Fraud prevention in iGaming: the problem is onboarding, not the back office.
There are numerous cases of iGaming operators losing their licenses and taking a long time to understand why. And they often take a long time to realize that the reason isn't in the suspicious operation report, or because of a lack of technology…or because the verification model was addressing the wrong problem at the wrong time.
In reality, the real reason lies in the registration process, whose flaws occurred months earlier. Structural fraud doesn't begin with the suspicious transaction that ends up at COAF (Council for Financial Activities Control). It begins in the registration process, when a fake identity goes through onboarding without friction. Everything that comes after is a consequence.
What does onboarding actually need to do?
Brazilian Ministry of Finance Ordinance SPA/MF 722 already requires facial recognition before any account is created. This is not a suggestion: it is a technical requirement of Annex IV, with mandatory certification. What it does not solve, on its own, is post-registration behavior: multiple accounts linked to the same device, betting patterns that suggest cross-laundering, use of bonuses by an account that should never have been approved.
Device fingerprinting, cross-referencing ownership and financial behavior via Open Finance close the window left open by documentary KYC. Valid CPF (Brazilian taxpayer ID), matching face, but illogical behavior: without post-onboarding monitoring, this profile will generate a suspicious transaction report months later, hastily, outside the deadline.
ECA Digital closed a window that was still open.
Law 15.211/2025 came into effect in March 2026. Betting platforms are within its scope. The law prohibits self-declaration of age as the sole verification mechanism and assigns the National Data Protection Agency (ANPD) the responsibility for overseeing compliance.
Operators already working with biometrics and liveness don't need to adjust anything in the process. The problem lies with those who still accept self-declared birth dates as age verification: with the Digital ECA (Brazilian Statute of Children and Adolescents) in effect, the exposure is no longer solely to the SPA/MF (Brazilian Federal Revenue Service/Ministry of Finance) but also to the ANPD (Brazilian National Data Protection Authority). A minor using their father's CPF (Brazilian taxpayer ID) is not an isolated case of failed KYC (Know Your Customer). These are two regulatory bodies with the authority to take action on the same matter, but through separate procedures.
Biometric verification with liveness verification is not an optional technical detail in this context. It is what distinguishes identity verification from document verification; and this distinction has direct legal consequences when the regulator questions the onboarding process.
The true cost of a fraudulent account.
Deposit made via a dummy account, immediate withdrawal to a third party, subsequent chargeback, delayed notification to COAF (Brazilian Financial Intelligence Unit) because no one was monitoring the profile. This is the script for an account that should never have been approved.
What smaller operators tend to underestimate: each fraudulent account approved during onboarding distorts LTV data and contaminates the risk model. In volume, it becomes a pattern. A pattern attracts scrutiny. The Securities and Exchange Commission (SPA) can suspend the license. And the Council for the Control of Financial Activities (COAF) can initiate an independent procedure for systematic omission. Both can happen simultaneously, regarding the same facts.
The calculation changed.
The discussion about friction in onboarding ended when the regulation started requiring biometrics and the Digital ECA (Statute of Children and Adolescents) prohibited self-declaration. Those who haven't implemented it aren't behind in the strategic decision, they're behind in adapting. The consequences will come during an audit.
And then the deadline has already passed.
