The Brazilian government steps forward with its commitment to a regulated betting landscape as the Official Diary of the Union disclosed Normative Ordinance No 722 last week, manifesting part of a broader regulatory framework initiated in April. This recent development trails the country’s legalization of sports betting and igaming on 21 December, culminating in Bill 3,626/2023 being enacted by President Luiz Inacio Lula da Silva later that month.
Normative Ordinance No 722 meticulously delineates the criteria and requirements that betting systems technologies must fulfill, focusing on robust security measures. A critical aspect is the handling of data centres, where the ordinance for the first time addresses exceptions allowing for such data centres to be stationed outside Brazilian territory.
At the core of the ordinance is the directive that data centres must essentially be set up within Brazil to operate. Nonetheless, it carves out a set of exceptions that facilitate the offshoring of data under stringent conditions. Foreign countries hosting these data outlines must retain an International Legal Cooperation Agreement with Brazil covering both civil and criminal matters to be considered eligible locations. Moreover, the consent for data transfer must be sought and secured from data holders in advance, while ensuring that the Brazilian ministry of finance’s responsible technical area has both secure and open access to these datasets.
Further stipulations demand the operating agent duplicate data and information within Brazil. This ensures all databases reflect the same content through continuous updates and periodical testing, thereby maintaining data parity. A comprehensive business continuity plan must also be devised by the agent, mapping probable loss scenarios and risk evaluations. This strategic plan must underscore prevention and mitigation measures, along with specifying responsibilities for each outlined action.
For operators wanting to retain their platforms in other countries, adherence to Normative Ordinance No 722’s guidelines is imperative. They must justify their reasons for preserving their systems outside Brazilian borders to the Secretariat of Evaluation, Planning, Energy and Lottery (SPA), including evidence of their systems’ ISO 27001 certification, which denotes a high standard of information security management.
The certification of operators’ betting platforms and systems is another hurdle, where the nod has to come from entities endorsed by the ministry of finance. Gaming Laboratories International (GLI) has already secured such accreditation, joined by eCOGRA in their ranks.
Stringent technology and security standards are being set for operators, safeguarding consumers against possible fraud or unauthorized access. Additionally, ongoing updates and testing of the systems are mandated to ensure sustained adherence to regulations, particularly in preventing new fraudulent opportunities. Systems must also transparently preserve the integrity of wagers and game results for the users.
Compliance extends to the General Data Protection Law (LGPD) of Brazil, wherein operators need to establish rigorous security measures and acquire explicit consent from users for data collection. Provisions for user access to review and delete their personal data are also mandated.
On the subject of licensing, certificates for betting systems and platforms must be obtained, retaining validity for the duration of the granted authorization. Necessary renewal of these certifications must be slated annually or in response to changes to vital system components.
The enactment of Normative Ordinance No 722 conceivably raises entry and expansion barriers for operators due to the intricate certification process, regular audits, and continuous compliance validation. The requisition for data centres to predominantly operate within Brazil might pose logistical and financial challenges for international operators, particularly those without a Brazilian partner with at least a 20% capital stake within the country.
Further regulatory compliance involves granting unobstructed access to systems for review, including accommodating user accessibility needs, which introduces additional layers of complexity for operator adherence.
Regis Dudena, an established lawyer, was appointed as SPA leader in April, responsible for supervising Brazil’s betting regulations. Normative Ordinance No 615, one of the preceding regulations, prohibited credit card and cryptocurrency transactions for betting purposes, demanding that financial exchanges between bettors and operators occur through electronic transfers authorized by the Central Bank of Brazil.
Following up, the SPA’s recent pronouncement specifies a 15% taxation on bettors, adhering to the Brazil’s Economic Affairs Commission (CAE) decision ratified last November.
The future introduction of the four-part regulation will elucidate advertising and igaming prerequisites, alongside provisions for industry contributions to social causes. By the end of July, the gamut of regulations is projected to be fully disclosed, marking another milestone in Brazil’s path toward a systematic and regulated betting industry.
