iGaming Compliance in Brazil: How to Verify Bettors with CPF and Sanctions Lists

Brazil's sports betting market moved more than R$ 100 billion in 2024 — and with that came one of the strictest regulatory regimes in Latin America. Licensed operators now have to validate every bettor's identity, verify age, screen against national and international sanctions lists, and monitor political exposure. Operators that don't face multimillion-real fines, license suspension, and even criminal liability.

This guide explains, step by step, how iGaming compliance works in Brazil — from the regulatory framework to the technical implementation via API.

What iGaming compliance means

iGaming compliance is the set of processes a betting operator must follow to comply with Brazilian law. In practice, it means verifying who is placing bets, keeping minors off the platform, and making sure the operation isn't used for money laundering or financing illicit activity.

The three pillars of betting compliance are:

1. Know Your Customer (KYC) — validate identity, age and registration data
2. Anti-money laundering (AML) — monitor transactions and suspicious relationships
3. Sanctions screening — check lists of sanctioned individuals and entities

Without these processes, the operator is exposed to regulatory, financial and reputational risk.

The regulatory framework: Lei 14.790/2023 and the SPA ordinances

Lei 14.790 (Brazil's fixed-odds betting law), signed in December 2023, is the legal framework regulating fixed-odds betting in Brazil. It replaced MP 1.182/2023 (a provisional presidential decree) and created the rules for licensing, operating and supervising sports betting platforms and online games.

The Secretaria de Prêmios e Apostas (SPA) — the Prizes and Betting Secretariat, under Brazil's Ministry of Finance — is the body responsible for regulating and supervising the sector. The key ordinances affecting compliance are:

• Portaria SPA/MF nº 827/2024 — defines the mandatory KYC requirements: identity verification, CPF (Brazilian individual taxpayer ID) validation, minimum-age check (18 years) and screening against sanctions lists
• Portaria SPA/MF nº 1.143/2024 — establishes responsible-gaming rules, including deposit limits, self-exclusion and monitoring of at-risk behavior

Obligations of licensed operators

The regulations require iGaming operators to:

• Verify the real identity of every bettor before allowing deposits or bets
• Confirm the bettor is 18 or older
• Screen against national and international sanctions lists
• Identify Politically Exposed Persons (PEPs) and apply enhanced due diligence
• Monitor transactions for anti-money laundering purposes
• Keep compliance records for at least 5 years for auditing

Penalties

Non-compliance can result in:

• Fines of up to R$ 2 billion (or 10% of gross revenue)
• Suspension or revocation of the operating license
• Criminal liability for executives
• Blocking of the platform within Brazilian territory

How to verify bettors: the 5 layers of a complete KYC

A robust KYC process for iGaming isn't just asking for a CPF and a name. Brazilian regulation requires multiple verification layers, each going progressively deeper:

1. Identity — validate the CPF with the Receita Federal (Brazil's federal tax authority), confirm the full name and registration status (regular, suspended, canceled, deceased)
2. Age verification — confirm via date of birth that the bettor is 18 or older (mandatory under Lei 14.790)
3. Sanctions lists — check CEIS, CNEP, OFAC, UN, EU and UK lists for sanctioned individuals or entities
4. PEP and misconduct — check whether the bettor is a Politically Exposed Person or appears in the Cadastro Nacional de Improbidade Administrativa (Brazil's national registry of administrative misconduct)
5. AML and relationships — map connections to people or entities involved in money laundering

The first two layers are blocking: if the identity isn't valid or the bettor is under 18, the signup must be rejected immediately. Layers 3 through 5 may raise alerts that require manual review — the bettor isn't necessarily blocked, but the account stays under review until the compliance team makes a call.

Sanctions lists: what they are and why they matter in iGaming

Sanctions lists are databases maintained by governments and international organizations identifying people and entities involved in terrorism, drug trafficking, corruption and other illicit activity. iGaming operators are required to screen against these lists before accepting a bettor — and periodically thereafter.

List	Issuer	Coverage	FonteData endpoint	Cost
CEIS	CGU (Brazil's federal comptroller)	Companies and individuals sanctioned by public authorities	/ceis-sancoes/{doc}	R$ 0.54
CNEP	CGU (Brazil)	Companies penalized in public tenders and contracts	/cnep-sancoes/{doc}	R$ 0.54
OFAC/SDN	US Treasury	Terrorism, narcotrafficking, international sanctions	/ofac-sancoes	R$ 0.54
UN	Security Council	International sanctions under UN resolutions	/onu-sancoes	R$ 0.54
EU	European Union	Consolidated European sanctions	/eu-sancoes	R$ 1.95
UK	HM Treasury	British sanctions	/uk-sancoes	R$ 1.95

Why check international lists? Even when operating exclusively in Brazil, iGaming platforms can attract bettors with international ties. OFAC, for instance, sanctions Brazilian individuals involved in drug trafficking — and accepting bets from those people exposes the operator to secondary US sanctions.

PEPs and administrative misconduct: betting-specific risks

A Politically Exposed Person (PEP) is anyone who holds or recently held a significant public office — ministers, governors, directors of state-owned companies, judges, among others. PEP screening is mandatory because these individuals have greater exposure to corruption and may use betting platforms to launder illicit funds.

