Brazil is now a live, federally regulated market for online casinos. The regulated market launched January 1, 2025 under Law No. 14,790/2023 and the Secretariat of Prizes and Bets (SPA). Starting an online casino in Brazil is a compliance and operations challenge, not a quick launch — but the scale is unmatched in Latin America.
Is Online Gambling Legal in Brazil? The 2025 Regulatory Framework
Online gambling is legal in Brazil since January 1, 2025, the date the federal regulated market officially launched under Law No. 14,790/2023 (Lei das Apostas — the Betting Law). This law, regulated by Decree No. 11,870/2023 and subsequent SPA ordinances, is the first comprehensive federal framework for online casino and sports betting in Brazil's history. It ended an 80-year grey period dating back to Decree-Law No. 9,215 of 1946.
Key regulatory milestones
| Date | Event | Operator impact |
|---|---|---|
| December 2023 | Law No. 14,790/2023 signed — Lei das Apostas | Created the legal foundation for licensed online casino and sports betting |
| July 2024 | Detailed SPA regulations published — Ordinance SPA/MF No. 827/2024 | Defined licensing requirements, capital thresholds, and technical standards |
| January 1, 2025 | Regulated market officially launched | Only SPA-authorised entities may legally operate, advertise, or process payments |
| January 2025 | 14 licensed operators at launch | First wave of compliant platforms go live |
| August 2025 | 78 licensed operators | Rapid market growth — 5x increase in licensed operators in 7 months |
What online casino products are permitted under a Brazil SPA licence
- Online casino games (slots, roulette, blackjack, baccarat, crash games) — RNG-certified
- Fixed-odds sports betting including esports
- Live dealer games
- Fantasy sports (classified as skill-based)
- A single licence covers both sports betting and online casino products — no separate permit needed per vertical
B2B operator and software provider obligations
B2B software providers and content aggregators working with SPA-authorised operators must also comply with SPA technical standards. Brazil does not yet issue separate B2B licences but requires all service providers to: certify their gaming products with SPA-approved Brazilian laboratories; meet ISO 27001 information security standards; and maintain audit-ready documentation for all game math, RNG configuration, and software version changes. If you supply games or platform software to Brazilian licensed operators, your products must hold Brazilian certification — international equivalents from eCOGRA, GLI, or BMM are not sufficient on their own. SIGAP data requirements extend to B2B systems that generate round-level transaction data that feeds into licensed operator reporting.
Brazil Online Casino Licence — Requirements and Costs
To start an online casino in Brazil, you need prior SPA authorisation under the federal "quota fixa" framework. Licensing is not optional — unauthorised operators cannot legally advertise, process payments (including PIX), or accept Brazilian players. The Secretariat of Prizes and Bets (SPA) processes all applications via the SIGAP (Sistema de Gestão de Apostas) platform.
Eligibility requirements
- Brazilian legal entity required: Must incorporate a Brazilian Sociedade Anônima (S.A.) or Limitada (Ltda) — a foreign company branch does not qualify for SPA authorisation
- 20% Brazilian ownership minimum: At least 20% of the company's share capital must be held by a Brazilian shareholder (individual or entity) — Ordinance SPA/MF No. 827/2024
- Headquarters in Brazil: Operational headquarters must be physically located in Brazil
- ".bet.br" domain mandatory: All SPA-authorised operators must operate under the ".bet.br" domain for player-facing sites
- Portuguese-language support: 24/7 customer support in Portuguese is required under SPA licensing conditions
- Certified gaming systems: All RNG and game systems must be certified by SPA-appointed independent laboratories — Brazilian certification, not international equivalents
- ISO 27001 for servers: Technical infrastructure must meet ISO 27001 information security standards per Decree No. 11,870/2023
- Real-time SIGAP reporting: Operators must provide real-time transaction and player data to the SIGAP system — the government's Betting Management System
Financial requirements and cost breakdown
| Item | Amount | Timing | Notes |
|---|---|---|---|
| SPA authorisation fee | BRL 30,000,000 (~USD 6M) | Upfront — non-refundable | 5-year term covering up to 3 commercial brands. Additional BRL 30M per additional set of 3 brands. |
| Minimum paid-in capital | BRL 30,000,000 (~USD 6M) | Must be paid-in before licence approval | Fully paid-in share capital, lawful origin required |
| Financial reserve (player fund) | BRL 5,000,000 (~USD 1M) | Before approval | Regulatory guarantee fund to protect player balances — frozen, cannot be used for operations |
| GGR tax | 12% of Gross Gaming Revenue | Monthly | Plus IRPJ, CSLL, PIS/COFINS — effective total tax burden approaches 50% in practice |
| Player winnings tax | 15% on winnings above BRL 2,824 | Per withdrawal | Withheld by operator at source |
| Annual compliance/audit fees | Set by SPA — fixed amount | Annual | Includes mandatory independent annual audit, system recertification |
How to Start an Online Casino in Brazil: 6 Core Steps
Starting an online casino in Brazil is a compliance and operations programme — not a quick launch. The steps below outline exactly how to start an online casino in Brazil legally and sustainably. Each step below maps to what regulators and payment partners will review during authorisation and ongoing compliance audits.
