The Curaçao Gaming Authority’s portal breach exposed more than a security question. Follow the Money reported cases in which licences were granted while questions about ownership remained unanswered. The CGA says individual documents must be considered within the context of complete applications. For iGaming partners, the dispute raises a practical question about what a licence establishes and what they must still verify themselves.
Unauthorised access to the CGA portal continued from December 2025 until September 2026.
The CGA has not established the full extent of the material obtained.
Follow the Money and the CGA disagree over what individual licensing records show about unresolved ownership questions.
The CGA register identifies licensed entities and recorded licence details but does not guarantee current validity.
A Curaçao licence does not replace independent ownership, domain and market-access checks.
In its 17 September press release, the CGA confirmed unauthorised access to its online gaming portal. It said the access had been contained, the source identified and incident-response procedures activated with its service provider. Its initial investigation found no compromise of the authority’s core technical infrastructure.
The regulator’s 22 September follow-up added a significant detail to the timeline. According to the CGA, the account was registered in December 2025 using a false identity involving a variation of a real person’s name and an existing company listed in the Curaçao Chamber of Commerce register. The access continued until it was identified and ended in September 2026.
The CGA said:
The full extent of the material obtained has not yet been established.
Containment does not establish which application materials were viewed or obtained, while the nine-month access period does not prove that every licensee was affected. The initial Ace Alliance report on the breach examined this gap between containment and certainty.
Follow the Money says its examination found licences granted despite unanswered questions about who owned or controlled some businesses. The CGA disputes conclusions drawn from separate documents and says applications are assessed through the full file, including submitted evidence and follow-up questions.
That is a substantive disagreement. Partners should not assume that an issue recorded as unresolved was necessarily settled before a licence was granted. They should also avoid treating one document as proof that a licence is invalid or that misconduct occurred. Neither position removes the commercial need for current, independently verified information.
Regulatory approval confirms that an entity entered the Curaçao licensing framework. It does not show whether its ownership, contracts or operations remain unchanged, particularly when the brand, licence holder and contracting company are different group entities.
The CGA licence register identifies entities recorded as licensed and provides their listed licence details. However, the CGA warns on the same register that its published overview does not guarantee current validity because licence status can change. The register should therefore be treated as an essential starting point rather than a permanent assurance.
Commercial teams should retain dated evidence and clarify any uncertainty concerning an entity, certificate, domain or status. The Ace Alliance guide to Curaçao gaming licences explains the jurisdiction’s move from the former master-licence structure to direct supervision.
The breach does not make a Curaçao licence meaningless. It shows why regulatory status and counterparty risk should be treated as related but separate assessments.
| Due-diligence question | What the partner should examine | Why it matters |
|---|---|---|
| Who holds the licence | Legal entity, licence status, certificate and approved domains | The licensed company may differ from the brand or contracting party |
| Who owns and controls the business | UBO records, directors, corporate structure and authorised representatives | Ownership and decision-making risk may not be visible from the consumer brand |
| What activity the relationship supports | Products, domains, brands, payment flows and technical roles | The proposed service may extend beyond the licensed scope presented during onboarding |
| Where players are accepted or targeted | Local permissions, restricted-market controls, geoblocking and marketing activity | A Curaçao licence does not automatically authorise activity in another jurisdiction |
| Whether information remains current | Corporate filings, source-of-funds evidence and change notifications | Licence status does not remove the need for continuing monitoring |
The CGA’s official licence conditions require licensees to comply with the laws of the jurisdictions where they offer remote gambling. A Curaçao licence therefore does not settle whether an operator may accept or actively seek players in another country.
Affected businesses should identify what they submitted during the access period, preserve relevant records and review notification obligations. Banks, suppliers, investors and payment providers may request updated information.
A Curaçao licence remains important regulatory evidence, but it should be tested against the entity, ownership structure, approved operations and markets involved. For B2B decision-makers, it is the beginning of the assessment rather than the end.
