Brazil's iGaming AML/CFT: COS reports to COAF operational manual

By

Brazil's iGaming AML/CFT: COS reports to COAF operational manual

A new educational material aimed at online gaming operators in Brazil details how to prepare and submit Suspicious Operations Communications (COS) to COAF, focusing on structure, legal foundations, and a compliance checklist. Published on September 18, 2025, the content aligns with the ongoing regulation process of the iGaming and fixed-odds betting market in the country. The document seeks to standardize criteria and raise the quality of reporting to the financial intelligence unit, a key element in the prevention of money laundering and terrorism financing. The guide also highlights the need to integrate transactional supervision, risk management, and due diligence controls in the operation of platforms, payment methods, and third-party relationships.

The manual, titled “Practical Manual of COS to COAF in iGaming: structure, legal basis, and checklist,” practically organizes the sections that a communication must contain: client and counterpart data, operation description, unusualness indicators, analytical support, and attached documentation. It emphasizes the obligation to preserve evidence and records, as well as the prohibition of “tipping-off” the user, central aspects of the Brazilian framework. The legal basis section refers to Law 9,613/1998, which establishes measures to prevent money laundering, and is articulated with sectoral provisions applicable to remote gambling derived from Law 14,790/2023. Additionally, the guide describes the use of Siscoaf as the official reporting channel and the need to designate a responsible person before COAF, ensuring traceability and quality in the information submitted.

COAF, the Financial Activities Control Council, acts as Brazil’s financial intelligence unit (FIU) and receives, analyzes, and disseminates reports of suspicious operations from obligated entities. In the iGaming ecosystem, operators, payment providers, digital wallets, and acquirers supporting deposits and withdrawals are part of the first line of detection. The professionalization of compliance among these actors includes KYC/KYB, risk-based monitoring, verification of Politically Exposed Persons (PEP), and source of funds analysis. For the sector, the manual serves as a bridge between due diligence practices typical of traditional finance and the particularities of flows in online betting, such as bonuses, cashouts, combined bets, and the use of multiple payment instruments.

The Brazilian regulatory environment is undergoing a phased implementation process following Law 14,790/2023, with the Secretariat of Prizes and Bets of the Ministry of Finance as the sector authority and COAF as the AML/CFT reference. At the prevention level, Law 9,613/1998 requires integrity programs, record retention for at least 5 years, and suspicious operations communications without thresholds, in line with FATF recommendations. Compliance is articulated through internal policies, continuous training, independent auditing, and a risk-based approach that segments clients, products, and channels. In international comparison, the obligation to report COS to COAF resembles SARs to the NCA in the United Kingdom or reports to the FIAU in Malta, with local particularities regarding typologies and interinstitutional coordination.

In operational terms, the proposed checklist prioritizes critical steps:

It also recommends enhanced due diligence procedures for high-risk clients, source of funds validations during activity peaks, and governance of third parties, including affiliates and data providers. On the technological front, it suggests periodic effectiveness tests of the alert engine, backtesting of scenarios, and reconciliations between PSPs, gateways, and the operator’s back office to ensure data integrity. The systematic adoption of these measures reduces false positives, raises the quality of COS, and mitigates risks of administrative or reputational sanctions.

For the market, a guide of this nature helps homogenize reporting criteria and facilitates supervision, especially in a segment with strong innovation and high transactional volume. International operators with experience in mature jurisdictions, such as the United Kingdom or Spain, will find points of convergence in risk typologies (bonus abuse, digital mules, impersonation, misuse of cryptocurrencies through payment rails), while local actors can strengthen their compliance culture with international standards. Interoperability with payment aggregators and the proliferation of wallets require a consolidated risk view per client, an aspect the manual incorporates by emphasizing data orchestration and identity resolution. In an environment of increased scrutiny, the narrative and documentary consistency of each COS will be decisive for an effective response from authorities.

Looking ahead, as secondary regulations and supervision by the Secretariat of Prizes and Bets are deployed, an increase in the quality and volume of reports to COAF is expected, with better analytics and feedback to the sector. The professionalization of compliance in iGaming, supported by this type of manual, should translate into living risk matrices, dashboards with key indicators (alerts, effectiveness, cycle times), and continuous improvement circuits. Likewise, collaboration with international entities and alignment with the FATF’s 40 recommendations will strengthen Brazil’s position as an attractive and reliable regulated market. The monitoring of implementation and operators’ capacity to execute this operational checklist will set the pace for the ecosystem’s maturity in the coming months.

Tags: Brazil, compliance Brazil, Brazil betting, compliance betting Brazil