The Secretariat of Prizes and Betting (SPA) - an entity of the Brazilian Ministry of Finance - recently issued Ordinance SPA/MF 722/2024, which details the technical and security requirements that sports betting and online gaming operators must meet. The technical requirements focus on the technological infrastructure of the betting systems. Specifically, all authorized operators must store the betting system and the corresponding data in data centers located in Brazil.
In exceptional circumstances, systems and data may be located outside Brazil, but must meet certain criteria. Operators must present to the SPA an explanation of why their systems are kept outside Brazil. The data center must also be ISO 27001 certified.
These conditions include that the countries have an International Legal Cooperation Agreement with Brazil in civil and criminal matters. Data owners abroad must authorize data transfers in advance. To facilitate effective supervision, operators must provide the SPA with data on bets, players, customer portfolios, legal destinations, and other operational information. This manual will soon be available on the website of the Secretariat, which may request additional information from the operator at any time.
On the other hand, operators must obtain certification of their platforms and systems from entities recognized by the Ministry of Finance. They must meet strict technology and security standards to protect consumers against potential fraud or unauthorized access.
Ordinance 722 SPA/MF 722 was published in an extra edition of the Official Gazette of the and can be consulted at the http://www.in.gov.br/web/dou/-/portaria-spa/mf-n-722-de-2-de-maio-de-2024-557715851
