How to Get a Brazil Gambling License: 2025–26 Operator’s Playbook (Player-First, Compliance-Ready)

Want legal access to the world’s hottest LatAm market—without your cashier getting cut off? This guide shows (step-by-step) how to secure a Brazil gambling license the right way: entity, capital, fee, certificates, payments, domain, audits, RG/AML, launch, and what to do post-go-live. If you’re a player, you’ll learn the fast checks that separate a legal Brazil site from a risky .com.

TL;DR (Executive Summary)

Brazil now runs a federal authorization regime for fixed-odds betting and online gaming administered by the Secretariat of Prizes and Bets (SPA/MF) under the Ministry of Finance. A five-year authorization costs BRL 30 million and (today) permits up to three brands per grant, subject to strict KYC/AML, technical certification, specified payment rails (PIX, TED, debit/prepaid only), and “.bet.br” domain use. Operators pay GGR tax (currently 18% as of Oct 2025), monthly supervision fees, and comply with robust advertising/RG rules. Players pay 15% IRPF on net winnings above the monthly threshold, withheld at source by operators.

The practical takeaway: Brazil is no longer a “test & see” market—you need a Brazilian entity, capital, certification plan, and a go-live checklist before you ask SPA for authorization.

What “Licensed” Means in Brazil (and why players should care)

Brazil’s framework prioritizes payment safety, identity checks, fair-play certification, and accountability for marketing (including affiliates/influencers). Players get clearer rights, a complaints path, and tax clarity. For operators, the upside is banking access, ad inventory, league partnerships, and long-term brand equity in a market with continent-scale demand.

Eligibility Checklist (are you even ready?)

Corporate & capital

• A Brazilian legal entity (LTDA/S.A.) with HQ/management in Brazil
• Corporate capital and financial capacity consistent with SPA rules
• Transparent ownership/beneficial owners and clean “fit & proper” profiles

People & governance

• Designated responsible director for SPA relations
• Named officers for compliance, AML, operational security/integrity, data security, ombudsman/support (no impermissible role stacking)
• Board/Risk committee cadence and minutes

Technology & content

• Platform + RGS mapped; game catalogue aligned to permitted types
• Online games and live-studio setups ready for certification
• Logging, monitoring, SIEM, and incident response playbooks

Policies

• AML program (risk assessment, KYC/CDD/EDD, transaction monitoring, SAR/STR)
• Responsible gambling: limits, self-exclusion, reality checks, vulnerable-user policies
• Advertising/affiliate governance, approvals, and RG messaging
• Payments SOP aligned to allowed rails; reconciliations & bank controls
• Privacy & data (including cross-border transfers, retention)

The Licensing Process (Operator Step-by-Step)

Time goal for a prepared applicant: ~4–6 months to authorization, then a staged certification/launch plan. Build to this choreography.

Step 1 — Scope & entity setup

• Incorporate LTDA/S.A. with HQ/admin in Brazil; update corporate purpose to include fixed-odds betting & online games.
• Lock your capital plan and banking (Brazilian PSP/Bank partners that support PIX/TED flows and KYC data exchanges).
• Decide your brand architecture (up to three brands/skins now) and product mix (sports only, games only, or both).

Step 2 — Assemble your dossier (the “authorization pack”)

• Corporate & ownership: group chart, UBOs, source of funds, shareholder registers, good-standing certificates.
• Key persons: CVs, declarations, criminal/civil/PEP checks, conflict statements.
• Business plan: Brazil market sizing, acquisition strategy, risk matrix, 36-month P&L/cash flow.
• Technology: platform/RGS architecture, environments, integrations, RNG, game catalog by type, change-control.
• Security & resilience: access control, SoD, DR/BCP, RTO/RPO, DDoS/WAF, data classification and handling.
• Payments: end-to-end flows (deposit → bet → settlement → withdrawal), reconciliations, chargeback handling, dispute queues.
• KYC/AML: onboarding, age checks, PEP/sanctions, SoF/SoW thresholds, monitoring rules, typologies, STR workflow to COAF.
• RG & advertising: tools (limits, time-outs, self-exclusion), tone/placement rules, affiliate controls, influencer policy.
• Complaint handling: ombudsman structure, SLAs, escalation to regulator/ADR.

