The N.F.L. on Thursday suspended Antonio Brown, the Tampa Bay Buccaneers star receiver, and defensive back Mike Edwards without pay for the next three games for misrepresenting their Covid-19 vaccination status, an egregious violation of protocols that were jointly agreed upon by the league and its players’ union.

A review conducted by the N.F.L. and the N.F.L. Players Association concluded that Brown and two other players, Edwards and the free-agent receiver John Franklin III, had acquired fake vaccination cards. Franklin will have to sit out three games if he is signed by a team. The Tampa Bay Times on Nov. 18 first reported that Brown had obtained the card, prompting the review.

“The health and safety of players and personnel is our top priority,” the league and the players’ union said in a statement together. “The protocols were jointly developed working with our respective experts to ensure that we are practicing and playing football as safely as possible during the ongoing pandemic. The N.F.L.-N.F.L.P.A. jointly reinforce their commitment and further emphasize the importance of strict adherence to the protocols to protect the well-being of everyone associated with the N.F.L.”

Brown’s lawyer, Sean Burstyn, said in a telephone interview on Nov. 18 that Brown promised him that night that he was vaccinated and that he had gotten at least one shot at a drive-through site. Burstyn said then that he neither asked Brown nor knew when he got his first dose.

In a statement Thursday, Burstyn again said that Brown was vaccinated “and continues to support the vaccine for any person for whom it is appropriate.”

The N.F.L. would not publicly confirm the players’ vaccination statuses or whether the league was trying to determine who had been exposed to the players before it was publicly known that they had fake vaccination cards.

The N.F.L. has responded to breaches of Covid protocol over the last two seasons by fining the offending players, coaches and teams. Just last month, it docked the league’s reigning most valuable player, Green Bay quarterback Aaron Rodgers, $14,500 for not wearing masks inside his team’s headquarters and other facilities or during his news conferences, as is mandated for unvaccinated players.

Although Rodgers misled reporters who asked if he was vaccinated, the Packers were aware of his unvaccinated status and were fined $300,000 for not monitoring his behavior better.

But the N.F.L. determined that acquiring fake vaccination cards — a criminal offense — merited the strictest punishment it has yet to mete out for an individual violation.

The league has not mandated Covid-19 vaccines, but it has incentivized players and personnel to get them by instituting harsh penalties, including the forfeiture of games, for teams whose unvaccinated staff members expose others to outbreaks.

There are also different everyday protocols for players based on their vaccination status. Unvaccinated players must, among other things, undergo daily testing, wear masks inside teams’ training facilities and travel separately from vaccinated teammates.

Brown, who has not played since Oct. 14 because of an ankle injury, tested positive for the coronavirus in September and missed the team’s Week 3 game at the Los Angeles Rams.

On Nov. 18, citing Brown’s former live-in chef, Steven Ruiz, the Tampa Bay Times reported that Brown had acquired a fake vaccination card. The Tampa Bay Times said that Brown’s girlfriend had asked Ruiz over text message on July 2 if he could obtain a fake card for Brown, who was willing to pay $500 for it. Brown, the newspaper reported, owed Ruiz $10,000.

The Buccaneers said in a statement Nov. 18 that they had reviewed all cards but that no irregularities had been “observed.” The next day, Buccaneers Coach Bruce Arians said that the organization did its “due diligence” and that it had no reason “whatsoever” to believe that Brown had submitted a fake card.

On Thursday, the team said it recognized “the importance of the health and safety protocols that have been established” and vowed to continue to enforce them.

Individual teams are responsible for corroborating the vaccination status of their players and personnel. They were reminded of that responsibility before training camps began, in a video conference on July 22 when they were also ordered to scrutinize cards for potential forgeries.