Table Of Content :

Home News Dutch Regulator Acts After Investigation Exposes Cruks Identity-Check Weakness

Dutch Regulator Acts After Investigation Exposes Cruks Identity-Check Weakness

From exclusive events and interviews to real-time market trends, Ace Alliance brings you unbiased, well-informed, and data-driven content. Our editorial team adheres to strict editorial standards, ensuring that the information you receive is not only relevant but also trustworthy.

Built by market experts hosting events since 2023, with our first event in Riga, Latvia gathering over 300 top level iGaming industry executives, Ace Alliance is able to provide you with reliable information from direct interaction with experts and leaders in the sector.

Altay Celikkaya

Content Manager

Updated: 04/09/26

Reading Time: 3 minutes

The Netherlands Gambling Authority, Kansspelautoriteit (KSA), is taking action after an investigation found that people registered in the Cruks self-exclusion system could enter Dutch gambling arcades and casinos using someone else’s identification. In its official response published on 3 September 2026, the regulator described the findings as a serious warning for the land-based sector.

The KSA said Cruks operated correctly when visitors were identified using their own documents. The weakness concerned the physical checks performed at venue entrances. Action is being taken towards the venues featured in the investigation, although no final findings or sanctions have been announced.

Kansspelautoriteit logo beside the Netherlands flag against a blue sky

Regulation & Compliance

Key Takeaways From the Cruks Investigation for Dutch Operators

The KSA says Cruks worked correctly when visitors used their own identification.
The reported weakness involved venue-level verification rather than a technical breach.
Operators must confirm that each visitor matches the identification being presented.
The KSA has started acting but has not announced sanctions or final findings.

Cruks Technology Was Not Breached

Cruks, also known as Gokstop, blocks registered individuals from licensed online gambling, gambling arcades and casinos. PowCrime found that some excluded people entered physical venues by presenting another person’s identification.

Cruks checks whether the identity submitted by a venue has an active exclusion. Staff must first establish that the document belongs to the visitor. If somebody else’s valid document is accepted, the register checks that document holder’s status instead.

The findings therefore do not show that Cruks was hacked or bypassed at system level. They point to a weakness in the human controls surrounding the technology.

Human Verification Remains Critical

The KSA said it published guidance in 2025 to clarify Cruks and identity-check requirements for gambling arcades. The latest case demonstrates that written procedures must be supported by consistent execution. Employees need to compare visitors with their documents, escalate uncertain matches and avoid relaxing checks for familiar customers.

The incident also highlights the difference between registering vulnerable players and enforcing their exclusion. Although recent changes to Cruks registration have accelerated entry into the system, that protection still depends on reliable controls at each physical venue.

Technology can check submitted identity data, but it cannot correct an inaccurate assessment by entrance staff. This reflects the KSA’s broadened player-protection approach, which increasingly focuses on whether safeguards work in practice.

Regulatory Action and B2B Implications

The KSA has not disclosed whether its action involves information requests, inspections or formal investigations. No fines, licence restrictions or other measures have been announced. The venues should not be described as sanctioned unless the regulator publishes a final decision.

Operators should review staff training, escalation procedures, busy-period supervision and controls preventing membership cards or other identifiers from being transferred. Technology suppliers may also face questions about how their systems support accurate verification.

The case forms part of a wider move towards evidence-based protection. Dutch initiatives include an open-source gambling risk model for assessing harmful online behaviour. Although it concerns online activity, the principle is comparable. A protection system only works when its output produces an effective intervention.