Curaçao Gaming License Reform and Infrastructure Readiness: An Operator’s Guide

The global online gambling market is not slowing down. Grand View Research estimates that it will grow from USD 97.7 billion in 2026 to USD 202.8 billion by 2033. But growth is arriving with closer scrutiny of how operators identify players, monitor risk and move funds.

Curaçao is a good example of that shift. It is one of the world’s most established iGaming licensing jurisdictions, and its importance extends well beyond the island itself.

For years, Curaçao was associated with a relatively simple master licence and sublicence model. That era has ended. The National Ordinance on Games of Chance, better known as the LOK, came into force on 24 December 2024. Existing licences issued under the former NOOGH regime were converted into provisional LOK licences, while the Curaçao Gaming Authority, or CGA, took direct responsibility for licensing and supervision.

The important change is not the name on the licence or the seal in a website footer. It is the direct chain of accountability behind the operation. Operators now need to show that their policies, people and systems work together in practice.

What the new licence requires in practice

Under the reformed framework, applicants must be entities incorporated under Curaçao law, have a statutory seat on the island and maintain local management that meets the CGA’s requirements. The local substance policy also requires most licensees to maintain dedicated office space in Curaçao and have at least one additional qualifying Key Person who works full-time and is registered there. Limited exemptions may apply to smaller operators that are genuinely new to the market.

The technical side matters just as much. Current online gaming licence conditions require documented policies and procedures covering customer identification and verification, player accounts and funds, responsible gaming, information security, AML/CFT, and account suspension or closure.

They also require critical information about players, gaming activity and financial transactions to remain accessible to the CGA through a server hosted in a Tier IV-certified data centre in Curaçao. Certain incidents must be reported within 24 hours.

In practice, written policies must be supported by working systems. If a player is identified as high risk, for example, the platform should apply the appropriate restrictions, send the case for review and retain a clear record of the decision. Compliance can no longer be treated as separate paperwork. It has to be built into everyday operations.

KYC begins at registration

Identifying a player and verifying their identity are not the same thing. Identification involves collecting the player’s personal details, while verification means confirming that the information is accurate using reliable sources.

Under the CGA’s AML/CFT rules, operators do not need to complete every verification check as soon as a player opens an account. But KYC still begins at registration.

Operators must first collect the player’s full name, permanent residential address and date of birth, and screen them against PEP and sanctions lists. The remaining customer due diligence checks must be completed by the time the player’s cumulative deposits, withdrawals and peer-to-peer transfers reach XCG 4,000, equivalent to approximately USD 2,235. Additional or enhanced checks may be required sooner if the player or their activity presents a higher risk.

Waiting until the threshold is reached can create problems. Withdrawals may have to be stopped while checks are completed, suspicious funds may already have entered the platform and legitimate players may face additional verification at the worst possible moment.

A more practical approach is progressive KYC, starting with proportionate checks at registration and requesting further verification when the player’s activity or risk profile changes. This may be triggered by a new payment method, an expired document, unusual transactions or activity linked to a high-risk country.

KYC also continues after onboarding. Operators must keep player data up to date, monitor transactions and investigate activity that does not match the customer’s profile. Relevant records must generally be kept for at least five years after the business relationship ends.

AML and KYC rules apply to crypto too

The CGA makes clear that using crypto does not exempt operators from their existing AML and KYC obligations. Licensed operators may accept crypto for gaming purposes, but they must not act as a cryptocurrency exchange, payment service provider or virtual asset service provider.

Operators must use transaction-monitoring tools capable of screening wallets, tracing the source and destination of funds and identifying links to sanctioned addresses, mixers, fraud or other prohibited activity. Wallets should be screened at both deposit and withdrawal.

KYC is an important part of this process. A wallet address alone does not identify the person behind a transaction. Operators must be able to connect the wallet to a verified player and, where a self-hosted wallet is used, confirm that the player owns or controls it. If a withdrawal is made to a different wallet, that wallet must be screened and verified as belonging to the same customer.

The requirements are being introduced in stages. Licensees must upload a compliant crypto policy to the CGA portal by September 2026. Crypto risk assessments, checks on third-party providers, wallet ownership controls, transaction-monitoring procedures and relevant staff training must be completed by December 2026. Full implementation of the remaining controls is required by June 2027.

Five questions to test operational readiness

The new framework includes detailed requirements, but operational readiness comes down to a simpler question: can operators demonstrate that their KYC and compliance controls work in practice? These five questions provide a useful starting point.

Can you prove who the player is and how their identity was verified?

Verification records should clearly show which checks were completed, when and what information was used.

Can your KYC process adapt when the player’s risk changes?

New payment methods, unusual activity or higher-risk locations should trigger additional checks where necessary.

Can you link a verified player to the accounts, payment methods and crypto wallets they use?

Operators need a clear connection between the customer’s identity and the financial activity associated with their account.

Can you retrieve the evidence behind each decision quickly?

Documents, screening results and review histories should be readily available for internal checks or regulatory scrutiny.

Can your KYC process scale?

As player volumes grow, routine checks should remain fast, accurate and consistent without causing unnecessary delays for legitimate players or increasing the workload the operator.

How X-faces supports KYC readiness

The new framework requires operators to verify players reliably without making onboarding unnecessarily difficult. X-faces helps with the identity-verification part of this process.

Players can upload an identity document, take a selfie and complete a liveness check in one flow. X-faces reads the document data, confirms that the person matches the ID and sends the verification result to the operator.

These checks can be carried out during registration or later if a risk signal calls for stronger verification. This allows operators to take a progressive approach to KYC, keeping the process simple for legitimate players while applying closer scrutiny to higher-risk cases.

X-faces also provides a clear record of how and when each identity was verified. It does not replace transaction monitoring, crypto wallet screening or the operator’s compliance judgement. Instead, it provides a fast and consistent identity layer that can work alongside the operator’s wider AML and risk systems.

Operational readiness is the real test

Curaçao’s reform is more than a change in licensing structure. Operators must be able to demonstrate that their KYC and compliance controls work consistently in day-to-day operations.

In practice, this means applying the right checks at the right stage, automating routine verification, referring higher-risk cases for further review and keeping clear records of the results. When these processes are designed well, this gives operators stronger control without slowing down onboarding or placing extra pressure on internal teams. Reliable, well-documented processes are important for CGA supervision.

X-faces helps iGaming operators automate key identity checks and receive clear verification results. Straightforward cases can be processed automatically, while those requiring closer attention can be flagged for further review.

X-faces — identity verification for a digital world.