Curaçao Gaming License 2026: LOK Fees, CGA Review Phases, and Technical Compliance
The Curaçao gambling license stopped being a formality on 24 December 2024, when the National Ordinance on Games of Chance (LOK) dissolved the master license system and handed direct licensing to the Curaçao Gaming Authority. Most guides still price the jurisdiction on fees. Fees are the easy part. This one covers what the CGA now actually inspects: the two-phase review, the security control baseline, the hosting and reporting architecture, and the supplier deadline sitting five months out.
Operators need that detail because the failure modes have moved. A license is revoked on day 71 for a missed invoice, an incident goes unreported past 24 hours, or a game studio in the stack turns up absent from the CGA register — none of those are legal problems, they are platform problems. NuxGame covers that side of the obligation with certified content, wallet and reporting architecture, and back-office configuration control across the online casino platform.
Key Takeaways
What a Curaçao Gambling License Covers Under the LOK
The LOK (P.B. 2024, no. 157) ended the NOOGH master license system on 24 December 2024. Four master license holders once sat between the operator and the state, selling sub-licenses with thin oversight. That intermediary layer is gone. The body operators once known as the Curaçao Gaming Control Board now operate as the CGA, sole regulator of the online gambling sector and its AML/CFT supervisor. All licenses in Curaçao are issued directly and recorded in a public register.
Two categories replaced the old structure. The B2C authorization covers remote games of chance offered to players. The supplier category covers critical services and goods. The LOK prohibits anyone from offering online gaming in or from Curaçao without authorization, and that prohibition extends to any entity controlling player databases or player transactions.
What the B2C authorization covers in one grant:
- Online casino: slots, table games, video poker, crash and instant-win formats
- Live dealer content streamed from certified studios
- Sportsbook: pre-match, in-play, and esports markets
- Peer-to-peer poker and bingo
- Lottery and virtual sports products
There is no per-vertical approval step, which is a real operational difference from Malta. The most misreported detail concerns duration. Under the indefinite-term license conditions effective 17 December 2025, a definitive license is granted for an indefinite period, subject only to license suspension or revocation. Annual fees still recur. The license itself does not expire.
Curaçao Gaming License Cost in 2026: The Full LOK Fee Schedule
The application fee is EUR 4,592 for both categories, non-refundable, and the CGA does not begin processing until it clears. Add EUR 150 per UBO and per qualified interest holder — anyone with 10% of share capital or voting rights. A listed UBO entity costs EUR 2,551. Fees are flat, not a percentage of gross gaming revenue.
Annual fees are where the two categories diverge. A B2C operator pays EUR 47,450, split across two simultaneous invoices from two payees. A B2B licensee pays a single supervisory fee of EUR 24,490. Both fall due in full by 15 January. The Green Seal is not issued until the first invoice is settled.
| Fee item | B2C operator | B2B supplier |
|---|---|---|
| Application fee (one-time) | EUR 4,592 | EUR 4,592 |
| UBO / qualified interest holder | EUR 150 each | EUR 150 each |
| License fee — National Treasury | EUR 24,490/yr | Not applicable |
| Supervisory fee — CGA | EUR 22,960/yr | EUR 24,490/yr |
| Total annual | EUR 47,450 | EUR 24,490 |
| Add a main domain | EUR 250 | Not applicable |
| Certificate application | EUR 383 | EUR 383 |
| Change or add a UBO | EUR 128 | EUR 128 |
The collection timetable in the published LOK fee schedule deserves a calendar entry in finance, not legal. Invoices fall due in 14 days. Reminders land on day 15 and day 29. Day 43 brings a notice of intended suspension, day 57 a formal 21-day suspension, and day 71 revocation plus removal from the public register. A missed invoice, not a failed audit, is the fastest route to losing a license.
Gaming License Application: Two Phases and the Provisional Trap
Phase one tests integrity and financial stability: UBO identity, source of funds, criminal record, liquidity to pay winnings. The applicant company must already be registered in Curaçao when it files, and everything moves through the CGA online gaming portal — there is no route outside it. Phase two tests regulatory and technical readiness. The CGA targets eight weeks per phase once documentation is complete, extendable by four weeks each. Regulator time alone can therefore reach 24 weeks before any full Curaçao gaming license issues.
The mandatory refusal grounds read better as a pre-submission checklist than as legal text. A gaming application fails on any one of them, regardless of how strong the rest of the file looks.
