BiS Sigma Brasília 2026: Legitimuz says 27 million Brazilian players are already shaping KYC and risk checks

At BiS Sigma Brasília 2026, held on 02 and 03 June at the Royal Tulip Brasília Alvorada, Legitimuz used its panel to show where Brazilian bettors become most exposed to security risk during onboarding. For PSPs and operators in regulated iGaming, the point is simple: in Brazil, KYC is not a back-office formality; it is the part of the flow where fraud either gets stopped or gets through.

1. Pedro Brisola represented Legitimuz at the event and presented data on the profile of the Brazilian bettor and the stage of the journey where users are most vulnerable to security risks. The company said the discussion was based on a white paper released in May.
2. That white paper draws on real data from more than 27 million unique CPFs that passed through the platform since January 2025, when the market was regulated. Legitimuz also said it processes more than 1.5M liveness checks and 300k onboardings per day.
3. Brazil is now the 5th-largest betting market globally and ranks first for traffic, with estimated revenue of US$ 4.1 billion (about R$ 22 billion), according to Regulus Partners. For payment teams, that scale matters because it is large enough to attract both licensed volume and a lot of junk pretending to be licensed volume.
4. The risk side is ugly in a very practical way: 78% of bettors cannot tell real betting sites from fraudulent ones. In other words, a user who does not understand the difference between a licensed operator and a fake site is not going to self-police the payment journey either.
5. Legitimuz said Android accounts for 77.5% of its base, with iOS at 22.4%. On browser access, Chrome leads with 47%, but Instagram is the second-largest access channel at 20.8%, followed by Safari Mobile at 10.9% and Chrome WebView at 10.2%.

That browser split is the bit PSPs should notice. If more than 1 in every 5 users enters through Instagram’s in-app browser, then acquisition, fraud controls, and KYC need to be built for social traffic, not just for someone calmly typing a URL into Chrome like it is 2014.