How to Start an Online Casino in Brazil in 2026: The SPA Outorga License Explained for Serious Operators

What is Brazil's SPA and how does it regulate online casinos?

The Secretaria de Prêmios e Apostas (SPA) is the federal body created by Law 14.790/2023 to regulate fixed-odds sports betting and online casino games in Brazil. It sits under the Ministry of Finance and took over from the earlier SEAE framework. The SPA began issuing outorgas in late 2024, with the first licensed operators going live in January 2025.

Brazil's path to regulation was long and messy. The country had a legal framework for sports betting since 2018 (Law 13.756), but the casino-specific rules only crystallized with Law 14.790 in December 2023 and the subsequent SPA ordinances published throughout 2024. The SPA is not a gaming commission in the traditional sense; it is a secretariat within the Ministry of Finance, which gives it a different political profile than, say, the MGA in Malta or Coljuegos in Colombia. That matters because its priorities are tax collection and consumer protection, in that order, and its enforcement posture reflects that.

The regulatory perimeter covers fixed-odds sports betting, online slots, table games, live dealer, and virtual sports offered to Brazilian CPF holders. Offshore operators without an outorga are explicitly prohibited from targeting Brazilian residents, and the SPA has already published blocking orders against unlicensed domains. The enforcement mechanism relies on ISP-level DNS blocking and payment processor cooperation, neither of which is airtight, but the political will to enforce is clearly stronger than it was under the pre-2025 grey-market era.

One thing worth understanding early: the SPA operates a concession model, not a licensing model in the strict sense. You are not buying a license that you own; you are receiving an outorga (authorization to operate under concession) for a fixed term. That distinction has real implications for how you structure your corporate entity and any investor agreements, because the outorga cannot simply be transferred like an MGA license can.

What does the SPA outorga actually cost, and what are the real financial requirements?

The outorga fee is BRL 30 million for a five-year authorization, which at mid-2024 exchange rates equates to roughly USD 5.8 to 6.2 million. That figure is the authorization fee alone. Add mandatory capitalization requirements, a player-fund escrow account and the cost of Brazilian entity setup, and your pre-revenue cash commitment easily exceeds USD 8 million.

The BRL 30 million outorga fee is paid to the federal government and is non-refundable. There is no partial-credit mechanism if your application is denied after submission, which is one reason operators should invest seriously in pre-application due diligence. The SPA also requires applicants to demonstrate minimum paid-in capital, the exact threshold for which was set at BRL 18 million in the initial ordinances, though you should verify this against the current SPA normative instructions because the figure was subject to revision during the 2024 rulemaking period.

Beyond the outorga fee and capitalization, operators must maintain a segregated player-funds account at a Brazilian financial institution. The SPA's rules require that player balances held on the platform are covered by liquid assets in this account at all times. This is not a bond or insurance product; it is actual cash parked in a Brazilian bank, which creates a meaningful working-capital drag, especially in the early months when deposits are ramping up but GGR is still low.

Then there is the Brazilian entity requirement. You cannot hold an outorga as a foreign company. You must incorporate a Brazilian LTDA or S.A., appoint Brazilian-resident directors (or at minimum a legal representative with powers of attorney recognized under Brazilian corporate law), and register with the Receita Federal for CNPJ purposes. Expect legal and accounting setup costs in the range of USD 50,000 to 150,000 depending on the complexity of your group structure and whether you need a holding layer to manage IP and royalty flows efficiently.

A realistic total pre-launch budget for a compliant Brazilian operation in 2026, covering the outorga, capitalization, entity setup, platform integration, payment infrastructure, and a modest marketing reserve, sits somewhere between USD 12 million and USD 20 million. Anyone quoting you a number below USD 10 million is either excluding the outorga fee or underestimating the compliance and tech build.

What is the step-by-step process to apply for a Brazilian SPA outorga?

The SPA application process runs through a formal call for proposals (edital) process. Operators submit a dossier covering corporate structure, technical compliance, anti-money-laundering controls, responsible gambling systems and financial capacity. The SPA reviews applications and issues outorgas in tranches. The full cycle from first document preparation to receiving your outorga has taken between six and twelve months for the initial cohort.

