SPA Brazil licence cost (BRL 30M), Pix payment rails, banking options for foreign operators, AML compliance under COAF, and tax structure.
Brazil's regulated iGaming market went live on 1 January 2025 under the Secretaria de Prêmios e Apostas (SPA), and seventeen months in, the bottleneck for operators is no longer the licence — it's the bank account. Tier-one Brazilian banks remain cautious about gambling-classified merchants, and foreign-owned operators are routing real-denominated flows through a narrow band of specialist Pix-enabled payment service providers. This guide breaks down the licensing economics, the Pix infrastructure that now carries roughly four-fifths of iGaming deposits, the AML obligations under COAF, and the banking structures that actually work in 2026.
_Last updated: 9 May 2026._
The SPA (Secretaria de Prêmios e Apostas) is the federal regulator within Brazil's Ministry of Finance that authorises fixed-odds betting and online casino operators. It was established by Law 14,790/2023 and began issuing definitive five-year licences from 1 January 2025, ending the grey market that had operated under the cover of Lei 13,756/2018.
The framework is federal in scope but does not pre-empt state lotteries. Brazilian-licensed operators are restricted to a .bet.br domain, must hold a Brazilian legal entity with at least 20% local ownership, and must connect to the SPA's SIGAP real-time monitoring system. Both sports betting (apostas de quota fixa) and online casino (jogos online) are covered under the same authorisation, though casino activity is regulated as a sub-modality.
Operators that ignored the deadline are blocked at the DNS level — the federal government, working with Anatel, took down more than 11,000 unauthorised gambling domains in the first year of regulation. The official portal is published at gov.br/fazenda/sorteios-e-jogos.
A Brazil iGaming licence costs BRL 30 million (approximately £4.5 million / EUR 5.3 million / USD 5.8 million at May 2026 rates) for a five-year authorisation covering up to three brands. This is one of the highest direct authorisation fees in any regulated iGaming jurisdiction worldwide and is paid as a single upfront outorga (grant fee), not amortised across the licence term.
The fee structure is deliberately calibrated to filter out under-capitalised entrants. In addition to the BRL 30M outorga, operators must demonstrate paid-in capital of at least BRL 30 million, post a financial guarantee linked to projected handle, and front the operational costs of integrating with SIGAP, certified test labs, and the SPA's monitoring stack. Total go-live costs typically land between BRL 45M and BRL 70M.
Each additional brand beyond the third in a five-year cycle requires a fresh authorisation. The authorised brand portfolio is also published on the SPA portal, which means competitors and acquirers can verify status in real time.
| Cost component | Amount (BRL) | Approximate GBP |
|---|---|---|
| Federal SPA licence (5 years, up to 3 brands) | 30,000,000 | 4,500,000 |
| Minimum paid-in capital | 30,000,000 | 4,500,000 |
| Financial guarantee (variable, handle-linked) | 5,000,000+ | 750,000+ |
| Game lab certification (per supplier) | 100,000–250,000 | 15,000–37,500 |
| SIGAP integration & ongoing compliance (year 1) | 1,500,000–3,000,000 | 225,000–450,000 |
| Annual inspection fee (taxa de fiscalização) | 1,944,000 | 290,000 |
A second route exists alongside the federal regime: state lottery authorisations, the most active being Loterj in Rio de Janeiro. Loterj operates under a 2018 STF ruling that confirmed states' constitutional right to license lottery products within their borders, and the agency has used that ruling to authorise a parallel set of online sports betting and casino brands.
A Loterj authorisation is materially cheaper — the upfront outorga sits around BRL 5 million for a ten-year licence, and the GGR tax rate is lower. The trade-off is jurisdictional reach: SPA, Anatel and the federal AGU dispute whether a Loterj licence permits operations outside Rio de Janeiro state, and the Supreme Court has not yet ruled definitively. Operators routing nationwide traffic on Loterj-only authorisations face active enforcement risk.
