As at 30 October 2026, the former Brazilian licensing route cannot support a new release by itself. The parties should first establish whether any current legal basis permits the precise proposed operation. Existing certificates and contracts belong in that review, alongside the prohibition and any applicable court order.
Executive Summary
- Brazil prohibits fixed-odds betting, including covered online games and offerings from abroad to people in Brazil. The measure also reaches state and Federal District authorisations. A previously licensed counterparty therefore needs a fresh legal-status check before any live supply. (MP 1.394/2026, arts. 1–6.)
- The former technical rules separated operator authorisation, laboratory recognition, system certification, individual games and integration testing. A certificate issued to a developer could support the operator's submission, subject to the applicable conditions. (Portaria SPA/MF 722/2024, arts. 6–8; Portaria SPA/MF 1.207/2024, arts. 5–8.)
- For development performed in the Province of Buenos Aires, the distinction between software work and gambling operation depends on actual functions and provincial effects. Export documentation supplies no exemption for operating or assisting unlawful gambling. (Argentine Criminal Code, arts. 1, 45–46 and 301 bis; Buenos Aires Province Law 15.079, art. 147; Law 13.470, arts. 4–5.)
- A resident Argentine company ordinarily must bring service-export receipts into the exchange market and convert them within 20 business days of receipt or foreign-account credit. The natural-person exception does not automatically extend to a studio company. (BCRA, Exterior y Cambios, sections 2.2.1–2.2.2.2.)
- The contract should preserve evidence, regulator access and lawful closure work while keeping prohibited games unavailable. Player-data retention and international transfers require separate controls in each country. (MP 1.394/2026, arts. 10–11; Brazil Law 13.709/2018, arts. 33, 39 and 46; Argentina Law 25.326, arts. 12 and 25.)
Separate game development from gambling operation
The studio's scope should identify who designs the game mathematics, operates the random-number generator and hosts the remote game server. It should also identify who controls wallets, accepts players, settles bets and decides whether a game remains available. A player contract signed by the Brazilian operator does not answer every operational question.
This matters because the Brazilian prohibition covers offering and intermediation as well as exploitation. It expressly includes covered offshore offerings to people located in Brazil. Maintaining an unavailable product's code and exporting historical records require a different assessment from running live betting sessions. The parties should remove prohibited functions from the service specification and disable the corresponding production permissions. (MP 1.394/2026, arts. 1 and 3.)
An overseas operator or a change in branding does not resolve Brazilian destination law. The separate choice between supplying technology and undertaking an operator's responsibilities is addressed in Licentium's Armenian platform and Curaçao operating-route analysis. For this supply arrangement, the decisive question remains whether the intended Brazilian activity can lawfully occur.
Before accepting work, the studio and counterparty should approve a function-and-location schedule. It should identify each legal entity, the staff and servers performing each function, the permitted territories, and the controls preventing unauthorised play. Ordinary development should not acquire wallet, player-acquisition or gambling-administration functions through an undocumented support request.
Brazilian authorisations and the certification record
The September measure entered into force on publication. It prohibited new authorisations and prescribed the extinction of existing permissions after 30 days. The Ministry's published timetable required betting sites to become unavailable from 6 October 2026; the 30-day authorisation period ended on 25 October. These dates are distinct. The transition did not provide an unrestricted launch window. (MP 1.394/2026, arts. 4, 6–9 and 30; Ministry of Justice and Public Security, Bets fora do ar: plataformas cumprem determinação e encerram apostas no Brasil, 6 October 2026, updated 26 October 2026, section Confira o cronograma.)
The measure remains before Congress. The Supreme Federal Court's 26 October order in ADI 8027 scheduled a hearing for 3 November; that procedural order did not authorise continued betting. If the operator claims judicial protection, obtain the operative decision and verify its beneficiary, permitted activities, dates and subsequent treatment. Neither a pending challenge nor an expired transitional order establishes permission for a new game release. Any later legislative or judicial change requires a fresh assessment of its effects on the operator and product. (Federal Constitution, art. 62; Congress, MPV 1394/2026, legislative status; STF, ADI 8027, order of 26 October 2026.)
