Since Friday, Banks Have 24 Hours to Block an Illegal Betting Account

Update, September 25, 2026. Provisional Measure No. 1,394 (in Portuguese) banned fixed-odds betting in Brazil. Article 21-A of Law 14,790, the basis for the blocking described below, remains in force and gained two provisions: a duty to report transactions linked to the unauthorised operator to COAF, Brazil's financial intelligence unit, and forfeiture of the money in blocked accounts through an administrative proceeding, with no prior court case. The measure also bars financial and payment institutions and payment schemes, including Pix, from processing betting transactions (art. 14). The details are in The provisional measure that banned the bets also wipes out state licences — and puts the banks in charge of refunds.

CMN Resolution No. 5,320 of 25 June 2026 took effect this past Friday, 28 August 2026. It requires financial institutions and payment institutions that participate in the Brazilian Payment System to block the accounts of anyone running fixed-odds betting without a licence — and it sets deadlines in hours, not days.

The resolution is the final link in a regulatory chain assembled over the course of 2026, one that shifts where illegal betting is fought. The target is no longer just the operator's site; it is the account the money flows into.

The clock

CMN Resolution No. 5,320 imposes four duties on two clocks, and all of them start running from receipt of the blocking notice issued by the Secretariat of Prizes and Betting — not from the date the rule took effect, nor from the day the case makes the news.

Note the middle column: the rule counts in hours, not business days. A notice received on a Friday afternoon runs straight through the weekend.

Note, too, who owes what. The art. 2 blocking duty falls on financial institutions and payment institutions, which are the ones that hold accounts. Arts. 3 and 4 add payment scheme owners — who have no account to freeze, but do have transactions to refuse.

The art. 2 block is not selective: it reaches demand deposit accounts, savings accounts, prepaid payment accounts and record accounts, all held by the parties named in the notice.

The sequence in the sole paragraph matters. It is from the block onward that the institution begins rejecting movements involving funds in those accounts and informs the account holder, setting out the grounds and attaching a copy of the finding report and the notice. Notification is not a prior step: the design leaves no window between the order and the freeze.

Unblocking has two doors, both in art. 5: a final administrative decision in the holder's favour, or conversion of the funds into a court deposit.

Where the order comes from — and why it still travels through SEI

The trigger does not sit with the bank. Under Decree No. 13,033 of 19 June 2026, the Secretariat of Prizes and Betting issues a finding report of irregularity and, on that basis, sends the blocking notice to the identified institutions, with the specific list of account holders and the compliance deadline (art. 5).

Art. 5 requires that notice to travel over a secure electronic system offering traceability, authenticity and confidentiality. That system does not yet exist: art. 6 allows ninety days from publication of the decree to get it running — a deadline that falls on 17 September 2026 — and assigns the Banco Central, alongside the SPA, the task of issuing the technical rules.

Until then, § 1 provides that notices be sent by electronic official letter with digital certification, through the Federal Government's Electronic Information System. In other words: a blocking order with a 24-hour deadline currently travels over the same document system the government uses to move ordinary administrative files.

The Banco Central is watching from minute one

Art. 5, III of the decree requires the SPA to notify the Banco Central simultaneously whenever a blocking notice is sent, "for the purpose of supervising compliance with the measure by the obligated institutions." And art. 6, § 1 repeats the requirement under the transitional regime: the letter that goes out through SEI goes out with simultaneous notice to the BC.

The supervisor therefore knows the exact moment the clock started running — in every case and at every institution. The 24-hour deadline is not self-reported.

Art. 21 spells out what happens when it is missed: non-compliance exposes the officers and the institutions themselves to the penalties under Law 14.790, "without prejudice to the penalties set out in Banco Central do Brasil regulations and in Law No. 9,613 of 3 March 1998."

Worth noting as well, under art. 22, that the administrative block created by this decree is independent of any judicial block and does not replace it.

The law that redrew the design

None of this is a free-floating regulation. Law No. 15,358 of 24 March 2026 amended Law 14.790/2023 and created four provisions that reposition the payment institution.

Art. 21-A is the source of the blocking duty: once the competent authority establishes that betting is being offered without a licence, institutions must block the unlicensed operators' accounts and prevent further transactions that enable the activity, directly or indirectly. § 1 preserves due administrative process, with adversarial proceedings and full defence, and guarantees that the block does not impair reimbursement owed to bettors. § 3 earmarks for the National Public Security Fund any amounts declared forfeited.

Art. 24-A is the one that matters most to anyone building controls. It requires financial and payment institutions to connect to the interoperable systems for sharing information on indications of electronic fraud, for three purposes: reporting indications that a party is acting as an unlicensed operator, consulting what has been shared in order to prevent and detect, and applying measures proportionate to the risk — blocking, refusal or enhanced review. § 2 provides that the SPA receive those indications and may maintain a public reference database of unlicensed operators, for cross-checking against institutions' anti-fraud systems.