For comparison with other iGaming jurisdictions, see our iGaming licence comparison and the Malta MGA banking guide.
| Feature | SPA (Federal) | Loterj (Rio de Janeiro) |
|---|---|---|
| Upfront fee | BRL 30M | ~BRL 5M |
| Term | 5 years | 10 years |
| Brands covered | Up to 3 | Per-brand authorisation |
| GGR tax | 12% | ~5% (state-set) |
| Geographic scope | National (.bet.br) | Disputed — RJ confirmed |
| Real-time reporting | SIGAP mandatory | Loterj-specific stack |
| Enforcement risk outside scope | Low | High |
Itaú Unibanco, Bradesco, Santander Brasil and Banco do Brasil — the four institutions that hold roughly 75% of Brazilian retail deposits — continue to apply restrictive onboarding policies to gambling-classified merchants, even those holding a definitive SPA licence. The reasons are familiar to anyone who has tried to open a high-risk account in Europe.
First, internal correspondent-banking pressure. Brazilian tier-ones rely on USD and EUR clearing through global correspondents whose risk appetite for gambling flows is constrained by their own AML programmes. Second, chargeback exposure on card-funded play, which remains material despite Pix's dominance. Third, reputational risk linked to Brazil's high-profile match-fixing investigations of 2023–2024.
The practical effect is that even fully licensed operators with Brazilian directors typically wait three to six months for tier-one onboarding, get capped transaction volumes, and pay punitive merchant discount rates. Many never get on-boarded at all and route through specialist PSPs from day one. For background on why this pattern repeats globally, see our note on why banks reject high-risk applications.
Pix is the Brazilian Central Bank's instant payments system, launched in November 2020 and now used by more than 160 million Brazilians. It settles 24/7 in under ten seconds, with no card networks involved and no chargeback rights for the payer. For iGaming, that combination is transformative.
By the end of 2025, Pix accounted for an estimated 78–82% of regulated iGaming deposit volume in Brazil. Card deposits, traditionally the dominant rail, dropped below 15% as operators repriced bonuses to favour Pix and as players adopted Pix-only checkout. Withdrawals are almost entirely Pix; bank transfers (TED) and card refunds are residual.
The economics matter as much as the speed. Pix processing rates from specialist PSPs typically range from 0.5% to 1.2% per transaction, compared with 3.5–5.5% for card-acquired deposits in Brazil's high-risk segment. The absence of chargebacks also removes the case for a heavy rolling reserve, though most acquirers still hold a 5–10% reserve for AML scenarios. Read more on reserve mechanics in our rolling reserves guide.
Pix QR at checkout is the dominant UX pattern: the player is shown a dynamic QR code, scans it in their banking app, confirms, and the deposit credits the operator wallet within seconds. The Banco Central do Brasil publishes the technical specification at bcb.gov.br/estabilidadefinanceira/pix.
The SPA framework requires a Brazilian legal entity to hold the licence — typically a sociedade limitada (Ltda) or sociedade anônima (S.A.) — with at least 20% Brazilian-resident ownership in the cap table. That entity needs a Brazilian banking relationship to receive Pix flows, settle taxes, and pay local staff and game suppliers.
Foreign operators generally pursue one of three structures, each with different banking implications. The right choice depends on group structure, target volumes, and whether the foreign parent already holds MGA, UKGC, or other tier-one licences that ease correspondent due diligence.
| Structure | Banking footprint | Pros | Cons |
|---|---|---|---|
| Brazilian Ltda + tier-one bank account | Itaú/Bradesco/Santander BR | Cleanest narrative; tier-one credibility | 3–6 month onboarding; volume caps; 5–10% MDR on cards |
| Brazilian Ltda + specialist Pix PSP | Pagar.me/EBANX/dLocal | Live in 4–8 weeks; 0.5–1.2% Pix MDR | PSP-dependent; FX margin on settlement to parent |
| Brazilian Ltda + neobank (Stark, Cora, BTG Pactual digital) | Mid-tier digital | Faster onboarding than tier-ones; Pix-native | Lower transaction caps; less correspondent depth |
A common 2026 pattern is a hybrid: open a Brazilian Ltda account at a digital bank or BTG Pactual for operating payroll, route player deposits and withdrawals through a specialist PSP that settles to that account in BRL, and remit profit upstream to the foreign parent via FX swap or a structured EBANX/dLocal cross-border product. Cross-reference our offshore banking for iGaming write-up for the upstream side.
