--- title: "Curacao (CW) — Financial-Integrity Intelligence · Sentinel" canonical: https://sentinel.gi/jurisdictions/curacao/ source_html: /jurisdictions/curacao/index.html description: "Financial integrity intelligence for Curaçao (CW): sanctions, beneficial ownership, enabler jurisdictions, conflict finance, digital assets and compliance technology — with sourced findings." generated_at: 2026-11-08T17:53:23Z content_sha256: 0f0f8f57ca1b533c4d0dc179444d309686d565cc99708d629bdb73245cadd7a1 generator: "fe-fleet/md-twin@1.0" --- # Curacao (CW) — Financial-Integrity Intelligence · Sentinel Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. Financial Integrity Monitor # Curacao CW Domains covered 8 of 8 Sources 127 Role actions 8 Horizon <90d 1 Jurisdiction profile FATF status: Clean Tier: B Risk direction: Improving Enablement vs enforcement: Mixed Curaçao is a distinct AML/CFT jurisdiction within the Kingdom of the Netherlands (not an EU member state; classified as an EU Overseas Country and Territory). More It maintains its own AML/CFT ordinances (NORUT, NOIS), a Central Bank (CBCS) supervisory function, an FIU (MOT), a 2023 National Risk Assessment, and a 2024 UBO Decree, assessed by CFATF/FATF in a 2025 Mutual Evaluation as medium-high ML risk with substantial technical and effectiveness gaps. Key deficiencies - FIU (MOT-Curaçao) lacks full operational independence - UBO portal not yet fully operational; limited sanctions for non-compliance and gaps in director registration - Historically unsupervised online-gambling sub-licensing model enabled global proliferation of unlicensed operators - TF and NPO risk assessment (2024) not published and insufficiently detailed to support its 'low risk' conclusion - Understaffing of law enforcement limiting ML prosecutions in high-risk sectors (e-zones, online gambling) - Gaps in effective control over cross-border cash movements Recent developments (18m) - CFATF completed Curaçao's 4th-round Mutual Evaluation (on-site June 2024; report adopted CFATF Plenary May 2025; endorsed by FATF) - National Ordinance on Games of Chance (P.B. 2024, no.157) enacted, replacing the historic master-license/sub-license online gambling model with a direct Curaçao Gaming Authority licensing regime, under a multi-year transitional arrangement - Curaçao Public Prosecutor's Office reached its first-ever AML-related settlement with 12 online gambling operators (including crypto casino Stake) in July 2025, fining each the equivalent of $12,500 - National Decree on UBO Registration issued (2024), with portal development and cross-verification mechanisms still incomplete at MER on-site Brief ## Lead signal #### Lead Signal Curacao surfaces this cycle on a regulator-side data-security lapse rather than on a sanctions or enforcement action. The Curacao Gaming Authority confirmed unauthorised access to an externally managed online-gaming licensing portal and database, with the intrusion running from December 2025 through September 2026 before detection and remediation. The portal has been permanently discontinued. CGA has not itself confirmed the full scope of material exposed, but third-party commentary describes passports, tax returns, financial disclosures, CVs, addresses and criminal-record excerpts held on the system, alongside beneficial-ownership-relevant Personal History Disclosure Forms for a reported approximately 646 licensed gaming companies. That latter detail is attributed only to secondary reporting and should be read as uncertain pending CGA confirmation. Read full brief #### Lead Signal Curacao surfaces this cycle on a regulator-side data-security lapse rather than on a sanctions or enforcement action. The Curacao Gaming Authority confirmed unauthorised access to an externally managed online-gaming licensing portal and database, with the intrusion running from December 2025 through September 2026 before detection and remediation. The portal has been permanently discontinued. CGA has not itself confirmed the full scope of material exposed, but third-party commentary describes passports, tax returns, financial disclosures, CVs, addresses and criminal-record excerpts held on the system, alongside beneficial-ownership-relevant Personal History Disclosure Forms for a reported approximately 646 licensed gaming companies. That latter detail is attributed only to secondary reporting and should be read as uncertain pending CGA confirmation. The analytical significance sits less in the breach itself and more in what it reveals about where Curacao concentrates sensitive due-diligence data for an offshore-facing licensing sector, and for how long a compromise of that concentration can run undetected. #### Other Developments Statutory ownership register reported distinct from the compromised portal. The Chamber of Commerce beneficial-ownership register, which operates on its own access controls, is reported separately from the CGA licensing system and has not itself been reported compromised. This distinction matters for assessing how far the exposure extends into Curacao's formal ownership-transparency infrastructure versus a sector-specific licensing repository. CGA defends its outsourcing posture while signalling change. The regulator issued a public response defending a 2023-origin decision to rely on external technology and regulatory-support providers for the portal's operation, while committing to reduce reliance on external consultants and to build an internally managed replacement system. The authority has also indicated a near-term interim portal launch. Government claims of progress on international review remain unverified. Separately, Curacao's government has stated it achieved significant progress addressing weaknesses identified in its mutual evaluation, but the relevant enhanced follow-up report had not been published as of early September 2026, leaving that claim without independent confirmation available this cycle. #### Cross-Monitor Connections The data-protection monitor's coverage of Curacao this cycle, concerning a regulator warning on oversight adequacy and intra-Kingdom data-sharing conditions, bears on the same underlying question raised here: whether institutions that hold sensitive due-diligence and ownership data in Curacao operate under oversight capacity adequate to the volume and sensitivity of what they hold. The crypto-asset monitor's coverage of Curacao's virtual-asset-service-provider registration regime and of gambling-sector restrictions on crypto activity touches the same enabler-sector population now implicated in the licensing-portal exposure, since gaming operators are also a population subject to financial-sector onboarding and due-diligence obligations. #### Outlook The immediate open question is scope: whether CGA's own investigation will confirm or narrow the volume and categories of beneficial-ownership and due-diligence material reported exposed, and whether any of that material reached parties beyond the original intrusion. A second open question is institutional: whether the shift away from external consultants and toward an internally managed portal, now under construction with an interim system reported for near-term launch, materially improves data-security posture or simply relocates the same capacity constraints in-house. Separately, publication of the outstanding CFATF follow-up report, still pending as of this cycle, would be the next test of whether Curacao's claimed progress on technical-compliance weaknesses can be externally verified rather than taken on the government's own account. Earlier periodic briefs (7) 25 Oct 2026 · fim-2026-10-25 #### Lead Signal Curacao surfaces on a regulator-side data-security lapse rather than on a sanctions or enforcement action. The Curacao Gaming Authority confirmed unauthorised access to an externally managed online-gaming licensing portal and database, with the intrusion running from December 2025 through September 2026 before detection and remediation. The portal has been permanently discontinued. CGA has not itself confirmed the full scope of material exposed, but third-party commentary describes passports, tax returns, financial disclosures, CVs, addresses and criminal-record excerpts held on the system, alongside beneficial-ownership-relevant Personal History Disclosure Forms for a reported approximately 646 licensed gaming companies. That latter detail is attributed only to secondary reporting and should be read as uncertain pending CGA confirmation. The analytical significance sits less in the breach itself and more in what it reveals about where Curacao concentrates sensitive due-diligence data for an offshore-facing licensing sector, and for how long a compromise of that concentration can run undetected. #### Other Developments Statutory ownership register reported distinct from the compromised portal. The Chamber of Commerce beneficial-ownership register, which operates on its own access controls, is reported separately from the CGA licensing system and has not itself been reported compromised. This distinction matters for assessing how far the exposure extends into Curacao's formal ownership-transparency infrastructure versus a sector-specific licensing repository. CGA defends its outsourcing posture while signalling change. The regulator issued a public response defending a 2023-origin decision to rely on external technology and regulatory-support providers for the portal's operation, while committing to reduce