How Licensing Works in Practice

Setting the Scene

The three frameworks arrived through different routes. Colombia adopted dedicated internet-gambling regulations in 2016 under Coljuegos. Brazil's federally authorised market opened in January 2025 following legislation in 2018 and 2023 and implementing ordinances. Mexico applies its Federal Law of Games and Lotteries, dating from 1947, alongside its regulations and individual permits.

These are different legal structures, not interchangeable licences. Local accountability matters in each, but the corporate requirements, permitted activities, technical controls and fiscal charges must be examined separately.

Brazil: National Authorisation and Detailed Operating Rules

Brazil's federal framework combines Law 14,790/2023 with SPA ordinances covering authorisation, payments, technical systems and player protection. Many practical requirements sit in this secondary regulation rather than in the headline law.

The ownership rule is explicit: the applicant must be incorporated under Brazilian law, headquartered and administered in Brazil, and have a Brazilian shareholder holding at least 20 percent of its capital. Federally authorised betting sites use a .bet.br domain.

Hosting is more nuanced than an absolute requirement to keep every server in Brazil. SPA guidance permits overseas hosting under specified safeguards, including international legal-cooperation arrangements, regulator access and replication of required records in Brazil. Infrastructure plans therefore need to address both data location and the regulator's ability to inspect it.

Payments must follow the permitted arrangements and identification requirements. PIX and bank transfers are important parts of that architecture; operators cannot offer credit for betting or accept credit-card payments. Operators must also meet the applicable identification, account-security, certification and safer-gambling requirements.

A federal authorisation costs BRL 30 million for five years and covers up to three brands. That entry fee is separate from ongoing fiscal obligations. At this article's publication, Complementary Law 224/2025 had already legislated an increase in the GGR-based statutory allocation from 12 to 13 percent from April 2026, then 14 percent in 2027 and 15 percent in 2028. General business taxes and compliance expenses sit alongside that allocation.

The commercial implication is that headline tax comparisons alone are insufficient. Capital, systems, local governance and ongoing supervision all affect the cost of serving the market, particularly for smaller entrants.

Colombia: An Established Framework and a Changing Tax Position

Colombia's internet-gambling framework rests on Law 643/2001, as amended by Law 1753/2015, and Coljuegos regulations including Agreement 4/2016 and its successors.

Operators require a Coljuegos concession and must satisfy its corporate, financial, technical and player-protection requirements. A licence issued abroad does not authorise the same operator to target Colombia. For market entry, the regulator's application rules and technical standards are more useful than assuming that a platform approved elsewhere is already compliant.

Fiscal analysis needs the same care. Colombia's framework includes exploitation rights, fixed charges and administrative costs. The 15 percent revenue-based exploitation-rights calculation applies under the statutory conditions, including the applicable minimum return to players; it should not be presented as a universal, all-inclusive tax bill.

The separate 2025 emergency VAT measure used deposits as its base. Decree 1474/2025 subsequently provided for 19 percent VAT on GGR in 2026. However, the effects of that decree were suspended from 29 January 2026 following the Constitutional Court's intervention. DIAN confirmed the suspension in February. At the original publication date of 6 March, an ongoing 19 percent GGR-based VAT regime could therefore not be treated as settled law.

For a prospective operator, this is a lesson in timing as well as tax design: a financial model must distinguish an enacted measure, its effective date and a court order stopping its operation. Claims about offshore migration also require evidence beyond a change in licensed revenue or an industry forecast.

Mexico: The Permisionario Model

Mexico's framework requires permits issued by SEGOB under the Federal Law of Games and Lotteries and its implementing regulations. For remote betting centres, the eligible applicant is a legal entity incorporated under Mexican law.

International brands commonly work with a domestic permit-holder, or permisionario. This is a commercial structure within the regulatory framework, not an automatic entitlement to offer every game or operate any website. Due diligence must establish which entity holds the permit, what it authorises and how the proposed operation fits within it.

Where a brand relies on a partner's permit, market access also depends on the partner's compliance and the contract between the parties. Control over customer relationships, payments, reporting and changes to the authorised operation becomes commercially important.

The age of the primary law does not mean that online activity is wholly unregulated: implementing regulations and permit conditions matter. Equally, a foreign licence or a .com domain does not demonstrate Mexican authorisation. The practical task is to verify the specific legal route to market rather than infer it from a brand's international presence.

Industry Implications

For operators evaluating entry, incorporation, banking, hosting, certification and payments are separate workstreams with different costs. Requirements should be mapped to the relevant law, regulator guidance and proposed business structure.

For compliance teams, the challenge includes tracking changes between enactment and implementation, and checking whether litigation affects a measure already built into a financial plan. Colombia's early-2026 tax position demonstrates why a rate without a date and legal status can mislead.

For investors, reliance on another entity's permit creates a commercial dependency that should be assessed alongside regulatory risk. For suppliers, localisation must cover the regulated operating model as well as language and payment preferences.

The next article moves from these requirements to outcomes: what the available evidence can, and cannot, tell us about channelisation and enforcement.