Regulated Brazil: what the licence demands from your vendors
The authorisation belongs to the operator, but vendors deliver most of the obligations. What to check in each layer before signing.
The authorisation to run fixed-odds betting in Brazil belongs to the operator. The obligations are distributed: game certificates come from the provider, identity checks from the KYC vendor, self-exclusion handling from the platform, consent evidence from the messaging layer. When the regulator asks, the operator answers — holding paperwork another company produced.
This is the map of that distribution.
Certification: what must arrive with a report
Games and the system hosting them need certification from a recognised laboratory. In practice:
- ask for the current report, not the "we are certified" line in the deck;
- check that its scope covers the version you are integrating;
- store the expiry date somewhere a human looks before it lapses.
A vendor slow to send the report is usually slow to renew it too.
KYC and the player account
Brazilian rules require real identification of the bettor and a match between the payment account holder and the registration. That has vendor consequences:
- the identity solution must cover Brazilian documents and liveness;
- ownership must be checked against the deposit, not only at signup;
- minors and self-excluded players must be blocked at the door, not in the audit.
Responsible gambling is not a screen
Deposit limits, self-exclusion, cool-off and the national register require the platform and the CRM to talk to each other. The common failure is shipping the limits screen and continuing to send campaigns to someone who self-excluded — it surfaces in the first audit, and it belongs to the operation, not to the email vendor.
When assessing CRM and messaging, ask:
- is opt-out unified across channels, or one per channel?
- is the self-exclusion register checked before every send?
- is there a consent trail with date, channel and source?
Advertising and communication
Player communication is inside the regulatory scope. That pushes requirements onto whoever delivers the message: sender identification, timing rules, and proof the recipient asked to receive it. A vendor that does not keep that proof transfers the risk to you.
What to demand in writing
| Layer | Document |
|---|---|
| Platform and games | Certification report with scope and expiry |
| KYC | Flow description, document coverage, verification SLA |
| Payments | Authorised institution, ownership policy, payout window |
| CRM and messaging | Opt-out policy, consent retention, send logs |
| Data | Processing agreement and legal basis |
None of this is exotic. What happens often is that the list gets assembled after the contract is signed — and by then there is no negotiation left.
Where to look
See who already operates in the regulated market under Licensing Consultants, KYC & Identity and Responsible Gambling.