Brazil's Ministry of Finance establishes technical, security requirements for online betting operations

Brazil's Ministry of Finance has established the technical and security requirements of betting systems, as well as their sports betting platforms and online games, to be used by fixed-odds betting lottery operating agents. Notably, the requirements include a provision mandating operators to use the "bet.br" domain.

The rules were featured in Ordinance No. 722, published by the Secretariat of Prizes and Betting last Friday in the Official Diary of the Union (DOU). The 35-page ordinance is the first to be signed by the new SPA secretary, Regis Dudena. 

The requirements call for operators to guarantee data protection, in compliance with the General Law of Data Protection (LGPD):

• The operators must keep the betting system and the respective data in data centers located in Brazilian territory or in countries that have an International Judicial Cooperation Agreement with Brazil, in civil and criminal matters jointly.
• The user must provide specific and highlighted consent for the transfer of their personal data, and the operator must provide clear information regarding the purpose of the operation.
• The technical area responsible for the Ministry of Finance must have secure and unrestricted access, both remotely and in person, to the systems, platforms, and operation data.
• The operator must replicate its database and information in Brazil, which will be continuously updated, ensuring that all database instances have the same content and are periodically tested.
• The operator must present a Business Continuity Plan for Information Technology in case of critical situations that may jeopardize the operation and data.

Elsewhere in the requirements, the ordinance establishes that the electronic channels used by the operator to offer fixed-odds bets in a virtual environment must use the domain registration "bet.br".

Moreover, operators must have their betting systems, including sports betting and online gaming platforms, certified by an entity whose operational capacity has been recognized by the Prizes and Betting Secretary of the Ministry of Finance, in accordance with MF/SPA Ordinance No. 300 of February 23, 2024.

The betting systems, including sports betting and online gaming platforms, must maintain valid certificates for the duration of the authorization granted. The certificates must be revalidated annually whenever there is the inclusion, exclusion, or alteration of critical resources of the systems or platforms. In this case, the new certificates must be submitted to SPA within five days of their issuance.

Also as per the published requirements, operators must submit to the Secretariat of Prizes and Betting the relevant data related to bets, bettors, bettor wallets, legal destinations, and other information regarding their operation.