Interview with a representative of Curacao Gaming Authority

Curacao carried out a deep reform of the regulation of online gambling: instead of the historical scheme of "master licenses" and sublicenses, a single regulator CGA (Curacao Gaming Authority) and a direct licensing regime for operators and critical suppliers were created. We spoke with a CGA representative about what it takes to successfully complete the application path, how to live in the new compliance regime and what to expect for the industry in the coming years.

Interview (Q&A)

1) Who would a Curaçao licence suit today?

Q: For which companies is the Curacao license relevant?

Answer (CGA): For operators and B2B providers willing to work in a transparent frame and comply with AML/CFT, KYC, Responsible Gaming, security and GGR reporting. We see interest from international brands with multi-geography and a hybrid payment basket (local methods + digital assets where allowed). Real risk control and mature infrastructure are important.

2) What types of permits exist?

Q: How are licenses structured now?

Answer: There are B2C licenses for operators (casinos, bets, lotteries, etc.) and B2B permissions for critical providers (gaming content, aggregators, hosting of critical infrastructure, RNG, payment/identification logic providers). We also identify key functions within the organization (compliance, AML, security, RG) for which we conduct inspections.

3) Transition from "sub-licenses" to direct licensing

Q: What is important for existing brands to know on sublicenses of the past regime?

Answer: There is a transition period: you need to apply for a direct license, bring contractual relations and processes in line with the new rules, ensure the continuity of services and reporting. We have specially released "bridge" requirements for logs, reports and SLAs so that the transition goes without harm to players.

4) Stages of obtaining a license

Question: What blocks does the process consist of?

Answer: Five key steps:

1. Fit & Proper - beneficiaries, directors, key functions; sources of funds, reputation, experience.

2. Business plan and financial stability - cash flows, reserves, insurance, stress response plan.

3. Policies and Procedures - AML/CFT, KYC/SoF/SoW, RG, Incident Management, Outsourcing, Security, Data Protection.

4. Technical architecture - segmentation of environments, monitoring, storage and integrity of logs, fault tolerance, integration with providers, control of releases and accesses.

5. Readiness check - system and technical audit to "go-live"; then scheduled inspections, especially in the first year.

5) Documents and artifacts: what's mandatory

Question: What do applicants most often fail to deliver?

Answer: Actual, not template policies, architecture diagrams with roles and trust zones, register of providers with SLA and audit rights, incident management procedures and BCP/DRP, register of affiliates with advertising control, personnel training plan (including front line), as well as reporting on RG indicators.

6) AML/KYC and finmonitoring

Q. What is the focus of AML/CFT checks?

Answer: Risk stratification of customers, correct onboarding KYC procedure, source of funds for high-risk segments, sanction and PEP screening, behavioral monitoring of transactions (velocity, jurisdictions, methods), quality of escalations and decision log. It is important that the front office understands the criteria and captures the logic of each case.

7) Responsible Gaming (RG)

Q: What are the minimum expectations for RG?

Answer: Deposit/loss/time limits, timeouts and self-exclusion, "reality checks," early interventions on behavioral risk patterns, understandable texts in the interface. Marketing should not conflict with RG signals; system of mandatory revaluation after interventions - plus.

8) Technical Audit and Security

Question: What is the tech audit looking at?

Answer: Logs and their integrity, correct billing and balances, RNG/provider integrations, API and key protection, separation of environments, control of access to production, monitoring and alerts, encryption of data "on disk" and "on the wire," PII minimization and compliance with local storage rules.

9) Server location and providers

Question: Is there a strict requirement to "host on an island"?

A: We look at controllability and auditability. It is important that the regulator and auditors have access to the necessary telemetry, logs and environments, regardless of the cloud/data center. Critical suppliers should undergo your risk assessment and be recertified regularly.

10) Payments, stablecoins and Web3

Q: How do you feel about crypto payments?

Answer: Possible within the framework of the law and the AML framework: targeted risk scoring, sanctions lists, monitoring of "fresh" addresses, partners understandable to him/off-ramp. The player must see commissions and ETAs; RG policies also apply to the crypto segment. Any innovations are through the prism of transparency and controllability.

11) White-label and outsourcing

Question: Is it possible to build a business on a white-label?

Answer: Yes, but the licensee is responsible. We need contracts with clear SLAs, auditor rights, an incident response plan, role boundaries and regular supplier reassessment. For critical services, increased transparency requirements apply.

12) Affiliates and Marketing

Question: How to control partners?

Answer: Enter the register of affiliates, advertising rules (age, geo, fair offers), traffic verification mechanisms, stop-list and regular checks of creatives. The operator is responsible for the promises of affiliates and must respond quickly to violations.

13) Timing and planning

Question: How to speed up the passage?

Answer: Come with ready-made policies and charts, a contractual framework, certain key functions and a pilot infrastructure with logs and monitoring. The most frequent delays are the elimination of AML/RG comments and the "bringing" of the technical architecture to the audit.

14) Typical errors of applicants

Question: What most often leads to failures or long-term improvements?

Answer:

"Copy-paste" policies without connection to real processes.
Unclear roles and accesses, lack of segregations of duties.
Weak cash flow tracing and SoF/SoW.
No RG metrics and early intervention scenarios.
Unformed relationships with providers/affiliates and lack of audit rights.
Erratic log of incidents and releases.

15) What "mature" compliance looks like after launch

Q: What makes a good licensee different?

Answer: Culture of continuous compliance: planned internal audits, metrics and alerts on AML/RG/security, policy updates, staff training, infrastructure change log, regular re-certification of suppliers, timely reporting on GGR and key incidents.

Practice: checklists and roadmaps

Application preparation checklist

Transparent ownership and beneficiary structure; key feature profiles.
Full set of policies: AML/CFT, KYC/SoF/SoW, RG, incidents, outsourcing, information security, risk management.
Architecture diagrams, access differentiation, release processes, monitoring and logs.
Critical supplier contracts: SLAs, audit rights, incident plan.
Registries: affiliates, incidents, complaints, releases; personnel training plan.
Financial plan: reserves, insurance, stress scenarios.
Metrics showcases: AML alerts and outcomes, RG indicators, SLO critical flow.

90-day roadmap for new applicant

Weeks 1-3: gap analysis, assignment of key functions, draft policies, primary architecture and logging schemes.

Weeks 4-6: AML/KYC/RG finalization, provider contracts, pilot monitoring and event log.

Weeks 7-9: dry audit (internal/external), fixation of SoF/SoW processes, BCP/DRP stress test.

Weeks 10-12: submission of an application, revision of comments, preparation for technical audit and operational inspections.

Curaçao's new regime is direct, transparent and managed licensing. Those who come with real processes, mature architecture, reporting discipline and respect for RG/AML requirements are successful. CGA is committed to balance: giving the industry innovation and flexibility while providing risk control and player protection.