The Brazilian Secretariat of Prizes and Betting (SPA/MF) closed public consultation on its draft B2B Supplier Recognition Ordinance on 23 March 2026. The final rules have not yet been published. Suppliers and operators serving the Brazilian market are now in a six-to-eight week regulatory window where the obligations are visible, the timeline pressure is real, and most companies in scope are still waiting for clarity that will not arrive in time.

What the draft Ordinance does

For the first 18 months of regulated betting in Brazil, B2B supplier relationships were treated as an operator compliance matter. If a supplier was not certified, the operator's licence was at risk. The supplier itself had no direct relationship with the regulator.

The draft Ordinance, opened for public consultation on 4 February 2026 and closed on 23 March, changes that fundamentally. Five categories of B2B supplier are now in scope for direct SPA recognition:

• Betting systems and platforms
• Online games and live game studios (including aggregators)
• KYC, identification, and risk classification services (including biometrics and geolocation)
• Sports betting data and statistics providers
• Customer identification services

Recognition will be granted by individual SPA Ordinance for a three-year term, subject to renewal. The application package is similar to the operator authorisation framework: corporate documents, technical capacity statements, certificates of legal eligibility, suitability, and tax and labour compliance. Once recognition is in force, licensed Brazilian operators will only be permitted to engage suppliers who hold formal SPA recognition. Existing supplier contracts will need to terminate if the supplier fails to obtain it.

The legal risk of non-compliance sits with the operator, not the supplier. This is the structural shift most operators have not yet fully internalised.

The incorporation requirement that is the actual deadline

The provision that matters most is in Article 4 of the draft. Suppliers must establish a Brazilian legal entity, headquartered and operated in Brazil. Foreign suppliers without an existing Brazilian presence can apply for recognition but must complete entity incorporation within 120 days. All contracts with operators must be executed in Brazilian Portuguese.

Brazilian entity incorporation typically takes six to twelve weeks minimum, depending on the corporate structure chosen. For a supplier with no existing Brazilian presence, the practical lead time is eight to ten weeks once you account for legal documentation, address registration, CNPJ application, and bank account opening.

This is the deadline that is running now. The final Ordinance text is unknown. The incorporation lead time is not. A supplier without an existing Brazilian entity that waits for the final Ordinance to be published before beginning incorporation has already conceded six weeks of runway. Many will only have started in May, by which point they are running into a transition window the SPA has indicated will be tight.

This timing logic does not depend on what the final text says. It depends only on the calendar.

Two provisions most law firm analysis has missed

The bulk of public legal commentary on the draft Ordinance has focused on the headline framework: who is in scope, what the recognition process looks like, transition arrangements. Two provisions in the draft text have received almost no attention but materially change how suppliers and operators should be planning.

Article 5(VI) requires a 48-hour disclosure obligation. Recognised suppliers must notify the SPA within 48 hours of becoming aware that an operator customer is using their service in a manner inconsistent with applicable legal and regulatory requirements. This is a structural change in how supplier-operator relationships work in Brazil. Most existing B2B agreements contain confidentiality provisions that prohibit disclosure of operator information to third parties without consent. The draft Ordinance contains no carve-out resolving the conflict between this regulatory disclosure obligation and standard contractual confidentiality. Suppliers face a real risk of being caught between the two when the rules go live.

Article 6 imposes additional obligations on suppliers in the same economic group as a licensed operator. Where a holding company owns both a licensed Brazilian operator and a B2B supplier (a structure that does exist in this market), the draft requires operational segregation between the supplier's activities serving its affiliated operator and its activities serving other operators. The SPA's recognition application may need to disclose the affiliated operator relationship in a way that triggers additional regulatory scrutiny. Vertically integrated groups will need a specific compliance architecture that does not fit cleanly into either the operator licensing stream or the standard supplier recognition stream.

Both provisions need addressing in supplier compliance planning before the recognition application is filed, not after.

What licensed operators must do about their supplier portfolio

The operator-side implications are structural. The draft places the legal risk of non-compliance on the operator. An operator that contracts with an unrecognised supplier after the rules take effect is exposed to enforcement action.

Five practical priorities for operators currently licensed under the SPA framework.

Inventory every B2B supplier relationship. Map every active and contracted supplier across the five regulated service categories. Most operators have between fifteen and forty supplier relationships once aggregators, KYC vendors, geolocation providers, sports data feeds, and content suppliers are all counted. The operator needs a current list before the final Ordinance is published, not after.

Identify suppliers without Brazilian entities. Foreign suppliers without an existing Brazilian presence are the highest-risk subset of the portfolio. These are the suppliers most likely to miss the recognition deadline. Operators relying on them are most exposed to a supply-chain compliance gap when the rules go live.

