Every iGaming conference presentation in 2025 carried the same Brazil slide: two hundred million people, a new regulatory framework, the next frontier. Law 14,790 of 2023 would create the structure. The SPA, housed under Brazil's Ministry of Finance, would license operators, and the regulated market would go live on 1 January 2026 with 68 licensees and a 12% tax on gross gaming revenue. That is the version the industry repeats. For anyone watching from markets with their own regulatory architecture — Nigeria's NLRC dual-licensing system comes to mind — the Brazil template is being sold as a model worth copying. We read what the law actually requires. The conference slides left out the parts that bite.
TL;DR:
- The SPA holds tier 2 regulatory standing while overseeing a market worth an estimated £2,800m — a mismatch with no close parallel
- Sixty-eight licensees launched on day one with zero enforcement history behind the regulator issuing their permits
- The self-exclusion register exists on paper but binds operators through a mechanism that has never been tested cross-border
Red Flag #1: The Subsidiary Requirement Is Not Cosmetic
The standard industry summary says operators need a "local presence" in Brazil. That undersells it. Law 14,790 requires a Brazilian subsidiary — a legal entity incorporated under Brazilian corporate law, with local directors, local tax registration, and local liability exposure. Flutter Entertainment's own disclosures confirm the subsidiary requirement as a condition of market entry.
This is not a nominee-director arrangement in a Caribbean jurisdiction. It is a full corporate commitment. For operators accustomed to servicing Latin American markets through Malta or Gibraltar holding structures, the subsidiary mandate forces a different kind of capital allocation. Headcount. Local counsel. Brazilian corporate governance obligations that do not vanish when the market underperforms.
The concession we will make is this: the subsidiary requirement is genuinely protective. It gives Brazilian regulators and courts jurisdiction over an entity they can actually reach. That part is sound. What follows from here is less reassuring.
Red Flag #2: PIX-Only Payment Rails Are Mandatory by Law
Brazil did not merely recommend PIX as a payment option. The law mandates it. Operators licensed under the SPA framework must accept PIX — the instant payment system operated by the Central Bank of Brazil — as a deposit and withdrawal method. Flutter's public disclosures flag this as an operative requirement.
For readers in Nigeria familiar with the patchwork of Paystack, Flutterwave, Interswitch, and USSD rails that operators integrate at their own discretion, the Brazil model is structurally different. One rail. Government-controlled. Fully traceable. Every deposit, every withdrawal, every transaction stamped with a CPF number tied to a natural person.
The surveillance benefit is obvious. The operational constraint is less discussed. Operators cannot offer alternative deposit methods to route around PIX downtime, processing limits, or user friction. The payment infrastructure is a single point of dependency written into law, not chosen by the market.
Red Flag #3: 12% GGR Tax With No Published Offset Mechanism
The 12% tax on gross gaming revenue is the number everyone cites. Entain's disclosures on the Brazilian market confirm it. On its face, 12% looks moderate. Portugal charges 25% on online casino GGR and between 8% and 16% on sports betting revenue under the SRIJ framework. The UK layers its own point-of-consumption tax. Twelve percent, by comparison, sounds competitive.
Here is what the conference slides skip. The 12% figure stands alone. We could not identify, in any grounding material available to this desk, a published mechanism for offsetting promotional costs, bonus liability, or free-bet expenditure against GGR before the tax is calculated. In mature jurisdictions, the definition of "gross gaming revenue" — what gets subtracted before the tax base is set — is the entire negotiation. Brazil published the rate. The deduction framework, if one exists in the implementing regulations, has not surfaced in operator disclosures we can verify.
A 12% rate on a generously defined GGR base is competitive. A 12% rate on a narrowly defined base is not. The base matters more than the rate. Always.
Red Flag #4: The SPA Is a Tier 2 Regulator Running a Tier 1 Market
This is the contradiction at the centre of the Brazil framework, and it requires reading two data points side by side. The Brazilian market under the SPA carries a tier 2 regulatory classification in the jurisdictional assessments available to this desk. The market itself is estimated at £2,800m in gross gaming revenue.
For comparison, the UKGC — a tier 1 regulator by any credible classification — oversees 268 licensed online operators and has issued enforcement settlements of £17m against Entain's Ladbrokes and Coral brands, £1,170,000 against Flutter's Sky Betting subsidiary, and £582,120 against Bet365's Hillside entity, all within a two-year window. That is what tier 1 enforcement looks like. It has names, amounts, and published failure descriptions attached.
The SPA carries none of that institutional history. A £2,800m market supervised by an authority with no enforcement register, no published sanctions, and no track record of testing its own rules against a major operator is not a tier 1 regulatory environment. It is a tier 2 regulator holding a tier 1 market's leash for the first time. The leash has never been pulled.
Red Flag #5: 68 Licensees for 210 Million People
Sixty-eight operators received SPA licenses for market launch. That number gets presented as evidence of a well-managed licensing process — selective enough to signal quality, broad enough to ensure competition.
Put it next to the comparables. Ontario, with roughly 15 million people, had 49 licensed operators under the AGCO framework as of late 2024. The UK, with 67 million people, has 268 licensed online operators on the UKGC public register. Brazil, with 210 million people and a £2,800m estimated market, licensed 68.