Art. 24-B directs the Banco Central to regulate, within the Pix scheme, specific mechanisms against misuse of the infrastructure. § 1 lists what may come: a dedicated betting transaction type tied to a register of licensed operators, automated CNAE and Pix key filters with blocking, integration with risk and self-exclusion directories, and visual flagging on statements. § 2 already requires Pix participants to detect suspicious usage patterns.

Art. 24-C closes the set with an enhanced due diligence duty to prevent payments to unlicensed operators.

This is not order-taking — it is finding it first

Two obligations that a hurried reading tends to merge are worth separating.

Blocking an account named in a notice is execution: the list arrives, the clock runs, you comply. Art. 3, I of the CMN resolution, by contrast, requires the institution to reject transactions when it detects funds destined, directly or indirectly, for betting — and art. 24-A of the law requires reporting indications and consulting those reported by others.

"Directly or indirectly" is the phrase that changes the problem. It cannot be resolved by checking an isolated transaction against a list of CNPJs: it reaches the interposed account, the intermediary, the two-hop path. This is a topology problem, of the same kind as the layered tracing under the Special Refund Mechanism — and, as there, whoever looks only at the endpoint sees nothing.

The ground was already prepared

The 2026 architecture only works because the money circuit for licensed betting was closed two years earlier.

SPA/MF Normative Ordinance No. 615 of 16 April 2024 provides in art. 3 that deposits, withdrawals and prize payments run exclusively by electronic transfer between the bettor's registered account — held in the bettor's own name — and the operator's transactional account, both at an institution authorised by the Banco Central. § 1 permits Pix, TED, debit or prepaid cards and on-us transfers. § 2 prohibits cash, boleto, cheques, virtual assets and other crypto-assets, accounts not previously registered, third-party payments and credit cards.

Then came SPA/MF Ordinance No. 566 of 20 March 2025, which already barred financial and payment institutions from maintaining a transactional account for an unlicensed operator and already required controls to identify indications, including of intermediaries, with reporting to the SPA within 24 hours. Art. 11 of that ordinance carries a warning that still holds: these obligations are not to be confused with anti-money laundering duties. They are a track of their own, with their own trigger and their own recipient.

The dates still to come

Three deadlines are open, and two of them fall on the same day as other commitments already covered here.

17 September 2026 — the art. 6 deadline under Decree 13.033 for the secure electronic notification system to go live.

30 October 2026 — BCB Resolution No. 569 of 19 May 2026, which added indications of acting as an unlicensed betting operator to the fraud data shared across the financial system, sets this date in art. 13-A, I as the implementation deadline for virtual asset service provision. It is the same day as the cut-off for virtual asset service provider authorisation and the September DeCripto reporting period.

1 December 2026 — art. 13-A, II of the same resolution sets the implementation deadline for the provision of financial and payment services to unlicensed betting operators.

What changes for compliance teams

The blocking regime is already in force, and the deadline is measured in hours. But that is not the part that requires building: detection is. Complying with a notice is process; finding the payment that funds an unlicensed operation through an indirect path is a risk model, and the deadline to have it ready is 1 December.

Between the two lies a difference in kind that Ordinance 566 had already flagged and that the 2026 law did not repeal: this is not the AML/CFT programme. Anyone treating the obligation as a subset of anti-money laundering monitoring will find the wrong trigger, on the wrong deadline, for the wrong recipient.

Which does not mean the two worlds never meet when the bill comes due. Art. 21 of Decree 13.033 requires non-compliance to be penalised without prejudice to the sanctions under Law No. 9,613 of 1998. The duty is a separate track; the penalty can arrive by more than one route.

Sources

Law No. 15,358 of 24 March 2026 — inserts arts. 21-A, 24-A, 24-B and 24-C into Law No. 14,790 of 29 December 2023.

Decree No. 13,033 of 19 June 2026 — finding report, blocking notice, the art. 6 electronic system and the art. 21 penalties.

CMN Resolution No. 5,320 of 25 June 2026 — published in the Federal Official Gazette on 29/06/2026, in force since 28 August 2026.

BCB Resolution No. 569 of 19 May 2026 — published in the Federal Official Gazette on 21/05/2026; amends BCB Resolution No. 343 of 4 October 2023.

SPA/MF Normative Ordinance No. 615 of 16 April 2024 and SPA/MF Ordinance No. 566 of 20 March 2025.

---

Correction — 1 September 2026. An earlier version of this article said that 30 October is the due date for the October DeCripto reporting period. It is the September period: Normative Instruction RFB No. 2,291/2025 requires filing by the last business day of the month following the reporting period. The date itself, and its overlap with the virtual asset service provider cut-off, are unchanged.