Curaçao Sets 2027 Deadline for Crypto Gambling Controls
The Curaçao Gaming Authority has issued crypto policy guidance for B2C online gambling licence holders under the LOK framework, with operators required to reach full implementation by June 2027. Published in June 2026, the policy covers deposits, wallet architecture, withdrawals, treasury wallet controls and incident reporting across licensed operators and any group entities that support their crypto activity.
Crypto does not sit outside Curaçao’s AML/CFT rules. Operators must document their crypto-specific controls in the AML policy submitted through the CGA portal, and crypto assets are treated as high-risk by default.
Immediate Bans and Phased Compliance
Several activities face prohibition with immediate effect. Licence holders cannot act as exchanges, custodians or virtual asset service providers. Funds from sanctioned wallets, mixers, tumblers, personal wallets, UBO-linked wallets or informal wallet arrangements are also banned.
Three compliance stages define the transition period. Within three months, operators must submit a crypto policy to the CGA portal. Within six months, crypto risk assessments, VASP due diligence, wallet control procedures and staff training must all be complete.
Full implementation arrives by June 2027. At that point, wallet segregation, blockchain analytics capability, withdrawal whitelisting, transaction reconciliation and audit-ready records must all be in place. The CGA retains authority to demand faster compliance where material risk is identified.
Blockchain Analytics Becomes Mandatory
All operators must screen deposits, monitor transactions, risk-score wallets and check withdrawals. Fund origin tracing, identification of exposure to sanctioned addresses and production of evidence for suspicious activity reports are each required.
No single provider is mandated. Chainalysis, Elliptic and TRM Labs appear in the guidance as examples, not requirements. Each operator must demonstrate that its chosen tools can deliver the full control set.
For operators that rely on third-party payment infrastructure, the accountability point is clear. VASP relationships require documented due diligence. Outsourced payments do not shift regulatory responsibility away from the licence holder.
Asset Rules Tighten Around Privacy Coins and Bridges
Fiat-backed regulated stablecoins are the CGA’s preferred instrument where operators have a choice. Privacy-enhancing assets, Monero, shielded Zcash transactions and Dash where privacy features are active, must each be addressed in the operator’s internal policy.
An outright ban on privacy coins or meme coins is not imposed. Each operator must classify higher-risk tokens against objective criteria: liquidity profile, governance maturity, volatility and financial crime risk.
Wrapped tokens and bridged assets face a harder line. Operators cannot accept deposits that involve those instruments where the origin of the underlying asset cannot be independently verified.
Withdrawals should return to the original wallet and in the original asset by default. Alternative arrangements, such as a different whitelisted wallet or a different asset, are permitted only where equivalent controls apply and a regulated VASP handles any conversion. The FATF Travel Rule applies to all transfers between regulated entities.
The guidance forms part of Curaçao’s broader regulatory rebuild under the LOK framework, which took effect in December 2024. For crypto-heavy Curaçao licensees, the new policy turns crypto compliance from a payments matter into a core licensing obligation.
💡TGJ Take
The three-month policy submission deadline is the straightforward part. Wallet segregation, blockchain analytics and audit-ready records across every group entity that touches crypto funds represent the real cost. Smaller Curaçao operators that built their model around fast crypto flows now face a direct choice: invest in controls that approach regulated-market standards, or reduce crypto exposure before June 2027. Demand for payments, AML and blockchain analytics suppliers should rise fast. Operators, however, will still carry the regulatory risk.
