A new SPA ordinance turns banks, fintechs and payment providers into the front line against unlicensed betting, backed by account freezes, forfeiture of funds and possible tax liability for institutions that keep the money moving.
Once Brazil's betting regulator flags an operator as illegal, banks and payment companies will have just 24 hours to lock down its accounts and freeze the money inside, under a new ordinance from the Ministry of Finance's Secretariat of Prizes and Betting (SPA).
Ordinance SPA/MF No. 2,750/2026 was signed on September 10 by SPA Secretary Daniele Correa Cardoso and published on Monday, September 14, in an extra edition of the Federal Official Gazette, taking effect the same day. It supersedes a much broader March 2025 ordinance (No. 566) on the same subject and sets out, step by step, how the account-blocking powers in the 2023 Bets Law (Law No. 14,790) and June's Decree No. 13,033 will work in practice.
Following the money
The SPA has already had more than 60,000 illegal betting sites blocked, with the process automated since October 2025, according to figures presented to a Chamber of Deputies committee in August by Carlos Renato Resende, the secretariat's undersecretary for monitoring and oversight. Resende said that tracking where the money from those sites was going had led officials to a few hundred companies receiving the funds, the same logic now being written into rules for the entire financial system.
Banks were already part of the effort under the old framework. By the end of 2025, 54 financial and payment institutions had sent the SPA 1,255 reports involving 1,687 people suspected of transferring money to unauthorized betting companies, leading to the closure of 550 bank accounts, 265 of them already identified as illegal.
The new rules cover banks, payment institutions and payment scheme operators. In card schemes, the duties to monitor, report and block fall on the acquirers and sub-acquirers that hold the contract with the merchant receiving the funds.
A red-flag checklist for compliance teams
Article 5 is where the ordinance gets granular, spelling out the warning signs compliance teams are expected to watch for. Among them: deposit-sized amounts that recur or bunch together in the same ranges; bursts of small and medium transfers from many different senders within short windows; Pix transfer descriptions mentioning terms such as apostas (bets), bônus, recarga (top-up), palpites (tips) or prêmios (prizes), or brand names that hint at a betting site; and a habit of swapping Pix keys, QR codes or receiving accounts right after one is blocked or closed.
The recipient's profile matters too. Payments to companies registered at virtual offices, coworking spaces or residential addresses raise flags, as do newly incorporated firms that suddenly receive large numbers of scattered transfers that don't fit their declared business. Using payment gateways or other intermediaries to hide the final beneficiary or the purpose of a transaction is another warning sign, as is the rapid onward transfer or dispersal of funds, including through virtual assets.
The ordinance also creates the category of intermediary person (pessoa intermediária): any individual or company that repeatedly moves funds on behalf of an unlicensed operator. The idea is to catch not just the betting brand but the web of front men, known locally as laranjas, and payment providers that sit between bettors and the operator to obscure who really gets paid.
Other indicators reflect Brazil's multi-layered licensing landscape: recurring, sizable transfers from individuals whose declared address lies outside the state or Federal District that authorized the receiving operator; claims of municipal authorization; and payments collected by a company other than the one formally licensed. Institutions are expected to weigh these signals together and in proportion to risk, checking transaction patterns against each customer's registration data and economic profile.
The clock: 45 days, one business day, 24 hours
Once a suspicious situation is identified, institutions have no more than 45 days to complete their review. If that review uncovers signs of illegal betting, the case must be reported to the SPA by the next business day. Filing a report does not mean the SPA has ruled against anyone, and it does not by itself lead to a block.
That decision belongs to the SPA, which issues a formal record of irregularity (auto de constatação de irregularidade). The same document opens an administrative proceeding to forfeit the frozen funds to the federal government, in which the operator keeps the right to a defense. The record names the operator, describes the evidence and lists the websites and apps it uses.
The SPA then notifies institutions through a secure electronic system, alerting the Central Bank at the same time for supervisory purposes. Institutions have 24 hours to freeze the flagged operator's accounts and put mechanisms in place that stop new payments from reaching it, directly or indirectly, followed by up to 48 hours after the freeze to confirm compliance to the SPA. Institutions cannot sit this out just because the operator isn't their customer: the duty to stop payments applies even where they hold no account in its name.
Bettors will feel the change at the point of payment. When a customer tries to send money to someone named in a record of irregularity, the bank must tell them the transaction cannot go through because of an SPA notice. The case files then go to the Ministry of Justice and Public Security's National Secretariat of Public Security, which runs the forfeiture process.
Tax exposure, and a safe harbor
The ordinance also carries a financial stick for the institutions themselves. Blocking notices may come with a formal communication of joint tax liability under Article 6 of Complementary Law No. 224/2025, as regulated by Ministry of Finance Ordinance No. 1,766 of June 17, 2026. Put simply, a bank or fintech that keeps processing payments for an operator after learning it is illegal could end up sharing responsibility for that operator's unpaid taxes.
On the other side of the ledger, reports made in good faith do not expose the reporting institution to civil or administrative liability, a safe harbor meant to encourage banks and payment firms to flag cases even without conclusive proof. These reports are also kept separate from institutions' existing anti-money laundering and counter-terrorist financing obligations. The text further relies on National Monetary Council Resolution No. 5,320 of June 25, 2026, as the legal basis for institutions to reject transactions, a sign of prior coordination between the SPA and Brazil's monetary authorities.
Compliance teams will also get a whitelist to check against. The SPA must publish and keep updated a list of every authorized operator on its website, downloadable in a structured format and, when the technology is ready, accessible through an API. Each listing will show at minimum the authorization act, company name, CNPJ corporate tax number and the licensed brand names and domains. All SPA-licensed platforms operate under the .bet.br domain.
Technical rules still to come
Key operational details, including exactly what data institutions must send, in what format and through which technical channel, have been left to a separate normative instruction that has not yet been published. Once it is out, institutions will have 30 days to get their systems ready. A separate 30-day deadline, counted from the ordinance's publication, applies to institutions outside the Central Bank's messaging system, which must give the SPA an institutional contact address. In other words, the regime will not be running at full capacity until that instruction arrives.
Industry backs the crackdown
The Brazilian Institute for Responsible Gaming (IBJR), an industry body, welcomed the ordinance in a statement on September 16, calling it "an important step forward in the fight against the illegal market." In the institute's view, cutting off access to payments is among the strongest weapons available, since an operator that cannot take deposits or pay out winnings cannot stay in business. It also argued the rules help level the playing field for licensed platforms, which must meet technical, tax and player-protection requirements that illegal rivals ignore, and urged quick implementation.
A heated political backdrop
The ordinance goes after unlicensed operators, but it arrives as the future of the licensed market has itself become an election issue. The first round of Brazil's general election is set for October 4, with a possible runoff on October 25. At a campaign event in Guarulhos, São Paulo state, on September 18, President Luiz Inácio Lula da Silva declared, "I've decided I'm going to end the bets," using the local shorthand for online betting companies. Speaking in Florianópolis the next day, the re-election candidate said he would consult the Finance Ministry and the Central Bank before taking concrete action, without detailing the scope or timeline of any ban.
Finance Minister Dario Durigan has said that nothing has been decided. The government is reportedly discussing a measure to prohibit online casino games and impose new restrictions on sports betting, although no final design has been announced.
Whatever comes out of that debate, Ordinance 2,750 has already shifted a large share of the enforcement burden onto Brazil's financial system. For banks, fintechs and payment providers, the real test begins once the technical rules are published, and a 24-hour blocking window leaves little room for slow compliance.
