Curacao CW

Lead Signal

Curacao surfaces on a regulator-side data-security lapse rather than on a sanctions or enforcement action. The Curacao Gaming Authority confirmed unauthorised access to an externally managed online-gaming licensing portal and database, with the intrusion running from December 2025 through September 2026 before detection and remediation. The portal has been permanently discontinued. CGA has not itself confirmed the full scope of material exposed, but third-party commentary describes passports, tax returns, financial disclosures, CVs, addresses and criminal-record excerpts held on the system, alongside beneficial-ownership-relevant Personal History Disclosure Forms for a reported approximately 646 licensed gaming companies. That latter detail is attributed only to secondary reporting and should be read as uncertain pending CGA confirmation.

The analytical significance sits less in the breach itself and more in what it reveals about where Curacao concentrates sensitive due-diligence data for an offshore-facing licensing sector, and for how long a compromise of that concentration can run undetected.

Other Developments

Statutory ownership register reported distinct from the compromised portal. The Chamber of Commerce beneficial-ownership register, which operates on its own access controls, is reported separately from the CGA licensing system and has not itself been reported compromised. This distinction matters for assessing how far the exposure extends into Curacao's formal ownership-transparency infrastructure versus a sector-specific licensing repository.

CGA defends its outsourcing posture while signalling change. The regulator issued a public response defending a 2023-origin decision to rely on external technology and regulatory-support providers for the portal's operation, while committing to reduce reliance on external consultants and to build an internally managed replacement system. The authority has also indicated a near-term interim portal launch.

Government claims of progress on international review remain unverified. Separately, Curacao's government has stated it achieved significant progress addressing weaknesses identified in its mutual evaluation, but the relevant enhanced follow-up report had not been published as of early September 2026, leaving that claim without independent confirmation available.

Cross-Monitor Connections

The data-protection monitor's coverage of Curacao, concerning a regulator warning on oversight adequacy and intra-Kingdom data-sharing conditions, bears on the same underlying question raised here: whether institutions that hold sensitive due-diligence and ownership data in Curacao operate under oversight capacity adequate to the volume and sensitivity of what they hold. The crypto-asset monitor's coverage of Curacao's virtual-asset-service-provider registration regime and of gambling-sector restrictions on crypto activity touches the same enabler-sector population now implicated in the licensing-portal exposure, since gaming operators are also a population subject to financial-sector onboarding and due-diligence obligations.

Outlook

The immediate open question is scope: whether CGA's own investigation will confirm or narrow the volume and categories of beneficial-ownership and due-diligence material reported exposed, and whether any of that material reached parties beyond the original intrusion. A second open question is institutional: whether the shift away from external consultants and toward an internally managed portal, now under construction with an interim system reported for near-term launch, materially improves data-security posture or simply relocates the same capacity constraints in-house. Separately, publication of the outstanding CFATF follow-up report, still pending, would be the next test of whether Curacao's claimed progress on technical-compliance weaknesses can be externally verified rather than taken on the government's own account.

Lead Signal

A breach of the Curacao Gaming Authority's online licensing portal has surfaced a structural beneficial-ownership problem rather than a one-off security incident. The breach, confirmed by the CGA on 7 October 2026, exposed roughly 40,000 documents covering ownership structures, beneficial-owner identities and identification data for nearly 650 Curacao-licensed gambling companies. The investigation underlying the disclosure, conducted by Follow the Money, found that the CGA had in numerous instances granted licences without resolving outstanding ownership questions. Read architecturally rather than as an incident, this is evidence that UBO verification at the point of gambling licensing in Curacao has operated with gaps for some time, and the breach has simply made those gaps visible rather than creating them.

