Brazil’s newly regulated online betting market officially came into effect on January 1, 2025. It brought in a set of demanding standards, aiming to ensure consumer protection and rigorous oversight by the Ministry of Finance.
From day 1, the Federal administration started receiving bettor registration data. The financial flow monitoring affects both gambling platforms and players, with real-time data transfer handled by the government’s Betting Management System (Sigap). Regulators reported initially a “staggering” process due to the large volume of transactions involved.
The Big Picture – What Changes Come into Effect in 2025
- Last year, the Ministry of Finance said that 66 iGaming companies successfully completed the application for licensed operations in Brazil.
- However, only 14 have met all criteria for permanent licenses coming into 2025. These include top 10 operators like Betano, KTO and Estrela Bet. The rest have been granted provisional licenses and are due for an imminent review.
- Apart from obtaining an exclusive domain bet.br, all licensed operators must comply with the requirements set forth in Law 14.790/2023 on consumer protection, responsible gaming, fiscal transparency and game certification.
- Crucially, players must also voluntarily migrate to the regulated market. Above all, they must re-register with facial recognition and maintain a valid bank account for gaming transactions.
How Migration to bet.br achieves a safer environment and ensures market stability
The Brazilian government has recently taken an active role in tackling unlicensed gambling operators. Working alongside the National Telecommunications Agency (Anatel), it began blocking unauthorized websites as of October 2024.
It is also engaging financial institutions to restrict payments and transfers to sites lacking official authorization. These measures aim to push back illegal operators and protect bettors, as legitimate sites can only operate with the domain “.bet.br,” ensuring greater transparency. Should unauthorized operators attempt to skirt the rules, banks may refuse to process related transactions.
So far, the 14 companies with definitive authorization can each operate up to 3 brands per license. The other 52 have received provisional authorizations but must resolve pending documentation issues – particularly system certifications – within 30 days (renewable once for another 30 days).
Online gambling brands that have failed to meet all requirements face a denial of authorization, though they may file an administrative appeal. State governments retain authority to accredit betting sites within their jurisdictions, albeit restricted to local operations and promotions.
Responsible Gambling as a Cornerstone of aYoung Regulated Market
Betting companies must also implement “responsible gaming” measures such as deposit limits, betting frequency controls, and automatic alerts to help deter addiction and over-indebtedness.
Meanwhile, the Ministry of Finance will cross-check players’ wager amounts against their declared income, with a view to identifying suspicious patterns.
Why the new registration and KYC process is safer for consumers
Prior to the implementation of the full registration process required by Law 14.790/2023, it was sufficient for the now licensed operators to verify email accounts or, in fewer cases, ask players to upload a copy of their ID.
Still, this two-step verification process could not completely prevent the use of an account by a third party the way facial recognition can.
As someone who has personally gone through the new registration and KYC process of the top 10 licensed gambling operators in the Brazilian market, I will now describe it step by step. Field tests were conducted both on December 31, 2024, as well as January 1 and 2, 2025.
The order in which each step of the process was performed by the 10 different operators varied, as did the ability to provide a quality user experience. Regardless, it is important to note that any technical issues encountered on January 1 may have been resolved and the user journey updated by the time of writing.
Account verification
Account verification is necessary when migrating an existing account or registering a new one. Most operators therefore send a code either by e-mail or mobile phone.
- Legal basis: Licensed operators must implement measures to ensure the identification and verification of customers.
- Purpose: Avoids unauthorized access to the platform. It also protects users and makes it easier to recover an account if, for example, a password is forgotten.
In this regard, the best practice is to provide the code to the user immediately. However, on January 1, some platforms that required email or mobile phone verification for registration failed to send the code.
ID copy upload
Whether on desktop or mobile, uploading a copy of an ID is generally a simple process on most gambling platforms.
- Legal basis: The law requires operators to verify the identity of players to prevent underage gambling and ensure compliance with anti-money laundering regulation.
- Purpose: Ensures that customers are properly identified for financial transactions. It also helps complying with responsible gambling policies.
