How to get a gambling licence in Brazil: fees and steps

Until 25 September 2026 online betting was regulated federally by a directorate of the finance ministry, not by a standalone gambling commission or by the states: the SPA authorised operators nationally and the Receita Federal collected the taxes. Since MP 1.394 no regulator licenses fixed-odds betting; the SPA keeps supervision and sanction powers over the authorised period and the wind-down, and the Ministry of Justice sanctions platforms and app stores (MP arts. 5, 22, 29).

• Until the MP the regulator was the Secretaria de Prêmios e Apostas (SPA) of the Ministério da Fazenda (Ministry of Finance), which authorised, regulated, supervised, inspected and sanctioned fixed-odds betting, prize promotions and lotteries, and supervised operators' anti-money-laundering duties (Decreto 11.907 art. 55).
• The SPA portal sits on gov.br/fazenda and publishes the register 'Empresas Autorizadas até a vigência da MP nº 1.394/2026' (85 authorisations held by 82 companies, updated 9 October 2026), the Portarias and the closed sanction procedures. The Receita Federal (federal tax authority) administered the taxes of the authorised period and administers the player income tax.
• AML supervision is shared: the Conselho de Controle de Atividades Financeiras (COAF) is the financial intelligence unit that receives suspicious-activity reports, while, since the MP, Anatel (the telecoms regulator) distributes blocking orders requested by the Ministry of Finance or the Ministry of Justice and CGI.br those for .br names (MP art. 23).

Laws that apply

• Medida Provisória 1.394 of 25 September 2026 (in force on publication, art. 30: bans the exploitation, offer, intermediation and advertising of fixed-odds betting, repeals Lei 13.756 chapter V and most of Lei 14.790, ends every authorisation on 25 October 2026; not converted into law as of 23 October 2026)
• Portaria SPA/MF 3.005 of 2 October 2026 (wind-down: balances to the SPA through SIGAP by 7 October, every duty of the authorised period met by 15 December 2026, 48-hour notice of registration changes)
• Lei 13.756/2018 (created the fixed-odds betting lottery modality, apostas de quota fixa, as a federal service)
• Lei 14.790/2023, published 29 December 2023 (the Bets regulatory framework: authorisation regime, operator and player rules, taxation)
• Lei Complementar 224/2025 of 26 December 2025 (moved a social-security share of 1% in 2026, 2% in 2027 and 3% from 2028 into what the operator pays out of the stakes, so the 12% became 13% from 1 April 2026, then 14% and 15%; also made financial institutions and persons who advertise unauthorised operators jointly liable for tax)
• Portaria SPA/MF 827/2024 (authorisation request procedure, forms and documents)
• Portaria SPA/MF 722/2024 (betting-system technical requirements, identity verification and facial recognition; Annex IV certification)
• Portaria SPA/MF 615/2024 (payment-transaction rules until 25 September 2026: Pix, TED, debit or prepaid card between the bettor's own registered account and the operator's; credit cards, cash, boletos and crypto barred)
• Portaria SPA/MF 300/2024 and 504/2024 (accreditation of certifying entities; GLI recognised by Portaria 504 of 22 March 2024)
• Portaria SPA/MF 1.143/2024 (AML/CFT reporting to COAF); Lei 9.613/1998 (money-laundering law)
• Lei 9.249/1995 and Lei 7.689/1988 (IRPJ and CSLL on operator profit), administered by the Receita Federal; Lei Complementar 214/2025 arts. 244-250 (CBS and IBS regime for lotteries and fixed-odds bets)

The enabling statute came in 2018, the operative framework in December 2023, a year of Portarias through 2024, a hard regulated-market start on 1 January 2025, and a prohibition of fixed-odds betting from 25 September 2026.

Until 25 September 2026 the single instrument was a federal authorisation granted by the SPA: a five-year term, an outorga (grant fee) of up to R$ 30 million, up to three brands, and a .bet.br domain per brand. It can no longer be applied for or renewed (MP 1.394 arts. 4 and 6).

Nobody can apply now (MP 1.394 art. 6). Until 25 September 2026 there was no direct-foreign route: the applicant had to be a Brazilian limited or joint-stock company, seated and administered in Brazil, with a Brazilian shareholder holding at least 20% of the capital.

• Until 25 September 2026 the applicant had to be a Brazilian limited company or joint-stock company with its seat and administration in Brazil (Lei 14.790 art. 7; Portaria 827 art. 4). A foreign group operated through a Brazilian subsidiary; a branch or representation of a foreign company was not eligible (Portaria 827 art. 4 '2).
• A Brazilian partner or shareholder must hold at least 20% of the company's share capital (Lei 14.790, art. 7 requirements).
• The controlling group must include a member with proven experience in betting, games or lotteries, and must pass fit-and-proper / clean-record checks (criminal and tax certificates).
• A controlling partner or shareholder may not hold a direct or indirect stake in a Brazilian football corporation (Sociedade Anônima do Futebol) or professional sports organisation, nor manage a Brazilian sports team, to guard against integrity conflicts.
• Financial thresholds are set by SPA regulation rather than in the statute: a minimum share capital of R$ 30 million and a minimum financial reserve of R$ 5 million are required (see section 5).