Lock your authorisation path and legal entity
Before any platform work, define your exact casino scope — game types, wallet architecture, and brand structure. Confirm whether one licence (3 brands) covers your launch plan or whether you need additional brand authorisation. Incorporate your Brazilian S.A. or Ltda with the correct ownership structure — minimum 20% Brazilian shareholder. Prepare your document pack early: ownership chart, beneficial ownership declaration, AML/KYC policies, control descriptions, and a system overview that matches how you actually plan to operate. The SPA application review can extend up to 150 days — start the entity and documentation work immediately.
Set your channel and domain plan before heavy build work
Your ".bet.br" domain is not optional — all player-facing pages must operate under this domain. Choose brand names, domains, and full user journeys before committing to significant platform build costs, because late domain or brand changes break payment routing, tracking, and affiliate attribution. Plan TLS configuration, cookie consent, and LGPD (Lei Geral de Proteção de Dados — Brazil's data protection law) compliance into your technical architecture from the start. Set Portuguese as the default language on all interfaces. Write clear, complete terms for deposits, withdrawals, limits, and disputes — the SPA reviews these as part of the authorisation assessment.
Build the cashier and ledger first, not last
PIX is Brazil's dominant payment rail — the Central Bank reported PIX transaction value at R$26.4 trillion in 2024. Your cashier must handle PIX correctly before you consider anything else. Payment methods permitted under SPA rules: PIX, TED bank transfer, debit cards, and prepaid cards. Blocked under Brazilian law: cash, boletos, cryptocurrency, and any method that reduces traceability. Enforce same-account funding — deposits must come from the player's verified account. Design your payment state machine explicitly: created → pending → confirmed → credited → reversed. Implement idempotency on every payment callback so retries never create double wallet credits. Run daily reconciliation against three numbers: PSP records, wallet ledger entries, and bank settlement totals. If these three do not match, stop scaling until the discrepancy is resolved.
Embed KYC, AML, and fraud controls into core flows
AML compliance under Brazilian law (aligned with FATF/GAFI standards) and LGPD data protection are both licence conditions. Implement staged KYC at signup with document verification and facial recognition — age verification is mandatory (minimum age 18 in Brazil). Step up verification on risk triggers: first withdrawal, device change, or unusual deposit velocity. Route all risk events into case management with reason codes and time-stamped decisions — you need to be able to explain every AML decision months later during SPA audits. Log the rule version active at the time of each decision. Report suspicious transactions to Brazil's COAF (Financial Activities Control Council) as required under AML obligations.
Integrate casino games with round-level traceability
Every game round must produce IDs that link stake, outcome, and wallet movement in a single auditable chain. Treat round_id as a first-class database object — not a log detail. All RNG and game systems must be certified by SPA-appointed independent Brazilian laboratories before going live. Control all game math and RNG configuration changes through formal change management with versioning — silent configuration edits cause regulatory disputes and audit failures. Monitor RTP drift and error rates per game; catch misconfigurations before they affect players and appear in SIGAP audit data.