Five PSPs do most of the licensed-iGaming heavy lifting in Brazil: Pagar.me (owned by Stone Co.), EBANX, dLocal, AstroPay and PagBrasil. Their commercial terms are similar at headline level — 0.5–1.2% Pix, 3.5–5% cards — but they differ materially on settlement currency, cross-border capability, rolling reserve posture, and integration depth with SIGAP.
| PSP | Pix rate | Card rate | Settlement | Reserve | Best for |
|---|---|---|---|---|---|
| Pagar.me | 0.5–0.99% | 3.5–4.5% | BRL only | 5–10% | Domestic Brazilian operators |
| EBANX | 0.7–1.2% | 4.0–5.0% | BRL or USD/EUR | 7–10% | Foreign operators wanting cross-border |
| dLocal | 0.7–1.2% | 4.0–5.5% | USD/EUR upstream | 7–12% | Multi-LATAM operators |
| AstroPay | 0.8–1.2% | 4.5–5.5% | BRL or USD wallet | 5–10% | Player-wallet-led brands |
| PagBrasil | 0.5–1.0% | 3.8–4.8% | BRL with cross-border add-on | 5–8% | Mid-volume European operators |
EBANX and dLocal are the most popular choices for European-headquartered operators because they handle BRL-to-EUR/USD repatriation as a single product, reducing FX leakage and the need for a separate corporate FX broker. Pagar.me, by contrast, only settles in BRL — clean for domestic structures, awkward for groups that want to keep cash above the Brazilian entity. For a wider acquirer comparison, see our iGaming acquirer guide and high-risk payment processing.
Brazil's iGaming tax stack is heavier than headline GGR rates suggest. The federal GGR tax on regulated operators is 12%, allocated by Law 14,790/2023 across social security, sports, education, public security and tourism. On top of that sit corporate income taxes, social contributions, and a player-side withholding regime that affects bonus economics.
Combined effective tax rates for an SPA-licensed operator in steady state typically sit between 28% and 36% of GGR before any optimisation. Loterj operators face a lower aggregate burden but accept the geographic-scope risk discussed above. The Receita Federal publishes the operative regulations as Instrução Normativa RFB 2,191/2024.
| Tax | Rate | Base |
|---|---|---|
| Federal GGR tax (Law 14,790) | 12% | Gross gaming revenue |
| Corporate income tax (IRPJ) | 15% + 10% surtax above BRL 240k/year | Net profit |
| Social contribution (CSLL) | 9% | Net profit |
| PIS/COFINS (cumulative regime) | 3.65% | Gross revenue |
| Player withholding (IRRF) | 15% | Player net winnings above BRL 2,259.20/month |
| Annual SPA inspection fee | BRL 1.944M flat | Per licence |
The 15% player-side withholding above BRL 2,259.20 (the income tax exemption threshold) is operator-collected: SPA-licensed sites must withhold at source on winning sessions and remit to the Receita Federal. This adds material technical work to the wallet and reporting stack, and it changes how operators design VIP and bonus mechanics. Our iGaming banking requirements reference covers the cash-flow implications.
COAF (Conselho de Controle de Atividades Financeiras) is Brazil's financial intelligence unit, attached to the Banco Central do Brasil since 2020. SPA-licensed operators are reporting entities under Lei 9.613/98 (the 1998 anti-money-laundering act, as amended) and must implement a full AML programme: customer due diligence, source of funds documentation, transaction monitoring, PEP screening, and suspicious activity reports filed via COAF's SISCOAF portal.
Mandatory reporting thresholds are stricter than many comparable jurisdictions. Operators must file a Communication of Operation in Cash (COE) for any cash-equivalent transaction over BRL 10,000 and a Suspicious Activity Report (RIF) for any pattern that breaches risk indicators in COAF Resolution 36/2021. EDD is required for all PEPs, all non-resident players, and any account whose monthly throughput exceeds BRL 50,000.
The SPA's compliance regulation (Portaria SPA/MF 1,143/2024) layers gaming-specific obligations on top: a designated AML officer (compliance officer), board-approved AML policy, annual independent audit, and the SIGAP feed which transmits every wager and settlement to the regulator in near-real time. Operators should plan for an AML headcount equivalent to roughly one FTE per BRL 100M of annual handle, plus tooling. The full COAF rulebook is at gov.br/coaf. For broader principles, see AML compliance for online gambling and AML/KYC compliance for high-risk businesses.
The MATCH list — Mastercard's terminated-merchant database — is also a live concern for Brazilian operators that take card deposits, since a MATCH listing effectively locks the operator out of card acquiring in any jurisdiction for five years. We cover the avoidance playbook in the MATCH list and iGaming.
