Curaçao Gambling — Enforcement: How hard does the regulator enforce?

The CGA's enforcement toolkit rests on the LOK itself. Article 13.37 allows instructions, penalty-bearing orders, administrative coercion, administrative fines up to the sixth fine category of the Criminal Code, suspension for up to three months (extendable by a further three), and revocation for rule violations under Articles 1.2 and 1.5. Article 13.40 addresses unlicensed activity: a deliberate breach carries up to four years' imprisonment and a sixth-category fine, while a non-intentional breach is an infraction punishable by detention up to one year and a fifth-category fine. Both are standing statutory bases, reconfirmed rather than newly enacted. The live development is regulator-side: the CGA confirmed on 7 October 2026 that its breached licensing portal, exposing roughly 40,000 documents, will not return to service; it missed its own 9 October 2026 deadline to publish interim arrangements; and by 15 October it had signalled new licensing procedures in development, with trade press linking the ended service arrangement to a Malta-connected consultancy, a linkage the CGA's own announcement did not confirm. Separately, the CFATF's enhanced follow-up report on Curacao remains unpublished as of early September 2026, a standing transparency gap limiting independent verification of the jurisdiction's compliance trajectory.

The Curacao Gaming Authority confirmed unauthorised access to its online gaming licensing portal, running from December 2025 to September 2026, through an account created under a false identity. International press published the leaked licensee data between 5 and 8 October 2026, with reporting alleging unlicensed targeting of regulated monopoly markets drawn from the material. This is a confirmed statement from the authority itself, corroborated by trade press coverage of the incident. The development bears on the integrity of the Curacao Gaming Authority's own identity-verification controls over its licensee register, a distinct question from the stability of the underlying licensing statute, which has not changed. The full scope of the data taken has not been established by the authority, and the authority's enforcement register has not been independently fetched; the leaked-data reporting rests on secondary press accounts rather than the authority's own disclosure of scope.

The Curacao Gaming Authority's online licensing portal was reported offline from 28 September 2026 amid an internal governance investigation into an undisclosed consulting agreement, including invoices and work reports. No resolution timetable has been published, and the regulator states that issued licences and statutory deadlines remain unaffected by the investigation. This is a single-source report at the time of writing, with no second outlet corroboration located this cycle, and no enforcement action against any named licensee, fine, or revocation has been identified. Separately, the CGA's crypto guideline establishes a wallet-screening control requiring exclusion of funds linked to mixers, tumblers, or sanctioned blockchain addresses from licensees' crypto-payment channels; this functions as a forward enforcement trigger once the guideline's compliance milestones are reached, rather than as a presently active enforcement event. The combination of an unresolved internal governance question and two approaching statutory deadlines (8 October and 24 December 2026) represents an elevated but not yet crystallised risk picture: the exposure is institutional and procedural rather than a hardening of the licensing framework or a confirmed enforcement escalation against operators.

The Curacao Gaming Authority (CGA) holds significant investigative and licence-revocation authority under the LOK, a durable statutory grant. This cycle surfaces three specific, dated revocation-risk drivers rather than generic powers: failure to meet local-substance staffing thresholds by the 1 April 2027 deadline; non-submission of a compliant crypto policy within three months of the June 2026 guideline; and acceptance of funds from sanctioned wallets, mixers or tumblers, the latter an immediate rather than deferred obligation. These findings carry probable confidence, resting on T3 legal and compliance-vendor commentary rather than a primary CGA enforcement notice, but are corroborated across multiple independent sources. The crypto-policy guideline itself is a fragile regulator circular, distinct in durability from the LOK's durable statutory basis, meaning its specific deadlines carry less procedural permanence than the underlying licensing framework. No enforcement events beyond these risk drivers were identified this cycle; the picture is one of defined forward risk rather than an active enforcement record.

CGA enforcement hardened materially through the period following LOK implementation. Over an eighteen-month window, the CGA revoked three operator licences, each involving affiliate-driven traffic into restricted countries, and separately exposed a fraudulent digital-seal site, trumpbet.cc, in February 2026, a probable-confidence but concrete enforcement record. Beyond these realised actions, the CGA announced its intent to pursue domain-level blocks and referrals to international law enforcement against operators serving players without a valid direct licence or suspected of AML violations. This announced mechanism is carried at probable confidence and fragile durability, reflecting a stated enforcement intention rather than a codified instrument with confirmed cases behind it. Read together, the confirmed revocations and fraud exposure alongside the stated escalation toward domain-blocking and cross-border referral indicate a durable shift from a light-touch to an active enforcement posture, with risk concentrated on operators relying on affiliate traffic into restricted markets or lacking robust AML controls.

The CGA's enforcement toolkit is confirmed and statutorily grounded: orders subject to penalty, administrative coercion, administrative fines, and revocation, suspension or amendment of permits are all available powers under the LOK and its implementing instruments, a durable primary-legislation basis rather than a fragile circular. Evidence of active use accompanies the statutory grant: in February 2026 the CGA publicly exposed a fraudulent operator, trumpbet.cc, that was using a fake digital authorisation seal, demonstrating real market-surveillance capacity. Separately, the Board of Financial Supervision for Curacao and Sint Maarten formally retracted, in December 2025, an earlier claim that the CGA was under criminal investigation, acknowledging that the claim had relied on unverified rumours; taken together with the trumpbet.cc exposure, this retraction strengthens confidence in the CGA's enforcement credibility this cycle. The more consequential enforcement-adjacent risk is cross-border: a Curacao-based trust office, Downtown E-commerce Company, is named as administrator for Novatech Solutions (fined EUR24.8 million by the Dutch state lottery) and is separately named in a Nederlandse Loterij civil suit seeking personal liability against operators, trust offices and directors, though this litigation remains unresolved.