The former certification requirements still explain what the parties must reconstruct for earlier deployments. Article 29 of the measure preserves the previous legislation for facts during the authorisation period and specified closure obligations. It does not establish a new commercial launch route. (MP 1.394/2026, art. 29, sole paragraph.)
Under the earlier arrangements, the Brazilian operator needed its own SPA authorisation. The developer's evidence concerned the product and services supplied to that operator. The laboratory needed SPA recognition under Portaria 300/2024 for the relevant testing activities. International accreditation or a foreign gaming certificate alone did not satisfy the Brazil-specific certificate requirement. (Portaria SPA/MF 827/2024, arts. 2–3; Portaria MF-SPA/MF 300/2024, arts. 3, 6 and 11(1)(III); Portaria SPA/MF 722/2024, arts. 6–7; Portaria SPA/MF 1.207/2024, arts. 5–6.)
The technical file should distinguish these components:
- The betting system and its platforms, covered by Portaria 722, including the integration of modules and platforms.
- Each online game and its random-number generator, with the corresponding game and RNG certification evidence.
- A separate remote game server or other external game-delivery solution, requiring the applicable integration evidence.
- A live-game studio, where used, with its own certification and operational assessment requirements.
An operator could present a valid Brazil-specific game certificate issued in the name of its contracted supplier or developer. Where a different technological solution delivered the games, the operator also had to present an integration certificate. The supplier should therefore provide the exact certified build, report, dependencies and integration record. A certificate for a game title alone cannot establish the compliance of every version and deployment. (Portaria SPA/MF 722/2024, art. 6(1)–(2); Portaria SPA/MF 1.207/2024, arts. 5–8; SPA, Questões Técnicas, questions 69–71.)
Product classification precedes testing. The earlier online-game rules excluded skill games, fantasy sports, multi-bettor games and peer-to-peer games from that fixed-odds category. An exclusion from one category did not establish permission under another. A change in game mechanics therefore requires a fresh classification before the parties decide what testing could be relevant. (Portaria SPA/MF 1.207/2024, arts. 2–4.)
The certification and release sequence should now begin with a closed gate:
- The operator supplies its identity, former permission and any claimed current legal basis. Its Brazilian legal adviser checks the prohibition and the precise effect of any court order. Keep Brazilian real-money access disabled until that review establishes authority for the intended activity.
- The studio documents the product, functions, builds, hosting and data flows. Both parties identify work that may continue without offering or intermediating prohibited betting.
- The operator and studio reconcile historical certificates against deployed versions. The recognised laboratory confirms the tested scope and identifies missing or changed components.
- If a lawful operating route is established, the parties determine the technical rules then applicable. The laboratory performs the required testing; the operator completes the required submissions and obtains any necessary regulatory decisions.
- The operator records its acceptance of the exact release. The studio deploys only after the legal and technical conditions are satisfied, with the approved territory controls and rollback procedure.
The operator owns its regulatory submission and player obligations. The studio supplies accurate technical evidence and implements the agreed controls. The laboratory assesses the components within its recognised scope. The contract should assign a named owner to each dependency.
Development and export from the Province of Buenos Aires
For development carried out in the Province of Buenos Aires, Law 15.079 and Decree 181/2019 govern the local online-gambling question. The decree treats a player domiciled in the province, or a playing device located there, as a provincial connection. A Brazilian-only territory clause therefore needs effective access controls. Buenos Aires Province is a separate jurisdiction from the Autonomous City of Buenos Aires. (Law 15.079, art. 147; Decree 181/2019, Annex I, art. 147.)
