Brazil is moving to recognise the KYC vendors behind its licensed operators. Shufti gives operators audit-ready identity and AML evidence to protect their licence.
-- A licensed operator can pass every KYC onboarding check and still inherit compliance risk from the vendors working behind the screen. In Brazil's regulated market, that exposure is shifting from a commercial concern to a regulatory one.
In early 2026, Brazil's Secretariat of Prizes and Betting (SPA), under the Ministry of Finance, advanced a supplier-recognition framework. Public consultation on the draft closed on 23 March 2026, with final rules expected to follow.
The draft reaches the providers behind licensed operators. KYC vendors, authentication, geolocation, and responsible-gaming technology firms would face recognition in their own right, not only the operators they serve.
How Vendor Recognition Changes The KYC Buying Decision
This moves accountability up the chain. An operator's compliance becomes only as defensible as the standing of the vendor it relies on. A partner already built to the recognition standard becomes part of protecting the licence itself. And a vendor's standing now extends to how it handles player data, not only whether its checks are accurate.
Brazil already sets a demanding baseline. Ordinance SPA/MF No. 722/2024 requires certified biometric liveness before an account is activated, not a static selfie, and the transition period under Law 14.790/2023 closed on 1 January 2026, moving the market into active enforcement.
What Operators Now Answer For:
- A mandatory biometric face-match before any player account opens
- A closed transition window that moved the market into active enforcement
- Supplier recognition extending accountability to KYC and authentication vendors
- Visibility into which third parties handle a player's data to complete one check
- Parallel Central Bank authorisation deadlines for payment-adjacent providers
- Fraud rings exploiting synthetic identities and mismatched account funding
"Behind a single KYC check, a player's biometric data can pass through several third parties, and most operators have little visibility into who they are. Brazil is among the first to bring the KYC vendor itself into the regulator's recognition process, so the choice of vendor and how it handles player data now factor into an operator's own compliance,” said Faryam Asif, Chief Technology Officer at Shufti.
What Recognition-Ready KYC Verification Looks Like
Shufti, a global identity verification and AML screening platform, builds the controls that a recognition review is designed to inspect. It verifies people across 240+ actively processed countries and territories, with evidence captured at onboarding and kept current across the player relationship.
For operators handling identity verification in Brazil, the platform covers the evidence chain that a supplier review expects to see:
- Biometric face-match and liveness backed by iBeta Level 3 certified checks
- CPF extraction matched to a verified, live applicant at onboarding
- Sanctions, PEP, and adverse-media screening at onboarding and on an ongoing basis
- Audit-ready records per account, retrievable in a single pass
- Deployment via SaaS, Private Cloud, or On-Premise
Brazil treats KYC as one connected system rather than a menu of isolated checks, and recognition extends that logic to the vendors behind licensed operators. This is how Shufti maps the controls a Brazil supplier review requires to the evidence each one must produce.
Faryam further added, “Shufti owns its full verification stack, so even in our standard SaaS model, the data is processed within Shufti rather than handed across a chain of subprocessors, with on-premise and private-cloud deployment available as well. That lets an operator prove exactly who handled a player's data, not just trust that a third party got it right."
The Cost Of Proving It Later
Most operators who struggle in a review already have policies. What they lack is the ability to produce one account's full history, identity, screening, and monitoring in a single pass on the day a reviewer asks.
When that record does not exist at the point of request, it has to be rebuilt under remediation. Back-filled checks across live accounts, extended timelines, and compliance teams pulled off forward work follow-up. Shufti makes the record the default for every account.
Brazil's supplier rules are still being finalised. The operators treating identity verification as recognised infrastructure are the ones positioned to answer for it without rebuilding anything.
Operators that want the record in place before the rules land can turn to Shufti's verification built for Brazil's market, which captures identity, screening, and monitoring evidence per account from the very first onboarding.
About Shufti
Shufti builds and owns its full identity verification stack end to end, from document and biometric capture to AML screening and deepfake detection. Its technology verifies people across 240+ countries and territories and 10,000+ actively processed document types, with proprietary OCR trained natively on 150+ languages. Shufti holds iBeta Level 3 certification under ISO/IEC 30107-3 for liveness attack detection and serves 2,000+ clients worldwide. Shufti is a technology provider and does not offer legal or regulatory advice.
Contact Info:
Name: Aroosa Virk
Email: Send Email
Organization: Shufti
Website: https://shufti.com/
Release ID: 89196063
Should you identify any discrepancies, concerns, or inaccuracies in the content provided in this press release or require assistance with a press release takedown, we strongly urge you to notify us promptly by contacting error@releasecontact.com (it is important to note that this email is the authorized channel for such matters, sending multiple emails to multiple addresses does not necessarily help expedite your request). Our responsive team is committed to addressing your concerns within 8 hours by taking necessary actions to resolve identified issues diligently or guiding you through the necessary steps for removal. Our dedication lies in providing accurate and reliable information.
