SPA/MF No. 722, marks a major change in how the betting industry is regulated. It introduces strict rules for verifying players, handling data, and ensuring operator compliance. While designed to improve security and integrity, these regulations pose significant challenges for operators.

 Let's examine the advantages and disadvantages of this new ordinance, comparing it to established regulations like those in the UK, to understand its impact on the industry - which is, to put it simply, enormous

In the ever-evolving landscape of global sports betting, Brazil has introduced a significant legislative shift with the Ordinance SPA/MF No. 722, which came into effect on May 2, 2024. This pivotal ordinance outlines the technical and safety requirements for betting systems and their sports betting and online gaming platforms, fundamentally reshaping the operational dynamics for fixed quota betting lottery operators within the country. Administered by the Secretary of Prizes and Bets of the Ministry of Finance, this ordinance is underpinned by existing laws—specifically Law No. 13756 of December 12, 2018, and Law No. 14790 of December 29, 2023. Its introduction aims to enhance the regulatory oversight of the betting industry, ensuring a secure, fair, and responsible gaming environment that aligns with international legal standards and promotes consumer protection.

The ordinance addresses a comprehensive range of elements from the definition of betting systems and platforms to intricate details about the data centers where these systems are hosted. A key focus is placed on maintaining the integrity and continuity of IT services, which are crucial for the smooth operation of betting activities. This includes stringent measures for data storage, system certification, and ongoing compliance checks that require operators to hold certifications attesting to their adherence to these rigorous standards.

As Brazil steps into this new regulatory era, operators, suppliers and bettors are navigating a landscape marked by enhanced security protocols and operational transparency.

Coming into the main points:

• Technical and Safety Requirements: Establishes standards for betting systems and online gaming platforms to ensure secure and reliable operations.
• Data Localization: Requires that all betting system data be hosted within Brazilian territory unless specific international agreements allow otherwise, with strict conditions for data transfer and replication.
• Information Technology Continuity Plan: Operators must have robust plans to ensure the continuity of IT services, including strategies for handling data breaches or system failures.
• Critical Components: Specifies the identification and management of critical components within betting systems that could affect operational integrity and security.
• Certification Requirements: Betting systems and platforms must be regularly certified and revalidated, ensuring compliance with the established technical requirements.
• Supervision and Inspection: Details the regulatory oversight mechanisms, including the requirements for operators to grant access to their systems for inspection and monitoring by authorized entities.
• Operational Compliance: Operators must comply with detailed operational procedures including bettor registration, account management, and transaction handling to ensure fair and secure operations.
• Geolocation and Fraud Prevention: Implements stringent measures to prevent fraud and ensure the physical location of bettors aligns with legal requirements.
• Data Integrity and Security: Mandates the maintenance and backup of all critical data for a minimum period, ensuring the integrity and security of bettor and transaction data.
• Reporting Requirements: Operators are required to provide regular reports to the Secretariat of Prizes and Bets, detailing all aspects of their operations, including bet amounts, winnings, and user activity.

Let's look a little bit closer at the KYC/AML requirements 

Registration and Identity Verification

1. Age and Identity Checks: Operators must verify that a bettor is at least 18 years old using official documentation. This process includes checking the validity of the CPF (Cadastro de Pessoas Físicas) and performing facial recognition.
2. Single Account Per Bettor: A bettor is allowed only one active account per brand authorized by the Secretariat of Prizes and Bets, ensuring that multiple accounts do not exist for a single user across the operator's platforms.
3. Denial of Registration: If a person provides incorrect information that doesn't match their official documents or is underage, their registration request must be denied.
4. Consent and Awareness: Bettors must consent to the privacy policies and terms and conditions for placing bets, acknowledge the prohibition of third-party access to their accounts, and authorize monitoring and recording of their data by the operating agent and regulatory authorities.
5. Operators must collect comprehensive personal information from bettors during the registration process, including official identification documents and biometric data (e.g., facial recognition).
6. Verification processes are required to confirm a bettor's eligibility to ensure they are not on any exclusion lists that would prevent them from betting.
7. Systems must be capable of detecting and preventing unauthorized access or potential fraud attempts, ensuring that all betting activities are conducted by legitimately registered users.

Authentication Mechanisms

• System Access: Access to the betting system is controlled through authentication, typically involving a username and password or biometric data. The system must provide error messages and guidance if access is denied due to incorrect credentials.
• Multifactor Authentication: For account recovery or when suspicious activity is detected (like multiple unsuccessful access attempts), the system must implement multifactor authentication, one factor being facial recognition.
• Inactivity Protocols: The system must require new authentication after 30 minutes of inactivity and at least once every 7 days or upon first access after an extended period of inactivity.

Ongoing Verification and Account Management

• Account Updates: Bettors must have the ability to update passwords, registration information, and bank accounts used for financial transactions, subject to identity re-verification.
• Status Changes: Any change in a bettor's account status (active, canceled, suspended, etc.) must be updated and tracked in the system.
• Security Measures for Account Management: The system must control behaviors related to account management through a control program, ensuring all critical components are verified for authenticity at least once every 24 hours and on-demand.

Anti-Money Laundering (AML) Requirements

Transaction Monitoring

• Operators are required to monitor all financial transactions to detect patterns that might indicate money laundering, such as unusually large bets or frequent transactions within short periods.
• Transactions must be recorded with detailed logs that include the date, time, amount, and method of each transaction, facilitating traceability and auditability.

Limits on Transactions

• The ordinance mandates that betting operators set limits on the amounts that can be deposited, withdrawn, or wagered, which must be adhered to without exception. These limits help control excessive betting and mitigate the risk of laundering large sums of money.

Funds Segregation

• Operators must ensure that financial transactions (deposits and withdrawals) are conducted through accounts in authorized financial institutions and are segregated from the operational funds of the betting operator. This segregation aids in the clear demarcation of customer funds from company assets.

EDD Practices

• KYC practices are an integral part of AML efforts, requiring operators to verify the identity of their customers, understand their typical transactions, and assess their risk of illegal activities.
• Enhanced due diligence is required for customers engaged in high-value transactions or those who exhibit behaviors suggesting higher risk of fraud or money laundering.

Reporting Suspicious Activities

• Betting operators are mandated to report any suspicious activities potentially related to money laundering to the appropriate regulatory and enforcement authorities. This includes any discrepancies in the provided identity information or unusual betting patterns.