A day after losing Brazil’s presidential election to Luiz Inácio Lula da Silva, Flávio Bolsonaro was given 24 hours to surrender his passports on October 26.
The senator, son of former president Jair Bolsonaro, was also barred from contacting Willer Tomaz, a lawyer and family friend whose betting interests had become the subject of a money-laundering investigation. Bolsonaro said he would comply with the order, but described him as an attempt to intimidate him.
Buying into Brazil’s betting boom
By 2023, bookmakers were paying to put their names on some of Brazil’s most recognisable football shirts. Flamengo carried Pixbet, while its Rio rival Fluminense wore Betano. Across the country’s top division, 19 of the 20 clubs had betting sponsorships. A newcomer would be competing against companies already reaching supporters through the teams they followed.
The rules were still catching up with the business. Brazil had legalised fixed-odds sports betting in 2018, but the federal government had yet to complete its licensing framework. Rio de Janeiro pressed ahead with licences issued through its state lottery, Loterj, giving operators formal approval to enter the local market.
Tomaz’s family was among the first to take that opportunity. Its company, Rede Loto, paid R$5 million for a five-year licence and began taking sports bets as Loto Carioca in June 2023. The website came with an integrated payments service to handle stakes and winnings. It would later become BestBet, the bookmaker in which police now suspect Bolsonaro held a concealed interest through companies registered in Portugal. Both men deny the allegation.
Loto Carioca’s public promotion was brief. Its social media accounts stopped posting less than two months after their first update. The change to BestBet brought another burst of activity: from November 2023, its Instagram feed published daily odds for live games. By January 2024, those updates had stopped too, although the website remained online into September, according to a review by Metrópoles.
The financial results suggested little progress. Between December 2023 and June 2025, BestBet reported just R$210,000 in revenue, according to company correspondence obtained by Folha de S.Paulo. That was a small fraction of the licence fee alone. Its business plan had projected R$2.1 million in revenue by the end of 2025.
Its ambitions also depended on how far a Rio licence could reach. Loterj had relaxed its location checks, accepting a customer’s declaration that a bet was being placed inside the state. That allowed licensed websites to take wagers from elsewhere in Brazil.
In 2025, the Supreme Court ordered that practice to be stopped. By August, Rede Loto was telling the regulator that the restriction had forced it to scale back its growth plans.
The company behind the family holiday
On 23 May 2025, Bolsonaro and members of his family flew by private jet with Tomaz from Cascais, near Lisbon, to Nice, then on to Paris. The name on the flight contract obtained by Folha was also the formal owner of the bookmaker: Cathedral Holdings. Tomaz said he had paid personally for a holiday among friends, with no favour expected in return.
Cathedral owned Rede Loto, which had obtained its betting licence two years earlier from Rio’s state lottery, Loterj. The official who signed the authorisation, Hazenclever Cançado, had been recommended for his job by Bolsonaro, according to Folha’s sources familiar with the appointment. Loterj said Rede Loto supplied the required documents and nobody involved faced an impediment.
For that application, identifying Cathedral as the shareholder was enough. Rio’s rules did not require Rede Loto to disclose the people ultimately benefiting from the Portuguese company. Tomaz and members of his family therefore sat another step beyond the ownership information required by the regulator.
Cathedral’s registered address was a small office in Funchal, Madeira’s capital. Another Tomaz holding company, Alcazar, used the same address and administrator, according to piauí. Police suspect Bolsonaro held a concealed interest in the bookmaker through the Portuguese companies. His name also appeared in banking instructions sent from Tomaz’s office during the European trip.
On 22 May, the day before the flight to Nice, a Tomaz employee emailed Santander about an Alcazar account. She asked the bank to link it to a “master” banking profile. In the same message, she requested the removal of accounts identified with Bolsonaro and Tomaz from a master-user profile.
A published email names Bolsonaro in those instructions but leaves the identity of the master user unspecified.
A fee before the first bet
RioPag began collecting fees as soon as a customer put money into a betting account. The company, previously called Pixs, handled deposits and withdrawals for Loterj-licensed bookmakers, including Loto Carioca. Under its original contract, a R$100 deposit generated a R$2.50 fee. Withdrawing money attracted another charge of 1 per cent.
