pt|en
Last Friday, 3 May, the Ministry of Finance (the “Regulator”) published Ordinance nr. 722 (“Ordinance”), which establishes the technical and security requirements that betting operators must adopt in their betting systems, as well as in sports betting and online gaming platforms (referred to collectively as “Betting Infrastructure”).
Among the technical requirements established by the Ordinance, the requirement to keep betting systems and their respective data in centers located in Brazilian territory stands out, in compliance with Law nr. 13,709/18 (General Data Protection Law – “LGPD”). Although the first paragraph of Article 4 allows data to be located outside Brazil — provided they are in countries that have signed International Legal Cooperation Agreements with Brazil and comply with item VIII of Article 33 of the LGPD, which requires specific and prior authorization from the data subject for the international transfer of their personal data — it is mandatory for the Regulator to have secure and unrestricted access, both remotely and in person, to the systems, platforms, and operational data. Moreover, the betting operator must replicate its database in Brazil, keeping them continuously updated to ensure content uniformity across all database instances.
The Ordinance establishes various obligations for operators. Firstly, they must develop an “Information Technology Business Continuity Plan” to deal with vulnerability and risk situations in critical components of the Betting Infrastructure. Also, they must use the domain bet.br in their URLs and certify their Betting Infrastructure through testing laboratories previously authorized by the Regulator (“Certifying Entities”), including regarding the integration between modules and platforms with different build versions and suppliers.
Certificates issued by Certifying Entities must remain valid throughout the duration of the authorization granted to operators. They must be revalidated annually and whenever there are additions, changes, or deletions of critical components.
It is crucial to highlight that operators must, within 90 (ninety) days after the publication of the regulatory authorization act by the Regulator, produce an evaluation report for certification of the technical requirements defined in Annex IV of the Ordinance, issued by the Certifying Entities. Additionally, they must submit to the Regulator data regarding bets, bettors, bettors’ virtual wallets, legal allocations, and other information related to their operation, following the frequency and format established in the SIGAP Manual, available on the website (https://www.gov.br/fazenda/pt-br/composicao/orgaos/secretaria-de-premios-e-apostas).
Regarding physical betting terminals, the Regulator requires them to be always connected and integrated into the operator’s betting system, following KYC parameters and rules for payment transactions, as stipulated by Ordinance nr. 615.
Finally, Annex I of the Ordinance details the specific technical requirements for betting systems. Sports betting platforms must adhere to the requirements outlined in Annex II, while online games platforms are governed by the provisions of Annex III. Annex IV, on the other hand, establishes procedures and general practices related to the functionalities, control, and security of the betting system.
Our legal team at Bichara and Motta Advogados are attentively monitoring the regulation of the betting industry in Brazil, offering legal advice to multiple market participants. For further information, please visit: www.bicharaemotta.com.br.