Step 3 — File the request and pay the BRL 30m fee

• Submit your authorization request to SPA with complete annexes.
• Pay the BRL 30,000,000 concession fee and show paid-up capital as required.
• Prepare to respond to clarifications quickly (treat every info request as time-critical).

Step 4 — Lock compliance rails you must use on Day 1

• Payments: implement PIX/TED/debit/prepaid only; block credit, boleto, crypto, cash; restrict to player-owned bank accounts for deposits/withdrawals; disable P2P transfers.
• Domain: initiate “.bet.br” registration workflows once SPA notifies you in the authorization flow; align DNS/CDN/security.
• KYC: enable liveness/ID checks and sanctions/PEP at onboarding; add ongoing monitoring and SoF/SoW triggers.

Step 5 — Technical certification (parallel path)

• Contract a recognized lab and plan for at least five certificates if you run both sportsbook and online games (Platform/Betting system, Sportsbook, RGS, Integration, Online RNG).
• Deliver your evaluation report for certification within the regulator’s time windows and track lab tickets tightly.
• Maintain change-freeze windows near testing deadlines.

Step 6 — Marketing & RG readiness checks

• Review ad/communications ordinance requirements: age gating, no “easy money” claims, no minors imagery, clear RG disclaimers, and operator liability for affiliates/influencers.
• Produce creative templates with mandatory warnings, watermark “.bet.br” and age marks, and a workflow that rejects non-compliant submissions.

Step 7 — Go-live authorization and production cutover

• After SPA’s authorization act and certificate acceptance, complete the go-live checklist (monitoring dashboards, PSP go/no-go, game catalogue flags, RG banners, complaint links).
• Roll out in phases (soft launch) with elevated real-time MI to catch operational issues early.

Step 8 — Post-launch audits & reporting

• Submit monthly supervision fees and GGR taxes on time.
• File required technical and operational reports; keep an issues/resolution log.
• Prepare for a compliance audit within the first year; keep your evidence room (training, logs, controls) audit-ready.

Payments, Domain & Tech—Non-Negotiables you can’t fudge

Payments (what’s in, what’s out)

• IN: PIX, TED, bank book transfers, debit/prepaid cards only
• OUT: credit cards, boletos, cash, crypto, and unapproved intermediaries
• Rules of the road: deposits/withdrawals only to accounts in the bettor’s own name; no player-to-player transfers; auditable reconciliations

Domain policy

• Your electronic channels must operate on “.bet.br”—this is both a signal to consumers and a regulatory gate (only authorized agents can obtain it). Start registry prep early so DNS/certificates/CDN are ready when SPA calls your number.

Game & system certification

• Expect lab certification of platform and game systems, including RNG, catalogue declarations (e.g., slots, roulette, blackjack, crash), multiplier disclosure, and studio controls for live games.
• Keep release management mature: every update post-certification must be traceable with rollback capability.

Tax & Fees (budget realistically)

• Operator GGR tax: 18% of GGR (effective Oct 1, 2025), superseding 12% under the initial regime.
• Player tax: 15% IRPF on net winnings above the monthly threshold, withheld at source by the operator and credited toward the bettor’s annual return.
• Monthly supervision fee: tiered/banded; keep a table in finance ops and schedule payment before the 10th each month.
• Municipal ISS: service tax (2–5%) depending on municipality (plan location and booking carefully).
• Other levies: PIS/COFINS/CSLL/IRPJ per Brazilian tax law—model the effective rate on your post-GGR base, not headline GGR alone.

Pro tip: Build two P&Ls—base case (steady Q2–Q4) and stress case (higher tax, slower approvals, longer certification, promo caps). Price your bonus/odds/RTC with 18% GGR in mind and pressure-test cash runway.

Advertising, Sponsorship & Responsible Gambling: how to stay out of trouble

• Minors & vulnerable groups: zero tolerance—no targeting, no imagery, no youth team sponsorships.
• Content claims: ban “easy money/guaranteed profit” language; show odds, risk, and RG messages prominently.
• Affiliate/Influencer liability: you are jointly liable for their ads—centralize approvals and maintain a creative registry.
• RG tooling: limits, cool-offs, self-exclusion, and reality checks must be easy to find and easy to use; never dark-pattern the opt-out.