Those small percentages accumulated across the bookmakers it served. Between June 2023 and August 2026, RioPag retained R$187.8 million in processing revenue, before operating costs, while R$45.2 million went to Loterj, according to records obtained by UOL. BestBet barely traded, but the payments business earned money from customers using other betting sites.
Tomaz described himself as RioPag’s lawyer and denied being its shareholder or manager. Agência Pública’s reporting followed the ownership and payments through two further companies. RioPag belonged to Capital Pretium, which belonged to Embrasis, owned by Tomaz and his sister. Police reported that money passed up this chain and that Embrasis distributed almost everything it received. Tomaz’s tax declaration recorded at least R$67.7 million received from Embrasis in 2024.
Some of that company’s money also reached his gambling accounts. In March 2025, Tomaz received R$2.05 million in his personal Magnum Bank account, including R$1.05 million from Embrasis. Successive transfers of R$100,000 then went to Foggo Entertainment, the operator of Blaze in Brazil, according to a police report described by UOL.
The VIP customer marked “medium risk”
Between 2am and 4am on 29 July 2025, Tomaz deposited R$100,000 eleven times and lost the money over hundreds of roulette spins. The session appears in records from his own lawsuit against Blaze, reported by Metrópoles.
Across 2025 and 2026, his wagers reached roughly R$6.3 billion, overwhelmingly on Blaze and almost entirely on casino games, according to Finance Ministry data reported by Folha. That figure includes the same money being staked repeatedly as play continued.
Tomaz sued to recover his losses, accusing Blaze of exploiting a gambling addiction. His dealings with the platform included a dedicated VIP attendant and negotiations over how quickly he could withdraw money. When repeated facial-recognition checks slowed withdrawals, he asked for higher limits; an attendant offered relief from the checks. Tomaz also complained that the scale of his gambling should have prompted the company to intervene.
Blaze had classified this customer as medium risk. A Finance Ministry assessment said he belonged in its highest risk category and identified transactions the operator had failed to select for examination. On 30 October 2025, Tomaz deposited R$7 million in fourteen instalments. The following day, he withdrew R$6 million in twelve transactions within eighteen minutes.
The ministry has opened administrative proceedings against Blaze. The company says its monitoring is rigorous and that it complies with its regulatory obligations.
Police suspect the repeated transfers and bets served to disguise criminal funds, giving money withdrawn from the platform an apparently legitimate gambling history. Their theory includes losses accepted as the cost of moving the remaining funds. They are also investigating an alleged hidden ownership interest in Blaze, through which money recorded as losses may have returned to Tomaz via associated companies.
Tomaz and Foggo deny that he owned any part of Blaze. He also disputes the reported R$1.4 billion in transactions under investigation, denies withdrawing betting money abroad and says he gambled with lawful personal funds.
On 23 October, Supreme Court justice Alexandre de Moraes ordered an asset freeze of up to R$6 billion against Tomaz and suspended his companies’ activities. Banks were ordered to identify those authorised to operate the companies’ accounts, including Alcazar’s.
Tomaz had already left Brazil in August. His lawyers called the measures disproportionate and said the freezing limit bore no relation to his wealth.
What comes next
The banks now have a court order to answer. Moraes has demanded the identities of everyone authorised to operate accounts belonging to Tomaz’s companies, including former users of the Alcazar accounts. He has also opened the companies’ banking and tax records to investigators. The inquiry is moving from correspondence recovered from Tomaz to records held by the institutions that handled his money.
The decision to bring a criminal prosecution belongs to Brazil’s Prosecutor-General’s Office. Once the police submit their findings, prosecutors can file charges, seek further investigation or request that the case be closed. Charges would then need to be accepted by the Supreme Court before Bolsonaro or Tomaz became defendants in a criminal trial. The passport restrictions and asset-freezing orders concern the investigation already under way.
Blaze faces a separate reckoning over how it handled Tomaz as a customer. The Finance Ministry’s proceedings examine the monitoring failures identified in its assessment, including the medium-risk classification and the large transactions left unexamined. Those duties apply regardless of whether prosecutors ultimately establish money laundering. Blaze disputes the findings and maintains that its controls complied with the rules.
The regulator must now decide whether those failures warrant punishment. The available sanctions include fines capped at R$2 billion per infringement, with the amount determined by factors including the seriousness of the breach, the benefit obtained and the operator’s financial capacity. That places Blaze’s own conduct under examination alongside the money that passed through its customers’ accounts.