iGaming Compliance in 2026

On 1 January 2026, Brazil's Secretariat for Prizes and Betting (SPA) flipped the switch from a transitional regime to a fully licensed market. Operators that were running on grandfather rules now ship under a real authorisation, a real KYC stack and real reporting. We are designing for those operators every week, and the same shape of compliance work is showing up in other markets too – UK, Malta, the Netherlands, Ontario. This note is what we tell teams that ask us where to focus first.

What Brazil's SPA actually changed

The SPA regime is not subtle. Operators must hold a Brazilian licence to take real-money bets from residents. They have to onboard players through a verified CPF identity check, not a flexible email-first flow with a KYC tail. Payment rails are restricted to authorised PIX flows. Affordability checks, self-exclusion registers and advertising restrictions all apply on day one – not a soft launch.

The product implication is concrete: the casino lobby cannot show a deposit button to a visitor whose CPF status is unverified. The promo banner cannot reach a player who has self-excluded. The cashier cannot route a withdrawal to an account that does not match the verified identity on file. None of that is new in theory. What is new is enforcement that actually inspects the UI flow, not just the back-end logs.

Responsible gambling, productised

Responsible gambling has been moving from a footer link to a first-class product surface for years. 2026 is the year that move finally lands. Affordability checks, deposit limits, session reminders, reality checks and self-exclusion tools are no longer "compliance pages" tucked behind a profile menu – they are flows the product has to surface in the casino, in the cashier and at signup.

What this looks like in UI:

• Deposit limits offered at first deposit, not after a regulator complaint.
• Session reminders that respect dark mode and do not look like an upsell.
• Self-exclusion that takes one tap and survives a "try to log back in next week" attempt.
• Affordability flags that pause a session instead of letting the player chase.

The fastest-moving operators are designing these as positive features – not as compliance penalties. That framing is the right one. It is also the one the regulators are starting to ask for explicitly.

AML, KYC and the verified-identity baseline

AML and KYC requirements vary by jurisdiction, but a common floor is emerging. Operators in Brazil, the UK, Malta, the Netherlands and Ontario are converging on identity-verified-before-deposit as a default. The grace-period model – let the player play first, KYC them when they hit a threshold – is closing.

For product teams that means redesigning the first ten minutes. The wallet, the cashier, the first deposit and the first bet have to assume a verified identity from the start. The challenge is doing it without making onboarding feel like a passport interview. The best work we have seen this year does identity verification in parallel with product discovery – the player browses games, picks favourites, sees personalised promotions, all while the verification runs in the background.

Compliance is no longer a layer you bolt on the side of the product. It is the spine the product is built around.

Advertising and acquisition flows

Marketing surfaces are now part of compliance scope. Ads cannot target verified-vulnerable users. Affiliate links have to land on a compliant geo-aware splash if the visitor is in a restricted market. Welcome bonuses cannot dangle in the hero of every page – most regimes now require them to be presented with their full terms before they can be claimed.

Our practical default: any acquisition surface that touches a regulated market gets a geo-aware variant by default, not as an add-on. The cost is one extra Figma frame per page. The benefit is that the legal review takes hours, not weeks.

Design implications

What does this all mean for design teams shipping iGaming products this year?

• Identity is a product feature, not a compliance form. Treat the verified-identity flow as core onboarding, not as an interruption.
• Responsible gambling deserves real surface area. Limits, reality checks and self-exclusion deserve the same UX investment as the cashier.
• Geo-awareness is default. Treat every public surface as geo-variant-capable from day one. The cost up front is small. The cost retrofitted is large.
• Audit trails are a UX feature. If your UI cannot show a regulator the player's journey through limits, opt-ins and self-exclusion, you are building tomorrow's compliance debt.

---

The shift this year is not that compliance arrived in iGaming. It is that compliance moved from the legal department into the product surface. The operators that ship this well in 2026 will look very different from the ones that treat it as the year-end audit problem. The difference is mostly visible in the first ten minutes a new player spends with the product. We are designing those ten minutes for clients every week, and we are happy to compare notes.