Illegal Betting Transaction Monitoring: Brazil's Ban Moves the Money

The Money Does Not Stop on October 6

A ban changes where betting money goes, not whether it goes. Regulus Partners, quoted by iGaming Business, puts the licensed market at a $6.3 billion run-rate GGR as of the first quarter of 2026, spread across 188 authorized operators. The ANJL's statement, reported by Valor International, warns that the ban sends more than 30 million bettors "into the hands of thousands of illegal websites." Enforcement started before the licensed sites went dark: on September 27 a Justice and Finance task force took 506 suspected illegal betting sites offline and shut 43 Telegram channels with 212,634 combined members, according to Gambling Talk. The SPA had already blocked 66,000 clandestine domains.

Domain blocking is cheap for both sides. Each replacement domain needs one thing the operator cannot spin up as fast: a way to collect reais. That plumbing already exists. In August, Rio de Janeiro prosecutors' Operation Aposta Suja targeted unlicensed sites that, per a COAF report described by O Globo, moved more than R$1.4 billion between 2022 and 2026 through shell companies, dispersal across multiple accounts, crypto conversion, and remittances abroad. The same week, Folha reported the Receita Federal's account of Operation Arena: bettor deposits routed through front companies, converted to stablecoins or dollars, parked offshore, and returned as dividends.

Those cases describe the four collection channels a monitoring team should expect to grow after October 6: direct Pix to a Brazilian CNPJ fronting for an offshore operator; payment gateways and credit resellers that aggregate deposits and settle in bulk; individual and newly registered corporate mule accounts that receive thousands of small transfers and forward them; and stablecoin on-ramps, where the bank sees only a transfer to an exchange.

What Ordinance 2,750 Already Tells Banks to Look For

SPA/MF Ordinance 2,750/2026, published September 14, is the red-flag list Brazilian banks and payment institutions are working from. As summarized by LCB and iGaming Business, the indicators include frequent small transfers from many unrelated senders, sudden volume spikes, betting references in transaction descriptions, repeated replacement of Pix keys, QR codes, or payment links after a block, activity inconsistent with declared economic activity, recently created companies receiving thousands of microtransactions, and intermediaries such as gateways or individuals forwarding funds to operators. Institutions have up to 45 days to analyze, must report confirmed evidence to the SPA by the next business day, must freeze accounts named in an SPA blocking notice within 24 hours, and must confirm within 48 hours. The SPA's authorized-operator list is available through an API.

The Provisional Measure layers a harder mechanism on top. Article 14 prohibits financial institutions, payment institutions, and payment-arrangement participants, including instant payment arrangements, from processing or settling fixed-odds betting transactions. Article 15 of the text published by Planalto directs the Central Bank of Brazil to establish an electronic data-communication system so institutions can reject transactions and return funds interbank when a payment relates to illegal betting, within real-time transfers settled on Central Bank systems, meaning Pix. Those rules had not been published as of September 28. Until they exist, the job is real-time monitoring against a list, not a network-level block.

Why Every One of These Rules Floods the Queue

Each red flag in Ordinance 2,750 describes legitimate Pix behavior at least as often as it describes betting. Many small transfers from many unrelated senders is a street vendor, a church, a content creator selling a course. A sudden spike is a shop running a promotion. A new company receiving thousands of microtransactions is a microentrepreneur in its first good month. Pix key churn is a design feature: dynamic QR codes are generated per transaction. A betting reference in a memo field is two friends settling a wager on a Flamengo match.

Scored one transaction or one account at a time, these features have high recall and low precision. The ban makes that worse in a specific way. Before October 6, a bank could suppress most betting-pattern alerts by checking the recipient against the SPA's authorized list. After October 6, that list is empty for fixed-odds betting, so the suppression path disappears at the same moment illegal volume starts to rise.

Operation Aposta Suja is a useful yardstick. The COAF report behind it, per O Globo, aggregated more than 800 suspicious transaction reports filed between 2022 and 2026 to describe one network. Each report was an analyst's finished output, distilled from a larger set of alerts. Multiply that across the displacement the ANJL forecasts. Raising thresholds until the queue is manageable is the wrong move here, because the gateway hiding among the bakeries is the one that most resembles a bakery. We have written before about why rule tuning cannot fix a typology whose features overlap the legitimate population, and about how backlogs form when volume outruns review capacity.

The Signal Is in the Cluster, Not the Alert

What separates a payment gateway for an offshore book from a neighborhood bakery is not in the transaction that fired the rule. It is in the relationships around it. Do the same 5,000 CPFs that funded a blocked CNPJ last week now fund a CNPJ registered nine days ago? Did those CPFs deposit to licensed operators before October 6? Do deposits cluster around kickoff times and weekend evenings? Does the recipient's declared CNAE match its inflows? Do its outflows go to suppliers and payroll, or to an exchange, an FX house, and an entity in Curaçao? An analyst can assemble that picture for one alert in about an hour, and for none of the 3,000 behind it.

This is the work we built our agents to do. They log into the monitoring system, core banking, the Receita Federal CNPJ lookup, and the SPA list the way an analyst would, with no API integration, then pull sender history, compute overlap across recipient accounts, check registration age against inflow volume, and trace where the money leaves. The agent either writes a disposition with the evidence attached or escalates with the cluster already assembled. Every step is recorded under our Interpretable Agentic Framework, so an auditor or SPA examiner can see why one set of alerts was closed as a legitimate merchant and another was reported. Across our customer base this produces 87 percent fewer false positives and resolves 98 percent of cases the same day.

Two limits are worth stating. An agent inside one institution cannot see other institutions' side of a network; until the Article 15 system exists, the picture is partial. And the strongest behavioral feature available today, a former licensed-operator depositor now paying a new CNPJ, decays as bettors move to stablecoins. Human judgment still decides what to file.

What Changes When the Central Bank Writes Its Rules

Congress has 120 days to confirm or amend the measure, and Regulus assigns an 85 percent probability to a multi-month blackout rather than a permanent ban. Neither outcome changes the monitoring obligation. Article 14 §2 expressly preserves Article 21-A of Law 14,790, the provision Ordinance 2,750 implements, so the red-flag regime survives whether or not the licensed market returns. The wind-down mechanics for banks and PSPs are covered in our companion piece on the compliance runbook. The monitoring problem outlasts the runbook. Teams that treat October 6 as a typology event, and build cluster-level review before the queue arrives, will be the ones whose reports hold up when the Central Bank's reject-and-return system finally lets everyone else see what they saw.

Frequently Asked Questions