reliance on external consultants and to build an internally managed replacement system. The authority has also indicated a near-term interim portal launch. Government claims of progress on international review remain unverified. Separately, Curacao's government has stated it achieved significant progress addressing weaknesses identified in its mutual evaluation, but the relevant enhanced follow-up report had not been published as of early September 2026, leaving that claim without independent confirmation available. #### Cross-Monitor Connections The data-protection monitor's coverage of Curacao, concerning a regulator warning on oversight adequacy and intra-Kingdom data-sharing conditions, bears on the same underlying question raised here: whether institutions that hold sensitive due-diligence and ownership data in Curacao operate under oversight capacity adequate to the volume and sensitivity of what they hold. The crypto-asset monitor's coverage of Curacao's virtual-asset-service-provider registration regime and of gambling-sector restrictions on crypto activity touches the same enabler-sector population now implicated in the licensing-portal exposure, since gaming operators are also a population subject to financial-sector onboarding and due-diligence obligations. #### Outlook The immediate open question is scope: whether CGA's own investigation will confirm or narrow the volume and categories of beneficial-ownership and due-diligence material reported exposed, and whether any of that material reached parties beyond the original intrusion. A second open question is institutional: whether the shift away from external consultants and toward an internally managed portal, now under construction with an interim system reported for near-term launch, materially improves data-security posture or simply relocates the same capacity constraints in-house. Separately, publication of the outstanding CFATF follow-up report, still pending, would be the next test of whether Curacao's claimed progress on technical-compliance weaknesses can be externally verified rather than taken on the government's own account. 18 Oct 2026 · fim-2026-10-18 #### Lead Signal A breach of the Curacao Gaming Authority's online licensing portal has surfaced a structural beneficial-ownership problem rather than a one-off security incident. The breach, confirmed by the CGA on 7 October 2026, exposed roughly 40,000 documents covering ownership structures, beneficial-owner identities and identification data for nearly 650 Curacao-licensed gambling companies. The investigation underlying the disclosure, conducted by Follow the Money, found that the CGA had in numerous instances granted licences without resolving outstanding ownership questions. Read architecturally rather than as an incident, this is evidence that UBO verification at the point of gambling licensing in Curacao has operated with gaps for some time, and the breach has simply made those gaps visible rather than creating them. #### Other Developments The licensing portal will not return, and no interim process has been published. The CGA confirmed the breached portal, in service since September 2023, is permanently retired, and the terminated service arrangement has been reported by trade press, though not confirmed in the CGA's own announcement, as connected to a Malta-based consultancy. The CGA missed its own 9 October 2026 deadline to detail interim licensing arrangements, and as of 15 October had signalled only that new procedures are in development. The CFATF enhanced follow-up report remains unpublished. Curacao's government has claimed significant AML/CFT progress, including on UBO transparency, following a May 2026 CFATF review, but the underlying enhanced follow-up report has not been published on either the CFATF's or the FATF's official country pages as of early September 2026, preventing independent verification of the claimed progress. This sits alongside Curacao's confirmed standing position as CFATF-assessed and not on the FATF increased-monitoring list, per the 19 June 2026 plenary, with its July 2025 fourth-round mutual evaluation finding it Compliant or Largely Compliant on 30 of 40 Recommendations. #### Cross-Monitor Connections The advennt monitor is independently tracking the CGA's licensing-portal closure and its missed interim-arrangements deadline as a gambling-regulatory operational development; the finding here is the beneficial-ownership dimension of the same underlying event. The crypto monitor is tracking a separate CGA-issued crypto-policy guideline for B2C gambling licensees, including wallet-segregation and sanctioned-wallet-exclusion rules; those controls do not reference the licensing-portal breach directly, but both signals describe the same regulator's capacity to supervise its licensed population at a moment when its core licensing-administration channel has just failed. #### Outlook The near-term question is whether the CGA's forthcoming replacement licensing procedure incorporates stronger UBO-verification steps at the point of licensing, given the investigation's finding that licences had previously been granted without resolved ownership questions. A second question is whether the CFATF enhanced follow-up report is published, which would allow independent verification of the government's claimed AML/CFT progress on UBO transparency specifically. 11 Oct 2026 · fim-2026-10-11 #### Lead Signal Curacao enters this cycle with its sanctions architecture moving toward direct domestic effect. P.B. 2026 no. 144 amends the Omnibus Sanctiebesluit (P.B. 2025 no. 52) to integrate United Nations and European Union sanctions measures directly into national legislation. The instrument matters as architecture rather than incident: it closes a gap that the 2025 CFATF mutual evaluation had identified, converting what was previously a reliance on indirect application into a direct domestic mechanism for screening against UN and EU designations. The Curacao Gaming Authority's own notifications page is the primary record of the amendment, and the change sits squarely within the sanctions-evasion and compliance-architecture frame that this monitor tracks across jurisdictions regardless of enforcement posture. #### Other Developments A first follow-up assessment reports progress. The Caribbean Financial Action Task Force's first follow-up assessment, discussed at a May 2026 plenary and reported in September 2026, found that Curacao has made significant progress since its July 2025 fourth-round mutual evaluation. Government statements frame the reform process as unfinished, and the next full evaluation is expected around 2032. The underlying CFATF follow-up report was not independently retrieved; this rests on secondary press reporting of the government's own characterisation of the plenary outcome. Industry presses for a payment-services licensing mechanism. The Curacao FinTech Association wrote to the President of Parliament warning that the absence of a dedicated electronic-money-institution or payment-institution licensing mechanism under current law is a daily operational obstacle, limiting both banking access and investment capital for Curacao-based payment firms. This is industry advocacy rather than a regulatory action, but it names a structural gap: the current regime offers registration with the central bank rather than a full licensing framework, and draft national ordinances addressing payment services and VASP supervision remain before Parliament with an expected horizon around 2027. Crypto-handling rules continue a phased rollout. The Curacao Gaming Authority's crypto-policy guideline for B2C gambling licensees bars those licensees from acting as virtual-asset service providers, exchanges, or payment service providers, and requires wallet screening referencing FATF Recommendation 16 expectations for originator and beneficiary information. Sanctioned wallets, mixers, and UBO-linked wallets are prohibited with immediate effect, with staged compliance milestones falling in September and December 2026 and full technical compliance due by June 2027. The underlying guideline document was not independently retrieved; this rests on trade-press reporting of the Authority's published guideline. #### Cross-Monitor Connections The sanctions-decree amendment and the CFATF follow-up progress read together as a single structural signal: Curacao's reform trajectory since the 2025 mutual evaluation is an architecture question, not an enforcement-volume question, and it connects directly to how this jurisdiction is read by counterparties assessing correspondent-banking and cross-border payment exposure. The payment-services licensing gap flagged by industry, and the CGA's own crypto-handling rules for gambling licensees, both bear on digital-asset and payment-innovation exposure in the same jurisdiction, where gambling-sector money flows and a yet-unlicensed payments sector sit adjacent to each other under different regulators. #### Outlook Watch for the next full CFATF evaluation, expected around 2032, as the structural marker against which the current follow-up progress will eventually be tested. Nearer-term, the draft national ordinances on payment services and VASP/FMI supervision remain before Parliament with an expected 2027 horizon; their disposition will determine whether the current registration-only regime for payment institutions and EMIs is replaced by a full licensing framework. The CGA crypto-policy guideline's remaining milestones, in December 2026 and June 2027, are the next dated checkpoints for its phased rollout. 