Willer case exposes gaps in bettor data protection and what is lost when regulated betting ends in Brazil

A technical note from Brazil’s Secretariat of Prizes and Betting at the Ministry of Finance (SPA-MF) about the individual activity of one bettor reached the press five days before the second round. That leak only happened because betting platforms were authorized and reporting to the government — a control that disappears under MP 1.394.

1. The document, obtained by UOL and Folha de S.Paulo, says lawyer Willer Tomaz moved about R$ 5 billion in bets in 2025 and withdrew more than R$ 200 million. Most of that amount circulated inside the platform itself, as winnings, re-bets, or losses rather than fresh deposits.
2. According to the report, SPA-MF identified Tomaz as the individual with the largest combined volume of deposits and withdrawals in the authorized market that year, at about R$ 350 million, more than 60% above the second-ranked bettor. The secretariat also pointed to patterns it said could suggest structuring, including 12 withdrawals of R$ 500,000 in 18 minutes, and concluded that Blaze did not analyze the customer’s transactions for anti-money-laundering purposes. SPA-MF recommended reviewing the operator’s suspension.
3. Brazil’s Federal Police is investigating whether the bets were used to conceal the origin of funds. Tomaz told the press the money has a lawful origin and that the issue is already part of an ongoing court case. His defense says he suffers from ludopathy and that the amounts came from repeated re-bets of the same bankroll, not from new money.
4. The headline number needs to be handled carefully: in betting, turnover adds up every wager placed, including when the same money is wagered several times. So R$ 5 billion does not mean R$ 5 billion was deposited, R$ 5 billion was lost, or that a crime was committed. It is simply a volume figure, and the investigation has to do the rest.
5. The broader issue is who can see bettor data. Law 14.790/2023 gave SPA-MF access, through the Sistema de Gestão de Apostas (Sigap), to detailed information on millions of bettors, including identification, deposits, withdrawals, and betting patterns. These are protected data tied to citizens’ financial lives, which is why the route by which the note reached the press matters as much as the note itself.

What disappears with the end of the regulated market is not just a licensing regime. It is the government visibility into individual-level betting flows — the kind of visibility that can support AML checks, but also creates a live question about access, custody, and leak risk when politically sensitive cases hit the news cycle.