Curaçao’s Landsverordening op de Kansspelen (LOK) abolished the island’s three-decade-old master license and sub-license model in December 2024, replacing it with direct licensing from a single regulator, the Curaçao Gaming Authority. On paper, the reform is real: applications are now rejected at a meaningful rate and AML obligations have teeth. In practice, the CGA spent much of 2025 and 2026 dealing with a board resignation, a corruption investigation, and a nine-month data breach that forced it to shut down its own licensing portal. The structural fix is genuine; the institutional execution is still unproven.
Key takeaways
- The LOK ended the four-master-license system on 24 December 2024; the Curaçao Gaming Authority (CGA) now issues every B2C and B2B license directly.
- By April 2026 the CGA had processed roughly 140 direct applications and rejected or shelved close to 38% of them, a sharp break from the old sub-license era.
- The reform’s credibility was tested by a supervisory board resignation (September 2025), a Finance Minister’s resignation amid a corruption scandal (October 2025), and a prosecutorial investigation into the CGA itself (confirmed November 2025).
- A nine-month, undetected breach of the licensing portal, discovered in September 2026, exposed over 40,000 confidential documents and forced the CGA to permanently retire the system in October 2026.
- Curaçao still converts only a small fraction of the industry it hosts into direct government revenue, which limits what the regulator can invest in supervision.
Table of contents
What the LOK reform actually changed
Curaçao’s old system let four privately held “master license” companies sub-license operators at their own discretion, with the regulator several steps removed from the businesses actually taking player money. The CGA’s own account of the reform describes a phased process that began well before the law took effect:
the Curaçao Gaming Authority, on behalf of the Minister of Finance, began a phased reform of the online gaming regime in November 2023, laying the groundwork for the LOK’s implementation
. The ordinance itself requires
all applications for a license to offer remote gaming in or from Curaçao, as well as applications from suppliers seeking licenses to provide gambling-related critical services and goods, to be submitted to the CGA through its portal in accordance with the National Ordinance on Games of Chance
.
Curaçao has issued online gaming licenses since 1993, and
more than 300 licenses have been granted for iGaming operators, including online casinos in Curaçao
, giving a sense of the scale the CGA now has to supervise directly rather than through intermediaries. The reform also brought AML obligations that did not meaningfully exist before:
the LOK introduces substantive AML and KYC obligations, mandatory FATF-aligned frameworks, FIU reporting via goAML, and requirements for designated compliance officers, all of which must be operationalized through live systems, written policies, and verifiable audit trails
.
Timeline of the reboot
| Date | Event |
|---|---|
| 24 December 2024 | LOK enters into force; CGA becomes sole licensing authority |
| January 2025 | Legacy master/sub-licenses expire |
| September 2025 | CGA’s entire supervisory board resigns |
| October 2025 | Finance Minister Javier Silvania resigns amid a corruption scandal |
| 27 November 2025 | Financial Supervision Board confirms a prosecutorial investigation into the CGA |
| April 2026 | CGA has processed ~140 direct applications; ~38% rejected or shelved |
| 17 September 2026 | CGA discovers unauthorized access to its licensing portal |
| 7 October 2026 | CGA announces the licensing portal will not return to service |
| 19 October 2026 | Interim replacement portal launched |
| 24 December 2026 | Supplier (B2B) licensing becomes fully enforceable |
Evidence the reform is working
The strongest data point for the reform’s seriousness is the application outcome rate.
The CGA had processed roughly 140 direct license applications as of April 2026, approving 87 and rejecting or shelving the rest, with a rejection rate close to 38 percent that industry observers say signals the CGA is serious about raising standards.
That is a meaningful filter compared to a regime where four private companies competed to sign up sub-licensees.
Enforcement also now carries real procedural weight. When operators lose their license — voluntarily or otherwise — the CGA has published formal wind-down rules:
during the wind-down period, operators are prohibited from using the CGA seal, accepting new business, continuing existing contracts, onboarding new players or allowing existing players to continue wagering.
The regulator is also extending oversight further up the supply chain:
the CGA has issued a formal announcement clarifying the supplier licensing and registration obligations that will become fully enforceable on 24 December 2026, marking the end of the two-year transitional period provided under the LOK.
Evidence the reboot is still shaky
The CGA’s own governance had a rough 2025.
The Curaçao gambling regulator confirmed the resignation of its supervisory board, but said the LOK implementation is unaffected.
That resignation coincided with a political scandal:
former Finance Minister Javier Silvania resigned after a scandal involving corruption within the Ministry of Finance, which had previously been responsible for overseeing the gambling sector.
Weeks later, the island’s fiscal watchdog confirmed prosecutors were looking at the regulator itself:
the Curaçao and Sint Maarten Financial Supervision Board confirmed that the Curaçao Gaming Authority is under investigation, with the Criminal Investigation Cooperation Team assigned to the case.
The CGA pushed back hard on that characterization —
the regulator denied the reports categorically, stating that it “has not been approached by the Public Prosecutor and is not aware of any investigation”
— leaving operators and players with two contradicting official narratives about the same body that certifies their license.
Transparency around these events has also been inconsistent. Local reporting found that
only after a newspaper revealed the CGA no longer fell under the Minister of Finance did the Council of Ministers and the CGA itself, two months after the fact, provide the necessary information.
Even the public enforcement data requires careful reading: a comparison of the CGA’s own registers found that
all revocations appearing in the main license register are recorded as having taken place at the operator’s request, while regulatory actions initiated by the CGA appear in a separate enforcement register
— meaning a casual glance at the headline register understates how much enforcement, if any, the CGA has actually driven.