4 Oct 2026 · fim-2026-10-04 #### Lead Signal Curacao's crypto-asset AML perimeter has extended materially this cycle through the convergence of two separate regulatory tracks that now touch the same gambling-sector market. The Curacao Gaming Authority's June 2026 crypto guideline requires B2C gambling licensees accepting cryptoasset payment to segregate player, operational and treasury wallets, screen deposits and withdrawals, trace fund origin and destination, exclude funds linked to mixers, tumblers or sanctioned blockchain addresses, and conduct counterparty due diligence on virtual-asset service providers, rolling out on a phased 2026-2027 timetable. This sits alongside, rather than inside, the Centrale Bank van Curacao en Sint Maarten's VASP National Ordinance, which has prohibited unlicensed professional or commercial provision of virtual-asset services since 1 July 2025. The result is two parallel but distinct supervisory perimeters converging on the same gambling-and-crypto market segment: a gaming regulator imposing payment-channel AML controls on licensees, and a central bank imposing licensing-based AML controls on virtual-asset service providers as such. Architecturally, this is the more significant development of the two, because it signals a gambling regulator building its own AML control layer rather than relying solely on the banking-sector gatekeeper. #### Other Developments CBCS public warning on virtual-asset-linked investment schemes. The central bank issued a public warning identifying three social-media-promoted investment programmes exhibiting pyramid-scheme and unauthorised virtual-asset-activity characteristics. No confirmed enforcement action against the named programmes has been reported in this pass; the warning itself is the confirmed act, reproduced from the regulator's own notice language. This is a single-episode signal rather than a structural finding, but it demonstrates active monitoring of retail-facing virtual-asset promotion activity outside the licensed VASP perimeter. CBCS sanctions-notification formalisation. The central bank has formalised a 24-hour notification procedure for supervised institutions when UN, EU or Dutch sanctions-list changes occur, under the Omnibus-Sanctiebesluit Curacao (PB 2025 nr. 52). This is a procedural tightening of an existing gatekeeper function rather than a change to designation criteria themselves, and it evidences continued institutional build-out of the sanctions-compliance architecture supervised institutions must maintain. Standing AML/CTF architecture confirmed stable. Curacao's gambling-sector AML regulations, administered by the Gaming Control Board and Curacao Gaming Authority, became a mandatory licensing component effective 10 April 2025 after a three-month transition, applying the National Ordinance on identification when rendering services customer-due-diligence framework to gaming service providers. Curacao is not on the FATF list of jurisdictions under increased monitoring as of the 19 June 2026 Plenary, and its fourth-round CFATF mutual evaluation, adopted May 2025 and published July 2025, found it Compliant on ten and Largely Compliant on twenty of the forty FATF Recommendations. A draft National Ordinance on the Supervision of Payment Service Providers remains pending enactment; payment service providers, e-money institutions and virtual-asset service providers currently operate under Centrale Bank registration, in force since 25 June 2024, rather than under full licensing, and local industry representatives are pressing parliament to accelerate the law. #### Cross-Monitor Connections The CGA crypto guideline's wallet-segregation and counterparty-diligence requirements connect directly to the gambling-sector licensing picture tracked by the advennt monitor, where the same guideline appears as an operational and payments obligation on B2C licensees with its own phased compliance deadlines running into 2027. The guideline's exclusion of mixer-, tumbler- and sanctioned-address-linked funds also intersects with the sanctions-architecture reading above: a wallet-screening control operated by a gaming regulator is, in substance, a sanctions-nexus check performed outside the banking-sector gatekeeper chain, which is a notable enablement-and-architecture signal for a jurisdiction whose gambling sector is a significant share of its licensed economic activity. #### Outlook Watch for confirmation of the CGA crypto guideline's remaining milestones: a risk-assessment, due-diligence and wallet-controls deadline around December 2026, and full compliance targeted for mid-2027. Watch also for whether the draft Payment Services Ordinance advances toward enactment, which would convert the current registration-only regime for payment companies, e-money institutions and virtual-asset service providers into a full licensing framework; current expectation places this in 2027 with a wide uncertainty band. Neither item is a prediction; both are dated regulatory processes already in motion whose resolution would narrow the two-perimeter structure described above into a single, more coherent regime or confirm its continuation. 28 Sep 2026 · fim-2026-09-28 #### Lead Signal Curacao's Landsverordening toezicht virtuele activa dienstverleners, the VASP supervisory ordinance, is now enacted and in force, brought into effect via a Landsbesluit dated 24 June 2025 following enactment on 13 March 2025. The ordinance places virtual asset service providers under CBCS supervision explicitly to address FATF Recommendation 15 and the priority actions identified in Curacao's CFATF mutual evaluation. This closes a structural enabler gap that had persisted through the period when virtual-asset activity in Curacao carried no dedicated supervisory framework, and it is the clearest architecture-level development to report for this jurisdiction this cycle. #### Other Developments A sector-specific crypto-AML overlay for gambling. The Curacao Gaming Authority issued its own crypto policy guideline, effective 30 June 2026, imposing an immediate ban on sanctioned wallets and mixers for CGA licensees and phasing in blockchain-analytics and wallet-segregation controls through June 2027. This layers a gambling-sector-specific AML/CFT control regime on top of the general CBCS VASP framework, extending sanctioned-address screening into a vertical — online gambling — that has historically been a recognised crypto-AML exposure point for Curacao specifically. The CFATF follow-up process continues. Curacao's fourth-round CFATF mutual evaluation report was adopted 29 May 2025 following a June 2024 on-site visit, and the jurisdiction now sits under CFATF's enhanced follow-up process, requiring demonstrated progress against priority actions ahead of the next assessment window. As of the June 2026 FATF plenary, Curacao was not added to the FATF list of jurisdictions under increased monitoring, with the next plenary scheduled for October 2026. Reporting infrastructure remains standard. FIU Curacao, formerly known as MOT, continues to operate the goAML platform with a 48-hour standard for submission of unusual-transaction reports, a reporting standard unchanged this cycle but relevant context for assessing the jurisdiction's baseline AML architecture against which the VASP and crypto-gambling developments above should be read. #### Cross-Monitor Connections The VASP ordinance and the CGA crypto policy guideline both connect directly to the crypto monitor's coverage of Curacao's licensing and consumer-protection findings for virtual-asset service providers and gambling-sector wallet controls, and to the advennt monitor's coverage of the same CGA guideline from a gambling-licensee compliance angle. Both monitors are tracking the same underlying instrument from different vantage points — crypto from the general VASP-regulation angle, advennt from the gambling-licensee-obligation angle — and this financial-integrity read supplies the AML/CFT architecture framing that connects the two. #### Outlook The near-term marker to watch is Curacao's demonstrated progress against CFATF's priority actions ahead of the October 2026 FATF plenary; continued absence from the increased-monitoring list at that plenary would be a meaningful positive signal, while any adverse listing outcome would represent a material deterioration. On the crypto-AML front, the CGA guideline's phased compliance timetable running to June 2027 gives a further marker: full blockchain-analytics and wallet-segregation compliance by that date would complete the closure of the gambling-sector crypto-AML gap that the guideline was designed to address. 