Basic law: Wet op de Kansspelen

💡 Important date remark. The year 1958 is often found as the "source" of reforms, but the current codification of Wet op de kansspelen (Wok) was adopted and entered into force in 1964 (historical discussions and preparatory steps were indeed carried out earlier). The Wet Kansspelen op afstand (KoA) distance games law was adopted in 2019 and entered into force on April 1, 2021, and the online operator market opened on October 1, 2021.

1) Regulation architecture

Wok (1964) is a basic law that:

introduces the principle "everything that is not allowed under license is prohibited";
determines the powers of the state to limit the forms and scope of the game in the interests of society;
sets the framework for ground verticals (lotteries, casinos, machines, sweepstakes/sports, bingo, etc.);
lays the foundation for future institutions of supervision and operator responsibility.

KoA (2021) is an online add-on to Wok that:

legalizes remote products (online casinos, slots, live games, sports betting, poker) through a separate license;
Introduces centralized Responsible Gaming tools and technical controls
synchronizes offline and online to key player protection standards.

Supervision: Ksa (Kansspelautoriteit, since 2012)

issues licenses, checks IT readiness, audits KYC/AML and RG processes;

administers the CRUKS self-exclusion registry;

applies sanctions (fines, prescriptions, blocking of unlicensed services).

2) What exactly is regulated by Wok and KoA

2. 1. Verticals and Licensing

Lotteries (state and charitable): allowed on separate grounds, with targeted deductions.

Land casinos: historically - under state control (Holland Casino chain); strict access rules and RG.

Slot machines/arcades: requirements for placement, certification, age control.

Sports Betting/Betting: Licensed, with event and marketing restrictions.

Online (KoA): separate license for distance games; mandatory IT and RG components (see below).

2. 2. Mandatory player protection systems

CRUKS (Centraal Register Uitsluiting Kansspelen): unified register of self-exclusion for online and offline. CRUKS check - before admission to the game.

Duty of Care (duty of care): behavior monitoring, early interventions, personal limits and "pauses," escalation up to blocking.

Age and identification: 18 +; hard KYC before deposit/game (identity, age, address; with risks - a source of funds).

2. 3. Inspection and data

CDB (Control Database): mirroring key gaming and financial events into an independent control base for Ksa (near-real-time/almost real-time) - a condition of the online operator's license.

Certification of games/platforms: independent laboratories, RNG/RTP control, build versions and logging.

Reliability: logs, reservations, incident-reports; Storage and availability requirements

2. 4. KYC/AML

Customer identification, verification of sanction lists and PEP, monitoring of transactions and behavioral anomalies;

"Affordability "/availability: additional checks at high deposits/losses/session frequency;

Obligation to store and submit reports to the supervision.

2. 5. Advertising and bonuses

In the Netherlands, advertising is strictly limited: bans on "non-targeted" advertising, the use of role models, pressure on vulnerable groups, aggressive bonuses; time, environment, and target constraints.

Transparency of offers, prohibition of misleading shares; frequency of communications under control (e-mail, push, SMS).

3) Procedure for online license (KoA): what consists of

1. Legal and organizational readiness: ownership structure/UBO, financial stability, compliance policy, top management responsibility.

2. Technical package: integration with CRUKS, deployed CDB, certified game stack, crash/fraud protection.

3. RG design by default: starting limits, quick access to self-exclusion, "coolers" before a large bet, reports to the player on time/spending, communication button with support/help.

4. KYC/AML & risk policies: escalation procedures, intervention triggers, reporting.

5. Response plan: Security incidents, leaks, high-grade gambling addiction, notification to Ksa and players.

6. Testing: acceptance tests, pilot logs in CDB, "dry run" CRUKS and reporting formats.

4) Go online: Key dates and rules

April 1, 2021 - KoA entered into force: applications and technical audits began.

October 1, 2021 - the start of the licensed online market; CRUKS is mandatory for all channels.

2021-2024 - consistent tightening of advertising standards (including for "non-targeted" advertising and the participation of public persons), increased control over bonuses and behavioral protection.

5) Sanctions and enforcement

Fines for work without a license, violation of advertising and RG; prescriptions and blocking of payment/marketing channels;

Tightening in case of repeated violations, taking into account the scale of turnover and the number of affected players;

Ksa's public reports increase market discipline.

6) Taxes and reporting (in general terms)

Gaming tax is charged on GGR (the rate is set by law and periodically revised);

Reporting on turnover/payments/bonuses/incidents; coordination with auditors and submission of data to Ksa and fiscal authorities;

It is important for operators to separate client funds/reserves, transparent journals and reconciliations.

7) Timeline of key milestones

XV-XVIII centuries - city and state lottery practices (origins of Staatsloterij).

1964 - Adoption of the Wok: a single "by licence and in the public interest" framework.

1976 - The establishment of the Holland Casino chain under state control.

2012 - launch of the Ksa regulator.

2019 - Adoption of KoA (online).

1. 04. 2021 - KoA entered into force; 1. 10. 2021 - the start of the licensed online market and mandatory CRUKS.

2021-2024 - consistent strengthening of advertising and RG rules.

8) Operator compliance checklist (online)

CRUKS check before each admission to the game (and onboarding).

CDB logging of all mandatory events, integrity and timeliness of transmission.

RG-default: deposit/time limits, "cooler," access to self-exclusion in 1 click, reports to the player.

KYC/AML: identification, risk triage, sources of funds for high-risk, failure log.

Advertising/bonuses: without pressure on the vulnerable, without "indirect" coverage, without misleading offers; communication frequency caps.

Incidents: Ksa and player notification regulations, investigation log, replay prevention plan.

Data and security: redundancy, encryption, pen tests, vulnerability management, separation of client funds.

9) What it means for stakeholders

State and Ksa: controlled market, consumer protection, reputational stability.

Operators: predictable rules of entry and operation with high requirements for equipment and RG.

Players: understandable limits and self-control tools, quick access to help, safe and honest products.

Sports and NGOs: transparent sponsorship/lottery rules, emphasis on public benefit and harm reduction.

Inference.

The combination of Wok (1964) + KoA (2021) created the "Dutch standard": a permitted game is a regulated, transparent and socially responsible game. Centralization (CRUKS, CDB), Ksa's strong oversight, and strict advertising norms make the market predictable for investment and safe for society. That is why the history of 1958 here is only a preparatory stage, and the current system is based on the decisions of 1964 and 2021.