Resourcing is a related concern. The fiscal upside of being one of the world’s largest licensing hubs is modest:
government revenue from the sector is estimated at roughly 40 million guilders per year, equivalent to about 20 to 25 million euros, while the global online gambling market operating under Curaçao licenses is believed to generate billions of dollars annually in betting activity.
Staffing has grown but remains small relative to that footprint:
since the beginning of the reform in 2024, the regulator says it has recruited 14 employees, primarily in licensing, supervision and enforcement.
That is a thin team to directly supervise hundreds of operators that used to be someone else’s problem.
The 2026 data breach and portal shutdown
The clearest sign that the rebuild is incomplete came in October 2026, when the CGA confirmed its central licensing infrastructure had been compromised for nearly a year.
A security researcher from Germany accessed the online gambling licensing portal without authorization between December 2025 and September 2026 and published data and confidential information belonging to license holders.
The scale was significant:
a hacker publicly released more than 40,000 documents uploaded to the site after gaining unauthorized access the previous year.
The CGA’s response was to abandon the platform entirely rather than patch it.
The CGA confirmed its online licensing portal, active since September 2023, would not return to service following the breach, and the conclusion of associated service agreements suggests it ended its contract with former Malta Gaming Authority regulator Mario Galea and his company Random Consulting.
A replacement followed within days:
the CGA launched its new interim online gaming portal on October 19, 2026.
Importantly for anyone checking a license mid-transition, the regulator was explicit that
shutting down the old portal has no effect on the validity of existing licenses, and license holders must still meet their compliance requirements.
The episode matters beyond the technical embarrassment. A licensing system built to demonstrate transparency and centralized oversight was, for most of its life, run by an outside contractor the CGA has now cut loose — the kind of third-party dependency the LOK was partly designed to eliminate at the operator level. It is a reminder, covered in more depth in our piece on the dangers of unlicensed crypto casinos, that a license register is only as trustworthy as the system that maintains it.
What it means for operators and players
For operators, the reboot has raised the cost and uncertainty of staying under the Curaçao flag. A meaningful share of applicants have not made it through:
several rejected applicants have since sought licensing in other jurisdictions, with Malta’s MGA, Gibraltar, and the Isle of Man reported as popular alternatives.
That migration pattern is consistent with the broader regulatory tightening documented in our analysis of how European gambling regulations are tightening this year, where lower-friction jurisdictions are increasingly treated as a last resort rather than a first choice.
For players, the practical takeaway is more modest: a CGA license today carries real vetting behind it, but the regulator’s own operational stability — leadership turnover, a year-long undetected breach, and conflicting public statements about an investigation — means the license alone is not a complete substitute for independent due diligence on an operator’s payment history, complaint handling, and public enforcement record.
Curaçao versus tier-one regulators
Structurally, the LOK moves Curaçao closer to the direct-licensing models used by the UK Gambling Commission and Malta Gaming Authority: a single authority, a public register, and real power to suspend or revoke. What the reform has not yet replicated is the institutional continuity those regulators have built over decades — stable boards, in-house technical infrastructure, and a track record free of the kind of supervisory-board mass resignation or prosecutorial inquiry Curaçao saw in 2025. Our detailed side-by-side comparison in the license tier list covering UKGC, MGA, and Curaçao breaks down where each jurisdiction still diverges on player-protection enforcement and dispute resolution, which remains the more relevant gap for players than the headline rejection-rate statistic.
Frequently asked questions
Is a Curaçao license still legitimate after the LOK reform?
Yes, in the sense that it is now issued directly by a government-created regulator rather than a private sub-licensing company. However, legitimacy on paper does not guarantee consistent supervision: the CGA’s 2025–2026 record includes board resignations, a disputed investigation, and a major data breach, so a Curaçao license should be treated as a baseline check rather than a complete guarantee of operator reliability.
What happened to the old Curaçao sub-licenses?
All legacy sub-licenses issued under the former master-license system expired in January 2025, and the transitional “orange seal” used for pending applications was phased out during 2025. Any operator still referencing a Curaçao “sub-license” or “master license” today is describing a structure the current law no longer recognizes.
Is the CGA under investigation right now?
The Curaçao and Sint Maarten Financial Supervision Board confirmed in November 2025 that prosecutors were investigating the CGA, while the regulator publicly denied being contacted by the Public Prosecutor at the time. The public record has not provided a clear resolution since, which is itself a data point about the opacity surrounding the reform’s execution.
What was the 2026 Curaçao licensing portal breach?
A security researcher gained unauthorized access to the CGA’s online licensing portal between December 2025 and September 2026, later publishing more than 40,000 internal documents. The CGA permanently retired the compromised portal in October 2026 and launched an interim replacement, while stating that existing operator licenses remained valid throughout.
Does a Curaçao license guarantee player protection?
No license, including Curaçao’s reformed one, guarantees fair treatment on its own. It indicates the operator passed a vetting process and is nominally subject to AML and complaint-handling rules. For practical risk assessment, our security, fraud detection and fair play coverage and payout-dispute data matter as much as the license tier itself.
Methodology
GamblScout’s algorithm tracks Curaçao-licensed operators against the CGA’s public license and enforcement registers, cross-referencing status changes, revocations, and seal validity on a recurring schedule. Our data scraping engine ingests regulator announcements and trade-press reporting on licensing disputes, board changes, and breaches, while our scoring weights adjust an operator’s jurisdiction-risk component when its home regulator shows sustained institutional instability rather than isolated incidents. This article sits within our broader licensing and jurisdictions coverage.
Gambling involves risk. Only play with money you can afford to lose and use the deposit limits and self-exclusion tools available in your jurisdiction.