Beyond capital and AML, the SPA imposes a thicker technical-compliance layer than most jurisdictions. The four headline obligations are the .bet.br domain restriction, certified game labs, real-time transaction reporting via SIGAP, and a Brazilian-resident data-hosting obligation for personally identifiable information.
.bet.br is registered through Registro.br with SPA authorisation as a prerequisite. Operators cannot run a Brazilian-licensed offer on .com, .bet, or any other gTLD. Marketing on non-.bet.br domains is enforced as unlicensed activity, with fines up to BRL 2 billion under Portaria 1,231/2024.
Game and platform certification must come from labs accredited by the SPA — currently GLI, BMM, eCOGRA, iTech Labs, NMi, QuinelLab and a handful of regional players. Each game variant requires a separate certificate; live-dealer studios require studio-level accreditation as well. Per-supplier certification cost typically lands between BRL 100,000 and BRL 250,000 per year.
SIGAP is the regulator's real-time supervision feed: every wager, settlement, deposit, withdrawal and KYC event is transmitted via API within seconds of occurring. The data is used for tax collection, AML monitoring, and self-exclusion enforcement (the Cadastro de Excluídos). Operator integration cost typically runs BRL 1.5–3M in year one.
Data residency: all Brazilian-player PII must be stored on servers physically located in Brazil, in line with LGPD (Lei Geral de Proteção de Dados) and SPA's specific gaming-sector guidance. AWS São Paulo, Azure Brazil South, and Oracle Vinhedo are the main compliant cloud regions.
For an operator already licensed in Malta, Curaçao, Anjouan or another tier-one or grey-market jurisdiction, the realistic Brazil entry timeline is nine to fourteen months from engagement to live .bet.br offer. The three workstreams that gate the launch are corporate, banking, and SIGAP integration — and the banking workstream is usually the quietest assassin.
The sequence that consistently works in 2026:
.bet.br domain via Registro.br post-authorisationThe single biggest cause of slipped launches in 2025–2026 was assuming tier-one banking onboarding would run in parallel with SPA approval and discovering at month nine that the bank had quietly declined. The defensive move is to assume PSP-routed banking from day one and treat any tier-one win as upside.
No. The SPA authorises only Brazilian legal entities (Ltda or S.A.) with a CNPJ, headquartered in Brazil, and with at least 20% Brazilian-resident equity in the cap table. The foreign parent typically holds the remaining equity through an offshore holding structure. We cover the holding side in offshore corporate structuring for high-risk businesses.
Pix transfers settle 24/7 in under ten seconds end to end. They are functionally irreversible from the payer's side — there is no chargeback equivalent. The Banco Central runs a Mecanismo Especial de Devolução (MED) for fraud cases, but it is operator-cooperative, not consumer-driven, and does not impose chargeback liability on the merchant in normal play scenarios. This is a major reason rolling reserve requirements are lighter than for card acquiring.
The BRL 30M outorga is per authorisation, and one authorisation covers up to three brands for five years. A fourth brand requires a fresh outorga at the same price. Most multi-brand groups concentrate flagship traffic on two brands and reserve the third slot for a regional or vertical-specific play.
Yes — for now. Pix carries 78–82% of deposit volume, but cards remain important for first-deposit attribution, certain VIP cohorts, and players who haven't enabled Pix in their bank apps. Most operators run a card stack alongside Pix at least through the first two licence years and then revisit. Card acquiring is also where MDR, chargeback management and rolling reserve discipline matter most — see our iGaming chargeback management guide.
Brazil is materially harder than Curaçao or Anjouan and roughly comparable to Ontario in onboarding rigour, but with much heavier capital and tax demands than any of them. Malta sits between the two: MGA licences are well understood by international correspondent banks but expensive in their own way. We compare the major options in Malta MGA vs Curaçao banking and Ontario iGaming banking.
Domains are blocked at DNS level by Anatel, payment processors are required by Banco Central guidance to refuse the merchant, and directors face personal liability under Lei 14,790/2023 with fines up to BRL 2 billion. The federal task force took down 11,000+ unlicensed domains in the first year of regulation. Operating without authorisation is no longer commercially viable in Brazil's mainstream market.
Submit a free pre-approval in 2 minutes. We respond within 24 hours.
Get Free Pre-ApprovalSubmit a free pre-approval in 2 minutes. We respond within 24 hours with a realistic outcome.
Get Free Pre-Approval