BCB Register Audit: Which Brazil-Facing iGaming PSPs Hold Real Authorization

Brazil is the market where a payment provider's authorization stopped being a compliance footnote and became balance-sheet exposure. Since June, banks and payment institutions that keep serving an unlicensed betting operator after formal notice carry joint liability for its taxes; from December 1 they must report unlicensed-betting indicators into the central bank's fraud-marker system; blocking orders now come with a 24-hour clock. Every one of those duties lands on the entities that move the money, which makes one question suddenly practical for any operator building a Brazilian cashier: is the PSP on my contract actually an authorized instituição de pagamento, or a brand in front of somebody else's license?

So we checked, register-first, the way we did for EU crypto authorizations under MiCA and UK authorizations on the FCA register. All 13 Brazil-facing providers in our catalog went through the Banco Central's own files: the open-data register of institutions in operation, the official Pix participant list, and the DOU authorization record where dates and modalities live. Eleven brands came out holding real authorization, one runs honestly declared on a partner bank, one was a fully expected not-found, and the audit corrected our own catalog twice, once in each direction.

Three different things get called "a BCB license"

An IP authorization is the real thing: the central bank authorizes an instituição de pagamento in specific modalities. Emissora de moeda eletrônica (e-money issuer) is the base class for holding player balances; credenciadora is acquiring; iniciadora de transação de pagamento (ITP) is the open-finance initiation permission; the post-paid instrument class rounds out the set. A provider's real capabilities in Brazil are the modalities on its despacho, not the word "licensed" on its site.

Pix participation is not authorization, and this distinction does more work than any other in the audit. Under the transitional window of Resolução BCB 80/2021, institutions could join Pix while their IP authorization application was still pending, and several of the names below ran Pix rails for a year or more before their authorization landed. Participation also comes in two settlement shapes worth reading: an own settlement account in the SPI, or indirect settlement through a liquidante. Both are legitimate; they are different dependency structures.

A bank charter is the third shape. Banco Topázio, the rail behind Bazk, and BancoSeguro, the PagBank group's bank, are banks, a heavier regime than any IP. A provider fronting a partner bank can be a perfectly honest architecture, as long as the card says so.

The register: entity by entity

Brands are marketing; the register speaks CNPJ. The middle columns are the audit.

The check we expected to fail, and didn't

We went into this audit expecting AstroPay's Brazil claim to be the Paramount Commerce of the set, a marketing line outliving its paperwork, because that is what the FCA audit found when we pulled the same thread in the UK. The register said otherwise: Astro Instituição de Pagamento Ltda holds a real authorization as e-money issuer and payment initiator, granted November 29, 2024, published in the DOU a week later. The claim was simply true, and publishing the checks that pass is what makes the checks that fail worth believing.

The interesting part is the timeline underneath. Astro joined Pix in June 2023, eighteen months before its authorization landed, riding the Resolução 80/2021 transitional window that let applicants operate while under review. EBANX and Transfeera walked the same path in their day. That window is why "we are a Pix participant" and "we are an authorized institution" were, for years, two different claims that sounded identical at the cashier, and why the join-date column in the participant file is worth reading next to the authorization date in the DOU.

Where our own catalog was wrong, in both directions

OKTO's card understated reality. Our records said Brazil access ran "via partner U4C," which was true when written and stale by the time we checked: U4C Instituição de Pagamento was legally renamed OKTO Instituição de Pagamento S.A., and the central bank approved the control change to OKTO's founder in a decision published January 7, 2025. That is not a partner arrangement anymore; it is a captive authorized IP with e-money and initiation modalities and a direct Pix account, one of the stronger Brazilian setups in the catalog. Card upgraded. One trap for anyone repeating the check: OKTO also has a second, unlicensed Brazilian entity, OKTO Pagamentos S.A., and the register only tells them apart by CNPJ.

Pay4Fun's card carried the right claim with a soft date: the authorization decision is June 7, 2022, which per this audit makes it the first authorized payment institution of the betting segment, two years before Brazil's licensed market even opened. Zimpler undersold itself too, holding initiation alongside e-money issuance. And PayRetailers' row produced the audit's best structural detail: the group's own Brazilian entity, P R do Brasil, authorized as issuer and acquirer, is not a Pix participant at all. The group's Pix rail is Transfeera, the captive it bought in 2024. Nothing improper, but an operator mapping counterparty exposure should know which CNPJ actually touches the instant-payment system, because that is the entity the December fraud-marker duties and the 24-hour blocking orders land on.

Why this audit matters more after June

Brazil spent the first half of 2026 attaching real consequences to the payment chain, and every one of them references the institution, not the brand. The June decree gives the betting regulator a 24-hour fund-blocking order served on financial and payment institutions; the companion tax rule makes institutions jointly liable for an unlicensed operator's taxes if they keep serving it after notice; and from December 1, the fraud-marker reporting duty makes every participating institution a sensor for unlicensed-betting flows, payment intermediaries included. An operator whose Brazilian rail is an authorized IP with its own SPI account is dealing with a counterparty that answers to those rules directly. An operator whose rail is a brand in front of an undisclosed local arrangement is one subpoena away from learning who its counterparty actually is. The Brazilian credit-card ban playbook covers the deposit-side rules; this audit is the counterparty layer underneath them.

How to run this check yourself

Reading the BCB takes three files and one discipline. The open-data register (olinda) answers whether an entity is an authorized IP in operation; search it by CNPJ, never by brand, because the register knows P R do Brasil, Astro IP, Zero IP and Pay IP, and has never heard of PayRetailers, AstroPay, Z.ro or VPag. The official Pix participant list answers who is on the rail and how, with its own join dates, settlement shape, and an initiation flag that does not mean the ITP modality (account-holding participants initiate without it). And the modalities, the part that defines what your counterparty may actually do, live only in the authorization despachos mirrored from the Diário Oficial, which is where the dates in our table come from. Register, participant file, despacho: three documents, one afternoon, and the difference between knowing your Brazilian rail and taking its word for it.

This is the third register in the series, after the ESMA CASP register for EU crypto and the FCA register for the UK, and the pattern holds across all three: most claims check out, the ones that don't are load-bearing, and the register never quite matches the marketing. Entity by entity beats logo by logo, in any jurisdiction.