Only four rails exist
Art. 3, §1º-2ºDeposits and payouts run exclusively on Pix, TED, debit or prepaid cards, and same-institution book transfers. Banned outright: cash, boletos, checks, cryptoassets, credit cards and any postpaid instrument. The circulating "Pix-only since 2025" claim is false. The list never narrowed. Pix simply won the volume, carrying effectively all deposits at licensed operators.
Same-CPF, at the rail
Art. 3, caput + §2º V-VIMoney moves only between the bettor's own registered account and the operator's transactional account. Third-party and unregistered-account transfers are prohibited deposit forms. PayRetailers ships a real-time validation API for exactly this (live December 3, 2024, a month before market opening). Pay4Fun enforces it by construction, tying deposits and withdrawals to one verified CPF. Pagsmile pays out to CPF, CNPJ, EVP, phone, and email Pix keys, which is rail coverage rather than the betting-specific same-CPF check, so the match stays the operator's job. AstroPay has no betting-grade CPF product: it is a wallet players deposit from.
Two 120-minute payout deadlines
Art. 6 §2º · Art. 7 §4ºWithdrawals must reach the player's registered account within 120 minutes of the request, and prizes within 120 minutes of the event or game session ending. In practice that is a 24/7 payout-rail requirement, and it is why the direct-versus-indirect question on the BCB board below is operational rather than academic.
Four segregated accounts
Art. 2 · Art. 4The structure is a tetrad: the bettor's registered account, the in-system graphic ledger (36-month history), the operator's transactional account, and a separate proprietary account for operating expenses. Transactional funds are segregated assets, bankruptcy-remote and unattachable, and must equal all players' balances plus open bets at every moment.
R$ 5M reserve in federal bonds
Art. 9 · Portaria 827A standing financial reserve of at least R$ 5,000,000 in Selic-registered federal government bonds at a BCB-authorized custodian, proven at licensing alongside the R$ 30M minimum capital. Touching it requires prior SPA authorization and a two-business-day replenishment.
BCB-authorized institutions only
Art. 3 §3º · Art. 4 · Law 14.790 art. 21Both legs of every transaction must sit at institutions the Central Bank of Brazil authorizes, and unauthorized intermediaries such as collection agents and "payment managers" are banned from the flow. This is the clause that makes the register board below the first diligence step rather than a formality.
Mar 2025Portaria SPA/MF 566: financial and payment institutions must refuse and close accounts of unauthorized betting operators and report suspects to the SPA within 24 hours.
Feb 2026MED 2.0: Pix fraud reports now trigger automatic 72-hour precautionary blocks on suspect accounts, with multi-layer fund tracing.
May 2026The Novo Desenrola measure bans credit operations linked to funding bets, closing the credit-funded-Pix loophole banks had left open.
Aug 2026CMN Resolution 5.320 takes effect August 28: payment-system entities must block accounts and reject transactions of unauthorized operators within 24 hours, with automated tracking required.
OngoingPix Automático (live June 2025) excludes betting from eligible recurring-payment categories, so subscription-style deposits stay off the table.
Scale, for context: the Central Bank's own study counted R$ 18-21 billion a month in Pix transfers to betting firms across 2024, a figure its president updated to R$ 20-30 billion at the 2025 Senate inquiry. This is orientation, not legal advice. Confirm the current text with counsel before building against it.