Step one is corporate preparation. Before you touch the SPA portal, you need your Brazilian LTDA or S.A. incorporated, your CNPJ active, your ultimate beneficial ownership structure documented in a format that satisfies Brazilian anti-money-laundering rules (Law 9.613/1998 as amended), and your directors' backgrounds clean of any criminal convictions or prior regulatory sanctions in any jurisdiction. The SPA conducts background checks that go beyond a simple declaration; expect them to cross-reference international databases.

Step two is the technical compliance dossier. The SPA requires evidence that your platform meets the technical standards set out in the relevant normative instructions, covering RNG certification (typically from a lab recognized by the SPA such as BMM, GLI or eCOGRA), game return-to-player documentation, responsible gambling tools (deposit limits, self-exclusion linked to the national CPF registry), and data localization requirements. If you are running on a white-label or turnkey platform, your provider needs to have already completed SPA technical certification, or you need to budget for that process, which can take three to six months and cost USD 30,000 to 80,000 in lab fees.

Step three is the financial capacity demonstration. You submit audited financials, evidence of the BRL 30 million fee payment (or a bank guarantee acceptable to the SPA), proof of minimum capitalization, and your player-funds account setup. The SPA has been strict about accepting only Brazilian-regulated financial institutions for the escrow account, so foreign fintech solutions do not qualify here.

Step four is the ongoing compliance setup. Before you go live, you must integrate with the SPA's real-time monitoring system, which requires a certified technical connection that pushes bet and transaction data to the regulator. This is not optional and not trivial. Budget for a dedicated integration sprint with your platform provider, and confirm that your provider has already built this connector before you sign any contract with them.

Which platform providers are best positioned for a Brazil SPA-compliant launch?

For a 2026 launch, your safest bets are platform providers that already completed SPA technical certification or are actively in that process. SoftSwiss, EveryMatrix and BtoBet all had Brazil-specific development tracks underway by mid-2024. A provider without an existing SPA integration roadmap will add six or more months to your timeline and shift certification risk onto your balance sheet.

SoftSwiss has been aggressive about Brazil. They announced SPA readiness work in 2024 and their Casino Engine already supports Pix natively, which matters more than it sounds because Pix is not just a payment method in Brazil, it is the dominant real-money deposit rail, handling upward of 70% of digital transactions in the country. If your platform cannot process Pix deposits and withdrawals in real time, you are not competitive, full stop.

EveryMatrix has a similar Brazil track. Their CasinoEngine and OddsMatrix products were being adapted for the SPA technical reporting requirements during 2024, and their payment layer through MoneyMatrix supports Pix. The advantage of EveryMatrix for an operator entering Brazil is that they offer a relatively modular architecture, so if you want to run your own sportsbook alongside the casino, you can integrate OddsMatrix without rebuilding everything.

BtoBet, now part of the Kambi group, has a strong LATAM footprint and was actively working with Brazilian operators during the licensing transition. For sports-led operators who want casino as a secondary vertical, BtoBet's sportsbook pedigree is worth considering. That said, their casino content aggregation layer is thinner than SoftSwiss or EveryMatrix, so you may need to layer in a separate game aggregator like Relax Gaming or Pariplay to hit the content depth Brazilian players expect.

One category of provider to approach with caution: white-label solutions marketed specifically at Brazil that are run through an offshore master license with a Brazilian-facing frontend. Several of these products were pitched to operators in 2023 and 2024 as a cheaper route to market. They are not a compliant route to market under the 2025 framework. If you go live on an offshore white-label targeting Brazilian CPF holders without an SPA outorga, you are operating illegally, and the SPA has both the tools and the political mandate to enforce that.

How do payments and Pix integration work for a licensed Brazilian online casino?

Pix is the Brazilian Central Bank's instant payment system and it is the only realistic primary deposit and withdrawal method for a Brazilian casino in 2026. Operated by the Banco Central do Brasil, Pix settles in seconds, 24/7, and has near-universal adoption among Brazilian smartphone users. Your platform must support Pix natively, and your payment processor must hold a Bacen registration or partner with a registered Brazilian PSP.

