the authorisation procedure, 1.143/2024 on anti-money-laundering controls and 1.231/2024 on responsible gambling.[3] The index links each one to the Diário Oficial da União and is the place to check what is current.
The SPA states a minimum of five years of backed-up data covering bettors and operations, under Annex I of Ordinance 722/2024, with updates at least every 24 hours and integrity tested at least every seven days.[2]
Only between a bank or payment account registered in the bettor's own name and the operator, through Brazilian institutions authorised by the Central Bank; deposits from any other account are forbidden, and cash and boleto are not allowed.[1][2] Bettors' funds in transactional accounts are separate patrimony that does not answer for the operator's obligations.[1]
Disclosure: this page is published by amBrain. From amBrain's iGaming services: "Casino platform development with online casino games, sports betting engine, and player management." Every regulatory fact above comes from the consolidated law on the Planalto site or from the SPA's own pages on gov.br, read on 2026-09-23, and links to it. Not legal advice; no statement is made here about any operator's authorisation.
Sources
- [1]Presidência da República (Brazil), Lei nº 14.790, de 29 de dezembro de 2023, consolidated text (arts. 5, 7, 12, 22, 23 and 24 as consolidated on the Planalto site, including amendments by Lei nº 15.358/2026), Dec 29, 2023. Regulator · checked Sep 23, 2026
- [2]Secretaria de Prêmios e Apostas, Ministério da Fazenda (Brazil), Documento de perguntas frequentes — apostas de quota fixa (header reads "Atualizado em 1º/10/24"), Oct 1, 2024. Regulator · checked Sep 23, 2026
- [3]Secretaria de Prêmios e Apostas, Ministério da Fazenda (Brazil), Legislação — apostas de quota fixa (the regulator's own index, page header "Atualizado em 21/09/2026"; each entry links to the Diário Oficial da União). Regulator · checked Sep 23, 2026
- [4]Secretaria de Prêmios e Apostas, Ministério da Fazenda (Brazil), Sistema de Gestão de Apostas — SIGAP (manuals for first access, data submission and validation, API connection and testing, plus a data model and XSD files). Regulator · checked Sep 23, 2026
Related
- Kambi alternative: rent the sportsbook or build your own
- EveryMatrix alternative: rent modules or own the platform
- BetConstruct alternative: white label, turnkey or own
- Sportsbook Postgres at Match Peaks: Hot Rows, Settlement Lag, and Bet Placement That Does Not Wait
- Building Responsible Gaming Features: A Technical Deep Dive