Curaçao Keeps Licensing Without Its Portal, but the Interim Rules Due by 9 October Have Not Appeared

A week after scrapping the licensing portal at the centre of the Casino Secrets leak, the Curaçao Gaming Authority is still adding licences to its register and has moved its forms to its main website. It has not published how applicants and licensees should file anything while the portal is gone.

• The Curaçao Gaming Authority (CGA) said on 7 October that details of interim licensing arrangements were targeted for "no later than October 9, 2026", and by 15 October no such notice had appeared on its website
• Licensing has not stopped: the CGA's online licence register, updated on 14 October, lists 10 licences with issue dates from 9 to 20 October, each running for six months
• On 12 and 14 October the CGA moved its application forms and policies from the portal it has abandoned to its main website, but several still tell applicants to upload to that portal
• The register lists 296 licences as "Assessment in progress", 290 of them past the six-month expiry date shown against them, alongside 209 licences marked indefinite
• The leaked archive drawn from the portal states that it holds 40,000 documents, which Follow the Money says include passports and tax returns; the CGA has not said what was taken

The Register Is Moving While the Filing Channel Is Not

The Curaçao Gaming Authority (CGA) said in a notice dated 7 October that its online gaming portal "will not be returned to service", and that licensing, compliance and supervision would continue "through alternative arrangements while an interim solution is being implemented". Further information was "currently targeted for no later than October 9, 2026". On 15 October the CGA's news page still listed the 7 October notice as its latest item, and nothing on its website described those arrangements. Whether the regulator has written to licensees directly is not public.

The portal, which Casino News Daily says had been active since September 2023, was the channel for licence applications and for periodic, incident and change reports under the National Ordinance on Games of Chance (LOK). A CGA notice of 2 October told applicants not to email portal material to its egl-applications mailbox, and postponed portal deadlines until the portal returned. It will not, and portal.cga.cw now redirects to the CGA's homepage.

The register shows the licensing side still turning. The online gaming licence register, marked as last updated on 14 October, lists 10 licences with issue dates between 9 and 20 October, six business-to-consumer and four business-to-business, each with an expiry date six months later. Four carry dates after the register's own update. In all it holds 666 entries, of which 559 are neither expired nor revoked: 209 marked indefinite, 296 marked "Assessment in progress" and 54 with no status shown. Of the 296, 290 are past the six-month expiry date listed against them. The register does not define the status, but the CGA's fee policy describes provisional licences valid for six months and extendable for a further six before a full licence is granted.

The Forms Have Moved, the Instructions Have Not

Until the breach, the CGA's online gaming forms and guidance sat on the portal; a September snapshot of its main online gaming page carries none of them. The page now lists five application forms and 13 policy documents with file names dated 12 October, plus forms for alternative dispute resolution providers and gaming test houses dated 14 October, all served from the file store behind the CGA's main website.

The texts have not caught up. The Business and Corporate Information Form tells applicants to "follow instructions on the portal" and to upload a screenshot of their goAML registration "onto the portal". Version 11 of the change of control procedure says documents must be submitted via the CGA Portal and that a support ticket must then be opened there. The B2C operations manual guidelines also say the manual must be uploaded to the portal.

The seal is in the same position. The certificate site at cert.cga.cw, where licensed sites' seals lead, still loaded on 15 October. The CGA said on 7 October that the seal "will be affected" and that an alternative would follow "shortly". None has been published.

What the Portal Held

The German researcher Lilith Wittmann has written that she first logged into the portal under a false identity on 3 December 2025 and within eight hours could read every application and document submitted. She says applications include identity documents, proof of assets and criminal record extracts for owners and directors. The CGA confirmed in September that the intruder used an applicant account registered under a false identity, and said it would not repeat figures it could not verify.

The archive Wittmann published with European media partners states that it holds 40,000 documents. Follow the Money says the cache identifies about 800 owners of nearly 650 licensed companies and includes passports, tax returns and sensitive financial information. The CGA said on 17 September it would notify affected parties directly if its investigation found their information was affected. It has not said publicly whether it has.

The 7 October notice does not name the provider whose service arrangements are ending. Wittmann's reporting describes two outside firms working in the portal: Random Consulting Limited of Malta, which she says is owned by Mario Galea, a former head of Malta's gaming regulator, and which handled due diligence and developed the platform; and HSJ Consult of Cyprus, which she says carried out suitability assessments. Random Consulting has said it designed, developed, hosts and maintains the portal. Neither firm nor the CGA has said publicly whether either arrangement continues.

Licensing Without a Filing Channel Strains the LOK's Own Clocks

Under Article 5.1 of the LOK, licence applications run in two phases and the CGA has eight weeks to decide each, extendable by four. Those clocks start when documentation is received, and there is no published way to send it. New licences show the CGA can still decide files already in hand, which helps applicants near the finish. It does nothing for companies whose documents were due on the portal when it went dark, or for the 296 licences still shown under assessment. A regulator that keeps decisions flowing while the inputs are frozen will eventually run out of files it can decide.

Silence Past a Self-Set Date Costs More Than a Late Notice Would

The CGA chose the 9 October date itself, and moving its forms shows work is under way. But licensees, payment providers and affiliates now hold a seal the regulator has qualified and forms that point to a portal it has retired. Missing a date by days is a small failure. Leaving the market to infer the interim process from a document library is a larger one, because it invites each counterparty to set its own standard of proof. For a regime built on the claim that Curaçao now knows who it licenses, the ownership files at the centre of the leak make that clarity more pressing.

Curaçao has kept granting licences through the loss of its licensing system, which is more than many expected a week ago. What it still has to publish is how the market should file with it, and how anyone can confirm a licence is real.