SPA/MF-Licensed Online Casinos in Brazil (2026)

SPA/MF stands for Secretaria de Prêmios e Apostas do Ministério da Fazenda — the Secretariat of Prizes and Betting inside Brazil's Ministry of Finance. Created by Law 14.790/2023, it is the federal authority that issues, monitors, and revokes online gambling authorisations. An SPA/MF-licensed operator has passed capital adequacy, KYC infrastructure, and technical certification requirements, and pays R$ 30 million for the five-year federal licence plus state-level fees.

The Ministry of Finance publishes the official list of authorised operators at gov.br/fazenda/pt-br/assuntos/loterias/apostas-de-quota-fixa. This list is updated as licences are granted, suspended, or revoked. Cross-check the operator's exact legal-entity name (CNPJ + trade name) — several offshore sites use branded names that resemble licensed operators. The .bet.br top-level domain is a secondary signal: only SPA/MF-licensed operators can register under .bet.br.

As of Q3 2026, the SPA/MF has granted definitive authorisation to a growing list of operators. Our editorial database currently tracks 27 operators actively marketing in Brazil, of which the majority hold active SPA/MF licences. The remainder are either in the transitional grace period, awaiting a final decision, or operating offshore without Brazilian authorisation. Numbers change month-to-month — always check the primary source before depositing.

Playing at an unlicensed operator from Brazil is not a criminal offence for the player under Law 14.790/2023, but it removes all consumer protections that the SPA/MF licence guarantees: no local dispute mediation, no SIGAP self-exclusion coverage, and no guarantee that PIX payment blocking will not affect the operator. Anecdotally we track PIX payment blocks against several offshore operators in our Complaints tracker — the operator remains online, but deposits and withdrawals become impossible from Brazilian bank accounts.

Portaria 1231/2024 is the Ministry of Finance regulation that operationalises Law 14.790/2023. It defines the specific technical requirements SPA/MF-licensed casinos must meet: capital, KYC procedures, integration with the SIGAP self-exclusion register, mandatory PIX rail, and tax withholding at source. It replaced multiple earlier draft regulations and is the current governing document. Full text at gov.br/fazenda.

Registration under .bet.br is restricted to SPA/MF-licensed operators — Registro.br verifies the applicant against the Ministry of Finance list. So a genuine .bet.br domain is a strong positive signal. However, be aware of typosquatted variants (e.g., .bet.br.com, .bet-br.com, .betbr.com) that are not the official ccTLD and carry no verification requirement. Always check the address bar carefully.

Five main protections are required by the licence: (1) mandatory KYC before withdrawal, blocking under-18 registrations; (2) integration with SIGAP, the national self-exclusion registry — one self-exclusion covers every licensed operator; (3) 15% withholding tax at source on prizes above R$ 2,259, remitted directly to Receita Federal; (4) PIX-native settlement without operator-side fees; (5) a Ministry of Finance dispute-mediation channel that can suspend an operator's authorisation for repeated non-compliance.