Other Developments

The licensing portal will not return, and no interim process has been published. The CGA confirmed the breached portal, in service since September 2023, is permanently retired, and the terminated service arrangement has been reported by trade press, though not confirmed in the CGA's own announcement, as connected to a Malta-based consultancy. The CGA missed its own 9 October 2026 deadline to detail interim licensing arrangements, and as of 15 October had signalled only that new procedures are in development. The CFATF enhanced follow-up report remains unpublished. Curacao's government has claimed significant AML/CFT progress, including on UBO transparency, following a May 2026 CFATF review, but the underlying enhanced follow-up report has not been published on either the CFATF's or the FATF's official country pages as of early September 2026, preventing independent verification of the claimed progress. This sits alongside Curacao's confirmed standing position as CFATF-assessed and not on the FATF increased-monitoring list, per the 19 June 2026 plenary, with its July 2025 fourth-round mutual evaluation finding it Compliant or Largely Compliant on 30 of 40 Recommendations.

Cross-Monitor Connections

The advennt monitor is independently tracking the CGA's licensing-portal closure and its missed interim-arrangements deadline as a gambling-regulatory operational development; the finding here is the beneficial-ownership dimension of the same underlying event. The crypto monitor is tracking a separate CGA-issued crypto-policy guideline for B2C gambling licensees, including wallet-segregation and sanctioned-wallet-exclusion rules; those controls do not reference the licensing-portal breach directly, but both signals describe the same regulator's capacity to supervise its licensed population at a moment when its core licensing-administration channel has just failed.

Outlook

The near-term question is whether the CGA's forthcoming replacement licensing procedure incorporates stronger UBO-verification steps at the point of licensing, given the investigation's finding that licences had previously been granted without resolved ownership questions. A second question is whether the CFATF enhanced follow-up report is published, which would allow independent verification of the government's claimed AML/CFT progress on UBO transparency specifically.

Lead Signal

Curacao enters this cycle with its sanctions architecture moving toward direct domestic effect. P.B. 2026 no. 144 amends the Omnibus Sanctiebesluit (P.B. 2025 no. 52) to integrate United Nations and European Union sanctions measures directly into national legislation. The instrument matters as architecture rather than incident: it closes a gap that the 2025 CFATF mutual evaluation had identified, converting what was previously a reliance on indirect application into a direct domestic mechanism for screening against UN and EU designations. The Curacao Gaming Authority's own notifications page is the primary record of the amendment, and the change sits squarely within the sanctions-evasion and compliance-architecture frame that this monitor tracks across jurisdictions regardless of enforcement posture.

Other Developments

A first follow-up assessment reports progress. The Caribbean Financial Action Task Force's first follow-up assessment, discussed at a May 2026 plenary and reported in September 2026, found that Curacao has made significant progress since its July 2025 fourth-round mutual evaluation. Government statements frame the reform process as unfinished, and the next full evaluation is expected around 2032. The underlying CFATF follow-up report was not independently retrieved; this rests on secondary press reporting of the government's own characterisation of the plenary outcome.

Industry presses for a payment-services licensing mechanism. The Curacao FinTech Association wrote to the President of Parliament warning that the absence of a dedicated electronic-money-institution or payment-institution licensing mechanism under current law is a daily operational obstacle, limiting both banking access and investment capital for Curacao-based payment firms. This is industry advocacy rather than a regulatory action, but it names a structural gap: the current regime offers registration with the central bank rather than a full licensing framework, and draft national ordinances addressing payment services and VASP supervision remain before Parliament with an expected horizon around 2027.

Crypto-handling rules continue a phased rollout. The Curacao Gaming Authority's crypto-policy guideline for B2C gambling licensees bars those licensees from acting as virtual-asset service providers, exchanges, or payment service providers, and requires wallet screening referencing FATF Recommendation 16 expectations for originator and beneficiary information. Sanctioned wallets, mixers, and UBO-linked wallets are prohibited with immediate effect, with staged compliance milestones falling in September and December 2026 and full technical compliance due by June 2027. The underlying guideline document was not independently retrieved; this rests on trade-press reporting of the Authority's published guideline.