Until 25 September 2026 filing ran through SIGAP under Portaria SPA/MF 827/2024: the applicant lodged the request and documents, and the SPA had 150 days to notify it before the outorga fell due. No application route is open now.

• The authorisation request and its forms and required documents are set by Portaria SPA/MF 827/2024: corporate documents and the group structure, the Brazilian partner's 20% stake, administrator and beneficial-owner documents, federal, state and municipal tax and labour certificates, criminal-record and court certificates, and the economic-financial and technical documents; proof of paid-up capital and of the reserve was presented within 30 days of the SPA's notification, not with the application (Portaria 827 arts. 8-12, 14).
• The SPA had to notify the applicant within 150 days of the SIGAP filing, either to pay the outorga and present the closing documents or that the request was refused (art. 16); the clock stopped while the applicant answered a request for complementary documents, due within 15 days (art. 13 ''1-2).
• After the SPA notified approval, the R$ 30 million outorga had to be paid by GRU within 30 days, with the reserve, capital, net-worth, certificate and customer-service proofs (Portaria 827 arts. 14 and 17; Lei 14.790 art. 13); the authorisation was then granted by portaria in the DOU (art. 18).
• Until 25 September 2026 there was no application window (Lei 14.790 art. 9; Portaria 827 art. 5 III). Applicants that filed in the first 90 days after Portaria 827 (21 May 2024) were promised notification within 180 days and a decision by 31 December 2024 (art. 23). Since 25 September 2026 no application route is open and requests not decided that day are 'prejudicados' (MP art. 6 sole paragraph).
• On top of the fee and capital, operators had to certify the system (see section 6) and keep certification, capital and the reserve current.

Until 25 September 2026 the betting system and each online game had to be certified against the SPA technical requirements by a certifying body recognised by the SPA, with the certificate issued for Brazil.

• Portaria SPA/MF 722/2024 sets the technical and security requirements for betting systems: the betting system (sports-betting and online-game platforms) had to be certified against its Annexes I, II and III, and each online game was certified separately (Portaria 1.207/2024); Annex IV covers operating and security practices and is filed as an evaluation report.
• Certificates had to be issued by a certifying body recognised by the SPA under Portaria SPA/MF 300/2024; the SPA legislation list names Gaming Laboratories International (Portaria 504 of 22 March 2024), eCOGRA (588), BMM Spain Testlabs (603), Gaming Associates Europe (749) and others.
• Within 90 days after its authorisation was published the operator also had to file an evaluation report on the Annex IV requirements (operating and security practices), revalidated annually (Portaria 722 art. 8).
• Data location: the betting system and its data had to be in data centres in Brazil (with a replica in Brazil if any part was abroad) and could be abroad only in a country with a legal cooperation agreement with Brazil; the data centre had to hold ISO 27001 (Portaria 722 art. 4).
• Player onboarding, payments and self-exclusion controls (see section 7) must be built into the certified system before real-money play.

Until 25 September 2026 Brazil layered strict identity, payment and self-exclusion rules on top of the authorisation. Anonymous play is effectively barred, and only account-to-account payment methods are allowed.

• Identity verification is mandatory at registration: the player's CPF (national tax ID) must be validated, and Portaria SPA/MF 722/2024 requires facial recognition to confirm the account holder and block minors and impersonation. Players must be 18 or over.
• Re-authentication is required periodically (a new login after inactivity, and periodic biometric re-checks), so the identity link is maintained through the session, not just at sign-up.
• Payments are tightly channelled by Portaria SPA/MF 615/2024: until 25 September 2026 deposits, withdrawals and prize payments could be made only by Pix, TED, debit or prepaid card or a book transfer within one institution, between the bettor's registered account and the operator's. Cash, boletos (payment slips), cheques, crypto-assets and credit cards were prohibited, as were transfers from third parties.
• Until 25 September 2026 a centralised self-exclusion platform kept by the SPA, reached with a gov.br login, let a player bar their CPF from all federally authorised betting sites, for a fixed term or indefinitely (Portaria 1.231 art. 2 XXIII; the SPA describes a minimum of one month).
• Operators must report to the SPA on a regular (monthly) basis and keep records for the retention period set by the AML rules (at least five years).

