Brazil Bets ANGB Affiliate Compliance: Lei 14.790/2023 Operator Guide

Brazil's Bets ANGB (regulated under Lei 14.790/2023) entered active enforcement in Q4 2024, establishing Brazil as the world's 5th-largest regulated iGaming market by 2026. For non-Brazilian operators expanding in Brazil: (1) licensing requires a $1.5M one-time fee plus a 12% annual turnover tax, (2) CPF (Cadastro de Pessoas Físicas) validation of every player is mandatory - not optional, (3) Pix integration is dominant (90%+ of market player deposits flow through Pix), and (4) affiliate programs must validate CPF on every conversion to claim CPA payouts. This guide walks through the compliance framework, affiliate program structure, and LGPD overlap for operators planning Brazil entry.

Lei 14.790/2023 Framework

Lei 14.790/2023, enacted July 20, 2023, created the Bets ANGB (Autoridade Nacional de Gestão de Apostas de Cota Fixa) regulatory framework. The law took effect in 2024 and introduced a licensing regime for single-event sports betting (apostas de cota fixa) operators. Key provisions for affiliate operations:

• Article 3 establishes operator licensing requirements: only licensed operators may offer bets in Brazil. Unlicensed operators face fines up to 5% of annual revenue.
• Article 5 mandates CPF (Cadastro de Pessoas Físicas, Brazilian tax ID) collection and validation from every player. Affiliates are responsible for ensuring CPF validation at signup; invalid CPF entries block playthrough.
• Article 7 imposes a 12% turnover tax on gross gaming revenue (GGR). This applies to all player deposits and withdrawals, regardless of player nationality.
• Article 11 requires operator-level responsible gaming compliance, including affiliate marketing restrictions. Affiliate promotions cannot target minors or use misleading bonus claims.
• Article 13 creates SECAP (Secretaria de Controle, Avaliação, Planejamento, Energia e Loteria) under Ministério da Fazenda as the licensing authority. SECAP issues licenses; SPA (Secretaria de Prêmios e Apostas) handles enforcement and dispute resolution.

Unlike European frameworks (MGA, UKGC, CySEC), Lei 14.790 does not distinguish between operator-level and affiliate-level compliance. Affiliates are sub-contractors of the licensed operator and inherit the operator's compliance obligations. This means affiliate fraud, bonus abuse, or marketing violations can trigger operator fines and license suspension.

Licensing for Non-Brazilian Operators

Non-Brazilian operators seeking to offer Bets ANGB products in Brazil must obtain a license from SECAP. The process differs from European licensing in three key ways: (1) Brazil requires a physical company presence (office and local team), (2) the process is sequential rather than parallel-track, and (3) timelines extend 6-9 months from application to activation.

The $1.5M licensing fee is a one-time payment. Annual costs include the 12% turnover tax (applied to total GGR regardless of profit). A $10M GGR operator pays $1.2M annually in turnover tax alone. For foreign operators, the $1.5M fee is often the lowest-risk entry cost; hiring local compliance staff typically exceeds this.

One critical differentiator from European markets: Brazil does not offer fast-track or delegated-licensing routes. SECAP controls all licensing decisions. There is no intermediate conditional license or network-based affiliate pathway. Each affiliate group operating under a foreign operator's license must be registered with SECAP and undergo the operator's compliance audit.

CPF Validation Requirement

CPF (Cadastro de Pessoas Físicas) is the Brazilian individual tax identification number, issued by Receita Federal (Brazilian IRS). Lei 14.790 Article 5 mandates that every player provide a valid CPF before any wager. This is not optional; players cannot place bets or withdraw funds without CPF validation. For affiliates managing signups, CPF validation is a mandatory conversion checkpoint.