Cross-Monitor Connections

The sanctions-decree amendment and the CFATF follow-up progress read together as a single structural signal: Curacao's reform trajectory since the 2025 mutual evaluation is an architecture question, not an enforcement-volume question, and it connects directly to how this jurisdiction is read by counterparties assessing correspondent-banking and cross-border payment exposure. The payment-services licensing gap flagged by industry, and the CGA's own crypto-handling rules for gambling licensees, both bear on digital-asset and payment-innovation exposure in the same jurisdiction, where gambling-sector money flows and a yet-unlicensed payments sector sit adjacent to each other under different regulators.

Outlook

Watch for the next full CFATF evaluation, expected around 2032, as the structural marker against which the current follow-up progress will eventually be tested. Nearer-term, the draft national ordinances on payment services and VASP/FMI supervision remain before Parliament with an expected 2027 horizon; their disposition will determine whether the current registration-only regime for payment institutions and EMIs is replaced by a full licensing framework. The CGA crypto-policy guideline's remaining milestones, in December 2026 and June 2027, are the next dated checkpoints for its phased rollout.

Lead Signal

Curacao's crypto-asset AML perimeter has extended materially this cycle through the convergence of two separate regulatory tracks that now touch the same gambling-sector market. The Curacao Gaming Authority's June 2026 crypto guideline requires B2C gambling licensees accepting cryptoasset payment to segregate player, operational and treasury wallets, screen deposits and withdrawals, trace fund origin and destination, exclude funds linked to mixers, tumblers or sanctioned blockchain addresses, and conduct counterparty due diligence on virtual-asset service providers, rolling out on a phased 2026-2027 timetable. This sits alongside, rather than inside, the Centrale Bank van Curacao en Sint Maarten's VASP National Ordinance, which has prohibited unlicensed professional or commercial provision of virtual-asset services since 1 July 2025. The result is two parallel but distinct supervisory perimeters converging on the same gambling-and-crypto market segment: a gaming regulator imposing payment-channel AML controls on licensees, and a central bank imposing licensing-based AML controls on virtual-asset service providers as such. Architecturally, this is the more significant development of the two, because it signals a gambling regulator building its own AML control layer rather than relying solely on the banking-sector gatekeeper.

Other Developments

CBCS public warning on virtual-asset-linked investment schemes. The central bank issued a public warning identifying three social-media-promoted investment programmes exhibiting pyramid-scheme and unauthorised virtual-asset-activity characteristics. No confirmed enforcement action against the named programmes has been reported in this pass; the warning itself is the confirmed act, reproduced from the regulator's own notice language. This is a single-episode signal rather than a structural finding, but it demonstrates active monitoring of retail-facing virtual-asset promotion activity outside the licensed VASP perimeter.

CBCS sanctions-notification formalisation. The central bank has formalised a 24-hour notification procedure for supervised institutions when UN, EU or Dutch sanctions-list changes occur, under the Omnibus-Sanctiebesluit Curacao (PB 2025 nr. 52). This is a procedural tightening of an existing gatekeeper function rather than a change to designation criteria themselves, and it evidences continued institutional build-out of the sanctions-compliance architecture supervised institutions must maintain.

Standing AML/CTF architecture confirmed stable. Curacao's gambling-sector AML regulations, administered by the Gaming Control Board and Curacao Gaming Authority, became a mandatory licensing component effective 10 April 2025 after a three-month transition, applying the National Ordinance on identification when rendering services customer-due-diligence framework to gaming service providers. Curacao is not on the FATF list of jurisdictions under increased monitoring as of the 19 June 2026 Plenary, and its fourth-round CFATF mutual evaluation, adopted May 2025 and published July 2025, found it Compliant on ten and Largely Compliant on twenty of the forty FATF Recommendations. A draft National Ordinance on the Supervision of Payment Service Providers remains pending enactment; payment service providers, e-money institutions and virtual-asset service providers currently operate under Centrale Bank registration, in force since 25 June 2024, rather than under full licensing, and local industry representatives are pressing parliament to accelerate the law.

