How to Start an Online Casino in Brazil in 2026: The SPA License Explained for Serious Operators
What is the SPA and how does Brazil's new outorga system actually work?
The Secretaria de Prêmios e Apostas (SPA) is the federal body created under Law 14.790/2023 to regulate fixed-odds sports betting and online casino games in Brazil. It issues outorgas (authorizations) to qualifying operators. The market went live in January 2025, making Brazil one of the largest newly regulated iGaming jurisdictions in the world.
Law 14.790 was signed in December 2023 and replaced years of legal grey-area operation with a clear federal framework. The SPA, housed within the Ministry of Finance, took over from the earlier Secretaria de Avaliação, Planejamento, Energia e Loteria (SECAP) and was given real enforcement teeth, including the power to block unlicensed domains and fine payment processors that route funds to unauthorized operators. That last point matters: Brazil's central bank (Banco Central do Brasil) is a co-regulator on the payment side, and it has already issued guidance to acquirers and PIX operators about transaction monitoring obligations.
The outorga model is not a traditional license in the MGA or Curaçao sense. Think of it more like a federal concession. You apply, pay the BRL 30 million authorization fee, pass technical and integrity checks, and receive a five-year operating right. There is no secondary market for outorgas the way there is for MGA licenses, and the fee is non-refundable if your application is rejected, which is a significant financial risk that operators from smaller markets often underestimate.
The SPA has also published a list of permitted game categories, which broadly covers slots, table games, live dealer, and fixed-odds sports betting under a single outorga. That bundling is actually operator-friendly compared to, say, the Italian ADM model where sports and casino are separate concessions with separate fees. The catch is that every game title offered must be individually homologated (certified) by an SPA-accredited testing laboratory before it can go live. That certification backlog is real and was causing launch delays for several operators in H1 2025.
Who can apply for a Brazil SPA outorga and what are the eligibility requirements?
Applicants must be a legal entity incorporated in Brazil, or a foreign company that establishes a Brazilian subsidiary (CNPJ registration required) before submitting. Shareholders and directors undergo fit-and-proper checks. There is a minimum paid-in capital requirement, and the company must demonstrate financial capacity to cover the BRL 30 million fee plus ongoing operational obligations.
The corporate structuring question is where most international operators hit their first real friction. You cannot simply point your offshore holding company at the SPA and apply. You need a Brazilian LTDA or S.A., a local registered address, a tax registration (CNPJ), and at least one director who can be held legally accountable in Brazil. Many operators use a local law firm to set up a special-purpose vehicle (SPV) for the Brazilian entity while keeping the wider group under a holding structure in a jurisdiction like Malta or the Netherlands. That structure works, but it adds three to four months to your pre-application timeline and meaningful legal fees before you spend a single real on the outorga itself.
Fit-and-proper checks cover ultimate beneficial owners (UBOs) down to 10% shareholding, which is tighter than some offshore jurisdictions. Criminal background checks, source-of-funds documentation, and references from existing regulated markets are all required. If your group has ever held a Curaçao sub-license under a master licensee rather than a direct license, the SPA may ask additional questions about your regulatory track record. I have seen operators caught off-guard by this, particularly those who spent years operating under Curaçao umbrella licenses where the compliance paper trail is thin.
There is also a technical requirements layer: your platform must be hosted on servers physically located in Brazil or in a data center that meets SPA specifications, your RNG must be certified by an accredited lab, and you must integrate with the SPA's real-time monitoring system (a government-facing API that reports bet activity). That API integration requirement alone can add six to eight weeks to your technical build if your platform provider has not already done it. Ask your platform vendor directly whether they have a live, tested SPA API integration before signing any contract.
| Requirement | Detail | Common Pitfall |
|---|---|---|
| Legal entity | Brazilian LTDA or S.A. with active CNPJ | Foreign holding companies cannot apply directly |
| Paid-in capital | Minimum set by SPA regulation (verify current figure with legal counsel) | Undercapitalized SPVs rejected at first review |
| Fit-and-proper | UBOs to 10%, criminal checks, source-of-funds | Thin Curaçao compliance history triggers extra scrutiny |
| Technical certification | Platform and each game title homologated by accredited lab | Certification backlog can delay launch by months |
| Server location | Brazil-based or SPA-approved data center | Cloud-only setups may need local node added |
| SPA monitoring API | Real-time bet reporting integration required | Not all platform vendors have this built; verify before signing |
How much does it actually cost to start an online casino in Brazil?
