The risk was never just a fine and a blocked domain
The comfortable assumption in grey markets goes like this: if regulators ever catch up, the company eats an administrative fine, the domain gets blacklisted, and everyone moves the traffic somewhere else. Brazil is about to test that assumption in criminal court. Its latest push on illegal betting regulation puts a four to six year prison term on the table for people who operate unlicensed fixed-odds betting, and creates separate offences for the marketing, payments and technology layers that sit around them.
What makes Brazil worth following closely is not just the sentencing numbers. It’s the sequence: a country that built one of the world’s largest newly regulated betting markets, then reversed course, and is now writing criminal law to make the reversal stick. Follow that sequence end to end and you get a fairly clear picture of where enforcement is heading elsewhere.
Brazil’s proposed criminal penalties and the wider gambling law package
On 25 September 2026, the Executive filed PL 5.477/2026 with the Chamber of Deputies. The bill amends Law No. 13.756/2018, the statute that originally legalised fixed-odds betting in Brazil, to create specific criminal offences tied to betting activity. It also amends the Criminal Contraventions Law so that betting related conduct is handled by the new criminal provisions rather than the old misdemeanour regime.
The bill arrived days after a separate provisional measure that prohibited online betting outright, froze operator activity, and required sites to stop functioning on 6 October. A provisional measure in Brazil has immediate legal force but expires unless Congress approves it, which is precisely why the government also wants a statute with teeth. The stated purpose of the bill is to give the prohibition enforcement instruments, not just a legal declaration.
Prison terms for operators
For operating fixed-odds betting, the proposed penalty is four to six years’ imprisonment plus a fine. The same band applies to anyone who offers, receives, registers, processes or intermediates bets, and to those who maintain establishments used for that purpose.
That drafting choice is the interesting part. It doesn’t describe a single villain running a book; it describes a supply chain. A payment intermediary that processes bets, a white label partner that registers them, a retail location that takes them over the counter, all sit inside the same sentencing band as the brand owner. The four-year floor also matters procedurally, because short custodial sentences in Brazil are comparatively easy to substitute with non-custodial measures. A range that starts at four years is deliberately parked past that convenience.
Where promoters and affiliates land
Beyond the core operating offence, the bill creates crimes covering advertising, the recruitment of bettors, the use of personal data, the movement of funds, and the supply of the platforms and applications used to place bets. The headline penalty ceiling in the package is six years, and the precise band attached to each of those secondary offences sits in the bill text as filed and in whatever survives committee amendment.
For the affiliate industry the signal is unmistakable. Sending traffic is treated as conduct in its own right, not as a marketing service standing at arm’s length from the operator. An SEO site, a Telegram channel, a streamer with a referral code, a media buyer running the creative, all fall inside the described behaviour of advertising and capturing bettors. The inclusion of personal data handling should also make lead generation businesses read the draft twice.
How Brazil’s gambling licensing rules were built, then paused
None of this appeared from nowhere. Brazil legalised fixed-odds betting in principle in 2018 and then spent five years failing to regulate it, which produced exactly what you would expect: a very large market served almost entirely from offshore.
The framework the bill is meant to enforce
Law 14.790/2023 finally set out the regulatory framework, with supervision handed to the Secretariat of Prizes and Betting (SPA) inside the Ministry of Finance. Licensed operations went live at the start of 2025. The licensing conditions were demanding by design: a substantial authorisation fee for a five-year term covering a limited number of brands, a Brazilian incorporated entity with local shareholding, minimum capital requirements, certified games, mandatory use of the .bet.br domain, player identity verification tied to the bettor’s CPF, and a defined tax on gross gaming revenue.
What the licence actually bought players
Licensing rules are easy to read as pure bureaucracy until you look at the consumer side. A licensed Brazilian operator had to offer self-exclusion, deposit and loss limits, verified age and identity checks, and audited game outcomes. None of those obligations follow a player onto an unlicensed site. That is the core argument for licensing anywhere: the licence is the hook that consumer protection hangs on, and jurisdictional oversight without it is a leaflet.
The enforcement gap
The gap was never the rulebook, it was the consequence. Before this bill, unlicensed gambling in Brazil was handled largely under the 1941 Criminal Contraventions Law, where penalties were measured in months of detention and a modest fine. Administrative tools existed too, domain blocking and pressure on payment channels, but blocking is an arms race: a new mirror domain costs almost nothing, and the people behind it were never personally exposed. Raising unlicensed operation from a misdemeanour to a crime with a four-year floor changes the arithmetic for the individuals signing the contracts, not just the balance sheet of a shell company.