Cross-Monitor Connections

The CGA crypto guideline's wallet-segregation and counterparty-diligence requirements connect directly to the gambling-sector licensing picture tracked by the advennt monitor, where the same guideline appears as an operational and payments obligation on B2C licensees with its own phased compliance deadlines running into 2027. The guideline's exclusion of mixer-, tumbler- and sanctioned-address-linked funds also intersects with the sanctions-architecture reading above: a wallet-screening control operated by a gaming regulator is, in substance, a sanctions-nexus check performed outside the banking-sector gatekeeper chain, which is a notable enablement-and-architecture signal for a jurisdiction whose gambling sector is a significant share of its licensed economic activity.

Outlook

Watch for confirmation of the CGA crypto guideline's remaining milestones: a risk-assessment, due-diligence and wallet-controls deadline around December 2026, and full compliance targeted for mid-2027. Watch also for whether the draft Payment Services Ordinance advances toward enactment, which would convert the current registration-only regime for payment companies, e-money institutions and virtual-asset service providers into a full licensing framework; current expectation places this in 2027 with a wide uncertainty band. Neither item is a prediction; both are dated regulatory processes already in motion whose resolution would narrow the two-perimeter structure described above into a single, more coherent regime or confirm its continuation.

Lead Signal

Curacao's Landsverordening toezicht virtuele activa dienstverleners, the VASP supervisory ordinance, is now enacted and in force, brought into effect via a Landsbesluit dated 24 June 2025 following enactment on 13 March 2025. The ordinance places virtual asset service providers under CBCS supervision explicitly to address FATF Recommendation 15 and the priority actions identified in Curacao's CFATF mutual evaluation. This closes a structural enabler gap that had persisted through the period when virtual-asset activity in Curacao carried no dedicated supervisory framework, and it is the clearest architecture-level development to report for this jurisdiction this cycle.

Other Developments

A sector-specific crypto-AML overlay for gambling. The Curacao Gaming Authority issued its own crypto policy guideline, effective 30 June 2026, imposing an immediate ban on sanctioned wallets and mixers for CGA licensees and phasing in blockchain-analytics and wallet-segregation controls through June 2027. This layers a gambling-sector-specific AML/CFT control regime on top of the general CBCS VASP framework, extending sanctioned-address screening into a vertical — online gambling — that has historically been a recognised crypto-AML exposure point for Curacao specifically.

The CFATF follow-up process continues. Curacao's fourth-round CFATF mutual evaluation report was adopted 29 May 2025 following a June 2024 on-site visit, and the jurisdiction now sits under CFATF's enhanced follow-up process, requiring demonstrated progress against priority actions ahead of the next assessment window. As of the June 2026 FATF plenary, Curacao was not added to the FATF list of jurisdictions under increased monitoring, with the next plenary scheduled for October 2026.

Reporting infrastructure remains standard. FIU Curacao, formerly known as MOT, continues to operate the goAML platform with a 48-hour standard for submission of unusual-transaction reports, a reporting standard unchanged this cycle but relevant context for assessing the jurisdiction's baseline AML architecture against which the VASP and crypto-gambling developments above should be read.

Cross-Monitor Connections

The VASP ordinance and the CGA crypto policy guideline both connect directly to the crypto monitor's coverage of Curacao's licensing and consumer-protection findings for virtual-asset service providers and gambling-sector wallet controls, and to the advennt monitor's coverage of the same CGA guideline from a gambling-licensee compliance angle. Both monitors are tracking the same underlying instrument from different vantage points — crypto from the general VASP-regulation angle, advennt from the gambling-licensee-obligation angle — and this financial-integrity read supplies the AML/CFT architecture framing that connects the two.

Outlook

The near-term marker to watch is Curacao's demonstrated progress against CFATF's priority actions ahead of the October 2026 FATF plenary; continued absence from the increased-monitoring list at that plenary would be a meaningful positive signal, while any adverse listing outcome would represent a material deterioration. On the crypto-AML front, the CGA guideline's phased compliance timetable running to June 2027 gives a further marker: full blockchain-analytics and wallet-segregation compliance by that date would complete the closure of the gambling-sector crypto-AML gap that the guideline was designed to address.