14 Sep 2026 · fim-2026-08-25 #### Lead Signal Curacao's anti-money-laundering standing carries a formally tracked effectiveness gap this cycle: the Caribbean Financial Action Task Force adopted Curacao's fourth-round mutual evaluation report at its 29 May 2025 plenary and placed the jurisdiction under enhanced follow-up, a status that persisted through the 19 June 2026 FATF plenary without escalation to the grey list. Enhanced follow-up requires Curacao to demonstrate measurable progress on the MER's priority actions ahead of the next scheduled FATF plenary review in October 2026, and that review is the single most consequential near-term marker for the jurisdiction's AML/CFT trajectory: a favourable outcome keeps Curacao off the grey list, while continued shortfall carries real, though not yet realised, escalation risk. This is a structural finding rather than an incident: the enhanced-follow-up designation reflects an effectiveness assessment of the regime's implementation, not a single enforcement action, and the roughly four-month runway from this cycle's observation date to the next review is the frame within which every other development in Curacao's AML/CFT picture should be read. #### Other Developments CBCS signals a harder domestic enforcement line. The Centrale Bank van Curacao en Sint Maarten has stated it will make greater use of enforcement measures, including penalty payments, administrative fines, and public warnings, against unlicensed banks, money transfer companies, insurers, trust service providers, and investment institutions. This finding currently rests on a single locally-sourced statement of intent rather than a confirmed CBCS primary-source announcement, and its conversion into named, published enforcement actions is the test of whether it represents a genuine posture shift or remains an assessed rather than confirmed signal. Disclosure transparency remains structurally thin. An IMF Central Bank Transparency Code review found that CBCS has disclosed exactly one sanction for failure to report a suspicious transaction, and even that disclosure did not name the sanctioned entity or publish the remedial measures taken. Beyond this single instance, the review found that CBCS's broader enforcement-action disclosure remains largely undisclosed. Read against the enhanced-follow-up status, this is arguably the more analytically significant of the two developments: an under-disclosed enforcement record is itself an enabler-adjacent structural gap, one that understates whatever genuine enforcement activity may already be occurring and that makes external verification of Curacao's compliance trajectory correspondingly harder ahead of the October 2026 review. No sanctions-regime signal this cycle. No comprehensive or targeted country-level sanctions programme from the UN, UK, EU, or US regimes was identified against Curacao this cycle, though individually listed persons may still require counterparty screening. The absence of a sanctions signal is a stable finding this cycle, not a gap in coverage, and it sits separately from the AML/CFT effectiveness picture described above. #### Cross-Monitor Connections The CBCS enforcement-intensification signal and the underlying disclosure-transparency gap both touch the payments and correspondent-banking picture that World Payments Monitor tracks for Curacao's institutions: a domestic AML supervisor whose own enforcement record is largely undisclosed is a relevant input to correspondent-bank de-risking assessments of Curacao-domiciled entities, independent of any Curacao-specific sanctions finding. The enhanced-follow-up status itself, and the October 2026 plenary review date, is also shared context for other monitors tracking Curacao's broader regulatory trajectory, including gambling-sector and crypto-sector oversight: a jurisdiction-level AML/CFT effectiveness gap is the backdrop against which sector-specific AML obligations, such as those layered onto Curacao's gambling and virtual-asset licensees, should be assessed for adequacy. #### Outlook The October 2026 FATF plenary is the defining near-term marker for Curacao: continued demonstrated progress against the MER's priority actions keeps the jurisdiction in enhanced follow-up without escalation, while a stalled or negative assessment carries genuine, if not yet realised, grey-list risk. Whether CBCS's stated enforcement intensification converts into named, published enforcement actions before that review is a second marker worth tracking, since it bears directly on whether the enhanced-follow-up trajectory reflects genuine implementation progress or announced intent without disclosed follow-through. The persistent gap in CBCS's own enforcement-disclosure practice is unlikely to close quickly and should be treated as a standing structural constraint on external verification of Curacao's AML/CFT effectiveness, independent of whatever the October plenary concludes. 11 Aug 2026 · fim-2026-08-05 #### Lead Signal A single Willemstad-based trust office, Downtown E-commerce Company (DECC), is now documented as the corporate administrator for two separately-enforced offshore gambling operators: Novatech Solutions, operator of Qbet and 55Bet and the subject of a EUR24.8 million fine from the Dutch state lottery, and Lalabet, which is separately named in a Nederlandse Loterij civil suit. This is an enabler-jurisdiction finding, not an isolated-incident finding: a single facilitator entity sitting at the centre of two distinct enforcement actions is a structural signal about the professional-services layer underpinning Curacao's offshore gambling sector, and Novatech's post-fine deregistration pattern reads as a restructure-to-evade move rather than a wind-down. This is an architecture finding rather than an incident finding: a single facilitator entity linked to two independently enforced operators indicates something about the population of trust offices and corporate-services providers domiciled in Curacao, not merely about the two operators named. Novatech's deregistration following its EUR24.8 million fine, read alongside its continued administration by the same trust office, is consistent with a restructure-to-evade pattern in which the corporate wrapper changes while the underlying facilitator relationship persists. #### Other Developments Sanctions-adjacent maritime activity persists off Curacao's coast. Curacao-proximate waters, including the historic PDVSA transshipment hub at Bullenbaai, continue to register AIS-spoofing and loitering activity consistent with a dark fleet moving sanctioned Venezuelan crude amid the 2025-26 US oil blockade. OFAC's designation, effective 31 December 2025, of four companies and four associated oil tankers as blocked property reinforces enforcement pressure on this corridor, though no vessel-level attribution links a specific CW-loitering tanker to that designation list this cycle. A new crypto AML control layer arrives in the gambling sector. The Curacao Gaming Authority's June 2026 crypto policy guideline imposes phased AML/CFT-aligned controls on B2C gambling licensees, with a policy-upload requirement by September 2026, risk-assessment obligations by December 2026, and full controls by June 2027. This closes a longstanding oversight gap in a licensing vertical where a majority of operators historically accepted crypto with minimal scrutiny of wallet provenance. #### Cross-Monitor Connections The DECC finding connects directly to gambling-regulatory monitoring of Curacao-licensed operators: a single corporate-services administrator implicated across two enforced operators is exactly the kind of enabler-layer signal that a jurisdiction-focused compliance monitor would surface as a licensing-integrity concern rather than a financial-crime concern in isolation. The Bullenbaai/dark-fleet finding connects to conflict-finance and commodity-flow monitoring of the broader Venezuela sanctions-evasion architecture, where Curacao's geographic position as a historic transshipment point remains structurally relevant regardless of any CW-domiciled entity's direct involvement. The CGA crypto guideline connects to digital-asset monitoring of gambling-adjacent payment rails, where a majority-crypto-accepting licensee base moving from minimal to phased AML scrutiny is a meaningful shift in a previously under-supervised corridor. Three-pillar balance: this cycle's evidenced findings sit predominantly in the AML and sanctions space; no standalone counter-terrorist-financing or counter-proliferation-financing-specific development was evidenced for Curacao this cycle, and that absence should be read as a coverage gap rather than a clean bill on those pillars, consistent with the structural under-weighting of CTF/CPF signal relative to AML enforcement volume. #### Outlook The CGA crypto guideline's phased deadlines run through June 2027, giving a multi-cycle window in which to track whether B2C licensees actually implement risk assessments and full controls rather than merely uploading a policy document by the September 2026 first milestone. On the sanctions side, the Bullenbaai corridor and adjacent CW waters remain a recurring loitering and AIS-spoofing venue tied to the Venezuela oil blockade, and OFAC's December 2025 designations have not yet closed the routing gap that keeps this corridor active; further vessel-level attribution work would be the clearest signal of whether enforcement pressure is translating into reduced CW-proximate activity. On the enabler-jurisdiction side, the Novatech/DECC and Lalabet matters remain unresolved, and any court finding establishing personal liability for Curacao trust offices or directors would materially escalate enabler-jurisdiction exposure beyond what this cycle's finding alone establishes. Domain intelligence (D1–D8) #### Sanctions Architecture and Evasion Sanctions architecture exposure for Curacao this cycle centers on the persistence of a dark-fleet evasion vector running through Bullenbaai and adjacent coastal waters, a corridor with a history as a transshipment hub for Venezuelan state oil exports under PDVSA and, in 2025-26, a site of