A Week of Global Gambling Enforcement: From Brazil’s Betting Ban to Curaçao’s Portal Breach

Something unusual happened in the global gambling market during the week of 17 to 25 September 2026. Official bodies across several jurisdictions each took enforcement or regulatory action, and no two moves looked alike.

One government banned an entire product category. One regulator issued a six-figure fine. Others backed police raids, rewrote consumer rules, chased fake licences, disclosed a security breach and blocked illegal sites. Taken one at a time, each is routine. Taken together, they show how broadly the pressure on operators is now spreading. Every figure below is drawn from the official source that reported it.

The Major Regulatory Shift

Why Brazil’s nationwide betting ban is the defining regulatory shift

The largest move came from Brazil. On Friday 25 September 2026, President Luiz Inácio Lula da Silva issued a Provisional Measure ending the exploitation, offering, intermediation and advertising of fixed-odds betting nationwide. It covers both sports betting and online games in physical and virtual environments and extends to state and district concessions. Lottery modalities already authorised by law are not affected.

The wind-down is tight, and the official schedule runs as follows:

• From publication day (25 September), new investment in the platforms is barred.
• Advertising and sponsorship material must come down by 5 October, with bettors given until 11:59 PM that day to withdraw winnings.
• Betting sites and apps go offline from 6 October.
• Remaining balances are reported to financial institutions by CPF on 7 to 8 October, with banks returning funds by 14 October.

According to the government, 85 concessions had been granted at R$30 million each, totalling R$2.55 billion, none of it refundable. Breaches carry fines of up to R$2 billion, and a separate draft Bill proposes five new criminal offences covering the running of fixed-odds betting, advertising or recruiting bettors, misuse of personal data, financial facilitation, and providing the internet application for it, with prison terms attached.

Enforcement is not left to the timeline alone. The measure creates an Institutional Committee for Oversight and Combating the Illegal Exploitation of Betting, coordinated by the Casa Civil, while the Finance and Justice Ministries work to block illegal sites, with the Finance Ministry running a virtual lab to identify irregular platforms and Anatel handling the blocking of their domains.

The framing is what sets it apart. The Health Ministry presented the ban as a public-health intervention, citing that suicide mortality is fifteen times higher among people with gambling disorder, that more than 28 million Brazilians had bet in the prior twelve months as of 2023, and that health-system demand tied to gambling rose by roughly 140% between 2018 and 2025. Minister of Health Alexandre Padilha said the issue reaches into homes, schools and phones, affecting families and not only the person placing the bet.

Enforcement and Fines

What the VGCCC’s Tabcorp fine reveals about operator security duties

In Australia, the Victorian Gambling and Casino Control Commission fined Tabcorp VIC Pty Ltd A$350,000 for failing to implement mandatory multi-factor authentication controls. The regulator found Tabcorp had not complied with four Wagering and Betting Technical Standards between 30 January and 23 June 2025, and during that window some customer accounts were accessed without authorisation and money was withdrawn.

Tabcorp told the VGCCC that:

• Full implementation of the controls was completed in June 2025.
• Affected customers were reimbursed by their banks or by Tabcorp.

Chairperson Chris O’Neill APM was direct:

“We expect strong systems to prevent breaches and protect customers. If breaches occur it is our expectation that licensees identify and resolve them quickly and address their underlying cause.”

The penalty follows a A$4.6 million fine imposed on Tabcorp by the same regulator in 2024.

How the UK Gambling Commission is policing illegal betting on the ground

The Gambling Commission and Manchester City Council’s Licensing Team supported Greater Manchester Police in raids on four properties in Manchester City Centre. Officers seized mobile phones, gambling tables, records and account books, and recovered more than £20,000 in cash under the Proceeds of Crime Act.

Four people were arrested, each on suspicion only:

• Two women on suspicion of immigration offences.
• One man on suspicion of running a late-night takeaway without a licence.
• One man on suspicion of money laundering and breaching the Gambling Act.

Sue Young, the Commission’s Executive Director of Operations, said:

“Unlicensed operators often have links to wider criminal activity, exploit vulnerable people and undermine legitimate regulated businesses.”

Player Protection Rules

Why the Netherlands Ksa is forcing simpler gambling account closures

The Dutch Gaming Authority, the Ksa, found that not all licensed operators were properly following the rules on account termination, called that unacceptable, and issued clarifying guidance. Under it:

• Closing an account must be made as easy as possible.
• Operators may not force a customer to contact customer service first.
• A closure request may not be used to talk the player out of it.
• Any remaining funds must be paid out without undue delay and with no conditions attached.

Crackdown on Illegal Operators and Security

What Malta’s MGA unauthorised URL notice tells consumers

The Malta Gaming Authority published a notice declaring it has no connection with 12 URLs identified during September 2026, and stated that any reference by those sites to the MGA or to an MGA-issued licence is false and misleading. The domains named in the notice were katosports.com, caswino-pokies.com, caswino.cz, ritzo-hungary.com, elysiumstudios.se, tigercasino-au.com, horuscasino-aud.com, casinonight.nz, highflybet-aud.com, mzansibetcasino.live, casinonight-aud.com and chipscasino.pl, with the Authority maintaining its full running list of unauthorised URLs on its own site.

The MGA reminded consumers not to use a service unless they have confirmed it is authorised, noting that unlicensed entities operate outside the regulatory framework and its consumer safeguards.

How the Curaçao Gaming Authority is handling its portal breach

In a statement dated 17 September 2026, the Curaçao Gaming Authority said it had identified and contained unauthorised access to its online gaming portal and begun a forensic investigation, with no compromise of core technical infrastructure identified at that stage.

A follow-up on 22 September confirmed that international media reports of a German security researcher claiming to have accessed the portal were consistent with its own investigation. The Authority set out that:

• Access was obtained through the customer-facing part of the licensing portal, using an account registered in December 2025 under a false identity that combined a variant of a real person’s name with an existing company in the Curaçao Chamber of Commerce registry.
• That access ran until it was ended in September 2026.
• The full extent of the material obtained is not yet established, and the CGA will not repeat figures it cannot verify.

The CGA said it regards the incident as a serious breach under Curaçao law.

What the ACMA site blocks add to the illegal gambling picture

The Australian Communications and Media Authority asked ISPs to block more illegal sites operating in breach of the Interactive Gambling Act 2001, naming Bet Ninja, Riobet188, ThePokies33, Spade69 and WinShark. According to the ACMA:

• 1,822 illegal gambling and affiliate sites have been blocked since its first blocking request in November 2019.
• More than 230 illegal services have left the market since enforcement began in 2017.

What does this run of enforcement signal for operators?

The through-line is not coordination, because these bodies did not act together. It is convergence. In quick succession the market saw prohibition, a fine, criminal policing, a consumer-protection rewrite, anti-fraud notices, a breach disclosure and fresh site blocking. For operators, the read is that no single area of compliance can be treated as settled while another is neglected, because in a matter of days regulators tested nearly all of them at once.

Sources: Official regulator and government releases