Brazil tightens rules forcing banks to freeze illegal iGaming funds

Brazil’s Secretariat of Prizes and Bets, the Finance Ministry body that oversees gambling, approved new rules governing how financial institutions and payment processors handle money tied to unregulated iGaming operators. The rules took effect September 14, replacing a version that had been in place since March 2025, and this time the obligations go beyond simply refusing known bad actors. Banks and payment operators now have to actively monitor for transactions that directly or indirectly keep an unregulated platform running, and specifically watch for attempts to route around restrictions through intermediaries.

The risk indicators SPA laid out read like a checklist built from watching how these operators actually move money. A flood of small transfers from many different senders. A sudden jump in transaction volume with no obvious business reason behind it. Repeated changes to Pix keys, QR codes, or payment links, the kind of churn that makes an account harder to trace back to a single operator. Transactions that simply don’t match what a company claims to do. New legal entities that start pulling in large transfer volumes almost immediately after registering get flagged for particular scrutiny, since a shell company with no track record suddenly processing heavy payment flows is one of the clearer tells in the whole system.

Once SPA determines illegal activity is actually happening, it issues a formal notice naming the operator along with its sites, apps, domains, linked accounts, and the specific transactions that triggered the finding. From there the clock starts immediately: financial institutions have 24 hours to freeze the operator’s accounts and stop processing any new transaction that could fund its operations, then another 48 hours to confirm back to SPA that the block actually happened.

Brazil has been building this kind of enforcement machinery in pieces over the past year. Banks already closed hundreds of accounts tied to unregulated platforms under the previous rule, and this update tightens the detection criteria rather than starting the system from scratch, aiming at the accounts that were slipping through the earlier, less specific version of the same requirement.