The reviewed provincial operator and homologation provisions do not turn pure software development for export into a general gambling-operator licence requirement. That conclusion depends on the studio's actual activities. National Criminal Code article 301 bis reaches unauthorised exploitation, administration, operation and organisation of gambling. Provincial Law 13.470 separately addresses assistance or cooperation with unauthorised gambling within its scope. Hosting outcomes, controlling gambling sessions or administering player balances needs a separate assessment before those functions begin. (Law 15.079, arts. 151–155; IPLyC Resolution 791/2019, Annex I, section 1.1; Criminal Code, arts. 1, 45–46 and 301 bis; Law 13.470, arts. 1 and 4–5.)
If the studio serves a Buenos Aires provincial operator or permits provincial play, that local operation needs its own authorisation and technical assessment. A Brazilian certificate does not replace provincial homologation. Operations in another Argentine province require that province's rules to be applied to the actual work. (Law 15.079, arts. 151–155; Resolution 791/2019, Annex I, sections 7–8.)
Qualifying service exports require electronic class E invoices and the appropriate export invoicing configuration. Development, maintenance and copyright exploitation rights should be described separately where their legal and tax classification differs. Foreign-use evidence should include the contract, deliverable and acceptance record. A foreign customer's address alone does not establish the effective use abroad required for the relevant VAT and provincial turnover-tax treatment. (AFIP General Resolution 4401/2019, arts. 1–4; Argentine VAT Law, art. 1(b); Buenos Aires Fiscal Code, art. 186(d)(2).)
For a resident studio company, treasury should track the ordinary 20-business-day currency deadline from receipt or overseas credit. Keeping money in an offshore account does not postpone that trigger. Before collecting, the company should agree the service or rights classification and supporting documents with its authorised bank. A knowledge-economy exception requires its prescribed eligibility and evidence; being a software developer is insufficient. (BCRA, Exterior y Cambios, sections 2.2.1–2.2.2.2 and 2.6.)
The payment review must also address Brazil's restriction on transactions destined for fixed-odds betting, which preserves transactions necessary for closure and player refunds. Separate accrued fees and permitted closure services from charges for prohibited operation. Agree the lawful payment route before promising a settlement date or net receipt. (MP 1.394/2026, art. 14.)
Control updates and preserve regulatory evidence
Under the former rules, critical components included those whose failure could harm player rights, regulatory access, data security or compliance. System certificates required annual revalidation and revalidation when critical components were added, changed or removed. Game certificates required revalidation on critical-component changes; the game rule did not impose the same blanket annual cycle. Revalidated certificates had to be submitted within five business days of issuance. That filing period did not permit uncertified play. (Portaria SPA/MF 722/2024, arts. 2(VI) and 6(3)–(5); Portaria SPA/MF 1.207/2024, arts. 2(V) and 5(3)–(5).)
SPA's 2025 recertification instructions included remote game servers and aggregators in the annual platform cycle. Integration certificates had no fixed expiry, but critical integration changes required recertification. The operator and laboratory had to assess those changes jointly. Separate platform certificates remained necessary. (SPA, Ofício Circular SEI 1362/2025/MF, sections I(a) and II(b)–(c).)
The change schedule should apply those distinctions when examining historical releases and preparing any later lawful product:
- Changes to game mathematics, random-number generation, paytables or outcome logic require a critical-component assessment and the resulting retesting and certification work.
- A new game server, platform connection or changed integration requires the laboratory to assess the affected system and integration scope.
- Text, artwork or presentation changes require a recorded assessment of whether rules, displayed winnings or another certified requirement changed. Calling an update cosmetic does not establish an exemption.
- A security defect requires containment, evidence preservation and the applicable notifications. An emergency process should define technical approvals and testing; it must not restore prohibited Brazilian betting.
The operator should record its release approval after the required technical assessment. The studio should keep the request, source revision, build identifier, test evidence, certificate decision, deployment approval and rollback record. The earlier system requirements expressly required controlled changes and separation of development from production. Commercial acceptance cannot replace required certification. (Portaria SPA/MF 722/2024, Annex IV, items 34–35.)
Closure does not erase the operator's evidence duties. The measure requires accessible records for at least five years and continued SIGAP reporting for the relevant activity and refunds. The studio should deliver the game, session, financial-reconciliation and incident evidence needed for those duties, with a record linking each relevant event to its deployed version. (MP 1.394/2026, arts. 10–11; Portaria SPA/MF 1.207/2024, art. 10.)