PEP screening has two levels:

• Direct PEP — checks whether the bettor is a PEP (/pep-exposicao/{cpf})
• Extended PEP — checks whether the bettor has family or business ties to a PEP (/pep-estendida/{cpf})

In addition, the Cadastro Nacional de Improbidade Administrativa (CNIA) lists people convicted of administrative misconduct — misappropriation of public funds, illicit enrichment and damage to the public treasury. Accepting bets from people on the CNIA without enhanced due diligence is a direct regulatory risk.

Implementing compliance via API: a practical architecture

In practice, an iGaming platform's compliance flow works like this: the bettor enters their CPF at signup, the system automatically runs every verification layer, and a decision is made (approve, review or block) before access is granted.

FonteData offers dedicated endpoints for each step of this flow — plus a consolidated endpoint that runs every compliance check in a single call.

The bet-safe-compliance endpoint

The /consulta/bet-safe-compliance?cpf={cpf} endpoint was built specifically for the betting sector. In a single request (costing R$ 1.08), it returns a consolidated compliance check for the given CPF.

For details on the returned fields and sample responses, see the full documentation.

Granular checks: when to use each endpoint

For operators that need granular control — for example, applying different decision logic for national vs. international sanctions — each check is also available individually:

Endpoint	Description	iGaming use case	Cost
bet-safe-compliance/{cpf}	Integrated compliance	Full check at signup	R$ 1.08
pep-exposicao/{cpf}	Direct PEP	Identify PEP bettors	R$ 0.54
pep-estendida/{cpf}	PEP + family/ties	Extended due diligence	R$ 0.54
aml-vinculos/{documento}	AML relationships	Money-laundering prevention	R$ 1.08
cnia-improbidade/{documento}	Administrative misconduct	Corruption convictions	R$ 0.54
ceis-sancoes/{documento}	CEIS (CGU)	National sanctions	R$ 0.54
cnep-sancoes/{documento}	CNEP (CGU)	Public-tender sanctions	R$ 0.54
ofac-sancoes	OFAC/SDN (US)	International sanctions	R$ 0.54
onu-sancoes	UN	International sanctions	R$ 0.54
eu-sancoes	European Union	European sanctions	R$ 1.95
uk-sancoes	United Kingdom	British sanctions	R$ 1.95

Integration example

A single cURL call is enough to run a bettor's full compliance check:

curl -H "X-API-Key: fd_live_sua_chave_aqui" \
  "https://app.fontedata.com/api/v1/consulta/bet-safe-compliance?cpf=12345678900"

The response returns the compliance verification result as JSON. To see the full response structure and available fields, check the API documentation.

Continuous monitoring vs. verification at signup

A common mistake among iGaming operators is treating compliance as a one-time event — verify the bettor at signup and never again. The problem: sanctions and PEP status change over time. Someone who was clean at signup can land on an OFAC list three months later.

Brazilian regulation requires continuous monitoring. In practice, that means re-running the checks periodically (every 30, 60 or 90 days) and on specific triggers, such as deposits above a certain threshold.

What does monitoring cost per bettor?

Scenario	Endpoints	Cost per bettor
Signup check (one-time)	bet-safe-compliance	R$ 1.08
Full granular check	6 sanctions lists + PEP + AML + CNIA	~R$ 8.76
Monthly monitoring (12 months)	bet-safe-compliance × 12	R$ 12.96/year

For a base of 100,000 bettors, monthly monitoring via bet-safe-compliance costs approximately R$ 108,000/year — a fraction of the risk of a multimillion-real fine.

Compliance checklist for iGaming operators

Use this list to check whether your operation covers the regulatory requirements:

At bettor signup:

• Validate the CPF with the Receita Federal (regular registration status)
• Confirm the bettor is 18 or older
• Screen national sanctions lists (CEIS, CNEP)
• Screen international sanctions lists (OFAC, UN, EU, UK)
• Check direct and extended PEP status
• Check administrative misconduct (CNIA)
• Check AML relationships

Continuous monitoring:

• Periodic re-screening (at least every 90 days)
• Re-verification on risk events (large deposits, atypical withdrawals)
• Automatic account suspension when a new match is found

Auditing and records:

• Store compliance results for at least 5 years
• Keep timestamped logs of decisions (approve/review/block)
• Document manual review processes

Data protection:

• Collect only the data needed for compliance (data minimization — LGPD, Brazil's data protection law)
• Ensure verification data is stored encrypted
• Define a data retention and deletion policy

Conclusion

iGaming compliance in Brazil is not optional — it's a regulatory requirement with severe penalties. The good news is that the technical side can be solved with a simple integration: one API call per bettor, returning every required check in under a second.

FonteData already offers the complete infrastructure for iGaming compliance — from CPF validation to screening across 6 international sanctions lists, plus PEP, AML and administrative misconduct.

Create your free account and get R$ 50 in credits to test — no credit card, no commitment.

---

This article is for informational and educational purposes only and does not constitute legal or regulatory advice of any kind. iGaming legislation in Brazil is evolving constantly, and the information presented here reflects the landscape as of the publication date. For specific guidance on regulatory compliance, consult a lawyer specializing in digital and gaming law.

References

• Lei 14.790/2023 — The legal framework for fixed-odds betting
• Portaria SPA/MF nº 827/2024 — KYC requirements for operators
• Portaria SPA/MF nº 1.143/2024 — Responsible-gaming rules
• OFAC/SDN List — US sanctions list
• CGU Sanctions Portal — CEIS and CNEP
• FonteData documentation — Compliance endpoints and integration