The application, region-wide
Every Latin American licence application has the same skeleton, and an entrant that has done one is most of the way to understanding the next. The differences are in the local entity requirements, the technical rules, the fees and the timeline.
A local entity. Most regulated markets require a local presence, though the form varies. Brazil admits only companies constituted under Brazilian law with their head office and administration in the country, with a Brazilian partner holding at least 20% of the capital, and branches of foreign companies are not eligible. Peru accepts companies incorporated in Peru, Peruvian branches of foreign companies and non-domiciled companies, which must have a representative with powers registered in Peru. In Mexico, online operators work as, or in agreement with, one of the land-based permit holders authorised by the Interior Ministry (SEGOB). Some markets also require a designated local legal representative. Setting up the entity, opening bank accounts and registering for tax is a workstream that starts months before the application.
Suitability. Directors, shareholders above a threshold and key managers complete declarations and are checked. Applications look at the whole group: Brazil's asks for a list of every betting licence the applicant or its controllers hold elsewhere, including abroad, and a declaration of any authorisation revoked in another jurisdiction in the last five years, so a problem in one jurisdiction surfaces in the next.
Financial capacity. Evidence of capital, sometimes a minimum paid-in capital, and a guarantee or reserve to protect player funds. Brazil requires a financial reserve of at least R$5 million and paid-in capital of at least R$30 million; Colombia's concession application requires cover for the payment of prizes and the return of player funds.
Technical certification. Platforms, random number generators and games certified by an approved laboratory against the regulator's standards (in Brazil a certifying entity recognised by the Secretariat of Prizes and Betting, in Colombia a laboratory authorised by Coljuegos), and integrated with the regulator's monitoring or reporting system, which in several markets receives transaction-level data. Certification takes months and depends on the laboratory's queue; suppliers already certified in the market shorten it.
Hosting and data. Requirements ranging from mirrored data in-country to full local hosting, plus regulator access rights. Brazil, for example, requires data centres in Brazil, or abroad in a country with a legal cooperation agreement provided the database is continuously replicated in Brazil and the regulator has unrestricted remote and on-site access.
Policies. AML, responsible gambling, KYC, complaints, data protection, advertising. Latin American data protection laws apply in full: Brazil's LGPD, Law 13,709 of 2018, has its own enforcement authority, the ANPD, and the betting law requires operators' integrity mechanisms to observe it.
Fees. Application fees, licence fees (Brazil charges R$30 million for a five-year authorisation covering up to three brands), and concession economics: in Colombia online operators pay at least 15% of gross revenue less prizes for games returning 83% or more to players, plus 811 monthly minimum wages a year, and in Argentina, where each province and the City of Buenos Aires licenses online gambling separately, usually through competitive tenders, the terms differ by province.
Timelines run from a few months in a market with an established process to well over a year where the regulator is new or the queue is long. Brazil's regulator alone has up to 150 days from filing to respond to an application. Plan for the long end.
Anti-money laundering in the region
Latin American AML regimes are shaped by the Financial Action Task Force's regional body, GAFILAT, which groups 18 countries, and by domestic financial intelligence units, and gambling operators are obliged entities across the regulated markets: Brazilian operators report to the COAF financial intelligence unit, Mexico classes gambling as a vulnerable activity under its AML law, and Colombia's application requires an AML (SIPLAFT) manual and a compliance officer. The obligations match the global standard: customer identification, risk assessment, transaction monitoring, suspicious activity reporting, record keeping and training. Three regional specifics:
Identity infrastructure. National identity numbers (CPF in Brazil, DNI in Peru, and their equivalents in Colombia, Argentina and Mexico) are the backbone of verification, and regulators expect operators to verify against them. Brazil's requirement that players register facial recognition with a liveness check before they can bet, written into the betting law itself, set a regional benchmark.
Cash and informal economies. Cash remains significant in several markets, and cash deposit channels (vouchers, retail agents) require specific controls. Brazil bars operators from accepting cash, payment slips (boletos), cheques, crypto-assets and credit cards: deposits must come by electronic transfer from an account registered to the player. Where other markets allow cash channels, they need their own controls.