Unlicensed operators face rising penalties almost everywhere
Brazil is at the aggressive end of the scale, but it is not an outlier in direction. Several established markets already treat unlicensed supply as criminal rather than merely non-compliant.
| Jurisdiction | Core prohibition | Exposure for unlicensed supply | Lead authority |
|---|---|---|---|
| Brazil (proposed) | Operating, intermediating, promoting or supplying platforms for fixed-odds betting without authorisation | Four to six years’ imprisonment plus fine under PL 5.477/2026 | SPA, Ministry of Finance |
| Germany | Organising unlawful gambling under the Criminal Code (§284 StGB) | Fine or imprisonment, with a higher band for commercial or organised offending | GGL (joint gambling authority of the Länder) |
| United Kingdom | Providing facilities for gambling without a licence under the Gambling Act 2005 | Criminal offence carrying a fine and, on indictment, imprisonment | Gambling Commission |
| Netherlands | Offering remote gambling to Dutch consumers without a KOA licence | Administrative fines, penalty payments and public enforcement decisions | Kansspelautoriteit |
The Dutch and British regulators also went after the promotional layer rather than only the operator, pursuing affiliates and licensees over marketing conduct. The UK Gambling Commission and the Kansspelautoriteit both publish their enforcement decisions, which is itself part of the deterrent.
Why the tone hardened
Three things changed. Regulated markets now have tax revenue to protect, so leakage to offshore sites is a fiscal problem and not only a consumer one. Licensed operators who paid the fee started lobbying hard against competitors who didn’t. And political attention shifted to gambling harm, advertising volume and household debt, which makes “channelling” a phrase that ministers actually use. Once a state has issued licences, tolerating unlicensed supply undermines the whole structure, so the enforcement mechanisms get sharper.
What operators and affiliates should do about it
The practical lesson from Brazil is that jurisdictional risk is now personal risk, and it reaches further down the value chain than most commercial contracts assume.
A workable compliance checklist
- Verify the licence yourself on the regulator’s public register, by licence number and legal entity name, not by the logo in the site footer.
- Confirm the licence covers the specific product and the specific domain you are promoting or supplying. Brazil’s .bet.br requirement is a good example of a condition that makes mismatches obvious.
- Geo-restrict properly. Terms and conditions that exclude a country mean nothing if registration, deposits and marketing all accept traffic from it.
- Keep marketing inside the local rules on promotional restrictions: bonus presentation, affiliate disclosure, responsible gambling messaging and age gating.
- Write termination rights into affiliate and B2B contracts that trigger on licence suspension, revocation or a change in local law, and test that you can pull campaigns within hours.
- Take local legal advice in every market that generates meaningful revenue, and re-take it when the law moves. Provisional measures can take effect in days.
Red flags worth walking away from
- A partner who cannot name the licensing authority and the licence holder in one sentence.
- Revenue share that looks generous for the vertical, which usually prices in risk someone else is carrying.
- Mirror domains, rotating brand names or payment flows routed through entities unrelated to the licensee.
- Marketing briefs that avoid age verification, omit self-exclusion information or target people showing signs of harm.
- Pressure to keep promoting a brand during a regulatory freeze because “it hasn’t been enforced yet”.
One last point that the industry tends to skip. When a market bans licensed operators, players rarely stop betting; they migrate to sites with no deposit limits, no self-exclusion register and no dispute process. Anyone working in this sector should be clear-eyed about that, and about the basic realities of the games themselves: every product carries a house edge, outcomes are random, and no promotion changes that. If gambling has stopped being entertainment for you or someone close to you, licensed markets exist precisely so there is a self-exclusion tool and a support line to reach for.
Frequently asked questions
What are the penalties for illegal betting in Brazil under the new bill?
PL 5.477/2026 proposes four to six years’ imprisonment plus a fine for operating fixed-odds betting without authorisation, including offering, receiving, registering, processing or intermediating bets. Separate offences cover advertising, bettor recruitment, personal data use, fund movement and supplying platforms, with a penalty ceiling of six years in the package.
How does Brazil regulate gambling?
Fixed-odds betting was legalised in principle by Law 13.756/2018 and regulated by Law 14.790/2023, with licensing and supervision run by the Secretariat of Prizes and Betting under the Ministry of Finance. Licensed operators launched in 2025 under conditions including local incorporation, a .bet.br domain, certified games and identity verification. A September 2026 provisional measure then prohibited online betting and required sites to cease operating on 6 October.
What happens to unlicensed operators elsewhere?
It varies by jurisdiction. Germany and the United Kingdom treat unlicensed gambling supply as a criminal offence that can carry imprisonment, while the Netherlands leans on administrative fines and penalty payments. Most regulators combine that with domain and payment blocking, plus enforcement against the affiliates and suppliers involved.
Why are gambling licences required at all?
A licence is the mechanism that attaches enforceable obligations to an operator: age and identity checks, game certification, segregated player funds, advertising limits, self-exclusion and deposit limits, and a route to complain. Without it, players have no regulator to appeal to and the state has no oversight of the money involved.
Leave a Reply