The Banco Central do Brasil (Bacen) regulates Pix and requires that any entity routing Pix transactions holds a Brazilian financial institution registration or operates through a registered partner. For foreign operators, this means you cannot simply connect a European PSP to Pix and call it done. You need either a Brazilian payment institution (IP, or Instituição de Pagamento) as your processing partner, or a direct integration through a bank with Bacen approval. Companies like PagSeguro, Mercado Pago, and a growing number of iGaming-specific Brazilian PSPs were actively building casino-grade Pix solutions in 2024 and 2025.

Beyond Pix, you will encounter boleto bancário as a secondary deposit method, primarily for players without instant Pix access, though its share of casino deposits has fallen sharply as Pix penetration has grown. Credit and debit card processing is technically possible but practically difficult: Brazilian card issuers have historically blocked gambling MCC codes, and while the regulatory framework may eventually normalize this, do not build your payment strategy around cards working reliably at launch.

The SPA also imposes KYC requirements that are tightly coupled to payments. Every depositing player must be verified against their CPF (Cadastro de Pessoas Físicas), Brazil's individual taxpayer registry. The CPF check must happen before the first deposit is processed, not after. This means your KYC flow must integrate with a Receita Federal-approved CPF validation service, and your onboarding funnel must handle the friction that creates without losing conversions. Operators who have launched in Brazil report that a well-designed CPF verification step adds roughly 15 to 25 seconds to the registration flow but does not materially hurt conversion if the UX is clean.

One payment issue that catches operators off guard: the SPA's responsible gambling rules include mandatory deposit limit tools that must be enforced at the payment processor level, not just the platform level. If a player has set a daily deposit limit of BRL 500, your PSP integration must reject deposits above that threshold in real time. This requires a tighter-than-usual API integration between your platform's player account management system and your payment layer. Confirm this capability explicitly with any PSP you evaluate.

What are the responsible gambling and player protection requirements under the SPA?

Brazil's SPA framework has some of the most prescriptive responsible gambling rules in LATAM, modeled partly on UK GC and MGA standards. Operators must offer mandatory deposit limits, cooling-off periods, self-exclusion linked to a national registry, and reality-check notifications. Advertising to minors and to self-excluded players is prohibited and carries significant fines.

The centerpiece of Brazil's player protection framework is the national self-exclusion registry. Unlike some jurisdictions where self-exclusion is operator-by-operator, Brazil's SPA requires operators to check players against a centralized exclusion database before allowing account creation or deposits. The architecture for this registry was being finalized during 2024, and operators must build a live API connection to it. This is not a batch check; it is a real-time query at the point of registration and, depending on the final ordinances, potentially at each login.

Deposit limits are mandatory from day one of account creation. Players must set a limit before they can deposit, and operators cannot pre-populate that limit with an artificially high number as a dark pattern. The SPA's rules on this are explicit and enforcement will likely focus on this area early, because it is easy to audit. Your platform's responsible gambling module needs to support daily, weekly and monthly limits with a cooling-off period before any increase takes effect.

Advertising restrictions are worth taking seriously. Law 14.790 prohibits gambling advertising that targets minors, uses celebrities who appeal primarily to under-18 audiences, or appears in contexts where minors are likely to be the primary audience. The SPA has published specific guidance on social media advertising that is stricter than what most operators are used to from Curaçao or even MGA-regulated markets. Budget for a Brazilian legal review of every campaign before it goes live.

How does Brazil's tax structure compare to other regulated LATAM markets?

Brazil's 12% GGR federal tax is on the higher end for LATAM but not the highest globally. Colombia (Coljuegos) taxes at 15% GGR for online, while Peru (MINCETUR) sits around 12% as well. The difference is that Brazil's large player base and high average revenue per user make the absolute tax burden substantial even at 12%, and additional state-level taxes may apply depending on your corporate structure.

The 12% federal GGR tax is straightforward in principle but complex in practice because of how GGR is defined under Brazilian rules. The SPA's definition of GGR (receita bruta de apostas) includes bonus costs in a specific way that differs from MGA or UKGC definitions. Specifically, the treatment of free bets and deposit bonuses in the GGR calculation was still being clarified in SPA guidance as of mid-2025, and getting this wrong can result in significant underpayment penalties. Engage a Brazilian tax counsel with specific iGaming experience before you finalize your bonus accounting methodology.