Politically exposed persons. Political exposure is defined broadly: Brazil's rules require operators to check whether a player is a PEP, a relative to the second degree, a representative or a close associate of one, and flag accounts opened in a PEP's name. PEP screening is heavier than a European operator may be used to.
Responsible gambling
The region moved quickly from minimal to substantial requirements. The typical set now: deposit, loss and time limits that operators must make available, alongside cooling-off periods and self-exclusion, self-exclusion schemes (Brazil created a centralised national self-exclusion system in November 2025 and Peru keeps a register of self-excluded people, while in Colombia players self-exclude through each licensed platform), age verification before play, prohibition on marketing to minors and to self-excluded customers, mandatory responsible gambling messaging in advertising, and, increasingly, obligations to monitor for signs of harm and intervene. Brazil's first year produced a national debate about gambling harm, particularly among lower-income households, which drove tighter rules, among them a ban on betting with Bolsa Família and BPC welfare benefits in 2025, and will drive more. An operator entering the region should build its responsible gambling programme to the strictest standard it operates elsewhere and expect it to be tested.
Advertising and sponsorship
Football sponsorship built the grey market and is now regulated in the licensed markets. Brazil permits it under content rules that allow a complementary self-regulatory code and require operators to join a responsible advertising monitoring body, with constant political pressure toward restriction; Colombia permits it for licensed operators under Coljuegos oversight; Argentina's provinces vary; Mexico's regulations require advertising to carry the permit number, a warning that betting is prohibited for minors and a responsible gambling message, and not to mislead. Influencer marketing, which was central to grey-market acquisition, is now specifically regulated in Brazil (disclosure of testimonial advertising, no targeting of minors, no misleading claims, and operator liability for affiliates) and scrutinised elsewhere. The compliance review process an operator runs in Europe applies here per market.
Tax compliance
The tax layer is where regional entry most often goes wrong. Beyond the gaming tax on revenue or bets, entrants face corporate income tax, value-added, consumption or services taxes that in some markets apply to gambling (Colombia has taxed online gambling by emergency decree, most recently a 16% national consumption tax on online gambling for 2026, set by Decree 0240 of March 2026, after the Constitutional Court struck down the December 2025 emergency decree that had applied VAT to gambling and ordered the tax refunded; Brazil's municipal service tax list includes the sale of betting coupons), withholding on player winnings that the operator deducts at payout in some markets (Colombia taxes prizes at 20% with withholding at source, and Mexican operators withhold federal tax, and in some states state tax, on prizes; Brazil instead taxes players' net annual winnings at 15%), and taxes on cross-border payments to group companies for platform, content and marketing services. Transfer pricing between the local entity and the group is scrutinised. The effective tax rate on a Brazilian operation, properly modelled, is far higher than the headline gaming levy, which Complementary Law 224 of 2025 raised from 12% to 13% of gross gaming revenue from April 2026 and which is legislated to reach 14% in 2027 and 15% from 2028, and the same is true elsewhere. Local tax advice before the business case is signed off, not after.
Ongoing supervision
Once licensed, the regulator's relationship with the operator is continuous: periodic returns (in Brazil the gaming levy is calculated and paid monthly), real-time or daily data feeds to the regulator's monitoring system, audits and inspections, change approvals for new games, platform changes and key people, and enforcement through fines, suspension and revocation. Colombia and Brazil both publish enforcement actions: Brazil's regulator, for example, published the suspension of four provisional authorisations in April 2025 for failure to present the required certifications. Regulators in the region are newer and in some cases less predictable than their European counterparts, which argues for over-communication: a regulator that hears about a problem from the operator first behaves very differently from one that reads about it.
Unlicensed competition
Every regulated Latin American market coexists with an offshore market serving the same customers. How much of the demand the licensed market captures depends on tax (which sets the value licensed operators can offer), product restrictions, payment blocking, domain blocking and advertising enforcement. Colombia pairs a moderate levy with active blocking: in February 2025 Coljuegos reported blocking 10,000 illegal gambling websites and social media profiles, the most in its history. Brazil in 2026 required banks and payment institutions to block the accounts of unlicensed operators. Markets with higher effective tax and weaker enforcement channel less. An entrant should model the licensed market's likely share, not the total market, and should watch enforcement as a leading indicator of whether that share will grow.
The next lesson is about the customer-facing side: payments, localisation and product.