B2B Studios & Platforms (supplier path)

Brazil currently authorizes operators; suppliers are not licensed separately but are pulled under the regime via (i) game/system certification, (ii) integration requirements with authorized operators, and (iii) live-studio controls. If you’re a studio or platform:

• Pre-certify your RGS and game portfolio with a recognized lab (Brazil scope).
• Publish content facts: RTP/multipliers, volatility bands, paytables, contribution rules, crash/line game parameters.
• Negotiate operator-side responsibilities (incident triage, change windows, rollback plans).
• Maintain Brazil-specific builds (e.g., disable credit-linked UX, ensure Portuguese localization, RG tool hooks).

Player’s Corner: quick checks to verify a legal Brazil site

• Domain ends .bet.br and carries clear age/RG statements on every page.
• Cashier shows PIX/TED/debit only—no credit/crypto/boletos.
• Account in your name only (deposits/withdrawals to your own bank account).
• Visible complaints path and RG tools (limits, self-exclude).
• Transparent odds/multipliers and payout tables in-game.
• When you withdraw, KYC is requested once, not repeatedly without reason.

Complete, Step-by-Step Guide (Operators & Providers)

A) Corporate/Legal

1. Choose structure (LTDA vs S.A.) and incorporate.
2. Amend corporate purpose to explicitly include fixed-odds betting and online games.
3. Register tax & social obligations; open Brazilian bank accounts.
4. Appoint a responsible director for SPA relations and assign compliance/AML/IT security/ombudsman roles (no impermissible accumulation).
5. Build a capitalization plan (paid-up capital + fee payment schedule).

B) Financial architecture

6. Integrate PIX/TED rails with a reputable payment institution; enable debit/prepaid only; implement reconciliation & settlement.
7. Enforce same-name withdrawals; block third-party transfers; implement velocity and fraud rules.
8. Draft cash management policies; align treasury to monthly GGR tax (18%) and supervision fee timelines.

C) Technology & security

9. Finalize platform + RGS architecture; isolate environments (dev/test/prod), enforce SoD, MFA, least privilege.
10. Ship log/monitoring (SIEM), alert runbooks, DR/BCP with tested RTO/RPO.
11. Produce data maps (where PII lives, transfers, retention); implement DPIAs and encryption (at-rest/in-transit).

D) Game & system certification

12. Contract a recognized lab; agree on scope & timelines for certificates (Platform/Betting, Sportsbook, RGS, Integration, Online RNG).
13. Deliver evaluation report and test artifacts; plan a change freeze during lab cycles.
14. Capture RTP/multiplier disclosures and ensure in-UI payout tables for games.

E) KYC / AML / RG

15. Define KYC: document matrix (ID, liveness, address), PEP/sanctions, adverse media.
16. Set SoF/SoW triggers (e.g., cumulative deposit thresholds, unusual win patterns); implement transaction monitoring with typology rules.
17. Create RG playbooks: deposit/loss/bet/timeout/session limits; friction-free self-exclusion and reality checks.
18. Train staff annually on AML/RG; log attendance and knowledge checks.

F) Marketing & affiliate controls

19. Draft an advertising code (minors protection, “no easy money” claims ban, ad disclosures, RG warnings).
20. Centralize creative approvals and keep a registry; verify affiliate identity and actor age; specify take-down SLAs.

G) Authorization filing & .bet.br

21. Submit authorization with all annexes; assign a team for Q&A with SPA.
22. On SPA notification, pay the fee and start “.bet.br” registration with Registro.br per instruction.

H) Go-live & beyond

23. Pass certification gates; sign off production cutover checklist.
24. Launch with controlled volumes, track KPI dashboards (sign-ups passed KYC, payment success, limits uptake, RG tool usage).
25. File monthly reports, tax/supervision fees, and maintain an issue log for audit.

What Brazil expects and why

• Payments limited to non-credit rails curb debt-fuelled play and facilitate traceability.
• .bet.br helps consumers recognize authorized operators at a glance and allows domain-level enforcement.
• Lab certification turns “we promise it’s fair” into documented evidence (RNG, multipliers, fairness, studio controls).
• Affiliate liability stops the “we didn’t see that ad” defense—you own the message.
• Player tax withheld at source simplifies compliance and reduces disputes at cash-out.