On top of federal GGR tax, Brazilian corporate entities pay standard corporate income tax (IRPJ and CSLL) on net profit, and there are PIS/COFINS social contribution taxes on revenue that interact with the gambling-specific regime in ways that are not always intuitive. The effective total tax rate on a well-structured Brazilian casino operation, including all federal levies, is likely to land between 30% and 40% of GGR depending on your cost structure and how efficiently you manage the corporate layer.

Compared to operating in the grey market via a Curaçao or Anjouan license targeting Brazilian players, the tax cost is real and significant. Grey-market operators paid essentially zero Brazilian tax. The licensed route costs more, but it also gives you access to mainstream payment processors, above-the-line advertising, and the ability to operate without the constant risk of payment blocking or domain seizure. For operators building a long-term Brazilian business rather than a short-term arbitrage, the licensed route is the only rational choice by 2026.

Can you use a Curaçao or Anjouan license to operate in Brazil in 2026?

No. Since January 2025, operating real-money online casino games targeting Brazilian CPF holders without an SPA outorga is illegal under Brazilian law. Offshore licenses from Curaçao, Anjouan, Isle of Man or anywhere else do not confer any right to operate in the Brazilian market. The SPA has already issued blocking orders and is actively working with payment processors to cut off unlicensed operators.

This is the question I get most often from operators who built their LATAM business on a Curaçao or Anjouan license and are now trying to figure out whether they need to go through the SPA process. The answer is unambiguous: the offshore license does not work for Brazil anymore. Law 14.790 is explicit that only SPA outorga holders may offer real-money gambling to Brazilian residents. There is no grandfather clause, no transitional period beyond what was offered in 2024, and no grey area for operators who claim they are not actively targeting Brazil while accepting Brazilian CPF holders and processing Pix deposits.

The enforcement toolkit available to the SPA is meaningful. Domain blocking via ISP-level DNS filtering has already been used against dozens of unlicensed operators. Payment processor blocking is more impactful: the Bacen has instructed Brazilian payment institutions not to process transactions for unlicensed gambling operators, which means Pix, boleto and card payments can all be cut off. Operators who rely on cryptocurrency to route around these blocks are operating in an even higher-risk posture, because the SPA has indicated it will treat crypto-denominated gambling as subject to the same rules.

That said, I want to be honest about the practical reality as of mid-2025: enforcement is imperfect and many grey-market operators are still accessible to Brazilian players. Some will continue to operate in this grey zone for months or years before facing consequences. But the trajectory is clear. Brazil is not going to walk back its regulated framework. The risk profile for unlicensed operators increases every quarter as the SPA builds its enforcement capacity and as Brazilian banks become more aggressive about blocking suspicious transactions. If you are building a business with a three-to-five year horizon, the grey-market route is not a strategy; it is a liability.

What game content and localization requirements apply to a Brazilian online casino?

All games offered to Brazilian players must be certified by an SPA-recognized testing laboratory and must display RTP information in Portuguese. The platform interface, terms and conditions, customer support and responsible gambling tools must all be in Brazilian Portuguese. Operators cannot simply take an English-language casino and add a translation layer; the localization requirements go deeper than that.

Game certification under the SPA framework requires each title to be tested by an approved lab, with BMM Testlabs, Gaming Laboratories International (GLI) and eCOGRA being the most commonly recognized. If you are running a large content catalog, say 2,000 or more titles, the cost of certifying every game individually would be prohibitive. In practice, the SPA has indicated it will accept game certification at the provider level for studios that have already gone through the approval process, but the specifics of this approach were still being finalized in the SPA's technical ordinances during 2025. Confirm the current certification pathway with the SPA directly or through a Brazilian gaming attorney before you finalize your content strategy.

Localization goes beyond translation. Brazilian Portuguese has distinct vocabulary and phrasing from European Portuguese, and players notice the difference. More importantly, the SPA's responsible gambling requirements mandate specific Portuguese-language messaging on deposit screens, loss notifications and self-exclusion prompts. These messages must meet prescribed wording standards, not just be a rough translation of your English copy. Budget for a native Brazilian Portuguese copywriter and legal reviewer as part of your compliance setup, not as an afterthought.

