iGaming platform for the Brazil market

The Brazil iGaming market is the largest newly regulated online gambling market in the world: a country of more than 200 million people that moved from gray-market betting to a full federal licensing regime that went live on January 1, 2025. It is regulated by the Secretaria de Prêmios e Apostas (SPA) within the Ministry of Finance, under Law 14,790/2023, which covers both fixed-odds betting and online casino games. For operators, Brazil combines enormous demand with a young, prescriptive rulebook — mandatory .bet.br domains, SIGAP reporting, facial-recognition KYC, Pix-only payment rails and a ban on welcome bonuses — and the platforms that win are the ones built for those rules, not adapted to them after launch.

Regulatory status

Brazil's path to regulation ran in three stages. Law 13,756/2018 legalized fixed-odds sports betting in principle but left it unregulated for five years, creating the gray market that dominated Brazilian sport sponsorship. Law 14,790/2023, passed in December 2023, created the actual licensing framework — and, decisively, extended it beyond sports betting to online casino games. Throughout 2024 the SPA published the normative ordinances covering authorization, technical certification, payments, responsible gambling and reporting, and the regulated market opened on January 1, 2025.

The model is an open federal authorization: there is no fixed number of licences and no auction. Any company that meets the corporate, financial and technical requirements can apply, which is why Brazil launched with dozens of authorized operators rather than a protected handful.

The enforcement posture matters as much as the framework. Since launch, the SPA has moved systematically against unlicensed sites — blocking orders executed through telecom regulator Anatel, payment blocking through the financial system, and public lists of authorized domains. The gray-market era that made Brazil famous is closing: the durable path to Brazilian revenue is an SPA authorization and a .bet.br domain, and each enforcement wave widens the commercial gap between licensed and unlicensed books.

Operator requirements

Licence types

Brazil issues a single federal authorization class rather than separate product licences, with online casino permitted alongside fixed-odds betting under one grant:

The three-brand allowance shapes portfolio strategy: groups running multiple brands can amortize one grant across three .bet.br properties, provided all run under the authorized entity. Multi-brand operation on a single platform instance — one wallet infrastructure, one compliance layer, per-brand front ends — is the standard architecture, and the Vuch platform's unified wallet and modular design fit this model, as described in the turnkey casino solution.

Corporate and capital requirements

• Brazilian incorporation — the applicant must be a company incorporated under Brazilian law with headquarters and administration in Brazil
• Local shareholding — at least 20% of share capital held by a Brazilian shareholder (confirm current requirement)
• Fit and proper — background checks on ultimate beneficial owners, directors and key personnel
• Technical and financial capacity — documented proof of both, including reserve requirements to guarantee player funds (confirm current requirements)

For international groups, the local-shareholding rule usually means either a Brazilian partner or a structured local vehicle; it should be resolved early because it gates the entire application.

Servers, data and local requirements

The defining local requirements are the .bet.br domain, operation through the Brazilian entity, and data flows into SIGAP, the SPA's betting management system. Player data handling must also comply with the LGPD, Brazil's general data protection law. Certification requirements under the SPA's technical ordinances govern where and how gaming systems are hosted and monitored — consult the current ordinance texts. Operators should map their hosting architecture against the current ordinance text with their platform provider rather than assuming European hosting patterns carry over.

Review timelines

The SPA processed the first application waves ahead of the January 2025 go-live, and steady-state review of a complete application runs on the order of a few months (as of 2026 — confirm current timelines with the SPA). As in every certified market, the technical dossier — lab certificates, SIGAP integration evidence, payments and KYC arrangements — is the common bottleneck, and applicants on an already-certified platform compress it substantially.

Taxes

The Brazilian fiscal stack starts with a moderate headline rate and builds from there:

• Federal gambling contribution: 12% of GGR (as of 2026 — confirm current rates)
• Corporate taxes — IRPJ and CSLL on profits, PIS/COFINS on revenue, and municipal ISS on services, which together push the effective burden on gaming revenue meaningfully above the headline 12%
• Player income tax — 15% on annual net winnings above the exemption threshold, assessed at player level (confirm current rules)

Two planning notes. First, model the full corporate stack per municipality, because ISS varies by location of the Brazilian entity. Second, the fiscal framework is young and actively debated in Congress — rate-change proposals surface regularly, so sensitivity analysis belongs in every Brazilian business case.

Technical requirements

Brazil's technical regime was written in the 2020s, and it shows: it assumes API-level regulator connectivity, biometric identity verification and instant payments as baseline capabilities, not add-ons.

