The COAF Institutional Challenges and AML Obligations for Online Gaming Operators

Brazil's financial intelligence unit is the Conselho de Controle de Atividades Financeiras (COAF). It has operated as a Financial Intelligence Unit since Law No. 9,613 of 1998, the statute governing anti-money laundering, and its function is to receive, analyse and forward reports of suspicious transactions to the competent authorities. As the regulated gaming market has expanded, commentary on COAF's institutional capacity has become a recurring theme in the sector, with implications operators should understand.

Institutional pressures discussed in public debate

The points in this section are commentary drawn from public debate and press reporting. They are not verified institutional facts, Octus has not audited COAF's internal capacity, and readers should not rely on them as findings.

1. Staffing levels (unverified): Public commentary has repeatedly suggested that the analyst headcount is small relative to the volume of suspicious transaction reports received. Octus has not verified staffing figures and does not reproduce a specific number here. Any figure quoted elsewhere should be traced to an official source such as COAF's own reporting on gov.br before being relied upon.

2. Technology (unverified): Public reporting has described triage systems said to lack modern automation. Commentary on public-sector tooling, including whether automated or machine-learning triage would improve throughput, is opinion. It is neither an Octus finding nor an Octus product claim.

3. Volume growth (unverified): Reporting has described a marked increase in suspicious transaction communications following regulation of the betting market. The direction of travel is widely accepted; the magnitude is not something Octus has independently confirmed.

Institutional facts, by contrast, are the ones that follow from the statutes and instruments themselves: COAF's mandate under Law No. 9,613/1998, the reporting duties that attach to obliged entities, and the supervisory and sanctioning powers of the Secretariat of Prizes and Betting (SPA/MF) over authorised betting operators. Those are the parts of this article an operator can plan against.

Consequences of non-compliance

Operators that fail to implement adequate preventive measures are exposed to administrative sanction. Subject to applicable law and to the specific instrument invoked, the available measures range from warnings and pecuniary penalties through to restriction or withdrawal of authorisation. The applicable ceiling, the calculation basis and the availability of the more severe measures depend on which statute and which regulatory instrument the authority relies on, on the conduct in question and on aggravating or mitigating circumstances. Operators should not plan against a single headline maximum figure. The exposure should be assessed against the specific provision that would apply to the conduct concerned.

Operator responsibilities

An earlier version of this article cited an SPA/MF ordinance in a malformed form ("Portaria SPA/MF 11.43/2024"). That citation was not a valid instrument reference and has been withdrawn rather than replaced with a corrected number, because Octus has not verified which instrument was intended. Operators must confirm the specific SPA/MF instrument currently in force that governs AML obligations for fixed-odds betting, together with the applicable COAF regulations, on the official gov.br channels for the Secretariat of Prizes and Betting and for COAF before relying on any citation.

The substance of the obligations is nonetheless well established across the AML framework applicable to obliged entities. Gaming operators are required to adopt policies, procedures and internal controls covering user identification, monitoring of gaming operations and user transactions, and staff training sufficient to identify risk indicators and report suspicious transactions to COAF.

Three key areas of operator obligation stand out:

1. Rigorous user identification: At registration, operators must assess whether the individual's declared income is consistent with the volume of bets, and whether the person holds political connections. This requires documentation including tax returns and bank statements, plus consultation of public databases: in particular the Federal Comptroller General (CGU) database: for politically exposed persons (PEPs).

2. Robust record-keeping: Maintaining comprehensive internal records of users, including documentation, financial transaction history and internal audit procedures to verify the regularity of financial flows.

3. Timely COAF notification: Swift communication to COAF when indicators of suspicious activity are identified, plus annual reporting to the Secretariat of Prizes and Betting on the preventive practices adopted.

Conclusion

A frequent view in public debate, which Octus shares as commentary rather than as a finding, is that the system would benefit from institutional strengthening: adequate analyst capacity, modern triage tooling, structured public and private collaboration, and clearer regulatory standards. Whatever happens on that front, operators cannot make their own compliance contingent on it. The strength of an operator's own controls is what determines its regulatory posture, and the obligations described above apply irrespective of how much scrutiny the operator expects to receive. Our team is available to support operators with compliance training, technical reviews and implementation of documented controls.