Brazil’s regulated betting market sent 27,600 suspicious transaction reports to Coaf in 2025, up from 928 in 2024

Brazil’s fixed-odds betting regime has moved anti-money laundering controls to the center of operator compliance, and KYC (Know Your Customer) is now the first filter that decides who gets through the door. For PSPs and payment teams serving bets, the takeaway is straightforward: if identity checks are weak, transaction monitoring starts from a bad dataset.

1. The latest figures from the Conselho de Controle de Atividades Financeiras (Coaf) show how regulation has changed supervision in the sector. In 2025, Coaf received 27,600 suspicious transaction reports involving betting and lottery companies, compared with just 928 notifications in 2024. The jump reflects the obligation for authorized platforms to report atypical movements to the financial intelligence unit.
2. During BiS SiGMA Brasília 2026, Coaf president Ricardo Saadi said the regulated betting market has, for the most part, followed the good practices required by Brazilian law and has been constantly seeking new anti-money laundering tools. That matters because Brazil is no longer treating betting as a loose perimeter business; it is being pulled into the same reporting logic that financial institutions live with every day.
3. The legal base for AML in the sector combines the Betting Law (Lei 14.790/2023) and the Money Laundering Law (Lei 9.613/1998), regulated by ordinances from the Ministry of Finance and the Secretaria de Prêmios e Apostas (SPA). Operators must identify and verify the true identity of each bettor, monitor transactions and betting behavior continuously, report suspicious operations or situations to Coaf, keep their headquarters in Brazil, use a .bet.br domain, and run monitoring systems connected to Banco Central and Coaf.
4. The rules also require risk-analysis mechanisms before releasing high-value prizes, including security delays for Pix payments. In practice, that creates a payment operations problem, not just a compliance one: if payout controls are too loose, the operator becomes a cash-out rail for suspicious activity; if they are too strict, legitimate users feel it immediately.
5. Legitimuz says KYC is the first line of defense before transaction monitoring even begins. Its model combines document validation (OCR), liveness checks, and FaceMatch facial verification at signup, then repeats verification for higher-risk movements such as large withdrawals. The tension is familiar to anyone running payments in high-risk verticals: too much friction and players drop off; too little and the platform makes it easier for the very concealment schemes the regulation is trying to stop.

The thing is, Brazil’s betting framework is now forcing operators and their PSPs to think about identity, monitoring, and payout controls as one flow rather than separate boxes. That is usually where the real operational work starts.