During the test, instructions were clear and it was possible to upload either images or PDFs of the front and back of the document, with two exceptions.
One of the platforms required that the files be named exactly as shown in an illustration, however, with no instructions. Several attempts were made to accomplish this before it was finally guessed. Another only required PDFs, but did not recognize PDF files.
Therefore, the best practice is to clearly instruct users to upload different permitted file types (e.g., jpeg and pdf) without requiring that the files be named in any particular way – especially considering that most players are likely to be using their mobile phones.
Facial recognition
Using a camera, facial recognition translates facial features into numerical, computer data. This data is then compared to stored templates to identify a person.
- Legal basis: Facial recognition is specifically required by Law 14.790/2023.
- Purpose: Prevents minors from gambling – as well as the illicit use of player accounts by third parties
This popular technology, which is used to secure online banking transactions as well as to protect smartphones, was generally well deployed by the gambling operators tested.
To complete the process, users must tilt their head to both sides while placing their face in a frame. If done correctly, the gray bar around the frame will turn green.
Surprisingly, though, two legal operators had no facial recognition requirements at all, either for registration or deposits. While one was limited to operating in a single Brazilian state different from where it was tested, the other did not even display information in Portuguese, let alone on deposit and withdrawal limits.
Another platform, although accessed from the desktop, required users to scan a QR code, which resulted in the entire facial recognition process being completed on the mobile device. This method proved to be arbitrary and the process did not run smoothly on the smartphone.
Therefore, in addition to providing an intuitive solution, best practice includes respecting the user’s choice of device – either mobile or desktop.
Valid bank account
Registering a valid, personal bank account, consistent with the user’s documents, is necessary for both deposits and withdrawals from licensed gambling platforms.
As for instant payment (PIX), withdrawals will be directed to the bank account whose PIX key is the user’s Individual Taxpayer Registry (CPF), which has the same result.
- Legal basis: Every financial transaction must be connected to a verified bank account.
- Purpose: Ensures secure transfers of funds and that winnings are credited to the rightful account holder.
Initially, on December 31, the only platform that required a personal bank account during the registration process was also the only one that had technical problems recognizing it. The issue was resolved by January 1.
Best practice in this regard is to provide the website or mobile app with the ability to recognize all Brazilian bank numbers, as well as the different combinations of numeric codes used to identify bank accounts.
Geolocation
If an online casino site is not hosted in Brazil, it means that taxes are not paid and thus there is no benefit to Brazilian citizens from its operation.
Additionally, players are exposed to the risk of placing bets on non-certified versions of casino games and being prevented from withdrawing their funds.
By regulating the jurisdiction of the licenses provided for its iGaming industry, Brazil has therefore promoted a much safer environment.
- Legal basis: Online gambling operations are subject to authorized jurisdictions, i.e., the entire national territory or a single Brazilian state.
- Purpose: Enforces legal compliance and protects players from illegal, unsafe platforms.
Again surprisingly, two licensed online casino and sports betting sites performed migration and registration without checking location on either desktop or mobile.
The best practice in this regard is to verify the location of players to prevent unauthorized access, thereby enforcing consumer protection.
New withdrawal time limit
The regulation states that players can withdraw their money at any time, while a normative ordinance specifies a time frame.
- Legal basis: According to the Prizes and Betting Office’s Normative Ordinance No. 615, of April 16, 2024 the process must not exceed 120 minutes from the request.
- Purpose: Protects consumers by reducing the time it takes to receive payouts. Importantly, the rule itself justifies migration to licensed platforms.
During the test, most of the platforms that worked without errors performed an immediate withdrawal. Only one took exactly 120 minutes. Best practices are therefore already in place among Brazil’s top operators.
Public perception of the changes in registration
We used Google Trends to assess public perception of the changes after the registration and KYC process improvements were implemented on January 1.
At the time of writing, there was a spike in searches for betting platforms that don’t perform verification (blue) in the 7 days following the changes. In comparison, searches for betting platforms that don’t perform facial recognition (red) were negligible.
