Brazil moves from onboarding to enforcement: what the SPA's first suspensions tell operators

Brazil spent 2024 and 2025 building a licensing regime. In 2026 it started running one, and the difference is now visible in the enforcement record. The transition period defined by Law 14.790/2023 expired on 1 January 2026, moving the Secretariat of Prizes and Betting (SPA) from guidance into enforcement against both licensed and unlicensed operators.

Operators holding active federal licences as at 30 June 2026

87Operators holding active federal licences as at 30 June 2026

Licensed platforms ordered to suspend operations on 14 August 2026

14Licensed platforms ordered to suspend operations on 14 August 2026

Length of the SPA licensing consultation running to 9 September 2026

45 daysLength of the SPA licensing consultation running to 9 September 2026

The failures were operational, not legal

On 14 August 2026 the SPA ordered 14 already-licensed betting sites to suspend operations. These were not unlicensed rogues; they had passed the authorisation gate. What they failed was the ongoing obligation: breaches of responsible-gaming requirements and violations within Sigap, the national betting management system through which operators report to the regulator.

Two failure patterns dominate the enforcement actions reported so far, and both are worth reading closely because they generalise well beyond Brazil:

• Ghost accounts: operators penalised for allowing customers to register and play without completing a biometric liveness check, defeating the identity assurance the regime depends on.
• Self-exclusion leaks: platforms penalised for failing to block customers listed on the national self-exclusion register, meaning the protection existed on paper but not in the betting flow.

Neither failure is a drafting problem. Both are integration problems: a rule was written, a register was built, and the operator's production systems did not honour either in real time. A regulator that cannot detect that gap in the data it already receives is not supervising. It is archiving.

The unlicensed market is a payments and distribution problem

Brazil's toolkit against unlicensed supply now runs to domain blocking, payment-processor blacklisting and criminal referral. The results are instructive about the limits of blocking alone: VPN usage among Brazilian bettors reportedly rose 35% in the first quarter of 2026, and the SPA has since floated obligations that would require Apple and Google to remove unlicensed gambling apps from their Brazilian storefronts.

Channelling is won at the payment rail and the app store, not at the DNS record. Every jurisdiction that has tried to block its way to compliance has learned this in the same order.

The regulator is also revising the framework itself. A 45-day consultation on fixed-odds licensing regulations opened on 27 July 2026 and runs to 9 September, explicitly intended to fold lessons from the first authorisation cycle into the next one. That iteration loop, authorise, supervise, learn, re-draft, is the part of regulatory design that rarely survives contact with a fixed-scope government IT project.

The read-across

Brazil is a large, well-resourced market that did most things in the right order and still needed enforcement action against a sixth of its licensed base within eight months of going live. Smaller jurisdictions standing up a regime should take that as the base rate, not the exception, and should design the supervisory layer, the reporting schema and the self-exclusion integration before the first licence is issued, not after the first breach.