Curaçao Gaming Authority Plans New In-House Licensing Portal

The Curaçao Gaming Authority (CGA) plans to develop and operate its own licensing platform after unauthorized access to an externally managed system exposed confidential information belonging to licence holders. The regulator has ended its use of the affected portal and is preparing replacement technology while maintaining its licensing responsibilities.

The move advances the authority’s effort to reduce dependence on outside providers. It also places the handling of sensitive operator information at the centre of a transition that must support continuing regulatory work.

Existing licences remain valid despite the permanent closure of the previous gaming portal. Licensed businesses must continue fulfilling their obligations while the CGA changes the systems through which it administers their authorisations.

Replacement Portal Requires Security Checks

The CGA discovered the breach on September 17 and attributed the unauthorized access to a German security researcher. Its account places the access between December 2025 and September 2026. The incident affected the licensing portal and its database, both of which an external company managed.

After discovering the intrusion, the authority investigated internally and strengthened security measures. It subsequently took the portal offline for an external examination before deciding to discontinue the system and terminate the provider’s regulatory services.

A temporary portal will support applications and supervisory matters during the transition. Preparations include checks for vulnerabilities that could permit unauthorised access, alongside testing to establish whether the system works properly for operators and regulatory staff.

The authority identified its internal system, digital seal and licence register as ready for independent security testing. It also outlined adjustments to the client portal before that component undergoes security checks.

The digital seal allows a website to demonstrate that it holds a CGA licence. Keeping licence verification available therefore forms part of the replacement arrangements, alongside the tools staff use to administer regulatory work.

The CGA has not announced a final completion date for its permanent, internally managed platform.

Investigation Continues Alongside Data Removal Efforts

The authority has filed formal complaints in Curaçao and Germany, with another complaint lodged in the Netherlands. It has also engaged specialist companies to seek the removal of leaked information from online locations.

An independent forensic investigation will establish the breach’s impact and help determine remedial measures. The regulator is considering civil legal action as part of its response.

The full extent of the information exposed remains unclear, and investigators have yet to publish final findings. The continuing examination will inform the authority’s assessment of the consequences for affected licence holders.

“Closing the previous portal does not invalidate existing licences,” the authority said.

That clarification preserves operators’ existing authorisations while the technology changes. The closure also leaves their compliance responsibilities in force throughout the transition.

Internal Technology Supports Wider Licensing Reform

The replacement project follows the broader overhaul of Curaçao’s gambling licensing framework. In 2023, the Ministry of Finance instructed the then Gaming Control Board to reform online gambling oversight.

International criticism of the former licensing model contributed to that decision. Growing player complaints and negative media coverage also influenced the reforms, alongside agreements with the Netherlands.

The Landsverordening op de Kansspelen, commonly known as the LOK, came into force in December 2024. It replaced the master licence and sublicence structure and placed online operators under direct CGA supervision.

The authority initially used outside technology and regulatory expertise while building its own capabilities. An externally managed portal supported applications and supervision from 2024.

Since the reforms began, the CGA says it has recruited 14 employees, mainly for licensing and supervisory work, with enforcement also within their remit. Developing local expertise and assuming direct responsibility for its technology remain part of the regulator’s longer-term plans.

Source: 

Curaçao Regulator Brings Licensing Tech In-House, LCB.org, October 22, 2026.