continuing AIS-spoofing and loitering activity tied to the United States blockade on Venezuelan crude. This is not an isolated shipping anomaly; it is a structural feature of the corridor that recurs across successive sanctions-enforcement cycles rather than resolving with any single action. The US Treasury Office of Foreign Assets Control designated four Venezuela-oil-sector companies and four associated tankers as blocked property effective 31 December 2025, an enforcement escalation that reinforces pressure on the wider evasion network without, on the evidence available this cycle, establishing a documented link between the specific tankers loitering off Curacao and the entities named in that designation. This attribution gap is analytically significant: it indicates that Curacao-proximate dark-fleet activity and the formal US sanctions list are being tracked as parallel rather than fully merged evidentiary streams, leaving room for vessels to continue operating in the corridor even as individual designated entities are removed from circulation. Continue reading This sits against the baseline established by the CFATF fourth-round mutual evaluation of Curacao, adopted 29 May 2025, which found the jurisdiction compliant or largely compliant on 30 of 40 FATF Recommendations but substantially or highly effective on only one of eleven effectiveness measures. Read together, the mutual evaluation and the Bullenbaai dark-fleet pattern describe a jurisdiction with a reasonably developed legal architecture that has not yet demonstrated the enforcement capacity, or in some cases the enforcement priority, needed to interdict sanctions-evasion activity occurring within its own proximate waters. Separately, the standing sanctions-regime-divergence tracker recorded no new signal this cycle: Curacao is not subject to comprehensive country-wide sanctions, and no fresh divergence between EU, US, and UK sanctions treatment specific to Curacao was identified. The absence of a divergence signal is a stable-baseline finding rather than a gap in coverage, and it is recorded as such. Applying a three-level sanctions-architecture analysis clarifies the mechanism at work: at the scheme level, this involves AIS transponder manipulation and vessel loitering to obscure the origin and destination of Venezuelan crude; at the architecture level, it exploits weak maritime-domain awareness in Curacao-proximate waters and a historic transshipment role rooted in the PDVSA-era Bullenbaai infrastructure; at the strategic-consequence level, it sustains dollar-denominated revenue reaching a sanctioned regime even as designations target corporate and vessel nodes rather than the geographic chokepoint itself. The enforcement-versus-enablement balance for Curacao on this domain is best read as mixed and structural rather than purely episodic: enforcement pressure from Washington is increasing in absolute terms, evidenced by the December 2025 designation round, but the underlying routing infrastructure through Curacao-proximate waters has not yet shown a corresponding contraction. Precise vessel-level attribution linking specific Curacao-loitering tankers to the designated entities was not established this cycle, a gap that limits how confidently the corridor can be assessed as directly implicated in this particular designation round rather than in the broader Venezuela shadow-fleet phenomenon generally. This recurring dynamic across FIM standing coverage of Venezuela-linked sanctions evasion underscores the architecture-over-incident principle: the corporate and vessel entities named in any single OFAC action are replaceable nodes within a network whose underlying routing geography has proven considerably more durable than any individual designation. #### Outlook The near-term horizon item most relevant to this domain is the CFATF follow-up reporting cycle ahead of the October 2026 FATF plenary, in which Curacao is expected to report progress against priority actions flagged in the mutual evaluation, including customer due diligence and suspicious-transaction reporting enhancements relevant to sanctions-evasion detection capacity. Continued OFAC designation activity targeting the Venezuela shadow oil fleet is assessed as likely to persist given the ongoing blockade posture, and the open question for the next several cycles is whether vessel-level attribution linking Curacao-proximate loitering activity to specific designated entities can be established, which would materially strengthen the case for a Curacao-specific enforcement or supervisory response rather than a general-region one. Judgment: No Curacao-specific sanctions-evasion signal found this cycle. Uncertain #### Beneficial Ownership and Corporate Transparency Globally, the EU AML Package sets the structural direction for beneficial-ownership architecture: the directly applicable AML Regulation (Reg (EU) 2024/1624), the sixth AML Directive transposed state-by-state, and the AMLA Regulation (Reg (EU) 2024/1620) establishing a new Anti-Money Laundering Authority are together shifting beneficial-ownership supervision from a purely national function toward a hybrid regime with direct and indirect EU-level oversight of certain obliged entities. Curacao sits entirely outside this perimeter. It is autonomous within the Kingdom of the Netherlands and is not an EU or EEA member state, so none of the AMLR, 6AMLD or AMLA Regulation applies to it directly or indirectly; its beneficial-ownership architecture is a matter of domestic ordinance and Chamber of Commerce administration, assessed internationally through the Caribbean Financial Action Task Force rather than through any EU supervisory layer. That structural fact frames this cycle's Curacao-specific development as a question about the adequacy of domestic due-diligence data controls, not about alignment with a supranational transparency regime. Continue reading This cycle's directly relevant development is a data-security lapse at a sector regulator rather than a change to the ownership-register framework itself. The Curacao Gaming Authority confirmed that an externally managed licensing portal and its underlying database were accessed without authorisation over a period running from December 2025 to September 2026, a roughly nine-month window before the intrusion was detected and the system retired. CGA has not confirmed the full scope of what was exposed, but secondary reporting, treated here as uncertain pending regulator confirmation, describes Personal History Disclosure Forms, passports and financial-disclosure material tied to beneficial-ownership and suitability due-diligence for a reported approximately 646 licensed gaming companies. If accurate, this would represent exposure of ownership-adjacent due-diligence material held by a financial-integrity-relevant regulator, distinct in kind from a breach of the general commercial register. Importantly, the statutory beneficial-ownership register administered through the Chamber of Commerce, which operates under its own access controls limited to designated authorities including the central bank, is reported as a separate system and has not itself been reported compromised. The exposure, as currently understood, is confined to the gaming-sector licensing pathway's own due-diligence holdings rather than to the jurisdiction's general ownership-transparency infrastructure. That distinction is analytically important: it localises the lapse to a sector-specific repository rather than indicating a systemic failure of Curacao's ownership-register architecture, while still raising a legitimate question about how sector regulators holding beneficial-ownership-equivalent material are expected to secure it to a standard consistent with the sensitivity of what they collect. #### Outlook The principal unresolved question is scope confirmation: CGA's own investigation, not yet concluded as described in available reporting, will determine whether the volume and categories of beneficial-ownership-relevant material described in secondary commentary are accurate, and whether any exposed material has been used or further distributed. A second question is structural: CGA has committed to building an internally managed replacement portal and reducing reliance on external consultants, a response that, if implemented, would bring the custody of ownership-adjacent due-diligence data back inside direct regulatory control rather than leaving it with a third-party operator. Whether that shift materially improves the security of beneficial-ownership-equivalent data, as opposed to relocating the same underlying capacity constraints, will only become clear as the new system is built out and as, if ever, CGA publishes a fuller account of the breach's actual scope. Judgment: A regulator-held repository of beneficial-ownership and due-diligence material for ~646 gaming licensees was compromised for approximately nine months before detection and remediation; the statutory Chamber-of-Commerce UBO register is reported separate and not confirmed compromised. Uncertain #### Enabler Jurisdictions and Professional Facilitators Curacao functions as an offshore-facing licensing centre for the online-gaming sector, a classic enabler-jurisdiction role in which the credibility of the regime rests heavily on the regulator's own capacity to vet and monitor the operators it licenses, many of which serve customers and route funds well outside Curacao itself. This