SPA's closure instructions, updated on 26 October, identify 15 December 2026 for regularising remaining financial and regulatory obligations, subject to the specific deadlines set by SPA. They also require contact changes to be communicated within 48 hours. The operator should reconcile outstanding submissions now and give the studio dated evidence requests. The December date does not revive the expired October refund and balance-reporting deadlines. (SPA, Secretaria de Prêmios e Apostas regulamenta obrigações das empresas após proibição das bets, 5 October 2026, updated 26 October 2026, sections Devolução dos valores and Regularização das obrigações.)
For historical offshore hosting, Portaria 722 required cumulative conditions: qualifying civil and criminal legal-cooperation arrangements, the data subject's specific prior authorisation for the transfer, regulator access, continuous replication in Brazil, continuity arrangements and ISO 27001 certification. Selecting an Argentine cloud region alone did not satisfy them. Retained systems and proposed migrations should be checked against the obligations that continue to apply. (Portaria SPA/MF 722/2024, art. 4.)
Remote access by the Argentine studio also needs a data-transfer and processing assessment. Brazilian transfer rules cover making personal data available to another processing agent abroad. Where the parties use ANPD standard contractual clauses, they must adopt the prescribed text without alteration and satisfy the accompanying requirements. A processor contract and a transfer mechanism perform separate functions. (Brazil Law 13.709/2018, arts. 33, 39 and 46; ANPD Resolution 19/2024, Annex I, arts. 3–4, 9 and 16–17.)
The retention schedule should distinguish the operator's regulatory archive from the studio's processor copies. Argentine law restricts purpose and end-of-service retention; its future-engagement exception is limited. Allocate the archive, lawful holds, return and secure deletion expressly. Transfers from Argentina to Brazil require their own lawful mechanism. (Argentina Law 25.326, arts. 9–12, 16(5) and 25.)
Contract for permitted work and a verified release decision
The supply agreement should make the operational restrictions executable. The following provisions are proposed contractual allocations; the legal duties identified above remain with their statutory actors.
The market schedule should name the counterparty, products, domains and permitted territories. It should keep Brazilian real-money deployment disabled under the present prohibition. Any proposed reopening should require the actual legal authority, the technical rules then applicable and written approval of the exact build. The agreement should distinguish offline development, historical-record support and live exploitation rights.
The certification schedule should allocate laboratory engagement, fees, test materials, integration evidence, rejected-build remediation and submissions. The studio should warrant the accuracy of its supplied technical information and disclose deviations from the certified build. The operator should control production acceptance and notify the studio of restrictions affecting the permitted service.
Audit and cooperation clauses should secure access to relevant logs, reports and subcontractor evidence. They should accommodate lawful regulator requests while protecting unrelated source code and personal data. The incident procedure should identify who contains the defect, who preserves evidence and who makes each required notification. The supplier's reporting deadline must leave the operator enough time to meet its own applicable deadlines.
Suspension and exit provisions should disable unlawful play without destroying the records needed for refunds or supervision. Separate accrued invoices, cancelled milestones, certification costs and agreed transition work. Negotiate liability limits, indemnities and insurance against the functions each party controls. No reimbursement promise changes the regulator's statutory powers or supplies missing operating permission.
The studio should also establish its rights to license employee, contractor and third-party code, and define the laboratory's and operator's access rights. Argentine software copyright and the employee-creation rule require their own factual checks. (Argentina Law 11.723, arts. 1–4.)
The immediate documents are a function-and-location schedule, a certificate and version inventory, a closure-support statement of work, and revised market, payment and data clauses. Any future production schedule must follow a verified legal-status decision and the applicable technical assessment.
Scope game-supplier market entry with a review of the studio's functions, Brazilian deployment restrictions, certification record and operator agreement. The scope should identify work that can proceed and the evidence needed before any live release.