CPF verification + biometric/facial match (3DS / liveness)

BR.SPA.CPF_KYC.1 · BR-SPA · kyc_identity

Severity

critical

Cadence

continuous

Region

americas

Current status (Apollo Gaming Ltd.)

pass

Requirement

Each player must be registered with a valid CPF and identified via a document + biometric facial match. Account is unique per CPF across operator brands.

Source: Portaria SPA/MF 1330/2023 + Lei 14.790 — Identification · Audit artifact: SPA KYC audit

Remediation guidance

Sumsub BR ID + liveness flow; Receita Federal CPF check.

Evidence specification

Evidence type	Connector	Spec	Acceptance criteria
`kyc_event`	`kyc-sumsub`	{ "check_type": "br_cpf_biometric", "required_fields": [ "player_id", "cpf_hash", "biometric_pass" ] }	`biometric_pass = true and cpf_hash present`

Recent evaluations (Apollo Gaming Ltd.)

✓

When	Status	Findings
5/28/2026, 12:52:56 AM	pass	none