The ratio is not the problem. The question is what the SPA's capacity looks like when three or four of those 68 licensees require simultaneous enforcement action. The UKGC, with decades of operational depth, managed to fine three major operators — Entain, Flutter, Bet365 — in overlapping timeframes. Each settlement required a separate investigative team, separate regulatory proceedings, and separate published findings. Can the SPA run parallel enforcement across multiple licensees in its first operating year? Nothing on the public record suggests it has staffed for that scenario.
Red Flag #6: The Self-Exclusion Register Has No Cross-Border Precedent
Law 14,790 establishes an autoexclusion register administered by the SPA. A player who registers is, in principle, blocked from all licensed operators. The mechanism mirrors what GAMSTOP does in the UK — where a single registration blocks deposits across every UKGC-licensed online operator for a user-selected period of six months, one year, or five years. GAMSTOP reported 420,000 registered users as of late 2024, with annual registrations increasing by 35%.
Portugal runs a comparable system through its RSA — the Registo de Auto-Exclusão — which binds all SRIJ-licensed operators under a single exclusion registration.
Both of those systems operate within a single regulatory perimeter. Brazil's register faces a different problem. Operators serving Brazilian players from offshore — those not among the 68 SPA licensees — sit outside the register entirely. The mechanism binds licensed operators. It does not bind the market. Whether the SPA has the technical infrastructure or the cross-border agreements to make offshore operators respect the register is a question that has not been answered publicly, because no comparable Latin American jurisdiction has tried it at this scale.
Red Flag #7: Zero Enforcement Track Record Means Zero Precedent
A regulator's credibility is not established by its licensing framework. It is established by its first enforcement action against a licensee that does not want to be enforced against.
The UKGC's public record demonstrates this. Entain paid £17m in August 2022 for social responsibility and anti-money laundering failings across Ladbrokes and Coral — specifically, failures to carry out sufficient customer interactions with high-risk players and inadequate AML controls for customers with unusual deposit patterns. Flutter paid £1,170,000 in March 2023 for similar failures at Sky Betting and Gaming. Bet365 paid £582,120 in December 2022. Those are published settlement amounts, with published failure descriptions, attached to named brands.
The SPA has none of this. No first fine. No published settlement. No regulatory proceeding that tested whether a licensee's compliance programme met the standards the SPA claims to enforce. Until the SPA fines someone — and publishes why — the regulatory framework exists only as text. Text without enforcement is a suggestion. Operators know the difference.
The Verdict
Law 14,790 is not a bad framework. The subsidiary requirement, the PIX mandate, the self-exclusion register — these are structurally serious design choices that exceed what many jurisdictions attempted in their first regulatory iteration. We concede that without reservation.
But the industry consensus — that Brazil is ready, that the framework is complete, that operators should treat SPA licensing as equivalent to UKGC or AGCO standing — is wrong in the specific ways that matter most. A tier 2 regulator with zero enforcement history, an untested self-exclusion register, and a GGR tax base that has not been publicly defined with deduction clarity is not a finished regulatory product. It is a first draft with a launch date. Whether the SPA writes its first enforcement action before the market outgrows the regulator's capacity to supervise it is a question that nobody in the industry's Brazil coverage has answered yet — because nobody can. The answer does not exist. It will be written in real time, and the first operators to test the SPA's limits will write it for everyone else.
FAQ
What does Brazil's Law 14,790 actually require from iGaming operators?
Law 14,790 of 2023 establishes the legal framework for regulated iGaming in Brazil. It requires operators to incorporate a Brazilian subsidiary — not a branch office or a nominee arrangement, but a full legal entity under Brazilian corporate law. Operators must accept PIX, the Central Bank's instant payment system, as a mandatory payment rail. The SPA, operating under the Ministry of Finance, issues licenses and administers an autoexclusion register. The regulated market launched on 1 January 2026 with 68 licensed operators and a 12% tax on gross gaming revenue.
How does Brazil's 12% GGR tax compare to other regulated markets?
The 12% rate on gross gaming revenue sits below several established jurisdictions. Portugal charges 25% on online casino GGR under the SRIJ framework and between 8% and 16% on sports betting. The headline rate is competitive, but what operators deduct from revenue before the tax applies — promotional costs, bonus liabilities, free-bet expenditure — has not been clearly published in the operator disclosures available to this desk. The net effective rate depends on that definition.
Is the SPA considered a tier 1 regulator?
No. In jurisdictional assessments available to this desk, the SPA carries a tier 2 classification. Tier 1 regulators — the UKGC, MGA, AGCO in Ontario, NJDGE in New Jersey — share a common trait: published enforcement histories with named operators, stated failure descriptions, and settlement amounts on the public record. The SPA launched its regulatory operations on 1 January 2026 and has not yet published its first enforcement action against a licensed operator.
How does Brazil's self-exclusion register work?
The autoexclusion register administered by the SPA allows players to block themselves from all SPA-licensed operators through a single registration. The design mirrors the UK's GAMSTOP system, which covers every UKGC-licensed online operator and reported 420,000 registered users as of late 2024. Brazil's register binds the 68 licensed operators. It does not bind offshore operators serving Brazilian players outside the SPA framework, and no public disclosure confirms cross-border enforcement agreements are in place.