SPA-MF publishes in its FAQ the permission to reuse documents for KYC processes - BNLData

SPA-MF publishes in its FAQ the permission to reuse documents for KYC processes - BNLData SPA-MF publishes in its FAQ the permission to reuse documents for KYC processes. Betting The 21.05.26 By: Magno Jose Share: -A + A Legitimuz offers a complete digital identity verification ecosystem that seamlessly adapts to your workflow, regardless of your industry. The Portuguese Prize and Betting Secretariat – SPA-MF published in its official FAQ (Frequently Asked Questions) a text that formalizes its position on the reuse of documents for KYC processes on betting platforms. According to the SPA FAQ (number 136, which can be...) viewed here ): Does the Prizes and Betting Department allow the use of electronic verification methods that replace the capture/storage of physical document images, while maintaining KYC security? Yes. The requirement for biometric identity verification can be considered fulfilled when: I) The operator uses a database in which identity confirmation through the submission of a digital copy of the document has been previously carried out using KYC procedures that guarantee its authenticity; II) Through consultation of highly trusted government databases that allow for the confirmation of captured biometrics, the betting agent verifies the bettor's identity and stores an auditable proof of this verification. These procedures must result in the confirmation of the authenticity of the data from a primary source, fulfilling the purpose of the regulation to guarantee the bettor's identity, in line with the security and modernization principles already adopted in other regulated sectors in Brazil. Such procedures do not exempt the betting operator from maintaining bettors' information and documents in databases. Furthermore, these procedures must be preceded by confirmation of the bettor's identity through facial recognition and must guarantee the protection of bettors' data. The SPA's response allows for two approaches: using a reliable database where the document has already been verified, without needing to request it again from the bettor, or consulting government databases, such as those of the TSE or SENATRAN, with storage of auditable proof of verification. In both cases, four conditions are non-negotiable: facial recognition of the bettor is mandatory; the operator remains obligated to maintain the data and documents in its databases; the process must be auditable; and personal data must be protected. In general, the SPA's answer is yes, it is permitted to use other methods, provided they are equally secure. In practice, there are two accepted approaches: ⇒ Use a reliable database where the document has already been verified. In other words, if the bettor has already gone through a Know Your Customer (KYC) identity verification process at another time, and that process was done securely, the company can rely on that existing verification without needing to ask for a photo of the document again. ⇒ Consult government databases. The company can confirm the bettor's identity by comparing their facial biometrics with official records (such as the TSE or Denatran databases, for example) and keep proof that this check was performed. However, the text mentions four important conditions: ⇒ In both cases, facial recognition of the bettor is mandatory. ⇒ The betting operator remains obligated to keep the bettors' data and documents in its databases. Everything needs to be auditable, meaning there must be a record proving that the verification was done correctly. ⇒ The personal data of bettors must be protected. In short, the betting operator doesn't necessarily need to ask for a photo of the physical document, as long as they use secure digital methods (such as facial recognition cross-referenced with government databases) and keep everything recorded and protected. Authorization occurs after lengthy discussions and the presentation of an opinion. The publication on this topic in the SPA FAQ represents a victory for reputable KYC companies, such as Legitimuz, which offer reliable, secure solutions certified by globally recognized industry institutions. In June of last year, during discussions with the secretariat to obtain permission to reuse documents for KYC processes, Legitimuz – together with one of the most renowned Brazilian law firms specializing in Data Protection, Digital Law and New Technologies – prepared an opinion concluding that "the data processing carried out in the current [KYC] flow is legitimate and adequate". In general, the opinion states that the course of action is legitimate for several reasons: "Brazilian data protection law does not require companies to request explicit authorization (consent) for all types of data use. There are other justifications provided for by law, all with the same weight. In the case of Legitimuz, two justifications are used: for biometric data (such as facial photos), the law allows processing when it serves to prevent fraud and ensure user security; for common data (such as name and CPF), the use is justified by the so-called "legitimate interest," that is, the company has valid reasons, such as improving the user experience and preventing fraud, and these reasons do not harm the rights of individuals." Furthermore, Legitimuz has already taken a number of precautions that reinforce this compliance: ⇒ Prepared technical documents that assess the risks and benefits of data use (the RIPD and the LIA). ⇒ Maintains an accessible Privacy Policy that explains how data is handled. ⇒ It has contracts with its clients and partners with clear rules regarding data protection. ⇒ It offers the user the option to accept or reject the reuse of their data on a clear and objective screen. ⇒ Continuously validates information with up-to-date sources to ensure the data is accurate. In summary, the opinion confirms that Legitimuz not only complies with the law, but adopts best practices that go beyond the minimum required, protecting user information with transparency, security, and accountability. Ready to raise the security level of your operation? If you're looking to transform the bureaucracy of registration into a secure and seamless digital onboarding experience, you need to know what Legitimuz has prepared for the market. We combine cutting-edge artificial intelligence and facial biometric security to ensure your company scales efficiently without opening doors to fraudsters. Our online document verification solutions are designed to be invisible to legitimate users and insurmountable for criminals, guaranteeing full compliance with current KYC regulations. Don't let myths about KYC limit your business growth or compromise your customers' trust. Legitimuz offers a complete digital identity verification ecosystem that seamlessly adapts to your workflow, regardless of your niche. Read more: ⇒ The importance of having excellent KYC during the World Cup: identity verification, compliance, and fraud prevention. ⇒ How identity verification became a competitive advantage: the BPX Group's success story with Legitimuz. Comment with Facebook Results of the CAIXA Lottery Mega-Sena lottery draw 3009: 04 - 06 - 08 - 18 - 21 - 30 Lottery draw 3010: Prize R$ 300 million Lotofácil contest 3690: 02 - 05 - 06 - 07 - 08 09 - 12 - 15 - 18 - 19 20 - 21 - 22 - 24 - 25 Contest 3691: Prize R$ 2 M Most read See also... Self-exclusion from online gambling reaches 519 requests in 5 months in Brazil. The Caixa lottery network will fall to 12.966 units in the first quarter of 2026. Brazilian lawmakers question betting revenue after tax authorities report R$ 9 billion in 2025. TCU identifies serious flaws in preventing money laundering in illegal betting. Central Bank mandates that banks share data on illegal betting operators. National Sports Council discusses tax reform and betting revenue in Rio. Country singer Josiene loses R$ 290 in lottery ticket scam in São Paulo. The City Council of São José dos Campos is analyzing a bill that revokes the Municipal Lottery that was created. 