VIE 5 DE DICIEMBRE DE 2025 - 05:01hs.
Fred Justo, Director of AML at Legitimuz

Practical manual for COS reports to COAF in iGaming: structure, legal basis and checklist

COS (Internal Control and Compliance Systems) is a report of suspicious transactions sent to COAF (Brazil's FIU) by obligated parties. In regulated iGaming, Ordinance SPA/MF No. 1,143/2024 details AML/FTP policies and controls. In this article, Fred Justo, Director of Anti-Money Laundering (AML) at Legitimuz and former General Coordinator of AML at the Ministry of Finance's SPA, explains the practical structure of the AML, prerequisites (KYC), and common errors.

Where does the COS come from?

The COS (Suspicious Activity Report) is an obligation that arose in Brazil with the enactment of Law 9.613/98. The text establishes that individuals or certain sectors of the economy with a history of money laundering must:

- Identify suspicious activities
- Monitor unusual transactions
- Report suspicious activities to COAF

Betting operators are included among those required by law.

Responsibilities of the AML analyst

First, it’s always important to remember: the AML analyst working in a betting company does NOT have police powers.

Therefore, what he/she needs to report to COAF is any suspicious or unusual activity on the betting platform that may result in:

- Money laundering
- Terrorism financing

Another key point that must always be kept in mind: when a report is made in good faith (and only then), even if the outcome does not point to an actual crime or fraud, the person who submitted the report will not be held liable for allegedly making a false crime report.

How to make a good COS?

A good Suspicious Activity Report starts even before a strange activity draws the attention of the betting company’s AML team.

Can you imagine seeing a miracle without knowing which saint performed it? That’s how the analyst will begin an investigation if the suspicious bettor has not undergone a rigorous KYC (“know your customer”) process.

The importance of KYC

It is in this preliminary stage, required by law at registration, that the following data are collected:

- Personal
- Financial
- Residential
- Reputational information of the bettor

What is the ideal structure of a COS in iGaming?

There is no magic formula that instantly generates a perfect report to COAF.

However, there is a desirable standard for reporting to the Brazilian Financial Intelligence Unit, which can be divided into four parts or paragraphs:

Part 1: registration information

- Complete registration data of the suspect

Part 2: General information

Reputational information:
- Banking data
- Geolocation
- Negative media
- Police investigations
- Court cases

Part 3: Suspicious operation

Information on the suspicious or unusual operation:
- Financial backing
- Flow of funds
- Where the money came from and where it went
- Whether it was split into smaller amounts
- Use of intermediaries

Part 4: Analytical conclusion

- The analyst’s conclusion justifying the atypical, suspicious, or illegal nature of the transaction

Current legislation on suspicious activity reports

As mentioned, Suspicious Activity Reports must be made by individuals or legal entities required under Law 9.613/98 (the so-called Anti-Money Laundering Law).

Complementary regulations

In addition to Law 9.613/98, there are other regulatory instruments listing dozens of typologies used by criminals seeking to:

- Circumvent rules and controls
- Commit money laundering

It is the AML professional’s responsibility, when faced with such cases, to pay special attention and, if the activity qualifies as suspicious, begin drafting the COS.

Likewise, Article 12 of COAF Resolution 21/2012 lists several suspicious actions that require particular attention.

Specific regulation of COS for betting
Speaking specifically about the betting market, the Secretariat of Prizes and Betting of the Ministry of Finance has issued a regulation establishing the obligation to create:

- Prevention policies
- Internal procedures
- Internal controls

These must be defined by operators to prevent:

- Money laundering
- Terrorism financing
- Proliferation of weapons of mass destruction

In addition, Article 25 of Ordinance SPA/MF 1.143/2024 highlights nineteen situations that betting companies’ AML officers must closely monitor.

If any of these typologies occur, the case must be:

- Monitored carefully
- Analyzed before starting the reporting process to COAF

Technological solution for compliance

With the goal of protecting the market and ensuring that betting operators meet their legal obligations, Legitimuz has developed a product focused on anti-money laundering that uses AI to monitor unusual transactions on platforms.

The solution features advanced technology that assists AML teams in preparing:

- COS reports to COAF
- AML best practices reports to be delivered to SPA in February next year

And much more.

What becomes clear here is that the combination of analysts’ technical expertise and the power of artificial intelligence represents the future of anti-money laundering in the sector.

This way, it is possible to ensure greater efficiency, accuracy, and protection for both operators and the market as a whole.

Contact Legitimuz, schedule a demo, and test it with no obligation. We are ready to help your operation.

Fred Justo
Director of Anti-Money Laundering at Legitimuz and former General Coordinator of AML at the Secretariat of Prizes and Betting of the Ministry of Finance.