cycle's development goes directly to that capacity question. The Curacao Gaming Authority confirmed that an externally managed licensing portal and database, the system through which operator due-diligence and suitability material is collected and held, was accessed without authorisation for a period of roughly nine months, from December 2025 to September 2026, before the intrusion was detected and the portal discontinued. A nine-month undetected dwell time inside a regulator-run repository for an offshore-facing licensing sector is itself a capacity signal, independent of whatever is ultimately confirmed about the data actually taken. Continue reading CGA's own public response has been to defend the underlying decision, taken in 2023, to rely on external technology and regulatory-support providers to build and run the portal, while simultaneously committing to move away from that model: reducing reliance on external consultants and constructing an internally managed system, with an interim replacement portal reported for near-term launch. Read together, the defence of past decisions and the commitment to a different future architecture suggest the regulator itself has concluded that outsourcing the licensing-data function to external operators carried risks that materialised. For an enabler jurisdiction whose international standing depends substantially on confidence in its licensing gatekeeping, that is a more consequential signal than the breach's technical details. This sits alongside, but is analytically distinct from, Curacao's broader standing engagement with the Caribbean Financial Action Task Force, where the government has claimed significant progress addressing previously identified weaknesses. That claim remains unverified: the enhanced follow-up report discussed at a CFATF plenary earlier this year had, as of early September 2026, not been published, meaning independent confirmation of the government's own account is not yet available. The gaming-portal lapse and the unpublished follow-up report are separate tracks, one about data-security capacity in a specific regulator and one about broader AML/CFT technical-compliance ratings, but both bear on the same underlying question of how far Curacao's institutional capacity has kept pace with its role as a jurisdiction of convenience for internationally facing licensees. #### Outlook The near-term marker to watch is whether CGA's stated shift toward internally managed infrastructure actually reduces the kind of exposure window seen in this incident, or whether the same underlying resourcing and oversight constraints simply move in-house. A second marker is publication of the outstanding CFATF enhanced follow-up report; until it appears, assessments of Curacao's enabler-jurisdiction risk profile will have to weigh a government claim of progress against a demonstrated, lengthy, undetected intrusion into a regulator's own sensitive licensing data, two signals currently pointing in different directions on the same underlying capacity question. Judgment: A ~9-month undetected intrusion into a regulator-run licensing/due-diligence repository for an offshore-facing sector raises capacity and systemic-significance questions about Curacao's enabler-sector data controls. Uncertain #### Conflict Finance and Extractive-Industry Integrity Curacao continues to register as a channel jurisdiction in the Venezuela conflict-finance and sanctions-evasion picture through the historic Bullenbaai oil terminal and adjacent coastal waters, a corridor with a documented history as a PDVSA transshipment hub and, in 2025-26, continuing dark-fleet loitering and AIS-spoofing activity amid the United States blockade on Venezuelan crude exports. Applying the conflict-finance filter, the source is sanctioned Venezuelan state oil revenue tied to the Maduro regime, the channel is the Curacao-proximate maritime corridor and its history of accommodating transshipment and ship-to-ship transfer activity, and the deployment is continued dollar-denominated export revenue reaching a government under comprehensive US sanctions pressure. The US Treasury Office of Foreign Assets Control reinforced this picture on 31 December 2025 by designating four Venezuela-oil-sector companies and four associated tankers as blocked property, an enforcement escalation that targets specific corporate and vessel nodes within the shadow-fleet network rather than the geographic corridor through which that network continues to operate. Continue reading This is best characterized as a structural rather than episodic finding: the Bullenbaai corridor role predates the current blockade and has persisted across multiple prior sanctions-enforcement cycles, meaning that individual designation rounds, however material in isolation, have not yet demonstrated a corresponding contraction in loitering and spoofing activity in Curacao-proximate waters. The absence, this cycle, of a documented vessel-level link between specific loitering tankers and the entities named in the December 2025 designation is recorded as an evidentiary gap rather than a finding that no such link exists, and it limits how precisely the conflict-finance role of Curacao waters in this particular designation round can be characterized. This channel-jurisdiction dynamic recurs across FIM standing coverage of Venezuela-linked sanctions evasion, and its persistence despite periodic high-profile designations underscores the architecture-over-incident principle: the corporate and vessel entities named in any single OFAC action are replaceable nodes within a network whose underlying routing geography, including the historic role of Curacao-proximate waters as a transshipment and ship-to-ship transfer zone, has proven considerably more durable than any individual designation. Absent a maritime-domain-awareness or interdiction capability upgrade specific to Curacao waters, the reasonable expectation is that loitering and AIS-spoofing activity will continue to recur following each new designation round, with enforcement pressure rising in aggregate terms without a corresponding structural closure of the corridor itself. The wider significance of this finding for conflict-finance and extractive-industry integrity monitoring lies in its illustration of a channel-jurisdiction dynamic in which enforcement action against sanctioned entities and enforcement action against the geographic corridors those entities exploit proceed on different timelines and evidentiary standards. Curacao itself is not alleged to be a source of conflict revenue, nor is it under comprehensive sanctions; its documented significance is as a channel through which sanctioned Venezuelan crude revenue continues to move, a distinction that matters for how any future supervisory or enforcement response would need to be targeted. #### Outlook Continued OFAC designation activity targeting the Venezuela shadow oil fleet is assessed as likely given the ongoing blockade posture, and the material open question for this domain over coming cycles is whether maritime-domain-awareness or supervisory improvements specific to Curacao-proximate waters emerge, which would represent a more structurally significant development than further entity-level designations alone. The CFATF follow-up report ahead of the October 2026 FATF plenary, while focused primarily on customer due diligence and suspicious-transaction reporting, is the nearest formal review point at which trade-finance and maritime-sector due-diligence expectations relevant to this channel-jurisdiction dynamic could be addressed. Judgment: No Curacao-specific conflict-finance signal found this cycle. Uncertain #### Crypto, Digital Assets, and Financial Innovation The most directly relevant digital-asset development for Curacao this cycle is domestic: the Curacao Gaming Authority issued a crypto policy guideline in June 2026 that imposes, for the first time, a phased anti-money-laundering and counter-terrorist-financing-aligned control regime on business-to-consumer gambling licensees operating in the jurisdiction. This closes what has been a longstanding oversight gap in a licensing vertical historically dominated by crypto-accepting operators, more than sixty percent of which took crypto payments without wallet-segregation, blockchain-analytics, or reconciliation controls comparable to those expected of licensed financial institutions. The guideline runs in three phases: a policy upload requirement by September 2026, risk assessments by December 2026, and full controls, including wallet segregation, blockchain analytics, reconciliation, withdrawal whitelisting, and audit-ready recordkeeping, by June 2027. Continue reading This is assessed as a material improving-trajectory development precisely because it targets the specific gap identified in prior cycles: crypto-heavy gambling licensees in Curacao previously faced minimal scrutiny on token provenance or wallet controls, a gap that intersected directly with the global role of the jurisdiction as a licensing hub for online betting and crypto-casino brands. The phased structure means the practical AML and CFT benefit of this guideline will only be fully realized by mid-2027, and the domain posture between now and then is one of implementation risk as much as regulatory design; the gap between issuing a guideline and demonstrating supervisory follow-through on wallet segregation and analytics adoption across the licensee base is