Poland Wired a Payment Scheme to a Blocklist. Brazil Deputised the Banks

BLIK now checks every transaction against the Finance Ministry's register of illegal gambling domains and declines the matches. Brazil is doing the same job by loading obligations onto banks and fintechs instead. Both are admissions that domain blocking stopped working.

• Poland's BLIK began blocking payments to illegal gambling sites on 1 September, covering both domestic and foreign transactions
• Polski Standard Płatności, the operator behind BLIK, has connected to the Ministry of Finance's register of illegal gambling domains by API, so each transaction's domain is checked automatically and declined if it appears
• The register holds more than 55,000 domains and grows by roughly 700 entries a month; BLIK processed 2.9 billion transactions worth 441.5 billion zloty, about €102 billion, in 2025
• Brazil is pursuing the same objective through obligations rather than automation: a March 2025 ordinance barred financial institutions from holding accounts for unauthorised operators and requires suspicious movements to be reported to the SPA within 24 hours
• In June 2026 Brazil required institutions to block unauthorised operators' funds, and in July notified 37 fintechs over links to 60 illegal operators; proposed legislation adding automated identification and Pix key integration remains in committee

Two Countries, One Conclusion About Site Blocking

Poland switched on a new enforcement mechanism on 1 September. BLIK, the mobile payment standard used across Polish banking, now blocks transactions linked to illegal gambling websites at home and abroad.

The mechanism is the interesting part. Polski Standard Płatności has connected BLIK's systems to the Ministry of Finance's register of illegal gambling domains through an API. Each transaction's associated domain is checked against the register automatically, and if it is listed the payment is declined. The block covers transactions handled by domestic and foreign settlement agents.

Scale gives it force in both directions. The ministry's register holds more than 55,000 domains and is growing by around 700 a month. BLIK is not a minor rail: it processed 2.9 billion transactions worth 441.5 billion zloty, approximately €102 billion, during 2025.

Brazil has reached the same conclusion by a different route. Rather than automating the check at the payment scheme, it has placed duties on the institutions. A Ministry of Finance ordinance in March 2025 prohibited financial institutions from maintaining accounts for unauthorised betting companies and required suspicious movements to be reported to the Secretaria de Prêmios e Apostas within 24 hours. In June 2026 the government required institutions to block resources belonging to unauthorised platforms. In July it notified 37 fintechs suspected of moving funds linked to 60 illegal operators. More than 40,000 sites had been blocked by June.

Legislation before the Chamber would go further, adding automated transaction identification, filters based on business activity codes, integration with Pix keys and links to a risk directory. It remains in committee and is not in force.

Payment Blocking Is What You Do After Domain Blocking Fails

A register that has to add 700 domains a month is not a register that is winning. Every entry is an operator that registered a new domain faster than the state could list the old one, and Poland has 55,000 of them. Brazil had blocked more than 40,000 sites by June and still describes tens of millions of users on unauthorised platforms. Site blocking scales linearly against an adversary whose cost of registering a replacement is a few dollars, which is why both governments have moved a step down the stack to the payment. There is only one place a bettor's money can go, and unlike a domain it cannot be re-registered overnight. This is the single most consequential shift in gambling enforcement this year and it has happened almost without commentary.

Automating at the Rail and Deputising the Banks Are Not Equivalent

The two designs will not perform alike, and the difference is worth understanding before other jurisdictions copy one. Poland's approach is deterministic: the check runs inside the payment flow, applies uniformly, and requires no judgement from any institution. Its weakness is that it is only as good as the register, and a domain absent from the list clears normally. Brazil's approach is discretionary: institutions must identify, block and report, which catches conduct a list would miss but imposes assessment costs on hundreds of banks and fintechs and produces inconsistent enforcement between them. Poland's model creates false negatives, Brazil's creates uneven application. The proposed Brazilian legislation, with automated identification and Pix integration, is essentially a move toward the Polish design, which suggests where this settles.

The Compliance Burden Lands on Payments Firms, Not Operators

Both regimes make a payment provider responsible for whether a gambling transaction is lawful, which is a significant reallocation of duty. A licensed operator already knows it is licensed; the party now doing the checking is a bank or a scheme with no gambling expertise and no relationship with the regulator that issued the licence. That has two consequences the industry should watch. Licensed operators will experience false declines when a legitimate transaction trips a filter, and there is no obvious appeal route to a payment scheme. And payments firms, facing liability without margin, will price the risk, which historically means de-risking whole merchant categories rather than assessing them case by case. Poland's API approach limits that by making the test objective. Regimes that leave it to institutional judgement should expect the licensed market to absorb some of the friction intended for the unlicensed one.

Two governments have concluded in the same week that the way to stop illegal gambling is to stop the money. The design choices they made will determine whether the licensed market pays for it too.