Vpag Review

Regional Breakdown

Within Brazil coverage is national, since Pix is universal across every bank. The useful comparisons: Pay4Fun is the same Brazil-only footprint with more rails and an eleven-year head start; AstroPay runs the wallet model across Spanish LATAM and beyond; PayRetailers and EBANX cover the region without a wallet layer. An operator running Brazil-then-Mexico keeps Vpag for the Brazilian slice at most and runs a second integration for everything else.

Verticals

As iGaming-native as a payments company can be. The wallet is named 'the bettor's digital account', the gateway describes itself as specialized in Pix processing for the iGaming industry, and the parent is an affiliate group whose other business is sending players to bookmakers. The affiliate heritage shows up in the feature list: Club V+ loyalty converting to odds boosts, missions, influencer onboarding widgets, a VIP-player relationship team offered to operators as a service. There is no pretense of eCommerce diversification. For an operator this cuts both ways: total alignment with gambling, and total concentration in a single vertical and a single country's regulatory weather.

• iGaming (sportsbooks, casinos)
• online entertainment

Everything rides Pix, so everything is fast. Wallet deposits to integrated operators land in under 5 seconds on Vpag's own numbers, direct gateway deposits confirm as soon as the rail clears, which on Pix is effectively real time around the clock including weekends, and player withdrawals go back out instantly to the user's own CPF-keyed bank account. The OneClick Pix flow is arguably faster than a cashier can be, since the player pushes money from their bank app straight into their betting balance with no checkout step at all. None of this is Vpag engineering; it is the structural speed of Pix, and Pay4Fun posts the same numbers on the same rail. The part Vpag does differently is merchant settlement: Flash settles cross-border in EUR, USD or GBP in batches to bank accounts worldwide, on request, with BRL settlement locally. Batch frequency, cut-off times and the FX spread on that leg are not published, and neither is a refund-processing window, so pin all three down in the contract.

Integration Assessment

A single REST API using OAuth2 client-credentials with short-lived bearer tokens, documented publicly at docs.gateway.vpag.com (Redocly, downloadable OpenAPI spec) with a separate wallet doc site. Endpoints cover deposit, withdrawal, transaction list and detail, and balance. Two integration modes: pure API where the merchant renders the Pix QR itself, or a hosted checkout popup rendered by Vpag. Webhooks arrive via a Merchant-Callback-URL header alongside redirect success and fail URLs, and withdrawals accept a Pix key or full bank data with an optional flag to skip customer approval. The gaps: no SDKs in any language, no GitHub organization, no npm packages, no SoftSwiss, EveryMatrix or Slotegrator connectors, no published onboarding timeline, and code samples dated 2022. A competent team integrates this quickly, but everything gets built by hand.

Compliance Context

The real security asset is the group-level BCB authorization: Pay Instituição de Pagamento S.A. has been an authorized e-money-issuer payment institution since August 2024, which brings segregated e-money rules, capital requirements and Bacen supervision, and satisfies the Law 14.790 requirement that only BCB-authorized institutions intermediate bettor payments. The caveats are structural rather than cosmetic: the authorization sits one entity away from the consumer-facing operating company, the wallet has demonstrably run on Fitbank's BaaS rails into 2025, and Flash samples settle via Santander and BS2, so owned license, partly partner-run plumbing. CPF name-matching is enforced both directions (deposits must come from the registered bettor, withdrawals go only to the user's own CPF-keyed account), which is both the SPA rule and the fraud control. No PCI DSS attestation is published, which matters little for a cardless stack, and the consumer apparatus (Ouvidoria, DPO, responsible-gaming page with Jogadores Anônimos and GamblingTherapy links) is in place.

Regulatory Position

The structure is a four-entity onion, and the license does not sit where the contract does. The BCB authorization, granted August 23, 2024 as a payment institution in the electronic-money-issuer modality, belongs to Pay Instituição de Pagamento S.A. (CNPJ 36.690.516/0001-52), a 2020-incorporated Porto Alegre company controlled by Victor Mautone Filho. The company operating the consumer account since late 2025, Vpag S.A. (CNPJ 62.298.284/0001-00, incorporated 19/08/2025), is registered for auxiliary financial services and is not itself an authorized payment institution. The Vpag trademark and technology sit with Monee Ltd, an Irish company in Dublin, a layer that rests on Vpag's word alone. Wallet accounts have run on Fitbank Banking-as-a-Service with a pre-authorized migration to the group's own institution, bank code 679, while Flash settles through Santander and Banco BS2. So Vpag's 'regulado pelo Banco Central' line holds at group level, but the operating chain is layered, parts of the plumbing have been partner-run, and whether Vpag participates in Pix (SPI) directly stays open. On the compliance-substance side the wallet is SPA-shaped in substance: the T&C restricts integrated 'Sites' to operators authorized for fixed-odds betting in Brazil, clause 5.5 implements the full prohibited-bettor list, and CPF name-matching applies on deposits and withdrawals. One nuance cuts the other way: the live Flash merchant contract describes payment facilitation between Brazilian users and international merchants, with FX executed and foreign currency remitted abroad under art. 49 of BCB Resolution 277/2022. That is the documented architecture of a cross-border Pix gateway, and it means the gateway side is offshore-capable on paper even though the company's public positioning is regulated-market-first.

Named iGaming Clients

Aposta Online, Blaze, Aposta Ganha, Segurobet, Pixbet, JonBet, B2XBET

The roster is more substantial than outside coverage shows, because Vpag does the naming itself. Aposta Online (apostaonline.bet.br) is confirmed through the live June 2026 Copa Rally campaign with a dedicated Pix Turbo key and cashback. Vpag goes further with players, marketing the wallet as 'válido para Blaze, Aposta Ganha, Jonbet, B2X, Segurobet e Pixbet', and running dedicated campaigns for Blaze and Pixbet plus live campaign subdomains for Aposta Ganha and Segurobet. Blaze, Aposta Ganha and Segurobet also appear in independent Portuguese-language press, which lifts them to confirmed; Pixbet, JonBet and B2XBET rest on Vpag's word alone, so they carry a provider-stated grade. Stake shows up only on an affiliate blog claiming integration, which is too weak to treat as more than unverified. What is absent still matters: no cashier or press evidence ties bet365, Betano, KTO or Superbet to Vpag, and no client count, volume or user figure is published anywhere. Pixbet and Blaze are heavyweight Brazilian brands, though, so the roster is stronger than a two-year-old challenger usually shows.