Lead Signal

Curacao's anti-money-laundering standing carries a formally tracked effectiveness gap this cycle: the Caribbean Financial Action Task Force adopted Curacao's fourth-round mutual evaluation report at its 29 May 2025 plenary and placed the jurisdiction under enhanced follow-up, a status that persisted through the 19 June 2026 FATF plenary without escalation to the grey list. Enhanced follow-up requires Curacao to demonstrate measurable progress on the MER's priority actions ahead of the next scheduled FATF plenary review in October 2026, and that review is the single most consequential near-term marker for the jurisdiction's AML/CFT trajectory: a favourable outcome keeps Curacao off the grey list, while continued shortfall carries real, though not yet realised, escalation risk. This is a structural finding rather than an incident: the enhanced-follow-up designation reflects an effectiveness assessment of the regime's implementation, not a single enforcement action, and the roughly four-month runway from this cycle's observation date to the next review is the frame within which every other development in Curacao's AML/CFT picture should be read.

Other Developments

CBCS signals a harder domestic enforcement line. The Centrale Bank van Curacao en Sint Maarten has stated it will make greater use of enforcement measures, including penalty payments, administrative fines, and public warnings, against unlicensed banks, money transfer companies, insurers, trust service providers, and investment institutions. This finding currently rests on a single locally-sourced statement of intent rather than a confirmed CBCS primary-source announcement, and its conversion into named, published enforcement actions is the test of whether it represents a genuine posture shift or remains an assessed rather than confirmed signal.

Disclosure transparency remains structurally thin. An IMF Central Bank Transparency Code review found that CBCS has disclosed exactly one sanction for failure to report a suspicious transaction, and even that disclosure did not name the sanctioned entity or publish the remedial measures taken. Beyond this single instance, the review found that CBCS's broader enforcement-action disclosure remains largely undisclosed. Read against the enhanced-follow-up status, this is arguably the more analytically significant of the two developments: an under-disclosed enforcement record is itself an enabler-adjacent structural gap, one that understates whatever genuine enforcement activity may already be occurring and that makes external verification of Curacao's compliance trajectory correspondingly harder ahead of the October 2026 review.

No sanctions-regime signal this cycle. No comprehensive or targeted country-level sanctions programme from the UN, UK, EU, or US regimes was identified against Curacao this cycle, though individually listed persons may still require counterparty screening. The absence of a sanctions signal is a stable finding this cycle, not a gap in coverage, and it sits separately from the AML/CFT effectiveness picture described above.

Cross-Monitor Connections

The CBCS enforcement-intensification signal and the underlying disclosure-transparency gap both touch the payments and correspondent-banking picture that World Payments Monitor tracks for Curacao's institutions: a domestic AML supervisor whose own enforcement record is largely undisclosed is a relevant input to correspondent-bank de-risking assessments of Curacao-domiciled entities, independent of any Curacao-specific sanctions finding. The enhanced-follow-up status itself, and the October 2026 plenary review date, is also shared context for other monitors tracking Curacao's broader regulatory trajectory, including gambling-sector and crypto-sector oversight: a jurisdiction-level AML/CFT effectiveness gap is the backdrop against which sector-specific AML obligations, such as those layered onto Curacao's gambling and virtual-asset licensees, should be assessed for adequacy.

Outlook

The October 2026 FATF plenary is the defining near-term marker for Curacao: continued demonstrated progress against the MER's priority actions keeps the jurisdiction in enhanced follow-up without escalation, while a stalled or negative assessment carries genuine, if not yet realised, grey-list risk. Whether CBCS's stated enforcement intensification converts into named, published enforcement actions before that review is a second marker worth tracking, since it bears directly on whether the enhanced-follow-up trajectory reflects genuine implementation progress or announced intent without disclosed follow-through. The persistent gap in CBCS's own enforcement-disclosure practice is unlikely to close quickly and should be treated as a standing structural constraint on external verification of Curacao's AML/CFT effectiveness, independent of whatever the October plenary concludes.