Until 25 September 2026 advertising of licensed betting was regulated by the SPA itself (Lei 14.790 art. 16; Portaria 1.231 Chapter III; Portaria Interministerial 73 of 10 July 2026 on consumer protection). From 25 September 2026 all advertising, marketing and sponsorship of fixed-odds betting is prohibited in any medium (MP art. 16).

• From 25 September 2026 nobody may advertise or sponsor fixed-odds betting in any physical or digital medium, including content aimed at the Brazilian public from abroad; material and sponsorship signs had to be withdrawn within ten days (MP art. 16 and ''1-2). Content published before the MP that shows betting only incidentally is outside the ban (art. 17).
• Until 25 September 2026 advertising could not target persons under eighteen, present betting as a source of income or as an alternative to employment, or run without the age-classification notice (Lei 14.790 art. 17; Portaria 1.231 art. 12).
• Breach of the ban is abusive advertising under Consumer Code art. 37 §2, enforced by the consumer-defence system (MP art. 18), and the Ministry of Justice sanctions internet platforms, app stores and operating systems that do not prevent the banned content (MP arts. 19-22; fines up to 10% of the group's turnover in Brazil). Until the MP, operators also had to belong to an advertising-monitoring body (Portaria 1.231 art. 16).
• Until 25 September 2026 player-protection duties included self-exclusion, deposit and time controls, clear odds and rules disclosure, and responsible-gambling messaging within the product.

Betting operators were obliged entities under Brazil's anti-money-laundering law and had to report to the COAF financial intelligence unit; MP 1.394 arts. 10 and 11 keep the AML, responsible-gambling, integrity, five-year data-retention and SIGAP-reporting duties for the wind-down of the authorised period.

• Operators are subject to Lei 9.613/1998 (the money-laundering law) as obliged entities, with customer due diligence (KYC), beneficial-owner identification, record-keeping and a compliance function.
• Portaria SPA/MF 1.143/2024 requires operators to report atypical or suspicious movements to the COAF and to preserve data for at least five years.
• The identity regime (CPF plus facial recognition), the own-name PIX/TED/debit-only payment rule and the ban on cash and crypto together narrow anonymous funding channels and support the AML program.
• Lei Complementar 224/2025 art. 6 made financial institutions and persons who advertise unauthorised operators jointly liable for tax; Lei 15.358 of 24 March 2026 added account blocking and Pix and fraud-sharing duties (Lei 14.790 arts. 21-A, 24-A to 24-C); and from 25 September 2026 payment institutions may not process fixed-odds transactions (MP art. 14).

Until 25 September 2026 the operator paid out 12% of the stakes after prizes to legal destinations plus a social-security share (13% from 1 April 2026, 14% in 2027, 15% from 2028); players paid 15% income tax on net annual prizes above the first band of the annual IRPF table; and the ordinary corporate taxes applied on top. These rules are repealed from 25 September 2026 and apply only to facts of the authorised period, to be settled by 15 December 2026 (MP art. 29; Portaria 3.005 art. 5).

Until 25 September 2026 the SPA policed the market through sanctions, payment blocking and site blocking; since MP 1.394 the target is all fixed-odds supply: sites and apps offline, payments cut, platforms and app stores obliged to remove content.

• Since 25 September 2026 the Ministries of Finance and Justice may request the blocking or redirection of sites that offer fixed-odds lotteries; Anatel distributes the orders to telecoms providers and CGI.br to .br domain names (MP art. 23). At the 2 October 2026 briefing the Ministry of Justice and the SPA reported 10,435 sites sent for blocking from 25 September to 1 October, 186 apps notified for withdrawal from the Apple and Google stores and 3,040 social-media pages, profiles and channels reported for removal.
• Payment blocking is a core tool: under Lei 14.790 art. 21-A (added by Lei 15.358/2026) and Decreto 13.033 of 19 June 2026 the SPA notifies banks and payment institutions to block an irregular operator's accounts, and forfeiture of the blocked funds is declared in an administrative process; from 25 September 2026 payment institutions may not process fixed-odds transactions at all (MP art. 14).
• Since 25 September 2026 offering fixed-odds betting in Brazil is prohibited, including by operators abroad serving people in Brazil (MP art. 1). Sites and apps had to be unavailable from 6 October 2026 and bettors' balances were refunded through the banks (SPA timetable, 9 to 14 October); operators had to pay balances not claimed to the SPA through SIGAP by 7 October and meet every duty of the authorised period by 15 December 2026, with penalties under Lei 14.790 art. 41 and a fine of R$ 200,000 a day for breach of the wind-down duties (Portaria SPA/MF 3.005; MP art. 8 '2).
• On market size: the SPA register 'Empresas Autorizadas até a vigência da MP nº 1.394/2026' (updated 9 October 2026) lists 85 authorisations held by 82 companies, with 188 brand entries and 185 distinct .bet.br domain names. All authorisations ended on 25 October 2026. On 23 October 2026 the formerly authorised brands showed the federal block page or a notice that deposits, bets and registrations are suspended; a few offshore sites under Curacao companies were still reachable on some attempts.