the key variable to track. Global digital-asset regulatory developments, including the EU Markets in Crypto-Assets Regulation and evolving FATF virtual-asset service provider standards, form contextual backdrop against which licensee obligations in Curacao are increasingly measured, particularly given that Curacao-licensed operators serve customers who may themselves be subject to those frameworks in their home jurisdictions. But the Curacao Gaming Authority guideline itself, not those external frameworks, is the operative instrument for the domestic supervisory perimeter of Curacao this cycle, and it is this instrument, evidenced through a tier-three industry-press source rather than a tier-one primary publication, that anchors the domain assessment. This finding also carries a cross-domain dimension relevant to compliance-technology tracking: the requirement for blockchain analytics and reconciliation tooling implies adoption of regulatory-technology capability by licensees that have not previously deployed it, a dependency that will make the credibility of the June 2027 full-controls deadline partly contingent on vendor and technical capacity availability across a large and fragmented licensee base, rather than on regulatory intent alone. #### Outlook The near-term milestone sequence to track is the September 2026 policy-upload deadline, the December 2026 risk-assessment deadline, and the June 2027 full-controls deadline, each of which represents a discrete point at which implementation, or the absence of it, can be verified against licensee filings. Given the improving trajectory recorded this cycle, the principal outlook risk is not regulatory design but supervisory capacity: whether the Curacao Gaming Authority demonstrates the enforcement resources to verify wallet-segregation and blockchain-analytics adoption across a licensee base whose scale has historically exceeded supervisory reach, a question the CFATF effectiveness rating from the May 2025 mutual evaluation suggests is not yet resolved. Judgment: No new Curacao-specific crypto-integrity development within this cycle's window; CBCS VASP registration regime and blockchain-analytics expansion remain the standing position. Probable Judgment: No material RegTech/guidance development identified for Curacao this cycle. Uncertain #### AML/CTF Regime Curacao's AML/CFT effectiveness this cycle is defined by three anchoring findings. First, the Caribbean Financial Action Task Force adopted Curacao's fourth-round mutual evaluation report at its 29 May 2025 plenary and placed the jurisdiction under enhanced follow-up, a status that persisted without escalation through the 19 June 2026 FATF plenary. Enhanced follow-up is a formally tracked effectiveness designation: it requires demonstrated progress on the MER's priority actions, with the next plenary review scheduled for October 2026. That review date is the single clearest forward marker in the jurisdiction's AML/CFT trajectory, and it frames everything else in this domain this cycle, since continued progress keeps Curacao off the grey list while a stalled assessment carries real, though not yet realised, escalation risk. Continue reading Second, the Centrale Bank van Curacao en Sint Maarten has stated an intention to intensify enforcement, specifically penalty payments, administrative fines, and public warnings, against unlicensed banks, money transfer companies, insurers, trust service providers, and investment institutions. This is currently a single, locally-sourced statement rather than a CBCS primary-source confirmation, and is carried at assessed rather than high confidence for that reason. Its significance lies less in what it confirms today than in what it would confirm if it converts into named, published enforcement actions: a genuine domestic-enforcement posture shift, distinct from the MER's own effectiveness assessment, that would materially strengthen the demonstrated-progress case ahead of October 2026. Third, and arguably the most structurally significant finding, an IMF Central Bank Transparency Code review found that CBCS has disclosed only one sanction for failure to report a suspicious transaction, without naming the sanctioned entity or publishing remedial measures, and that its broader enforcement-action disclosure remains largely undisclosed. This is a high-confidence, Tier-1-sourced finding, and it should be read as an enabler-adjacent structural gap in its own right: low disclosure of enforcement activity makes it correspondingly harder for external assessors, including CFATF itself, to verify genuine implementation progress, independent of whatever enforcement activity is actually occurring behind that opacity. A fourth, negative finding rounds out the domain: no comprehensive or targeted country-level sanctions programme from the UN, UK, EU, or US regimes was identified against Curacao this cycle, though individually listed persons may still require counterparty screening. This is a stable, unremarkable finding that sits outside the AML/CFT effectiveness picture proper but is worth recording as context for any sanctions-nexus screening decision touching Curacao-domiciled counterparties. #### Outlook The October 2026 FATF plenary is the domain's defining marker. A positive assessment of demonstrated progress against the MER's priority actions would keep Curacao in enhanced follow-up without escalation; a negative or stalled assessment carries genuine grey-list risk, though that risk has not yet materialised. Separately, whether CBCS's stated enforcement intensification produces named, published actions before that review is the second marker to watch, since it is the most direct available proxy for whether domestic implementation is genuinely tightening. The transparency gap identified by the IMF review is unlikely to close on its own timeline and should be treated as a standing constraint on how confidently any external observer, including this monitor, can assess Curacao's true enforcement-versus-enablement balance between now and the next plenary. Judgment: Curacao's standing AML/CTF regime rests on the LID and MOT ordinances (amended May 2024 to bring VASPs, PSPs and EMIs into registration scope), supervised by CBCS and FIU Curacao, assessed by CFATF rather than FATF directly; 4th-round CFATF mutual evaluation (July 2025) rated Curacao Compliant/Largely Compliant on 30 of 40 Recommendations. Curacao is autonomous with no EU/EEA AMLR/6AMLD/AMLA coverage. Probable Judgment: No commercial events involving financial-integrity-adjacent firms identified for Curacao this cycle. Uncertain Regulatory horizon In Force Pending 2026-10 · ±half_year ### CFATF enhanced follow-up implementation for Curaçao's 4th-round MER Curaçao must demonstrate progress on MER priority actions to CFATF's follow-up process ahead of the October 2026 FATF plenary to avoid escalation toward the grey list. [CFATF / Curaçao Ministry of Finance Source](https://minfin.cw/en/updates/caribbean-financial-action-task-force-cfatf-mutual-evaluation-report-curacao/) In Force Pending 2027-Q1 · ±year ### CFATF enhanced follow-up reporting deadline for Curacao Curacao must demonstrate progress on CFATF priority actions on a designated timetable to avoid FATF grey-listing. [CFATF / Curacao Ministry of Finance Source](https://minfin.cw/en/updates/caribbean-financial-action-task-force-cfatf-mutual-evaluation-report-curacao/) Proposed 2027-Q2 · ±year ### Curacao National Ordinance on the Supervision of Payment Service Providers Registration-only supervision for payment/e-money/virtual-asset providers would move to a licensing regime once enacted. [Curacao parliament / CBCS Source](https://www.curacaochronicle.com/post/unknown/curacao-fintech-association-urges-parliament-to-fast-track-payment-services-law) In Force Pending 2027-Q2 · ±half_year ### CGA crypto guideline phased-compliance milestones Phased tightening of crypto-payment AML controls for CW gambling licensees. [Curacao Gaming Authority Source](https://sccgmanagement.com/sccg-articles/2026/07/01/cura-ao-new-crypto-guidelines-raise-compliance-bar-offshore/) 4 dated · 3 pending date · baseline financial-integrity-2026-07-05 Role action cards MLRO ### A regulator-run gaming-licensing portal in Curacao was accessed without authorisation for roughly nine months, with due-diligence and ownership-adjacent material reportedly exposed. Firms with onboarding, correspondent or payment relationships tied to Curacao-licensed gaming operators should treat identity and due-diligence documents collected via that licensing pathway as potentially compromised pending CGA confirmation of scope, which may raise re-verification considerations for affected counterparties. 2 evidence refs Compliance ### CGA has committed to retiring its externally managed licensing portal and building an internally managed replacement after a prolonged unauthorised-access incident. The shift away from third-party-managed licensing infrastructure signals an acknowledged capacity gap in how Curacao's gaming-licensing data has been secured; the standing AML/CFT registration regime for VASPs, PSPs and EMIs under CBCS supervision is unaffected by this change. 