Online gambling requirements in Brazil

On May 2, 2024, the Prizes and Betting Office of the Ministry of Finance published Ordinance SPA/MF No. 722 to regulate the minimum requirements for the systems and platforms to be used by operators for the operation of online betting and gaming, under the terms of Law No. 14.790/2023.

Among the issues regulated are the following:

Domain name: the electronic channels used by the operator must use the ‘bet.br’ domain name, according to specific regulations;

Online gaming: the ordinance establishes that the online games to be offered must have a multiplication factor for the amount wagered that defines the amount to be received by the bettor, in the event of a prize, at the time the bet is placed, for each unit of national currency wagered, the result of which is determined by the outcome of a random future event, based on a random generator of numbers, symbols, figures or objects defined in the rules system;

Location: the operator must keep the betting system and the respective data in data centres located in Brazil. The systems and data can only be kept outside national territory in countries that have an International Legal Cooperation Agreement with Brazil, in civil and criminal matters jointly, provided that specific and prominent consent is obtained for the international transfer, under the terms of art. 33 of the LGPD and that the following criteria are also met: the technical area of the Ministry of Finance must have guaranteed access to the systems and data, the operating agent must replicate its database and information in Brazil and the operating agent must present an Information Technology business continuity plan;
Certification: the systems must be certified by certifying organisation approved by the Prize and Betting Secretariat. The certificates must attest that the systems are in full compliance with the technical requirements defined in Annexes I, II and III of the ordinance. Operators must submit, within ninety days of the publication of the authorisation act by the Secretariat, the evaluation report for certification of the requirements by the certifying entity. Certificates must be revalidated annually and whenever critical components are added, altered or deleted;

Guarantee of access to the Secretariat: the operator must, at all times, grant full access to the betting systems to the units and inspection agents of the Secretariat of Prizes and Betting. Operators must send data on bets, bettors, bettors' wallets, legal destinations and other information on their operations, according to the frequency and format established in the SIGAP Manual.

The appendixes detail the general and technical requirements that must be implemented in the systems, including how to carry out registration, identity verification, account recovery and the provision of information to the punter; the mandatory use of multi-factor authentication; the duty to identify geolocation in order to monitor and prevent bets placed by a single punter account from geographically incompatible locations; fraud prevention processes; the list of data that must be recorded by the systems; the need for the software source code to be assessed by certifying bodies; minimum access controls and other security requirements.