There is no route to a live operator since 25 September 2026: no application can be made and every authorisation ended on 25 October 2026 (MP 1.394 arts. 4 and 6). The steps below are the route an operator followed until 25 September 2026, kept as the record of the old regime. There was no direct-foreign route: the holder had to be a Brazilian-incorporated company with a 20% Brazilian partner.

1. 01

   Scope the model and budget the full cost stack

   Planning

   Decide which products to run (sports betting and online games could sit inside one authorisation) and budget the fixed costs: the R$ 30 million outorga, R$ 30 million paid-up capital and net worth, the R$ 5 million financial reserve, the monthly supervision fee from R$ 54,419.56, the 12% (13% from 1 April 2026) payout of the stakes, and corporate tax (IRPJ 15% plus surcharge, CSLL 9%) on profit.

2. 02

   Incorporate the Brazilian vehicle with a 20% Brazilian partner

   Structuring

   Constitute (or acquire) a company under Brazilian law with headquarters and administration in Brazil and a Brazilian partner holding at least 20% of the share capital (Lei 14.790 art. 7). Ensure the controlling group includes a member with betting/gaming/lottery experience and no conflicting football-club (SAF) stake.

3. 03

   Capitalise the company and post the reserve

   Financial

   Meet the SPA financial thresholds: R$ 30 million paid-up capital and net worth, and a R$ 5 million financial reserve in federal bonds. Proof was presented within 30 days of the SPA's notification, not with the application (Portaria 827 arts. 11 and 14). These are separate from the outorga.

4. 04

   Assemble the Portaria 827 dossier and clear fit-and-proper

   Compliance

   Prepare the documents required by Portaria SPA/MF 827/2024: bylaws, capital and reserve proof, the Brazilian partner's 20% stake, administrator and beneficial-owner records, and criminal and tax clearance certificates. Answer any request for complementary documents within 15 days (art. 13).

5. 05

   File the authorisation request with the SPA

   Regulatory

   Lodge the request through SIGAP under Portaria 827. The SPA had to notify within 150 days of the filing (art. 16). The authorisation covered up to three brands and ran five years.

6. 06

   Pay the R$ 30 million grant fee within 30 days of approval

   Financial

   After notification, pay the outorga of R$ 30 million by GRU within 30 days (Portaria 827 art. 17). Failure to pay in time ended the procedure or lapsed the authorisation (Lei 14.790 art. 13).

7. 07

   Register the .bet.br domain(s)

   Technical / brand

   Register a .bet.br domain for each brand (up to three per authorisation; IN 11/2024). The electronic channels had to use exclusively the .bet.br domain (Portaria 1.231 art. 20 '1).

8. 08

   Certify the betting system for Brazil

   Technical

   Have an SPA-recognised certifying body (for example GLI, Portaria 504/2024) certify the system against Annexes I to III of Portaria SPA/MF 722/2024 and each online game under Portaria 1.207/2024, with certificates issued for Brazil; the Annex IV evaluation report on operating and security practices was filed within 90 days after the authorisation was published.

9. 09

   Localise data and connect to SPA monitoring

   Technical

   Keep the betting system and its data in data centres in Brazil (abroad only in a country with a legal cooperation agreement, with a replica in Brazil), and connect the operation to the SPA's data feed and reporting through SIGAP (Portaria 722).

10. 10

    Stand up player identity, payments and self-exclusion

    Compliance / product

    Implement CPF validation and facial recognition at onboarding (Portaria 722), 18+ enforcement, own-account Pix, TED, debit or prepaid payments with no credit cards or crypto (Portaria 615), and integration with the SPA centralised self-exclusion register through SIGAP (IN SPA/MF 31/2025).

11. 11

    Register for taxes with the Receita Federal

    Tax

    Register for the monthly supervision fee, the allocation of the stakes (12%, 13% from 1 April 2026, then 14% and 15% under LC 224/2025) and the corporate taxes (IRPJ and CSLL). The player's 15% IRPF on net annual prizes is assessed and paid by the bettor. All of these now apply only to facts of the authorised period, to be settled by 15 December 2026.

12. 12

    Stand up AML and advertising compliance, then go live

    Compliance / marketing

    Implement the Lei 9.613 AML program with COAF reporting and 5-year retention (Portaria 1.143), align advertising with Portaria 1.231, then launch on the .bet.br domain and file the reports through SIGAP while keeping certification, capital and reserve current. Advertising of fixed-odds betting has been banned since 25 September 2026 (MP art. 16).

Tier-ordered: official government first, then practitioner, then trade media. Every primary figure was read from the in-force text on 26 Oct 2026.