Source: Google Trends
Therefore, not only did the former peak significantly on two specific days, but it also peaked toward the end of the period, indicating increasing interest in this topic. On the contrary, facial recognition technology itself does not appear to be a concern for players.
Additionally, when looking at player interest in illegal betting platforms (red) compared to searches for legal betting platforms (blue) over the same period, it is clear that interest in licensed operators is also on the rise and more intense.
Source: Google Trends
This raises speculation, but not about how deeply the players understand that the main purpose of regulation is to benefit them.
According to ENV Media research, the vast majority of Brazilian gamblers – 92% – support the idea that the government should enforce specific laws for the iGaming sector.
Source: ENV Media
Although Law 14.790/2023 provides that operators should comply with it through implementing measures, in addition to requiring facial recognition technology, it is not as specific regarding other relevant processes.
Therefore, the issue at hand is likely to be more related to both consumers’ lack of prior knowledge of the changes and the quality of the technical measures taken to comply with the legal requirements.
Why Offshore Casinos Don’t Measure Up
To demonstrate how regulation benefits customers, we tested a sample of 116 offshore casino platforms operating illegally online in Brazil. The complete results of our test are shown below.
Among the platforms tested, 26.27% simply display the “br” suffix for the country, or use “Brazil” in their names to pass as local and therefore legitimate, even though they operate offshore.
One brand with multiple websites even redirects its websites from a “com.br” domain to an offshore “.com”. Thus, their relationship with potential customers is based on deception from the start.
Of those not yet blocked by ANATEL – 80.51% – it was not possible to register by simply using a fake email address at 22.03% . Only 1.69% – representing 2 platforms owned by the same brand – block registration from Brazil.
Moreover, licensed iGaming platforms comply with Brazil’s General Data Protection Law (LGPD), Law No. 13,709/2018, ensuring that citizens’ sensitive information is protected from third parties.
On the one hand, illegal online casinos are already evading the law, so no one should expect that their sensitive information such as CPF number, address or phone number will not be disclosed or protected from fraud.
On the other hand, there is no guarantee that the 22.03% that require valid personal information will return payouts. In addition, there will be no tax payments for the benefit of Brazilian society.
In Brazil, Article 29, Item I of Law No. 14.790 establishes the prohibition of offering welcome bonuses under any form such as free spins. The purpose of this policy is to foster responsible gambling. However, 60.17% of illegal casinos offer welcome bonuses.
Clearly, this belies the claim of supporting responsible gambling policies displayed on their pages. In this sense, offshore casinos also do not provide any resources so players can limit deposits.
Ultimately, the regulation prevents risks to players at all levels – financial, ethical, social, psychological. It promotes gambling as entertainment, educates customers and protects their rights.
Next Steps in 2025
The Ministry of Finance plans to publish a formal report later in the year, once it has a reliable pool of data. Up to now, the only available figures were those from a Central Bank estimate indicating R$20 billion in monthly bets (via Pix between January and August 2024) but numbers have been contested by industry experts.
Over the next six months, the government will process the influx of bettor data, verifying the efficacy of current regulations. Additional measures, such as credit card controls and stricter rules to safeguard vulnerable populations, could be adopted should the initial regulations prove insufficient.
In short, Brazil’s new regulatory framework signals a significant tightening of oversight and protection within the betting market, aiming to balance commercial growth with consumer well-being.
Key Facts
- The Ministry of Finance now receives bettor registration data and will soon receive financial transactions.
- Full migration requires bettors to re-register, including facial recognition and bank account linkage.
- 14 companies have received definitive authorization, each covering up to three brands.
- 52 companies hold provisional authorizations, pending required documentation within 30–60 days.
- R$30 million grant payment is one of the prerequisites for provisional or definitive licensing.
- Betting data is transferred via the Betting Management System (Sigap).
- The Ministry of Finance intends to release a market report after at least six months of data collection.
- The Central Bank previously estimated R$20 billion in monthly Pix transfers to betting sites (January–August 2024).
- Illegal betting sites face shutdowns by Anatel and financial blockades by banks.
