Brazil Advances Online Gambling Regulations with New IT Security Ordinance

Significant stipulations outlined by the SPA include:

• Data Center Location: Operators must host betting systems and related data within Brazilian data centers, ensuring all data centers are ISO 27001 compliant.
• International Data Storage: Data can be stored outside Brazil but must be in countries with an International Legal Cooperation Agreement with Brazil, covering civil and criminal matters.
• Ministry of Finance Access: Operators are required to provide the Ministry of Finance with secure and unrestricted access to all systems, platforms, and operational data, both remotely and in-person.
• Domain Requirements: Online gambling services must be hosted on a ‘bet.br’ domain to specifically cater to Brazilian consumers.

In alignment with consumer protection practices, the SPA mandates that customers be informed about the use of cookies, with necessary cookies functioning only upon acceptance of the cookie policy. Additionally, online games must clearly inform players about potential winnings at the time bets are placed, ensuring transparency in prize payouts.

Prior to the official market launch, all betting systems and platforms must be certified by SPA-approved agencies such as GLI, eCOGRA, and BMM Testlabs. Operators are required to submit an evaluation report by these certified agents within 90 days of the SPA’s authorization act.

With the completion of its second phase of market ordinances, the SPA will continue to define and refine pre-market requirements to ensure that the regulatory framework provides legal certainty and promotes a stable, trustworthy betting environment in Brazil.