RNG and game certification

Platforms and games must be certified by SPA-recognized certification laboratories — GLI and its peers — against the SPA's technical ordinances, notably Ordinance 722/2024 covering technical and security requirements for betting systems — confirm the current ordinance numbers and scope. Certification spans RNG quality, game integrity, platform security and the correctness of regulatory data capture. Every live game exposed to Brazilian players needs current certification, so per-game, per-jurisdiction certification status must be tracked and the Brazilian lobby gated accordingly — for a Vuch deployment, SPA certification is scoped in the certification roadmap, available on request.

SIGAP — regulator reporting

SIGAP (Sistema de Gestão de Apostas) is the center of gravity of Brazilian compliance. It is the SPA's betting management system, and the operator's entire regulatory relationship runs through it: onboarding into the authorization regime, monthly regulatory data files covering betting activity, and financial reporting all flow through SIGAP — confirm current requirements in the SPA ordinances.

The practical consequence for platform selection is blunt. SIGAP file formats, validation rules and submission cycles are prescriptive; a platform that produces them natively from its transaction records turns reporting into an operational routine, while a platform that does not turns every month-end into an export-transform-reconcile project with regulatory risk attached. The Vuch admin back office provides regulator-reporting tooling — reports and exports generated from platform data with a full audit trail; mapping those exports to the SIGAP file formats is deployment scope for a Brazilian launch.

National self-exclusion registry

Brazilian responsible-gambling ordinances mandate a national self-exclusion register under the SPA, which operators must check and honour, alongside mandatory operator-level exclusion and cooling-off tools — confirm the current ordinance requirements. The platform obligations follow the pattern of mature registries like GAMSTOP in the UK market:

• Check registrations and logins against the national register and block excluded players
• Apply operator-level self-exclusion with configurable periods and correct return-to-play handling
• Suppress all marketing to excluded individuals across every channel
• Keep audit evidence that each check occurred, per session

The Vuch platform provides self-exclusion integration capability; the SPA register connection and operator-level exclusion controls are implemented and certified as part of each Brazilian deployment. Related mandatory controls include facial recognition and identity verification at account opening — biometric KYC is required before play, not optional — and loss, deposit and time-limit tools per the responsible gambling ordinances — confirm current ordinance requirements.

Bonus, payment and stake restrictions

• Welcome bonuses are prohibited. Law 14,790 bans advance and sign-up bonuses — confirm the current rules — which invalidates the standard European acquisition playbook. Retention design shifts to compliant mechanics structured within the rules, and prohibited offer types must be blocked at platform level through configuration rather than marketing discipline — on the Vuch platform this is part of the jurisdiction mapping phase of a deployment
• Payments only via authorized instruments — Pix dominates Brazilian cashiering with near-instant deposits and withdrawals, while credit cards are banned for gambling funding; the cashier must enforce instrument rules at the rail level
• Advertising is subject to SPA rules plus CONAR self-regulation, including responsible-messaging and audience-protection requirements that extend to in-product promotional content — confirm current rules

What an SPA authorization does not cover

The authorization is federal and covers online fixed-odds betting and casino under Law 14,790 only. It does not cover lotteries reserved to state or federal lottery frameworks, and it does not resolve the parallel state-level betting regimes some Brazilian states have pursued, where the boundary between federal and state competence is still being litigated — confirm the current status. Certification evidence from European markets does not transfer: SPA ordinances require their own lab certification. And the rulebook is one year old — ordinances are still being refined, enforcement practice is still forming, and tax proposals are live in Congress. Operators should assume material regulatory change during their first authorization term and weight platform flexibility accordingly.

What Vuch provides for the Brazil market

• Modular platform: prediction markets, casino (30,000+ games via provider integrations), or the full stack on a unified wallet with an AMM liquidity core
• Certification roadmap: Vuch holds no SPA certification today; certification by SPA-recognized laboratories against the technical ordinances is scoped as part of deployment, with a certification roadmap and due-diligence pack available on request
• Regulator-reporting tooling: reports and exports generated from the admin back office with a full audit trail; mapping to SIGAP file formats and submission workflows is deployment scope
• Self-exclusion capability: the SPA national register integration and operator-level exclusion controls are implemented and certified per deployment; facial-recognition KYC is likewise a deployment integration
• Jurisdiction configuration: the welcome-bonus prohibition and limit tools are enforced through platform configuration during the jurisdiction mapping phase; risk-engine thresholds are tunable for Brazilian requirements
• Payments: current rails are USDT deposits and withdrawals; a fiat payment layer is on the roadmap. Brazil is a Pix-first market, so the Pix integration is a gating item and part of the deployment conversation
• Deployment timeline: white-label deployment typically takes 4–8 weeks depending on integrations and jurisdiction

Brazil is the rare market that is simultaneously huge, newly open and strictly enforced — the conditions under which technology choice compounds fastest. See the compliance suite for how jurisdiction rules and regulator reporting are managed across markets, or compare entry models with the US states and Spain market guides.