Common pitfalls (and how to avoid them)

• Leaving “payments & domain” to the end: start PIX/TED onboarding and .bet.br prep early.
• Under-scoping certification: if you offer both sportsbook and online games, plan for multiple certificates and integration evidence.
• Ad non-compliance via affiliates: run KYC on affiliates, pre-approve creative packs in Portuguese, and enforce take-down SLAs.
• RG tools hidden in the footer: Brazil expects front-and-center RG—make limits a default choice in onboarding.
• Thin capital planning: model 18% GGR, ISS, levies, and supervision fees; price promos accordingly.

For Players: Bankroll-safe checklist (30 seconds)

• “.bet.br” domain? ✔️
• PIX/TED/debit only? ✔️
• Limits/self-exclusion in Settings? ✔️
• Clear odds/multipliers & payout tables in-game? ✔️
• Portuguese support + ombudsman path listed? ✔️
  If any are missing, walk away—it’s not operating on Brazil’s rules.

FAQs – Brazil Gambling License

External sources & further reading

• Law & Ordinances overview (GGR tax, timeline, online games technical rules) — Ministry/SPA communications & legal summaries [Link]
• Authorization rules (fee, term, brand limit; entity in Brazil; corporate capital proofs) [Link]
• Payment rails (Ordinance No. 615/2024) — PIX/TED/debit only; ban on credit/boletos/crypto [Link]
• Domain policy (Ordinance No. 722/2024) — exclusive .bet.br for authorized agents
• Online games ordinance (No. 1,207/2024) — permitted game types; RNG/multiplier disclosure; certification
• Advertising & responsible gaming (No. 1,231/2024) — operator liability for affiliates; creative restrictions
• Player tax (withholding at 15% above monthly threshold) — IRPF guidance
• Supervision fee bands; municipal ISS ranges; updated GGR tax to 18% from Oct 1, 2025

Conclusion: Make Brazil Your Next Regulated Win (Without Tripping the Wires)

Brazil has moved from “open season” to a clear, rules-first market. If you want durable access, you need to operate like a regulated brand from day one. The playbook isn’t complicated—but it is non-negotiable: a local entity, the BRL 30m authorization, a .bet.br domain, PIX/TED-only payments, certified games and systems, and a living RG/AML program you can evidence at any moment. Do this well and the Brazil gambling license becomes a growth engine, not a compliance drag.

Operator next steps (7-point action plan)

1. Entity & capital: finalize your LTDA/S.A., resident management, and paid-up capital proofs.
2. Dossier: lock corporate/UBO files, business plan, tech architecture, security, and policy stack (AML, RG, incident/change control, complaints).
3. Payments & domain: integrate PIX/TED and debit/prepaid only; begin .bet.br registration workflows early.
4. Certification: contract a recognized lab; scope platform, sportsbook, RGS, integration, and online RNG certificates; schedule change-freeze windows.
5. Tax & fees: model 18% GGR tax, monthly supervision fees, and ISS; set treasury calendars and sign-offs.
6. Marketing & affiliates: implement approvals, age gating, mandatory warnings, and take-down SLAs you actually enforce.
7. Launch & monitor: soft-launch with real-time MI (KYC pass rates, payment success, RG tool uptake, complaint SLAs); maintain an audit-ready evidence room.

Provider checklist (studios, platforms)

• Pre-certify RGS and games for Brazil scope, publish RTP/multiplier facts, and version control every build.
• Offer operators a turnkey incident and rollback plan; align on change windows and live-studio rules.
• Localize content and UX, including RG messaging and Portuguese support.

Player takeaway (the 60-second test)

• Site runs on .bet.br and uses PIX/TED/debit only.
• Limits, time-outs, and self-exclusion are easy to find and use.
• Odds, multipliers, and payout tables are transparent in-game.
• There’s a visible complaints route and withdrawals go to an account in your name.

The trade you’re making

• Pros: national brand legitimacy, banking and ad access, long-term partnerships, and a measurable trust edge.
• Costs: the BRL 30m authorization, 18% GGR tax, certification, and permanent compliance headcount.
• Reality: in Brazil, compliance is a product feature. Treat it like one and you’ll compound the advantage every quarter.

Bottom line: if you can evidence controls—not just describe them—the Brazil gambling license is the most scalable way to participate in LatAm’s flagship market. Build once, document everything, and keep your release, payments, and RG flows audit-clean. That’s how you launch fast, stay live, and grow.