Budget a minimum of USD 8 to 12 million for a compliant Brazil launch when you add the BRL 30 million outorga fee, corporate setup, platform licensing, game certification, compliance infrastructure and initial marketing. That is before ongoing revenue share, taxes, and responsible gambling tooling. Brazil is not a cheap-entry market.
The BRL 30 million fee (approximately USD 5.8 to 6.2 million depending on the exchange rate at time of payment) is the headline number, but it is not the only large line item. Corporate setup and legal fees for entity formation, fit-and-proper documentation, and application support from a Brazilian law firm typically run USD 150,000 to 300,000. If you are using an international gaming law firm with a local partner, budget toward the higher end. Game homologação fees depend on the size of your library. At roughly BRL 5,000 to 15,000 per title (figures circulating in the industry as of 2024 to 2025, though the SPA has discretion here), a library of 500 games could cost USD 500,000 to 1.5 million in certification fees alone.
Platform costs depend heavily on your build approach. A white-label solution from a provider like SoftSwiss or EveryMatrix will carry a setup fee of USD 50,000 to 150,000 plus a revenue share of 15% to 25% of GGR. A turnkey build from a supplier like BetConstruct or Digitain will cost more upfront (USD 200,000 to 500,000 setup) but lower ongoing rev-share. Custom builds are not realistic for most operators entering Brazil, given the regulatory complexity and the need for a certified, proven platform from day one. I always tell clients: do not use Brazil as the market where you also launch your custom-built platform. The certification risk is too high.
Tax is a separate, painful line. Brazil's online gambling tax framework under Law 14.790 sets a gross gaming revenue (GGR) tax of 18%, plus a social contribution levy (PIS/COFINS) that pushes the effective tax rate higher. Add corporate income tax (IRPJ/CSLL) on profits and you are looking at an effective total tax burden that industry estimates put at 30% to 40% of GGR in the early years. That compresses margins significantly compared to offshore operations, and it should be baked into your financial model before you commit to the outorga fee.
| Cost Item | Estimated Range (USD) | Notes |
|---|---|---|
| SPA outorga fee | $5.8M, $6.2M | BRL 30M, non-refundable; rate-dependent |
| Corporate setup & legal | $150K, $300K | Entity formation, fit-and-proper docs, application support |
| Game homologação | $500K, $1.5M | Depends on library size; budget per title |
| Platform setup (white-label) | $50K, $150K + rev-share | 15-25% GGR ongoing to platform provider |
| Platform setup (turnkey) | $200K, $500K + lower rev-share | More upfront, better unit economics at scale |
| SPA API & tech compliance | $50K, $150K | If platform vendor has not already built integration |
| Compliance & AML stack | $80K, $200K | KYC provider, transaction monitoring, RG tooling |
| Initial marketing budget | $500K, $2M+ | Brazil is a competitive, high-CPM market in 2026 |
| Effective GGR tax burden | ~30-40% of GGR | GGR tax + social contributions + corporate tax |
White-label vs. turnkey vs. custom build: which platform approach works for Brazil?
For most operators entering Brazil in 2026, a turnkey solution from a provider with existing SPA compliance infrastructure is the lowest-risk path. White-label works if speed is the priority and you accept margin compression. Custom builds are a trap for this market: the certification timeline will kill your launch window.
The white-label route from providers like SoftSwiss (their SOFTSWISS Casino Platform) or EveryMatrix (CasinoEngine) gets you to market faster because these vendors have already invested in SPA API integrations, homologated game content, and Brazilian payment method support including PIX. The trade-off is a revenue share structure that compounds painfully once you add the 18% GGR tax. If you are paying 20% to a white-label provider and 18% to the SPA plus additional social levies, you are working on very thin margins until you reach significant volume. For operators targeting BRL 50 million or more in annual GGR, the math starts to favor a turnkey deal where you own the platform license and negotiate lower rev-share.
Turnkey providers worth evaluating for Brazil include BetConstruct, Digitain, and GR8 Tech (formerly Parimatch Tech's B2B arm). The key questions to ask any turnkey vendor: Do you have a live SPA monitoring API integration with a reference client already in production? Which testing lab certified your RNG for Brazil? What is your PIX integration setup, and do you support CPF (Brazilian taxpayer ID) verification natively in your KYC flow? If a vendor cannot answer all three questions with specifics, they are selling you a roadmap, not a product.
One underappreciated option is using a game aggregator like Relax Gaming, Paysafe's Income Access, or even the IBJR-connected local aggregators that have pre-negotiated homologação for their content libraries. Pairing a lean turnkey platform with a Brazil-certified aggregator can shorten your game certification timeline from six months to six weeks. The aggregator takes a cut, but the time-to-market value in a competitive market is real. In Brazil in 2026, the operators who launched in Q1 2025 already have brand recognition and player databases. Every month you delay costs you more in marketing spend to catch up.