Ship reporting and audit evidence before go-live
SIGAP real-time data reporting is a hard technical requirement — not an integration that can be added post-launch. Build a reporting pipeline that can export consistent, validated files on schedule. Maintain immutable logs for: admin actions, wallet movements, KYC outcomes, and all game rounds. Set clear retention periods (minimum 5 years) with access controls — data leaks create regulatory and legal liability. Before going live, run two specific drills: duplicate payment callback handling and payout queue backlog recovery. Fix failures before player-facing traffic starts.
Game Preferences in the Brazilian Online Casino Market
Brazilian players have distinct game preferences shaped by culture, mobile usage patterns, and the influence of social media and sports betting crossover audiences. Your lobby design should serve two clear play modes: quick mobile sessions and social, interactive table experiences.
| Game category | Player preference | Operator notes |
|---|---|---|
| Slots | High volume — primary daily-play category | Fast load times and mobile-optimised UI are critical. Carnival, Amazon, and Rio-themed slots consistently outperform generic Western themes. JILI and PG Soft titles perform strongly in LatAm. |
| Crash games | Very high — fastest-growing segment | Aviator and similar crash formats dominate user acquisition in Brazil's regulated market. Simple mechanic, social sharing, and fast rounds suit mobile-first play. |
| Live dealer roulette | Strong — consistent top-5 category | Localise with Portuguese-speaking dealers for significantly higher retention. Standard European rules and clear limits convert better than exotic variants. |
| Live blackjack | Strong — skill-perception drives appeal | Brazilian players respond well to blackjack when rules are standard and limits are visible. Live tables outperform RNG blackjack 3:1 in session length. |
| Sports betting crossover | Very high — football drives the market | Operators who offer combined casino + sportsbook wallet see significantly higher ARPU. PIX-speed withdrawals after a football match result drive immediate re-deposit behaviour. |
| Baccarat | Medium — growing with Asian-influenced players | Standard tables outperform squeeze variants for the Brazilian audience. |
Operators entering Brazil should certify game content with SPA-approved Brazilian laboratories — international certifications (GLI, eCOGRA) are not sufficient on their own. Build your game provider contracts around suppliers who have or are pursuing Brazilian SPA certification.
Payment Methods and Taxation for Brazilian Online Casinos
Brazil's payment infrastructure is built around PIX — the Central Bank's instant payment system that has processed over R$26.4 trillion in transaction value. Your online casino cashier must be architected around PIX first. Players expect instant deposits and fast withdrawals — operators who deliver sub-60-second withdrawal processing consistently outperform competitors on retention metrics.
Permitted and blocked payment methods under SPA rules
| Method | Status | Notes |
|---|---|---|
| PIX | Required — permitted | Dominant deposit and withdrawal method. Instant processing. Must verify same-account funding — PIX key must match registered player account. |
| TED (bank transfer) | Permitted | Second most important rail for higher-value deposits. Settlement takes minutes to hours depending on bank. |
| Debit cards | Permitted | Visa and Mastercard debit — credit cards are blocked under SPA rules. |
| Prepaid cards | Permitted | Permitted where traceability to registered player account is maintained. |
| Credit cards | Blocked by law | Explicitly prohibited under Law No. 14,790/2023 to prevent over-indebtedness. |
| Cryptocurrency | Blocked by law | Prohibited — reduces payment traceability which is a core SPA requirement. This includes Bitcoin, stablecoins, and any crypto-asset. |
| Boleto bancário | Blocked by law | Cash-like payment method. Blocked because it does not provide clear same-account traceability. |
| Cash | Blocked by law | Not permitted for any online casino transaction. |
Responsible gambling requirements (SPA-mandated)
- Self-exclusion "Pause" or "Panic" button — instant self-exclusion must be available at all times in the user interface
- Mandatory deposit limits at player registration — players must set maximum limits before completing account setup
- Session duration limits — mandatory alerts and enforcement
- Responsible gambling information visible on all platforms — links to support resources including BeGambleAware and GamCare for international players
- Advertising restrictions — cannot target under-18s; must include responsible gambling messaging; operators cannot advertise near schools or universities
PIX cashier performance as a competitive differentiator
PIX withdrawal speed is one of the strongest retention drivers in Brazil's online casino market. Players who experience sub-60-second PIX withdrawals after a football match or winning session have significantly higher re-deposit rates than players waiting 24 hours or more. Build your cashier with same-day automatic withdrawal processing for verified players as a baseline — not as a premium feature. Operators who treat fast withdrawals as standard practice consistently outperform competitors on LTV metrics in the Brazilian market. This is particularly important in the football betting crossover segment where players expect casino withdrawal speed to match the immediacy of PIX bank-to-bank transfers in daily life.
