Brazil Gives PSPs 24 Hours to Block Illegal Betting Transactions

Brazilian banks and payment firms have 24 hours to block accounts and stop new transactions linked to an illegal betting operator after receiving an SPA notice. The new procedure also sets a 48-hour reporting deadline.

Brazil's Secretariat of Prizes and Betting introduced the workflow in Portaria SPA/MF No. 2,750/2026, published on September 14. The Ministry of Finance said the measure adds procedures for identifying payment flows used by unauthorized betting businesses and cutting them off. The Portaria replaces the earlier No. 566/2025 rules.

24 Hours After an SPA Notice

Once the SPA has identified an illegal operator and issued a blocking notice, a bank or payment institution holding its account gets 24 hours to block it. Money already in the account can no longer be moved.

The same deadline applies more broadly to new payments. Institutions covered by the rule must put controls in place within 24 hours to stop transactions that directly or indirectly enable the named operator to continue taking bets.

That obligation is not limited to a bank that actually holds the operator's account. A notified institution still has to prevent new transactions even if no account belonging to the operator is found on its books.

Confirmation follows separately. The SPA must be told within 48 hours that the account block or transaction restriction has been implemented.

Firms Must Flag Cases Themselves

SPA notices are only part of the system. Banks, PSPs and payment-arrangement participants must also detect questionable betting flows on their own.

An internal review can run for no more than 45 days from the suspicious activity. If the institution concludes that the activity may involve illegal betting, the case goes to the SPA by the next business day.

The rule lists several examples: repeated payments in amounts consistent with betting deposits, transfers from many different senders, betting references in Pix data, and changes to Pix keys, QR codes or receiving accounts after previous restrictions.

The account under review does not have to belong to the betting operator itself. An intermediary receiving or moving money on its behalf can also be reported.

What It Means for Payment Firms

By 15M's count, the Portaria creates four separate operational checkpoints:

Up to 45 days for internal review;
The next business day to report a confirmed case;
24 hours to act on an SPA notice;
48 hours to confirm.

The scope also goes beyond accounts held in an operator's own name. Indirect flows and intermediary accounts are covered, while SPA's authorized-operator list must also become available as a structured file, preferably CSV, with API access planned later.

What Comes Next

SPA still has to publish an Instrução Normativa setting the reporting fields, data format and submission process. Institutions will have 30 days after its publication to implement the changes.

Firms that cannot receive SPA notices through the Central Bank system already have a separate 30-day deadline to provide the SPA with an institutional email address.