What payment methods do Brazilian players use and how do you integrate them compliantly?
PIX is the dominant payment method in Brazil and must be your primary integration. It is instant, free for consumers, and has over 150 million registered keys. Beyond PIX, Boleto Bancário covers unbanked segments. Crypto deposits are in a regulatory grey area under SPA rules and should not be your primary payment strategy for a licensed operation.
PIX, launched by the Banco Central do Brasil in November 2020, has fundamentally changed the Brazilian payments landscape. For online gambling, it offers instant deposits and withdrawals 24/7, which is what players expect. Your platform provider must support PIX natively, and your payment processing partner needs to be a PIX-enabled acquirer or a licensed payment institution (Instituição de Pagamento, IP) regulated by the Banco Central. International PSPs that are not registered as IPs in Brazil cannot legally process PIX transactions for your licensed operation. This is a compliance requirement, not just a technical preference.
Boleto Bancário remains relevant for players without bank accounts or credit cards, which is a meaningful segment in Brazil given the country's financial inclusion profile. Boleto payments take one to three business days to clear, which creates a friction point, but the reach justifies the integration. Some operators also offer Boleto Parcelado (installment Boleto) through fintech partners, though the regulatory treatment of installment credit for gambling deposits is an open question under SPA rules as of 2025.
Credit card transactions for gambling were restricted under the original regulatory framework, with the SPA and Banco Central both signaling that credit cards should not be used for gambling deposits. This aligns Brazil with the UK and Sweden in restricting credit-funded gambling, and it means your payment stack should be built around debit, PIX, and bank transfer from day one. Do not assume your European payment stack will translate. Providers like Paag, Transfeera, and Zoop have built Brazil-specific payment infrastructure that several licensed operators are using in production. Evaluate them alongside global names like Paysafe and Nuvei, both of which have Brazilian operations.
What are the responsible gambling and AML requirements under the SPA framework?
Brazil's SPA framework mandates deposit limits, self-exclusion integration with a national registry, real-time transaction monitoring, and full KYC using CPF verification. AML obligations are governed by COAF (Brazil's financial intelligence unit) and require reporting of suspicious transactions. These are not checkbox requirements; the SPA has enforcement authority and has already fined operators in early 2025.
The responsible gambling requirements under Law 14.790 and the SPA's subsequent portarias (regulatory orders) are substantive. Operators must offer daily, weekly, and monthly deposit limits that players can set themselves. A national self-exclusion registry (similar in concept to GamStop in the UK) was mandated in the legislation, and operators must check against it at registration and at defined intervals. As of mid-2025, the registry's technical implementation was still being finalized, but the legal obligation to integrate is already in force. Build the API hook into your platform from day one rather than retrofitting it later.
KYC is CPF-centric. Every Brazilian player has a Cadastro de Pessoas Físicas (CPF) number, and the SPA requires verification against the Receita Federal's CPF database before a player can deposit. This is actually a strong anti-fraud measure, but it creates friction in the registration flow that you need to optimize carefully. Providers like Serpro (the federal data processing agency) offer CPF validation APIs that several licensed operators use. Third-party KYC providers such as Idwall and Unico Check have built Brazil-specific identity verification products that combine CPF validation with biometric checks, which is what the SPA expects for higher-value accounts.
On AML, Brazil's COAF (Conselho de Controle de Atividades Financeiras) requires gambling operators to file Suspicious Transaction Reports (STRs) and maintain transaction records for five years. The SPA's real-time monitoring API also feeds bet data to regulators, which means unusual patterns will be visible to the authority without waiting for an operator's own reporting. This is a more surveillance-heavy model than Curaçao or even MGA, and operators who built their AML programs around reactive reporting rather than proactive monitoring will need to invest in transaction monitoring tools. Featurespace, NICE Actimize, and local fintech AML providers are all active in the Brazilian market.
How long does the SPA outorga application process take from start to launch?
Realistically, budget 12 to 18 months from the decision to enter Brazil to your first live player. The application review alone can take three to six months after submission. Add corporate setup, game certification, platform integration, and payment infrastructure, and a Q1 2026 decision to enter Brazil means a late 2026 or early 2027 launch at best.