Platform Options for Brazilian Online Casino Operators
Your platform must be architected for PIX-first payment processing, Portuguese-language UX, SIGAP real-time reporting, and SPA-approved RNG certification from day one. Choose your model before beginning build work — platform architecture decisions are expensive to reverse after SPA documentation has been submitted.
Pre-integrated PIX and TED payment processing. SPA-certifiable game library. Portuguese-first UI. 4-12 week setup. Best for operators who need to move quickly after SPA authorisation.
Your SPA licence, vendor-built platform. Full operational control including SIGAP reporting integration. 3-6 month delivery with full Brazilian payment stack.
Full-stack platform built to SPA and LGPD specifications. Complete source code ownership for Brazil-first expansion into LatAm markets.
See our full online casino software overview for platform-specific feature comparisons and SPA technical compliance documentation.
Brazil iGaming Market Data and Launch Cost Reality
The decision on how to start an online casino in Brazil must be grounded in realistic financial modelling. Brazil's regulated market is delivering exceptional performance in its first full year — but the entry cost is significant and the tax burden is among the highest in global iGaming. Both factors must be modelled accurately before committing to a Brazil launch.
Market performance — 2025 regulated year
- R$37 billion in Gross Gaming Revenue (GGR) generated in the full year 2025
- R$9.95 billion in tax revenue collected by the Brazilian government from licensed operators
- 78 licensed operators by August 2025 — up from 14 at January 2025 launch
- 185 million internet users; ARPU projected above USD 1,500 by 2028
- Brazil accounts for approximately 20% of global online gambling traffic despite only recently regulating
- PIX total transaction value hit R$26.4 trillion in 2024 — the infrastructure backbone of Brazil iGaming
Realistic minimum entry budget
| Cost item | Amount | When |
|---|---|---|
| SPA authorisation fee (5yr, 3 brands) | BRL 30,000,000 | Upfront, non-refundable |
| Minimum paid-in share capital | BRL 30,000,000 | Before approval — must be paid-in, not committed |
| Financial reserve (player guarantee fund) | BRL 5,000,000 | Before approval — frozen, not operational capital |
| Platform build (white-label) | USD 50,000-200,000 | Pre-launch |
| Brazilian entity formation + legal | USD 15,000-50,000 | Pre-application |
| RNG / game certification (Brazilian labs) | USD 20,000-80,000 | Pre go-live |
| SIGAP integration and testing | USD 30,000-100,000 | Pre go-live |
| Working capital / payout float (12 months) | USD 500,000+ | Ongoing |
Quick launch compliance checklist
Other Online Casino Licence and Market Guides
Comparing Brazil against other markets? See related guides below.
Frequently Asked Questions
Common questions on starting an online casino in Brazil — SPA licence, PIX payments, tax rates, and compliance requirements.
Yes. Online casino games and sports betting are fully legal in Brazil since January 1, 2025 under Law No. 14,790/2023 (Lei das Apostas). However, only operators holding SPA (Secretariat of Prizes and Bets) authorisation can legally operate, advertise, or process payments from Brazilian players. Land-based casinos remain banned. Unauthorised operators face payment blocking, advertising bans, and domain blocking orders — the SPA had issued over 11,000 domain blocking orders by end of 2025.
