The Portuguese SRIJ framework and the Brazilian SPA / SIGAP framework share more architectural DNA than either set of regulators publicly emphasises. Both expect operator-side primary licensure, both place the supplier on a technical-certification track rather than a B2C-licence track, and both require regulator-visible transaction logging at the same level of granularity.
What carries over: ISO 27001 control mapping, RNG and game-software evidence (where the laboratory is GLI- or BMM-tier), wallet ledger architecture with signed-receipt webhook replay, and the bulk of the AML / CTF transactional-monitoring scaffolding. Operators we onboarded for SRIJ in 2020-2022 typically save 20-30% of the cert effort when adding SPA — most of it on the evidence-vault side.
What doesn't carry over: the SIGAP submission template is fundamentally different from the SRIJ schema. CPF-based player identification has no SRIJ analogue (NIF-based identification doesn't map cleanly), and Brazilian Portuguese-language consumer-protection controls are a separate localisation pass — including the Brazilian-specific reality-check copy and the PIX deposit-method affordances. Plan for a delta of 4-6 weeks on the operator-side localisation, plus 2-4 weeks on the supplier-side schema work.
The single biggest cross-border lift we see operators underestimate is the CPF / KYC layer: Brazilian regulators expect more aggressive identity verification than SRIJ at signup, and the operator-side compliance team needs to re-map AML flags against Brazilian sanctions lists. That is rarely a platform-side change; it is rarely visible in the master-agreement scope.