The timeline breaks down roughly as follows. Corporate structuring and entity formation in Brazil takes two to three months if you are setting up a new subsidiary, accounting for CNPJ registration, tax enrollments, and opening a local bank account (which Brazilian banks make deliberately slow for new foreign-owned entities). Simultaneously, you should be selecting your platform provider and beginning the SPA API integration work, because that cannot wait for the license to be granted.
Application preparation, including fit-and-proper documentation, financial statements, technical architecture documentation, and the formal application submission, takes another two to three months if you have experienced counsel. The SPA review period has ranged from three to six months based on the first wave of applicants in 2024. The SPA can request additional information (a saneamento request), which pauses the clock and adds further weeks. Operators who submitted clean, complete applications with experienced Brazilian gaming lawyers moved faster.
Game certification runs in parallel but is often the critical path. If your platform provider has pre-certified content from an SPA-accredited lab (GLI, BMM, Gaming Laboratories International all have Brazilian accreditation), you can launch with their certified library and add your own custom titles later. That strategy cut launch timelines for several operators in 2025. Plan for a phased launch: go live with certified content, then expand your library as additional homologações are granted. Trying to certify 1,000 games before launch is how you miss your market window.
How does Brazil's SPA license compare to operating under a Curaçao or MGA license targeting Brazilian players?
Operating under a Curaçao or MGA license and targeting Brazilian players without an SPA outorga is now illegal under Brazilian law. The SPA has domain-blocking authority and has been coordinating with Banco Central to restrict payment flows to unlicensed operators. The grey-market window that existed before January 2025 has effectively closed for serious operators.
For years, Brazil was one of the world's most valuable grey markets. Operators with Curaçao licenses, and later Anjouan licenses, ran Portuguese-language casinos targeting Brazilian players with minimal regulatory risk because there was no domestic regulator with enforcement tools. That changed materially with Law 14.790 and the SPA's activation. The law explicitly prohibits Brazilian residents from gambling with unlicensed operators and creates liability for payment processors and advertising platforms that facilitate unlicensed activity.
The practical enforcement picture in 2025 is mixed. Domain blocking is happening, but determined players use VPNs. Payment blocking is more effective because PIX, the dominant method, flows through Brazilian-regulated institutions that respond to Banco Central guidance. Operators running Curaçao-licensed sites targeting Brazil are seeing increasing payment friction, and that friction will only grow as the SPA matures. For any operator planning a long-term Brazil strategy, the outorga is not optional. The grey-market arbitrage window is closing.
The MGA comparison is worth noting for operators who already hold a Malta license. An MGA license does not give you any preferential treatment in the SPA process. You still need a Brazilian entity, the full outorga fee, and local compliance infrastructure. What the MGA license does give you is a stronger fit-and-proper track record that the SPA will view favorably, and potentially faster review. If your group holds an MGA license and is entering Brazil, lead with that in your application narrative. It signals regulatory maturity that the SPA cares about, particularly after several early applicants with thin compliance histories were asked extensive additional questions.
| Factor | Brazil SPA Outorga | Curaçao License | MGA License |
|---|---|---|---|
| Legal status for Brazil players | Fully legal and compliant | Illegal under Law 14.790 since Jan 2025 | Illegal without SPA outorga |
| Upfront cost | ~USD 6M+ (BRL 30M fee) | USD 20K-50K (master license route) | USD 25K-35K application + annual fees |
| Time to obtain | 12-18 months total | 2-4 months | 6-12 months |
| Payment access (PIX) | Full PIX access via licensed IPs | Increasingly blocked by Banco Central guidance | No preferential PIX access without SPA outorga |
| GGR tax | ~18% + social levies (~30-40% effective) | 0% at jurisdiction level | 5% gaming tax (Malta) |
| Enforcement risk | Low (you are the licensed operator) | High and growing | High in Brazil without SPA outorga |
| Fit-and-proper scrutiny | High (UBO to 10%, criminal checks) | Low to moderate | High (comparable to SPA standard) |
What marketing and player acquisition strategies work in Brazil's competitive 2026 market?
Brazil's player acquisition landscape in 2026 is dominated by sports betting brands that entered early and built brand recognition. Casino-focused operators need to invest in SEO, influencer marketing through Brazilian content creators, and affiliate programs. Television and digital advertising are permitted for licensed operators but must include mandatory responsible gambling messaging.
The Brazilian market has a strong sports culture, and the early-mover brands (Bet365, Betano, Sportingbet, and domestic entrant Betnacional) have enormous brand awareness from their sports betting operations. A pure casino operator entering in 2026 is fighting for attention in a crowded space. The operators I have seen succeed in analogous markets combine a strong sports betting product as the acquisition hook with a deep casino product for monetization and retention. If your platform is casino-only, expect higher CPAs and longer payback periods.