CPF validation occurs in real-time via an integration with Receita Federal's public CPF verification service or a third-party validation provider. The process checks:

1. Format validation: CPF is an 11-digit number formatted as XXX.XXX.XXX-XX. The system validates the format and runs a modulo-11 checksum.
2. Duplicate check: The same CPF cannot be registered twice in the operator's system. Multi-accounting (one player with multiple CPFs) is the largest fraud vector.
3. Age verification: Receita Federal data must confirm the CPF holder is 18+. Players under 18 are auto-blocked.
4. Death check: CPF numbers of deceased individuals are marked in Receita Federal records. The operator must filter these out.
5. Active status: CPF must be active (not suspended, stolen, or under investigation). Receita Federal maintains a public blacklist.

For affiliate tracking, CPF validation creates a hard conversion boundary. An affiliate's CPA payout is NOT credited until CPF validation passes. If a player signs up via Affiliate A but the CPF is invalid, Affiliate A does not receive the CPA payout. This is material for affiliate program management; many affiliates source low-quality players with fake CPF attempts, expecting operator forgiveness. Under Lei 14.790, invalid CPF equals no payout.

Integration implementation (per Banco Central & Receita Federal documentation): Affiliates working through S2S (server-to-server) tracking should map the player's CPF as a required postback parameter. The operator's signup flow validates CPF before firing the affiliate conversion postback. The tracking system records both the CPF validation status and the conversion timestamp.

Pix Affiliate Integration

Pix, launched by Banco Central do Brasil (BCB) in November 2020, is an instant payment system dominating Brazilian e-commerce and iGaming. By 2026, Pix accounts for 90%+ of player deposits and 85%+ of player withdrawals in regulated iGaming. For affiliates, Pix integration is non-negotiable; operators without Pix cannot scale.

How Pix works (simplified): A player transfers funds instantly to the operator's Pix account using their bank app, debit/credit card, or e-wallet (Nubank, Inter, etc.). The transfer settles in seconds, 24/7, with no card declines. The operator receives the payment within milliseconds of initiation.

For affiliate tracking and CPA payouts, Pix integration creates a critical advantage: instant confirmation. When a player deposits via Pix, the operator knows within seconds whether the deposit succeeded. This allows instant CPA payout crediting or rejection based on deposit validation. Credit card deposits, by contrast, settle in 3-5 days, creating lag in affiliate payout calculations.

Pix for affiliates involves a technical setup: The operator generates a unique Pix key (QR code or copy-paste code) for each player session. When the player scans the code or enters the key in their bank app, the payment routes directly to the operator's Pix account. The operator's payment processor receives a webhook notification within milliseconds, confirming deposit amount, player CPF, and deposit timestamp. The affiliate tracking system fires a postback to the affiliate's tracking server confirming the deposit and CPA payout eligibility.

Risk management under Pix: Because Pix is instant and irreversible, fraud is shifted earlier in the funnel to account creation and deposit validation. Affiliates must validate player identity (CPF) before Pix deposit. Multi-accounting (one player, multiple CPFs to claim multiple welcome bonuses) is the leading fraud pattern under Pix. Operators must implement real-time duplicate CPF checking and behavioral fraud detection (same device, same IP, same geolocation equals high-risk consolidation).

LGPD and Affiliate Data Handling

Lei Geral de Proteção de Dados (LGPD), Brazil's General Data Protection Law, entered force in August 2020. It closely mirrors GDPR but has key differences relevant to affiliate compliance. LGPD applies to any processing of personal data (including CPF, email, phone, IP address, device ID) for residents of Brazil, regardless of where the operator is based.

Affiliate data handling under LGPD requires explicit consent and transparency:

• Data subject consent: Players must explicitly consent to CPF collection and processing. Affiliates cannot hide CPF requests in Terms & Conditions. A checkbox with clear language is mandatory.
• Affiliate as data controller: The operator is the primary data controller (responsible for compliance). Affiliates are co-processors; they help collect and validate data but remain liable if they fail to follow the operator's data-handling procedures.
• Data retention: CPF must be retained only for the duration of the player relationship plus 5 years post-closure (for tax and dispute purposes). After 5 years, CPF must be anonymized or deleted unless there is a legal hold.
• Cross-border transfers: If affiliate data is processed outside Brazil, the operator must implement Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs) with the affiliate's processor, similar to GDPR. Most Brazilian operators avoid this complexity by processing all data within Brazil.
• Right to erasure: Players can request CPF deletion (direito ao esquecimento). The operator must comply within 30 days, deleting CPF from active systems. Archived tax records are exempted.
• Data breach notification: If affiliate-sourced data is compromised, the operator must notify players and ANPD within 72 hours. Affiliates are contractually responsible for breach prevention in their systems.