Lead Signal

A single Willemstad-based trust office, Downtown E-commerce Company (DECC), is now documented as the corporate administrator for two separately-enforced offshore gambling operators: Novatech Solutions, operator of Qbet and 55Bet and the subject of a EUR24.8 million fine from the Dutch state lottery, and Lalabet, which is separately named in a Nederlandse Loterij civil suit. This is an enabler-jurisdiction finding, not an isolated-incident finding: a single facilitator entity sitting at the centre of two distinct enforcement actions is a structural signal about the professional-services layer underpinning Curacao's offshore gambling sector, and Novatech's post-fine deregistration pattern reads as a restructure-to-evade move rather than a wind-down.

This is an architecture finding rather than an incident finding: a single facilitator entity linked to two independently enforced operators indicates something about the population of trust offices and corporate-services providers domiciled in Curacao, not merely about the two operators named. Novatech's deregistration following its EUR24.8 million fine, read alongside its continued administration by the same trust office, is consistent with a restructure-to-evade pattern in which the corporate wrapper changes while the underlying facilitator relationship persists.

Other Developments

Sanctions-adjacent maritime activity persists off Curacao's coast. Curacao-proximate waters, including the historic PDVSA transshipment hub at Bullenbaai, continue to register AIS-spoofing and loitering activity consistent with a dark fleet moving sanctioned Venezuelan crude amid the 2025-26 US oil blockade. OFAC's designation, effective 31 December 2025, of four companies and four associated oil tankers as blocked property reinforces enforcement pressure on this corridor, though no vessel-level attribution links a specific CW-loitering tanker to that designation list this cycle.

A new crypto AML control layer arrives in the gambling sector. The Curacao Gaming Authority's June 2026 crypto policy guideline imposes phased AML/CFT-aligned controls on B2C gambling licensees, with a policy-upload requirement by September 2026, risk-assessment obligations by December 2026, and full controls by June 2027. This closes a longstanding oversight gap in a licensing vertical where a majority of operators historically accepted crypto with minimal scrutiny of wallet provenance.

Cross-Monitor Connections

The DECC finding connects directly to gambling-regulatory monitoring of Curacao-licensed operators: a single corporate-services administrator implicated across two enforced operators is exactly the kind of enabler-layer signal that a jurisdiction-focused compliance monitor would surface as a licensing-integrity concern rather than a financial-crime concern in isolation. The Bullenbaai/dark-fleet finding connects to conflict-finance and commodity-flow monitoring of the broader Venezuela sanctions-evasion architecture, where Curacao's geographic position as a historic transshipment point remains structurally relevant regardless of any CW-domiciled entity's direct involvement. The CGA crypto guideline connects to digital-asset monitoring of gambling-adjacent payment rails, where a majority-crypto-accepting licensee base moving from minimal to phased AML scrutiny is a meaningful shift in a previously under-supervised corridor. Three-pillar balance: this cycle's evidenced findings sit predominantly in the AML and sanctions space; no standalone counter-terrorist-financing or counter-proliferation-financing-specific development was evidenced for Curacao this cycle, and that absence should be read as a coverage gap rather than a clean bill on those pillars, consistent with the structural under-weighting of CTF/CPF signal relative to AML enforcement volume.

Outlook

The CGA crypto guideline's phased deadlines run through June 2027, giving a multi-cycle window in which to track whether B2C licensees actually implement risk assessments and full controls rather than merely uploading a policy document by the September 2026 first milestone. On the sanctions side, the Bullenbaai corridor and adjacent CW waters remain a recurring loitering and AIS-spoofing venue tied to the Venezuela oil blockade, and OFAC's December 2025 designations have not yet closed the routing gap that keeps this corridor active; further vessel-level attribution work would be the clearest signal of whether enforcement pressure is translating into reduced CW-proximate activity. On the enabler-jurisdiction side, the Novatech/DECC and Lalabet matters remain unresolved, and any court finding establishing personal liability for Curacao trust offices or directors would materially escalate enabler-jurisdiction exposure beyond what this cycle's finding alone establishes.