Affiliate marketing is a proven channel in Brazil, and a Brazilian affiliate ecosystem has grown rapidly since 2023. Platforms like Afiliados.com.br and established international networks like Income Access have Brazilian publisher bases. The key compliance point: affiliates promoting your brand must only direct traffic to your SPA-licensed domain, and you are responsible for their compliance with SPA advertising standards. Build affiliate compliance monitoring into your program from day one, not after you receive your first SPA warning letter.
Influencer marketing through Brazilian YouTubers, streamers, and Instagram creators is a major channel, particularly for reaching the 18 to 35 demographic. The SPA has advertising rules that restrict promotion to adults and require responsible gambling disclosures, but the influencer channel is active and measurable. Localization matters enormously here. Brazilian Portuguese is not European Portuguese, and campaigns that feel translated rather than native will underperform. Hire Brazilian creative teams, not European ones who speak Portuguese.
Which platform providers and technology partners are best positioned for Brazil in 2026?
SoftSwiss, EveryMatrix, BetConstruct, and Digitain are the most frequently cited platform providers with stated Brazil readiness. For game content, Pragmatic Play, Evolution Gaming, and NetEnt (now part of Evolution) have pursued Brazilian homologação. For payments, Transfeera, Paag, and Nuvei Brazil are the names appearing in live operator stacks.
SoftSwiss deserves specific mention because they moved early on Brazil compliance, publishing public documentation about their SPA API integration and partnering with GLI for game certification. Their Casino Management System (CMS) has Portuguese-language back-office support and CPF-based KYC flows. The revenue share model is 15% to 20% of GGR depending on volume tiers, which is workable at scale but tight given Brazil's tax burden. Their aggregator (SOFTSWISS Game Aggregator) includes a growing library of SPA-certified titles.
EveryMatrix's CasinoEngine has been active in Brazil through partnerships with local operators, and their MoneyMatrix payment hub has PIX integration. EveryMatrix tends to be more flexible on commercial terms for operators with existing track records in other regulated markets, which makes them worth the conversation if you are coming from an MGA or UKGC background. BetConstruct has a strong presence in LATAM more broadly and has invested in Portuguese-language support and local account management in São Paulo, which matters for ongoing operational support.
On the game content side, do not assume that a studio's global catalog is available in Brazil. Pragmatic Play and Evolution have been the most aggressive in pursuing Brazilian homologação for their core titles, but even they have not certified their entire libraries. Ask any aggregator for a Brazil-specific certified game list, not their global catalog. The gap between the two is often 30% to 50% of titles, and launching with a thin certified library hurts conversion rates in a market where players have seen large international catalogs on grey-market sites for years.
What are the biggest risks and hidden costs operators discover after committing to Brazil?
The three risks operators consistently underestimate are the game certification backlog (which delays launch and limits initial catalog), the effective tax burden once all levies are stacked, and the working capital required to maintain the BRL 30 million outorga fee as a sunk cost while the operation ramps to profitability.
The certification backlog is a structural problem, not a temporary one. The SPA accredits a limited number of testing laboratories, and the volume of titles submitted by all licensed operators has created queues. Operators who planned to launch with 1,000 games found themselves going live with 200 to 300 in Q1 2025, which hurt their competitiveness against grey-market sites still offering full libraries. The mitigation strategy is to use a platform provider or aggregator with a pre-certified library and plan your own title submissions as a second phase. Accept that your launch catalog will be smaller than you want.
The tax burden surprises operators who modeled Brazil based on offshore margins. The 18% GGR tax is the visible number, but PIS and COFINS (social contribution taxes on gross revenue) add roughly 3.65% to 7.6% depending on the tax regime elected, and IRPJ/CSLL on net profits adds further burden. Industry consultants in Brazil have published effective total tax rate estimates in the 30% to 40% of GGR range for typical operators. That means a business generating USD 10 million in GGR might net USD 2 to 3 million after taxes and platform costs. Model this carefully before committing the outorga fee.
Working capital is the hidden killer. The BRL 30 million is paid upfront and is non-refundable. Most operators fund this from equity or debt. The operation then takes 12 to 24 months to reach breakeven in a competitive market. That means you need the outorga fee, plus 18 to 24 months of operating costs, funded before you see meaningful returns. Operators who entered with exactly the outorga fee and minimal runway have found themselves in distress by month 18. I tell every client: if you cannot fund two years of operations beyond the outorga fee, Brazil is not the right market for your current capitalization.
Comments
No comments yet, be the first.