On content strategy, Brazilian players have shown strong preferences for slots with high volatility and bonus features, live dealer games (particularly baccarat and roulette), and football-themed content. Studios like Pragmatic Play, Evolution (for live dealer), and PG Soft have significant Brazilian player bases from the grey-market era and are actively working on SPA-certified versions of their catalogs. Having Evolution's live casino in your lineup is close to mandatory; their market share in LATAM live dealer is dominant enough that operators without it are at a measurable conversion disadvantage.

What does a realistic launch timeline look like for a Brazil-licensed casino in 2026?

A realistic timeline from the decision to pursue an SPA outorga to a compliant go-live is 12 to 18 months for a well-resourced operator. The SPA application process alone takes six to twelve months. Platform certification, entity setup, payment integration and content certification run in parallel but add their own dependencies. Operators who think they can compress this to six months are underestimating the Brazilian regulatory process.

Month one through three: corporate setup and pre-application preparation. Incorporate your Brazilian entity, appoint directors, open your Brazilian bank accounts, engage local legal counsel and begin assembling your beneficial ownership documentation. Simultaneously, select your platform provider and confirm their SPA certification status. Do not wait for the entity to be fully set up before starting platform conversations; the lead time on platform contracts and technical scoping means you need those conversations running in parallel.

Month three through eight: SPA application submission and review. Prepare and submit your application dossier. The SPA's review process has been running at six to nine months for the initial cohort of applicants. During this period, continue your platform integration work, complete your game content certification, and build out your payment stack. If the SPA requests additional documentation, response time matters; delays on your side extend the clock.

Month eight through twelve: technical integration and pre-launch compliance. Complete the SPA real-time monitoring integration, run your responsible gambling system tests, finalize your Pix payment flows and do a full compliance audit of your platform against the SPA's technical standards. This is also when you build your customer support team, which must be Portuguese-speaking and staffed to handle Brazilian time zones.

Month twelve through eighteen: soft launch and scale. Assuming your outorga is granted, do a controlled soft launch with a limited marketing budget to identify any operational issues before going full-scale. The Brazilian market is large enough that a botched launch with payment failures or compliance gaps will generate negative press that is hard to recover from. A soft launch period of four to six weeks before full marketing activation is worth the delay.

What are the biggest mistakes operators make when entering the Brazilian market?

The most common and costly mistakes are underestimating the outorga fee as a cash-flow event, choosing a platform provider without confirmed SPA certification, skipping proper Brazilian legal counsel in favor of offshore advisors, and launching marketing before the compliance infrastructure is fully operational. Brazil is not a market where you can fix compliance issues after launch without serious regulatory consequences.

Underestimating cash flow is the silent killer of Brazil entries. Operators who have operated on Curaçao or MGA licenses are used to license fees in the range of USD 30,000 to 150,000. The BRL 30 million outorga fee is a different category of commitment, and it comes due before you have generated a single dollar of Brazilian GGR. Operators who structure their funding assuming they can use early player deposits to partially fund the outorga are making a dangerous assumption. The fee must be paid to the SPA before the outorga is granted; there is no installment option in the current framework.

Platform selection errors are the second most common issue. Several operators have signed contracts with platform providers who marketed themselves as SPA-ready but had not actually completed the certification process. The result is a six-to-twelve month delay while the provider finishes their certification work, during which the operator is paying platform fees and salaries without any revenue. Before you sign any platform contract for a Brazilian launch, ask for written confirmation of SPA technical certification status, the specific ordinance version they are certified against, and the name of the testing laboratory that issued the certification.

The third mistake is treating Brazil as just another LATAM market. Brazil has a distinct legal system (civil law with specific Brazilian characteristics), a unique payment infrastructure, a different language from the rest of LATAM, and a regulatory body that is actively building its enforcement capability. Operators who copy-paste their Colombia or Mexico playbook into Brazil without adapting it will hit friction at every step. Hire Brazilian-specific expertise, not just a regional LATAM consultant who has never actually worked with the SPA.