- UBOs, qualified shareholders or policy-makers cannot be identified and verified
- A conviction in the past eight years for theft, fraud, extortion, money laundering or terrorist financing
- Source of funds cannot be traced, or links to criminal activity
- Outstanding tax or social security liabilities
- Any policy-maker linked to an operation whose license was suspended or revoked
- Insufficient liquid assets to pay expected prizes
- No responsible gaming policy, no CGA-approved ADR provider, or no goAML registration
Applicants who miss non-critical requirements may receive a provisional license instead of a rejection. That license is valid for six months, extendable once by six, and converts only once the applicant satisfies the full license requirements. Treat it as a commercial liability rather than a soft landing: payment processors, acquiring banks and premium studios price provisional status as counterparty risk. Build the phase-two evidence pack before phase one clears, and note the six-week objection window.
The 24 December 2026 Supplier Registration Deadline
Article 1.5(1) LOK makes a supplier license mandatory only for suppliers established in Curaçao. Foreign platform providers, aggregators and studios do not need one. They do need to register with the CGA. The transitional period expires on 24 December 2026, exactly two years after the LOK entered into force.
Article 5.16(4) is the clause that turns a vendor obligation into an operator obligation: holders of a CGA license may not obtain critical services or goods from suppliers that are not registered with the authority. The register covers every provider of critical online gaming services — content, odds, settlement — and it is public. From the deadline, an unregistered vendor in the stack is a compliance defect on the operator side.
Suppliers the CGA currently treats as critical:
- RNG game manufacturers and live dealer studio providers
- Poker and other peer-to-peer software suppliers
- Sportsbook software, bet capture and settlement providers
- Sports betting line and odds providers
- Lottery providers and game aggregators
The supplier registration announcement of 24 June 2026 urged locally incorporated suppliers to file by 1 September 2026, with registration for foreign suppliers expected to open in October. Two actions follow for product teams. Map every integration against the register before Q4. Then remember Article 4: adding a supplier, or a domain, requires prior CGA consent. NuxGame reduces the surface area of that audit by consolidating content from 140+ studios behind one aggregation contract and one API, so operators evidence a single critical-services relationship instead of dozens.
Operators tend to audit their vendor stack the way people audit a garage — once it is already full. The December register does not care how long a studio has been in the build. Map every critical supplier now, while the fix is a conversation and not a takedown.
Denis Kosinsky
Chief Product Officer, NuxGame
Information Security Control Requirements: CIS IG1, ISO 27001 and the 24-Hour Clock
In April 2026 the CGA published binding information security control requirements for B2C and B2B licensees. Article 7 of the license conditions already demanded equipment and application software aligned with international gaming standards; April 2026 attached numbers to that sentence. The enforceable baseline is CIS Implementation Group 1 — 56 safeguards of essential cyber hygiene — mapped throughout to ISO/IEC 27001:2022 Annex A.
Compliance is a condition of licensure. IG1 must be implemented within 12 months of license issuance, with IG2 recommended inside 24 to 36 months. Operators demonstrate it through annual self-assessment on CGA templates, independent third-party security audits (mandatory for online operators), and incident reporting. Any incident affecting gaming integrity, player funds or personal data goes to the regulator within 24 hours of confirmation.
| Control area | What the CGA requires | Evidence the auditor asks for |
|---|---|---|
| Access control | MFA on all internet-facing apps, VPN/RDP and admin access | IdP policy export, MFA enrollment coverage |
| Credentials | 8-char minimum with MFA, 14-char without; dormant accounts disabled after 45 days | Quarterly account inventory review |
| Vulnerability management | Scans at least monthly; OS, software and firmware patched monthly | Scan reports, patch approval log, exception register |
| Logging | Centralized, tamper-resistant collection of wagering, payout and admin events | SIEM retention config, hash or WORM integrity check |
| Backups | Automated weekly minimum; daily or real-time for transaction logs | Documented RPO/RTO plus restore test results |
| Data retention | Gaming transaction records retained for 5 years | Retention schedule per data classification |
| Feed integrity | Mutual TLS on API connections; signature or hash verification on inbound data | Cert inventory, anomaly and latency monitoring alerts |
The data feed integrity clause is the one most teams underestimate. Sports odds, live results and aggregated game outcomes must arrive over authenticated encrypted channels, be validated for tampering, and be monitored for availability, latency and consistency. Operators must also document how they suspend affected wagering markets when feed integrity cannot be assured, and how they resume.
Hosting and Wallet Architecture: Tier IV in Curaçao, Cloud Everywhere Else
Article 13.6 of the license conditions is precise: critical information about players, their gaming transactions and their financial transactions must remain accessible to the CGA through a server hosted in a Tier IV certified data center located in Curaçao. That is a regulatory access requirement. It is not an instruction to migrate an entire production platform onto the island.