Open the recognition cost conversation now. Compliance costs for suppliers, covering Brazilian incorporation, legal fees, SPA submission preparation, and ongoing reporting obligations, run from EUR 80,000 upwards. These costs postdate most existing supplier contracts. Suppliers will, legitimately, seek to pass them through to operators. The negotiating position for operators is much stronger before the transitional deadline forces the conversation than after.

Audit existing supplier contracts against the new framework. Confidentiality provisions in current B2B agreements may conflict with the Article 5(VI) disclosure obligation once the Ordinance is in force. Operators need a defined escalation policy and legal review of the contract templates before the supplier files for recognition.

Reclassify supplier risk under SPA/MF No. 1,143. The existing AML framework requires operators to risk-classify their suppliers. A change in a supplier's recognition status will be a mandatory reclassification trigger. The reclassification process typically takes weeks and cannot be automated. Operators should plan for a wave of reclassifications when the recognition framework goes live.

What B2B suppliers should be doing now

For suppliers, the priority order is different. Six items, in order of urgency.

Begin Brazilian entity incorporation immediately if you do not have one. Six to twelve weeks is the practical minimum. The formal recognition deadline is unknown. The incorporation lead time is fixed.

Assess your regulatory reliance position. Suppliers with existing MGA recognition, GLI certification, UKGC accreditation, or similar mature-market standing have a different argument to make to the SPA than suppliers without those credentials. Whether the SPA will adopt a regulatory reliance pathway in the final Ordinance is unknown. Plan for the no-reliance scenario.

Audit existing operator contracts against Article 5(VI) before applying for recognition. The 48-hour disclosure obligation does not pause during the recognition application period. Confidentiality provisions in existing contracts may need amendment before recognition is granted. Compliance teams need a defined escalation policy in place from day one.

If you are a KYC or payment-adjacent supplier, map your exposure across both Brazilian regulatory frameworks. The Central Bank's May 2026 deadline for payment institution authorisation runs in parallel with the SPA's supplier recognition framework. The two frameworks are administered by different regulators with different obligations. Satisfying one does not satisfy the other. The highest-risk configuration is instant payment rail integration combined with KYC or geolocation services.

Plan for vertical-integration disclosure if applicable. If your group owns a licensed Brazilian operator, the Article 6 segregation requirements apply. The compliance architecture is more complex than the standard recognition stream. Engage local counsel before the recognition application is drafted, not after.

What happens if a supplier misses recognition

The transitional regime in the draft Ordinance allows operators to maintain or enter into contracts with suppliers whose registration and recognition applications have been duly filed and accepted by the SPA. Suppliers currently providing services to Brazilian operators are not immediately in breach when the rules take effect, but the protection only runs as long as a recognition application is in process.

The draft provides 120-day wind-down periods in three distinct scenarios:

• Article 21: a supplier's recognition is cancelled following an SPA decision
• Article 26: a supplier fails to submit a valid registration application during the transitional window
• Article 28: a recognition application is finally denied following exhaustion of all administrative appeals

Operators carrying multiple suppliers in borderline status could find themselves managing simultaneous wind-down timelines across different service categories, each tied to a different regulatory event. This is a significant operational risk that is not addressed in any standard B2B agreement currently in place in the Brazilian market.

Why this matters for the wider Latin American picture

Brazil is the largest regulated iGaming market in Latin America and the regulatory model that other LATAM jurisdictions watch most closely. Colombia, Mexico, Peru, and Argentina all observe Brazilian regulatory developments and adapt their own frameworks accordingly.

The SPA's move to direct supplier recognition is novel in the region. Colombia's Coljuegos has supplier registration but not the kind of operational capacity recognition the SPA is implementing. Mexico's regime is less mature on supplier-side oversight. If Brazil's framework lands cleanly, expect at least one other LATAM regulator to adopt a similar architecture within twelve to twenty-four months.

For B2B suppliers serving multiple LATAM markets, the Brazilian framework may be the template for a wider regional compliance burden, not a one-off Brazilian-specific cost. That is a different planning question than treating Brazil as a discrete project.

What ICOS does

ICOS works exclusively with operators pursuing or holding regulatory licences.

If you want to talk about your specific Brazilian supplier exposure or your wider compliance framework, tell us your situation. Recommended jurisdiction, fixed price, realistic timeline. Within 24 hours.

The final Brazilian B2B Ordinance is coming. The incorporation deadline is already running. The operators who treat this as a Q3 problem will find out in Q3 that it was a Q2 problem.