CPF and CNPJ API for Betting & iGaming: KYC and Anti-Money Laundering
At CPF.CNPJ, we simplify and streamline access to essential information about individuals and companies.
The Challenge: KYC and Money Laundering Prevention in Betting & iGaming
The Brazilian sports betting and online gaming market was regulated by Law 14.790/2023, which establishes strict KYC (Know Your Customer) requirements, age verification 18+, and anti-money laundering prevention (AML). The Secretariat of Prizes and Betting (SPA) of the Ministry of Finance requires platforms to validate 100% of bettors against CPF from Receita Federal before allowing any bet or withdrawal. Non-compliance results in fines from R$ 50,000 to R$ 50 million, license suspension, and even a permanent ban from operating in Brazil.
Fraud and money laundering are critical risks in the betting sector: international studies show that 5-8% of the financial volume in unregulated betting houses involves money laundering. Bettors use third-party CPF (financial mules) to hide the illicit origin of funds, bet on both sides of events to "clean" money, and withdraw to different accounts. For licensed operators in Brazil, implementing rigorous KYC is not just legal compliance, but protection against criminal liability under Law 9.613/98 (money laundering).
The betting audience demands an instant experience: a bettor wants to create an account, deposit via PIX and bet in less than 2 minutes, especially during live events (football, UFC, etc). Any friction generates massive abandonment. But regulation requires simultaneous rigorous validation: CPF verification, age verification 18+, screening against PEP and sanctions lists. Reconciling speed with compliance is a technical and operational challenge that defines the success or failure of betting operators.
How the CPF.CNPJ API Solves It
1. Instant KYC with 18+ Age Verification
The API allows you to fully automate regulatory KYC for betting. During registration, the bettor fills in CPF, name and date of birth. The system captures the data and calls the API in real time (0.4-2 seconds) to validate CPF against Receita Federal. The automated decision engine checks: (1) the CPF exists and is Regular; (2) the declared name matches the official name (similarity >80%); (3) the date of birth matches and the bettor is 18+ years old (legal requirement).
If any criterion fails, registration is blocked instantly. People under 18 receive a clear message: "You must be 18+ to bet". An irregular CPF (Cancelled, Suspended) blocks registration: "Irregular CPF. Regularize before creating an account". This automatic barrier complies with Law 14.790/2023 art. 29 (prohibition of minors) and protects the operator from regulatory fines. For cases with a slight name discrepancy (nicknames), the system allows manual review with document submission before releasing bets.
2. Money Laundering Prevention with AML Screening
Law 14.790/2023 art. 31 requires operators to implement "controls for preventing money laundering and terrorism financing". The API allows you to integrate AML screening into the KYC flow: after validating CPF, the system automatically cross-checks data with restrictive lists (COAF, PEP, OFAC/UN international sanctions). If a bettor is identified as a PEP (politician, family member, public office holder), the system applies enhanced due diligence.
For PEPs, the operator implements reinforced rules: (1) reduced monthly deposit limit (e.g. R$ 5,000 vs R$ 50,000 standard); (2) withdrawal requires manual compliance approval with a 48h SLA; (3) transactions are monitored with special attention to suspicious patterns (betting on both sides, volume incompatible with declared income). A system integrated with the transaction monitoring platform automatically detects laundering patterns and generates alerts for COAF when necessary.
3. Responsible Gaming and Continuous Monitoring
Brazilian regulation requires "responsible gaming" practices: detection of compulsive behavior and protection of vulnerable bettors. The API allows you to implement an additional layer of protection: periodic (monthly) validation of active bettors' CPFs detects changes in registration status that may indicate vulnerability (e.g. a CPF changed to Suspended may indicate financial problems).
The system cross-checks CPF changes with betting patterns: if a bettor has an irregular CPF + a history of growing losing bets + multiple failed deposits, the system triggers a responsible gaming alert. The operator gets in touch offering voluntary limits, an account pause, or referral to support. This proactive approach meets regulation, protects bettors, and builds the reputation of a responsible operator in the Brazilian market.
Real Cases: PixBet and SorteOnline
PixBet, one of the largest sports betting platforms in Brazil with millions of active users, faced a critical compliance challenge after the Law 14.790 regulation: the legacy system did not validate CPF against Receita Federal, allowing registrations with nonexistent documents or those of minors. A pre-licensing audit identified more than 45,000 irregular accounts, including 3,200 minors. The regulatory risk was extreme: without remediation, the license would be denied and operations suspended.
An emergency implementation of CPF validation via API in less than 90 days: (1) real-time validation for all new registrations, blocking irregular CPF or under-18 users; (2) massive re-validation of a base of 2.8 million active CPFs, identifying and suspending all irregular accounts; (3) mandatory re-KYC of suspended accounts with document submission. The system processed validation of millions of CPFs in 60 days. The KYC approval rate rose from 67% to 94%. The license was approved by the SPA. Savings: it avoided a loss of R$ 2 billion in annual revenue had the license been denied.
SorteOnline, a lottery and sports betting platform, implemented CPF validation preventively before the regulation came into force. The goal was to build a competitive compliance advantage. The system validated 100% of registrations since launch: the CPF must be Regular, the bettor must be 18+, and the name must match. In 18 months of operation, the system automatically blocked 12,800 fraudulent registration attempts (irregular CPF, minors, financial mules).
When the SPA started enforcement after Law 14.790, SorteOnline was one of the first to obtain AML compliance certification. The audit identified zero KYC irregularities. The license was approved on a fast-track. The operator began using the certification in marketing: "First AML-certified betting house". Registration conversion increased 23% due to its security reputation. ROI: an investment of R$ 420k in automated KYC generated a competitive edge valued at millions in brand value.
Expected Metrics and ROI
- 100% Law 14.790 complianceAutomated KYC meets all SPA regulatory requirements
- Zero minors18+ age validation prevents art. 29 violations and fines
- 94% instant KYC approvalOnly 6% of cases require manual review with documents
- 12,800 frauds blockedAutomatic detection of irregular CPF, mules, minors
- 5-8% of volume protectedAML screening prevents money laundering
- SPA license approvedRobust compliance ensures regulatory approval
- R$ 2B in revenue protectedAvoids operational suspension for non-compliance
- 23% conversion increaseA security reputation attracts responsible bettors
