Curaçao Casinos Face New AML Compliance Deadline of 1 February 2027

The Curaçao Gaming Authority (CGA) has issued updated anti-money laundering, counter-terrorist financing and counter-proliferation financing regulations for the gambling sector, giving covered operators until 1 February 2027 to bring their procedures into compliance. The framework, which took effect on 1 November 2026, applies to land-based and online casinos and providers of other online games. It establishes requirements covering customer identification, risk assessments, sanctions screening, transaction monitoring, suspicious activity reporting and independent compliance testing.

The regulations form part of Curaçao's wider efforts to strengthen the supervision of its gambling industry under the revised licensing framework. The CGA is responsible for AML/CFT/CFP supervision of gambling activities operating in and from Curaçao, with the relevant obligations grounded in the National Ordinance on Identification when Rendering Services and the National Ordinance on the Reporting of Unusual Transactions. The updated requirements are intended to make these obligations operational across the sector and form part of the applicable gambling licence framework.

A central element of the rules is the requirement for operators to maintain documented risk assessments at both business and customer level. Businesses must assess the risks arising from their customer base, geographical exposure, products, services, transactions and distribution channels. The assessment must be reviewed at least annually and whenever significant changes occur, including the introduction of new payment methods, markets or games. Operators must document their methodology, information sources and conclusions and be able to provide this information to the competent authorities.

Individual players must also be assessed according to their risk profile. The regulations identify several circumstances that may require additional scrutiny, including disproportionate spending, the use of third parties to gamble on another person's behalf, multiple accounts and payment arrangements that make it difficult to establish the origin or destination of funds. Particular attention is directed towards transactions involving prepaid instruments, virtual assets, electronic wallets, third-party payment methods and transfers between player accounts.

The framework also addresses the risk that gambling accounts may be used primarily to move money rather than participate in genuine gaming activity. Depositing and withdrawing funds with little or no play, transferring balances between accounts and moving funds through multiple operators may indicate activity requiring further examination. These patterns are not automatically evidence of money laundering, but operators are expected to assess them in the context of the customer's profile, source of funds and wider transaction history.

Customer identification requirements include a significant distinction between the information required when an account is opened and the additional due diligence that must be completed when a financial threshold is reached. Operators must collect at least the player's name, permanent residential address and date of birth at account creation, and conduct politically exposed person and sanctions screening. Anonymous accounts and accounts opened under obviously fictitious names are prohibited.

The regulations identify XCG 4,000 as a central threshold for completing further customer due diligence in relation to financial transactions. Operators must monitor deposits and withdrawals from the beginning of the customer relationship, including relevant peer-to-peer transfers, and consider linked transactions when assessing whether the threshold has been reached. Once triggered, the operator must complete the customer risk assessment and outstanding verification measures. The threshold therefore does not permit anonymous or unidentified players to use gambling accounts until they reach that amount.

Where the required information is not obtained, restrictions apply to the player's account. If the threshold is reached through a deposit, further deposits and withdrawals must be restricted while the outstanding checks are completed, although the player may continue using funds already held in the account. Where the trigger is a withdrawal request, the account must be frozen and further gaming activity stopped. If the requested information remains outstanding 30 days after the threshold is reached, the relationship must be terminated. Reporting to the Financial Intelligence Unit (FIU) is required where the relevant circumstances give rise to a presumption of money laundering or terrorist financing.

Enhanced due diligence is required where higher-risk circumstances are identified. Depending on the circumstances, measures may include obtaining additional information about the customer's occupation, the purpose of transactions and the source of funds or wealth, securing management approval and applying more intensive ongoing monitoring. Simplified measures may be used where a lower level of risk has been established, but they are not appropriate where there is suspicion of money laundering or terrorist financing.

The regulations also place emphasis on unusual transaction reporting. Casinos must report unusual or intended unusual transactions to the Curaçao FIU without delay, in accordance with the applicable national reporting legislation. Operators must register with the FIU, obtain validated access to the goAML reporting portal and submit reports with supporting information in English. The framework also prohibits tipping off customers or third parties about reports or related FIU requests.

Governance and internal accountability are another significant part of the updated framework. Operators must maintain written AML/CFT/CFP policies and procedures, appoint an appropriately independent compliance officer at management level and ensure that the compliance function has timely access to customer identification records, transaction information and other relevant data. Senior management or the board must approve the AML programme, while employees must receive appropriate and continuing training. Outsourcing compliance activities or relying on third-party service providers does not transfer the operator's ultimate responsibility for meeting its obligations.

Independent testing is required at least annually. This may be performed by an adequately resourced internal audit function or an independent external party, provided that the reviewer is sufficiently separate from those responsible for implementing the controls. The review should examine customer files, transaction samples, suspicious activity reporting, staff training, record retention and the effectiveness of procedures for identifying unusual activity. Findings must be communicated to senior management, with corrective measures taken where deficiencies are identified. Customer due diligence and transaction records are generally subject to a minimum five-year retention period, with the applicable starting point depending on the type of record.

The requirements also address the risks arising from new products and technologies. Operators must conduct and document a risk assessment before introducing new products, business practices, delivery mechanisms or technologies that could create money-laundering or terrorist-financing vulnerabilities. Identified risks must be mitigated before implementation, and compliance personnel should be involved in reviewing proposed changes.

Although the updated framework provides detailed compliance expectations, questions remain about the extent to which existing requirements have been enforced across the sector. Several obligations concerning customer verification, transaction monitoring, sanctions screening, compliance officers and independent reviews were already present in Curaçao's earlier AML framework, including the regulations introduced in January 2025. The latest publication does not provide a detailed comparison of the previous and updated provisions, nor does it set out statistics on inspections, identified deficiencies, corrective measures or sanctions imposed against operators.

This distinction is important when assessing the significance of the new deadline. The November 2026 regulations establish an updated framework and a further implementation period, but the publication alone does not demonstrate how consistently operators have complied with the requirements already in force. Greater transparency regarding supervisory activity and enforcement outcomes would help operators and other stakeholders assess the practical effectiveness of Curaçao's regulatory reforms.

For gambling businesses, the immediate priority is to review existing AML programmes against the updated requirements before 1 February 2027. This should include assessing whether customer risk classifications are adequately documented, payment and gaming activity can be monitored together, sanctions and PEP screening operate effectively, and unusual transactions are escalated and reported without delay. Operators should also verify that their compliance officers have sufficient authority and access to information, that outsourced providers are appropriately supervised and that independent testing is supported by evidence of actual control effectiveness.

The new framework represents another step in the development of Curaçao's gambling regulatory regime. Its longer-term impact will depend not only on whether operators update their policies and systems before the deadline, but also on the CGA's ability to supervise implementation consistently and demonstrate that non-compliance is addressed effectively.

By fLEXI tEAM