OneKey Payments Review

Regional Breakdown

Within Brazil, coverage is national, since Pix is universal and OneKey's bank-transfer support spans the major institutions. The comparison set: Pay4Fun is Brazil-only with its own BCB license and a consumer wallet; PayRetailers runs direct acquiring across Brazil plus Mexico, Colombia, Argentina, Chile and Peru with roughly 7-8 local licenses; EBANX and dLocal cover LATAM at enterprise scale; D24 aggregates 300+ methods across a wider emerging-market set. OneKey's pitch is that it will become the multi-country option while keeping the Brazilian license depth; today, PayRetailers already is that, and OneKey is the deeper Brazil specialist. If the Mexican and Colombian rails come online with the same license-first posture, the calculus changes.

Verticals

Betting first, openly. OneKey pitches 'a complete solution, fully compliant' to casinos, sportsbook platforms and fantasy sport operators, and sports betting has been its core vertical since 2019. The stance is compliance-forward rather than grey: the company publicly recommended that operators use only regulated payment providers (BiS SiGMA 2024), its named clients are all licensed, and its KYC product exists to enforce SPA rules. It also serves eCommerce (expanded via the CianoPay acquisition), fintech, remittance and travel, with the FX and BaaS products pointing at the non-gaming side. For an operator this cuts both ways: you get a processor whose tooling assumes betting rather than tolerates it, and you should not expect it to be a route around Brazilian licensing requirements.

• iGaming
• Sports Betting
• eCommerce
• Fintech
• Remittance
• Travel

Deposits run at Pix speed, which is effectively instant: the rail settles in seconds, 24/7 including weekends, and OneKey's biometric and Open Finance ITP variants exist to cut the drop-off between QR display and completed payment rather than to change the timing. The company claims conversion above 90% on the deposit side, a self-reported figure. Payouts are the differentiator OneKey sells hardest: bank transfers in under 2 hours, seven days a week, and to betting operators it goes further still, promising cash-ins and cash-outs in seconds, with mass payouts in real-time and batch modes. Nothing independent backs the sub-2-hour figure, and OneKey publishes no settlement period for funds reaching the operator's own account and no refund-processing window, so both belong in the contract. The structural point stands regardless: because OneKey is itself the BCB-authorized e-money institution holding segregated bettor funds, the payout path does not depend on a partner bank's batch schedule, which is the architectural reason a sub-2-hour promise is plausible on this setup. Bettor-side Reclame Aqui complaints about blocked Pix withdrawals show the compliance engine does intervene in practice; that is the KYC stack doing its job, but operators should expect a support-ticket tail from held transactions.

Integration Assessment

One public REST API at apidocs.onekeypayments.com covers Deposits and Payouts, with per-country method pages, sandbox and test flags per method (Pix Biometric is marked not testable in sandbox), and a Java SDK offered as a direct download rather than through GitHub. The docs are public and structured, which already puts OneKey ahead of the many Brazilian gateways whose documentation sits behind a sales call, and a merchant portal at merchants.onekeypayments.com plus a PT-BR Zendesk help center round out the surface. What is absent: any GitHub organization (github.com/OneKeyHQ is the crypto-wallet namesake, not this company), npm packages, published onboarding or integration timelines, and platform connectors beyond the Atlaslive integration from September 2025, so SoftSwiss or EveryMatrix operators integrate the REST API directly or come in through Atlaslive if that is their platform. OneKey markets dedicated account management, though not an iGaming-specific team.

Compliance Context

The core asset is the license: a BCB payment-institution authorization (e-money issuer) held in OneKey's own name since March 2024, with R$12.3 million in share capital at authorization and fund segregation between transactional and proprietary accounts built into the account model. On top of that sits the SPA-compliance stack, and it is genuinely betting-shaped: QuickPay ML KYC validating CPFs against the categories Brazilian betting law excludes (minors, PEPs, athletes, social-program beneficiaries), Velocity Check real-time rules, Pix key validation, and automated registration of up to 3 cash-out accounts per bettor. What is missing is third-party attestation: the PCI-compliant checkout is self-stated with no published PCI DSS Level 1 certificate, there is no ISO 27001 or SOC 2 on record, no European or gambling-jurisdiction licenses, and the Mexican CNBV claim is unverified. Diligence should also cover the ownership chain (UK holding, Spanish beneficial owner, nominee director), which the BCB itself flags by listing OneKey among foreign-group-controlled institutions.

Regulatory Position

The regulatory story is the reason to look at OneKey. The Central Bank of Brazil authorized ONEKEY PAYMENTS INSTITUIÇÃO DE PAGAMENTO S.A. as a payment institution and electronic-money issuer, published in the Diário Oficial da União on March 11, 2024, and the entity appears in the BCB's own publications, including its list of institutions under control of foreign groups. Under Law 14.790, only BCB-authorized institutions may intermediate bettor payments, and OneKey satisfies that in its own name, unlike partner-bank models where the license sits with a sponsoring institution. One nuance stays open: whether OneKey participates in Pix directly or through a sponsor, though as an authorized e-money institution it is at minimum the legal settlement entity for bettor funds. Mexico is where the story thins. OneKey claimed a CNBV license in September 2025, two weeks after describing those same licenses as still being obtained, and no OneKey entity sits in the CNBV registry. The claim stands unverified. The rest of the compliance picture: ABRACAM membership on the FX side, IBJR and the IBIA Payment Provider Forum on the integrity side, Colombia Fintech in Bogotá, a self-stated PCI-compliant checkout with no published PCI DSS Level 1 attestation, and no gambling licenses (it holds financial authorization, not betting licenses, which is the correct shape for a PSP in this market). Ownership runs through Moovefin Holdings Ltd in London, with Emiliano Sebastián Fernández holding 75%+ since October 2024 and a corporate-services nominee as the sole UK director; none of that is disqualifying, but a compliance team doing counterparty diligence should know the beneficial-ownership chain leaves Brazil.

Named iGaming Clients

BandBet, Alfa (alfa.bet.br), Bet do Milhão (TQJ)

OneKey's named clients are all licensed .bet.br operators, and all three announced the relationship themselves across multiple outlets rather than through any independent audit, which is a trade-press grade of evidence. BandBet (October 2024) is the Grupo Bandeirantes brand operated with Bell Ventures Digital on OpenBet, with OneKey as official processor of Pix pay-ins and payouts. Alfa Entretenimento's alfa.bet.br (May 2025) holds one of the first fifteen definitive licenses and sponsors Grêmio and Internacional; OneKey manages its payment flows including biometric Pix. TQJ, Todos Querem Jogar (August 2025), is the Grupo Silvio Santos vehicle behind Bet do Milhão, with OneKey processing to SPA requirements. The Atlaslive deal (September 2025) is platform-side distribution rather than a client: it wires OneKey into an iGaming platform's cashier for its operator network, live in Brazil first, with no individual operators named. Beyond the names, two independent signals confirm OneKey is a processor-of-record for betting money: its help center fields the question 'Why does Onekey appear in my PIX transaction?', and bettors file Reclame Aqui complaints about Pix issues after gambling-site withdrawals. The company claims 170+ clients overall; that number is self-reported and nothing outside Brazil is named.