LGPD vs Bets ANGB overlap: Lei 14.790 mandates CPF collection for regulatory compliance (KYC). LGPD mandates consent and transparency for privacy. Both apply simultaneously. An operator cannot claim Lei 14.790 overrides LGPD; instead, the operator must justify CPF collection on two grounds: (1) regulatory requirement (Lei 14.790 Article 5) and (2) legitimate interest in fraud prevention. Consent alone is insufficient; the operator must demonstrate necessity.

Affiliate Program Structure Under Lei 14.790

Affiliate program design in Brazil differs from European models due to Lei 14.790's strict operator liability. The operator is legally responsible for affiliate behavior, marketing claims, and fraud prevention. This creates three key design constraints:

Commission models: CPA (Cost Per Acquisition) and RevShare (Revenue Share) are both permissible under Lei 14.790. Hybrid and lot-based models are also allowed, provided the affiliate agreement explicitly states how commissions are calculated and when they are paid. Multi-tier affiliate programs (sub-affiliates) are permitted but require registered agent disclosure; each sub-affiliate must be individually registered with the operator and visible to SECAP upon audit.

Marketing restrictions: Affiliates cannot make bonus guarantees, use fake testimonials, or target minors. Lei 14.790 Article 11 mandates responsible gaming language in affiliate promotions. This differs from European markets where affiliate marketing is lightly regulated; Brazil enforces it rigorously. Operators must pre-approve affiliate creative (banners, landing pages, email templates) before deployment. Unapproved creative is a license violation.

Payout mechanics: CPA payouts cannot be credited until CPF validation is confirmed. RevShare payouts are calculated weekly or monthly (per the affiliate agreement) based on net player GGR (total deposits minus withdrawals). Payouts are made via Pix, bank transfer, or (for foreign affiliates) SWIFT international transfer. Payout delays exceeding 5 business days are a contractual breach.

Frequently Asked Questions

Key Takeaways

• Lei 14.790/2023 created a fully regulated Brazilian iGaming market as of Q4 2024. Non-Brazilian operators must obtain a $1.5M license from SECAP; unlicensed operations face fines up to 5% of revenue.
• CPF validation is mandatory at signup and is a hard conversion requirement for affiliate CPA payouts. Affiliates sourcing fake or duplicate CPF entries receive zero payout for those conversions.
• Pix dominates (90%+ of deposits) and enables instant confirmation, allowing faster affiliate payout processing. Operators without Pix cannot scale competitively.
• LGPD applies in parallel to Lei 14.790. Affiliates must obtain explicit player consent for CPF collection and comply with 5-year data retention and breach notification requirements.
• Affiliate program design must include pre-approval of marketing creative, clear commission model documentation, and compliance audits per SECAP standards. Sub-affiliates must be individually registered.
• The 12% turnover tax applies to all GGR regardless of profitability. Operators should model this as a cost baseline, not a variable expense.
• License application timeline is 6-9 months; underestimating this delay is a common operator mistake. Plan for local staff hiring and office setup in parallel.

Brazil's Bets ANGB framework is operationally complex and compliance-intensive compared to European markets. Operators entering Brazil must prioritize CPF validation architecture, Pix integration, and LGPD consent workflows from day one. Affiliates working with Brazil-licensed operators must align with stricter marketing controls and CPF validation requirements. Market potential is high; Brazil's iGaming market is projected to reach $5B+ GGR by 2027, but execution risk is material for operators unfamiliar with Brazilian regulatory nuance.