The workable pattern is hybrid, and most online gaming businesses now run one. Production sits where latency and capacity dictate, while a regulatory data replica sits in the Curaçao facility. Cloud hosting stays explicitly permitted, assessed under the shared responsibility model, provided the licensee documents which controls the provider owns, and retains that provider’s SOC 2 or ISO 27001 evidence.
Architecture checklist before phase two:
- Replication lag budget between the production ledger and the Curaçao regulatory store
- Immutable, append-only log store for game events, payouts and admin actions
- Segregated bank account for player funds, with ring-fencing evidence for the liquidity test
- Single wallet ledger across casino and sportsbook, so balances reconcile without manual transfers
- Crypto controls: no currency exchange inside the player account, no investment products, payouts in the currency played
Payment design follows the same logic. All transactions between licensee and player must run through the player account, and card flows remain in scope for PCI DSS requirements regardless of what the LOK says. NuxGame handles this layer through a seamless wallet integration — one balance, no inter-product transfers — plus payment routing across 180+ currencies and a back office where market, product and payment rules are configured per brand.
What a Curaçao License Does Not Buy: US Traffic and Geo-Control
Curaçao as a jurisdiction licenses the operation, not the market. Article 3 obliges the license holder to comply strictly with the laws of every jurisdiction where games are offered. A Curaçao online gambling license therefore confers no authorization in the United States, where online casino and sports betting are licensed state by state.
Online gambling businesses pursuing US traffic need state licensure, a tribal arrangement, or a different product structure such as sweepstakes. Curaçao remains the pragmatic base for global and gray-market operations, banking recognition and crypto acceptance, while the UK Gambling Commission and the Malta Gaming Authority cover the regulated European perimeter. Most multi-brand groups run more than one license and route traffic accordingly.
Geo-control obligations that sit in the platform, not the policy:
- IP-level blocking of prohibited markets, with proxy and VPN detection
- Market-level enablement of games, payment methods and bonus logic
- Responsible gaming measures — deposit limits, self-exclusion, session reminders — enabled per market
- Domain scope aligned to the CGA register, since each main domain needs consent and a EUR 250 fee
- Terms and conditions served in English and in the target market language
Because the CGA approves domains individually and requires prior permission before adding one, mirror-domain strategies and affiliate landing pages need governance. Back-office configuration control is the difference between a routine change report and a critical change breach.
Technical Snapshot
| Dimension | 2026 requirement |
|---|---|
| Legal basis | LOK, P.B. 2024 no. 157, in force 24 December 2024 |
| Licensing authority | Curaçao Gaming Authority (CGA); filings through the online portal only |
| License types | B2C online gaming license; B2B supplier authorization (no hybrid) |
| Corporate form | Entity incorporated under Curaçao law, statutory seat on the island, resident managing director |
| Review time | 8 weeks per phase, extendable by 4; two phases |
| Provisional license | Valid 6 months, one 6-month extension |
| Definitive license | Indefinite term, subject to suspension or revocation |
| Year-one government cost (B2C) | From EUR 52,042 |
| Security baseline | CIS Controls IG1 (56 safeguards), ISO/IEC 27001:2022 mapped |
| Incident reporting | CGA notified within 24 hours |
| Data residency | Regulatory access via Tier IV certified data center in Curaçao |
| Content certification | All games certified by a CGA-approved test lab |
| Supplier deadline | Registration of all critical suppliers by 24 December 2026 |
| Ongoing reporting | Change, incident, player transaction, complaints and ADR reports |
Bottom Line
A Curaçao gambling license in 2026 buys entry to a mid-tier regulated gaming jurisdiction at a mid-tier price. Around EUR 52,000 in year-one government fees carries no per-vertical approvals and no GGR-linked compliance contributions, which is why operators still choose it over Malta — but it now demands evidence, audits and local substance. The cheap-and-easy era ended with the master license system, and the gaming industry has priced that in.
Licensing decisions fail on implementation, not on paperwork. A 24-hour incident pipeline, a Tier IV regulatory replica, certified content and a clean supplier register are an engineering programme for any gaming business planning a 2026 launch.
The NuxGame platform covers that layer end to end: GLI-19 certified technology, sportsbook, seamless wallet, payment routing across 180+ currencies, and back-office control over markets, domains and responsible gaming configuration — with licensing consulting alongside it. Book a technical walkthrough before the December register closes.