The minimum financial commitment to start an online casino in Brazil includes: a BRL 30 million (approximately USD 6 million) non-refundable SPA authorisation fee for a 5-year licence covering up to 3 commercial brands; BRL 30 million in minimum paid-in share capital; and BRL 5 million in a frozen financial reserve to protect player balances. Total minimum capital commitment before accepting a single player is approximately USD 12 to 13 million, excluding platform build, certification, and operational costs.
The Secretariat of Prizes and Bets (SPA) is the federal gambling regulator, operating under Brazil's Ministry of Finance. It was established by Law No. 14,790/2023. Applications are submitted via SIGAP (Sistema de Gestao de Apostas), the SPA's electronic platform. The application must include all legal, financial, technical, and compliance documentation. The SPA review process can extend up to 150 days. For the full step-by-step application guide, see our Brazil gambling licence guide.
Yes. The SPA licence requires a Brazilian legal entity — either a Sociedade Anonima (S.A.) or Limitada (Ltda). A foreign company branch does not qualify. Additionally, at least 20% of the company's share capital must be held by a Brazilian shareholder, whether an individual or a Brazilian company. Foreign operators typically structure their Brazilian entity with a local partner holding the minimum 20% stake.
The base tax rate is 12% of Gross Gaming Revenue (GGR). However, operators also pay IRPJ (corporate income tax), CSLL (social contribution on net income), and PIS/COFINS (turnover taxes), which together push the effective total tax burden toward approximately 50% of GGR. Additionally, operators must withhold 15% on player winnings above BRL 2,824 per withdrawal. Brazil's effective iGaming tax burden is among the highest in any regulated market globally.
Permitted methods under SPA regulations: PIX (dominant, instant, mandatory), TED bank transfer, debit cards (Visa and Mastercard), and prepaid cards. Explicitly blocked by law: credit cards, cryptocurrency (including stablecoins), boleto bancario, and cash. All deposits must come from the player's own verified account (same-account funding rule). Operators must enforce idempotency on all payment callbacks to prevent duplicate wallet credits.
SIGAP (Sistema de Gestao de Apostas) is the Brazilian government's Betting Management System. All SPA-authorised operators must provide real-time transaction and player data to SIGAP as a licence condition. SIGAP integration is a hard technical requirement — it cannot be added post-launch. The integration requires a dedicated data pipeline capable of exporting consistent, validated files on schedule with retry handling. Budget for SIGAP integration and testing as a separate line item in your pre-launch plan.
No. Cryptocurrency payments are explicitly prohibited under Law No. 14,790/2023 and SPA regulations. This applies to all crypto assets including Bitcoin, Ethereum, and stablecoins. The prohibition exists because crypto payments do not meet Brazil's traceability requirements for iGaming transactions. Attempting to process crypto payments through indirect rails is not a compliant workaround and risks licence revocation.
At the regulated market launch on January 1, 2025 there were 14 licensed operators. By August 2025 that number had grown to 78, reflecting strong investor interest and rapid market adoption. The pace of licensing is expected to continue as the SPA processes applications from international and domestic operators. The market is competitive but not yet saturated — significant market share is available for well-capitalised operators who launch with strong PIX cashier performance and Portuguese-first UX.
SPA-mandated responsible gambling requirements include: an instant self-exclusion Pause or Panic button accessible at all times in the player interface; mandatory deposit limits that players must set before completing account registration; session duration limits with mandatory alerts; prohibition on targeting advertising at under-18s; mandatory responsible gambling information on all platforms; prohibition on advertising near schools or universities. All marketing materials must include responsible gambling messaging. SPA auditors specifically review responsible gambling tool implementation during compliance audits.
Ready to start your online casino in Brazil?
SDLC Corp builds SPA-compliant casino platforms for Brazil — PIX-first cashier architecture, SIGAP reporting integration, Portuguese-language UX, and RNG-certifiable game libraries. Full source code ownership. No revenue share.
Contact Us
Share a few details about your project, and we’ll get back to you soon.
Let's Talk About Your Project
- Free Consultation
- 24/7 Experts Support
- On-Time Delivery
- sales@sdlccorp.com
- +1(510-630-6507)