1 evidence refs Legal ### No material change for this persona this cycle. No material change for this persona this cycle Board ### A nine-month undetected intrusion into a Curacao gaming regulator's licensing database raises institutional-capacity questions relevant to any group exposure in the jurisdiction. The incident and the unpublished CFATF follow-up report together indicate Curacao's institutional capacity is under external and governmental scrutiny; this is a reputational and operational-risk signal rather than a confirmed regulatory finding against the jurisdiction as a whole. 2 evidence refs CTO ### The compromised system was a third-party-operated licensing portal, now permanently discontinued and being replaced with an internally managed build. The incident illustrates the technical-architecture risk of outsourcing custody of sensitive due-diligence data to externally managed infrastructure; CGA's planned internal rebuild is a direct response to that exposure. 1 evidence refs Risk ### Beneficial-ownership and due-diligence data exposure at a Curacao sector regulator is a distinct risk signal from the jurisdiction's standing AML/CFT and sanctions posture. This is a data-security and institutional-capacity exposure concentrated in the gaming-licensing pathway, not a change to Curacao's AML/CFT registration regime or its CFATF assessment status, both of which remain as previously recorded. 2 evidence refs Operations ### No material change for this persona this cycle. No material change for this persona this cycle Audit ### CGA has not yet confirmed the full scope of beneficial-ownership and due-diligence data exposed in its licensing-portal breach. Until the regulator's own investigation concludes, the categories and volume of exposed material rest on secondary reporting rather than confirmed primary-source disclosure, which is a documentation gap relevant to any audit trail assessment of the incident. 1 evidence refs Scenario sketches ### Illustrative pathway: sector-licensing data exposure feeding into AMLA-era supervisory divergence As an illustrative orientation only, consider how a jurisdiction outside the EU AML Package perimeter, holding sensitive beneficial-ownership-adjacent due-diligence material in a sector-specific regulator rather than a centrally supervised registry, could diverge further from EU-aligned jurisdictions as AMLA direct and indirect supervision of cross-border obliged entities matures under the AMLA Regulation. A sector regulator outside that perimeter experiencing a prolonged, undetected data exposure illustrates one way such divergence could manifest: EU-supervised entities facing a harmonising supervisory architecture, while non-EEA enabler jurisdictions retain fragmented, sector-by-sector custody of ownership-adjacent data with no equivalent harmonising authority. This is illustration only, not a description of an observed trend or a prediction of how Curacao's own institutions will evolve. Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact. Standing trackers (T1–T6) Tracker Status Note T1 · Russian Sanctions-Evasion Architecture no_change T2 · EU AML Package / AMLA no_change Not applicable to Curacao — not EU/EEA. T3 · FATF Grey List watch Curacao is not on the FATF grey list; CFATF enhanced follow-up report remains unpublished as of early September 2026. T4 · Beneficial-Ownership Register Status watch CGA licensing-portal breach exposed beneficial-ownership/due-diligence disclosures for gaming licensees, distinct from the statutory Chamber-of-Commerce UBO register which is not reported compromised. T5 · Crypto & Digital-Asset Integrity no_change VASP registration regime in force since 1 July 2025; CBCS expanding blockchain-analytics/AML monitoring per its 2025 Annual Report. T6 · Sanctions Regime Divergence no_change Registers ### Enforcement actions - 1 Jul 2025 - 1 May 2025 - 1 May 2025 - 1 Jan 2025 - 2026-03 - First-ever accountability action against Curaçao's online gambling sector for identity-verification/AML failures, following a 2020 civil-society complaint dossier. Settlement involved fines rather than arrests or licence revocation. 1 Jul 2025 - CFATF completed and the FATF endorsed Curaçao's 4th-round Mutual Evaluation, rating the country's technical compliance and effectiveness across 40 Recommendations and 11 Immediate Outcomes, flagging medium-high ML risk and priority actions on BO, FIU independence and TF risk assessment. 1 May 2025 - Issuance and continued rollout of the National Decree on UBO Registration, a step forward on beneficial-ownership transparency, though the UBO portal and cross-verification mechanisms remained incomplete and sanctions for non-compliance limited at the time of MER assessment/endorsement. 1 May 2025 - Ongoing transition of gambling operators from the legacy master-licence/sub-licence model to direct Gaming Authority licensing under the National Ordinance on Games of Chance (P.B. 2024, no.157), with a transitional arrangement permitting continued operation pending licence determination. 1 Jan 2025 ### Sanctions changes - 23 Oct 2025 - 29 Apr 2026 - 31 Dec 2025 - 1 Jan 2026 - 5 Oct 2026 - EU's 19th Russia sanctions package (23 October 2025) targeted Russian energy, third-country banks and crypto providers, including shadow-fleet enablers and maritime registries. As an EU Overseas Country and Territory rather than a Member State, EU sanctions regulations do not self-execute in Curaçao; implementation instead depends on Kingdom-level Sanctions Act extension, creating a structural timing/scope gap versus direct EU-member enforcement. 23 Oct 2025 - EU's 20th Russia sanctions package introduced a sectoral ban on Russia-established crypto service providers and decentralized platforms, and explicitly prohibited state-backed instruments (RUBx stablecoin, digital ruble CBDC) — the first sector-level (rather than entity-by-entity) crypto sanctions design, relevant to Curaçao's role as a licensing hub for globally-operating crypto exchanges and crypto casinos. 29 Apr 2026 ### Regulatory horizon (register) - CFATF enhanced follow-up implementation for Curaçao's 4th-round MER - CFATF enhanced follow-up implementation for Curaçao's 4th-round MER - CFATF enhanced follow-up reporting deadline for Curacao - Curacao National Ordinance on the Supervision of Payment Service Providers - CGA crypto guideline phased-compliance milestones - Draft Payment Services / VASP supervision ordinances before Parliament - CFATF post-MER enhanced follow-up report on Curaçao - Full operationalization of Curaçao UBO portal and cross-verification - Completion of Gaming Authority licensing transition for online operators ### Active schemes - Curaçao online-gambling sub-licensing proliferation model - Conflict-tainted Venezuelan gold transited via Curaçao - Underground banking and money-transfer abuse in Curaçao Sources - [https://news.bitcoin.com/dutch-state-lottery-takes-biggest-illegal-gambling-site-to-court-as-regulator-says-e24m-fine-was-too-low/](https://news.bitcoin.com/dutch-state-lottery-takes-biggest-illegal-gambling-site-to-court-as-regulator-says-e24m-fine-was-too-low/) - [https://minfin.cw/en/updates/caribbean-financial-action-task-force-cfatf-mutual-evaluation-report-curacao/](https://minfin.cw/en/updates/caribbean-financial-action-task-force-cfatf-mutual-evaluation-report-curacao/) - [https://www.cga.cw/regulatory-scope](https://www.cga.cw/regulatory-scope) - [https://windward.ai/blog/u-s-sanctions-six-shipowners-and-prepares-to-seize-more-venezuela-tankers/](https://windward.ai/blog/u-s-sanctions-six-shipowners-and-prepares-to-seize-more-venezuela-tankers/) - [https://home.treasury.gov/news/press-releases/sb0348](https://home.treasury.gov/news/press-releases/sb0348) - [https://europeangaming.eu/portal/latest-news/2026/06/30/208477/curacaos-crypto-guideline-what-the-cga-now-requires-of-licensees/](https://europeangaming.eu/portal/latest-news/2026/06/30/208477/curacaos-crypto-guideline-what-the-cga-now-requires-of-licensees/) - [Ministry of Finance, Curaçao](https://minfin.cw/en/updates/caribbean-financial-action-task-force-cfatf-mutual-evaluation-report-curacao/) - [FATF](https://www.fatf-gafi.org/en/publications/Mutualevaluations/mer-curacao-2025.html) - [FATF (CFATF page)](https://www.fatf-gafi.org/en/countries/global-network/caribbean-financial-action-task-force--cfatf-.html) - [RegActions](https://regactions.com/countries/curacao) - [Centrale Bank van Curaçao en Sint Maarten (CBCS)](https://www.centralbank.cw/legislation-guidelines/integrity-financial-sector/anti-money-laundering) - [Curaçao Chronicle](https://www.curacaochronicle.com/post/unknown/cbcs-strengthens-crackdown-on-unlicensed-financial-service-providers) - [CBCS](https://www.centralbank.cw/index.php?eid=1910) - [IMF](https://www.elibrary.imf.org/view/journals/002/2026/063/article-A001-en.xml) - [https://www.centralbank.cw/legislation-guidelines/integrity-financial-sector/anti-money-laundering](https://www.centralbank.cw/legislation-guidelines/integrity-financial-sector/anti-money-laundering) - [https://www.fatf-gafi.org/en/publications/Mutualevaluations/mer-curacao-2025.html](https://www.fatf-gafi.org/en/publications/Mutualevaluations/mer-curacao-2025.html) - [https://regactions.com/countries/curacao](https://regactions.com/countries/curacao) - [https://fiucuracao.org/reporting-tool/](https://fiucuracao.org/reporting-tool/) - [https://gobiernu.cw/nl/themas-result/](https://gobiernu.cw/nl/themas-result/) - [https://www.721news.com/2026/09/centrale-bank-of-curacao-and-sint-maarten-with-public-warning-notice/](https://www.721news.com/2026/09/centrale-bank-of-curacao-and-sint-maarten-with-public-warning-notice/) - [https://www.knowyourcountry.com/country-reports/curacao/](https://www.knowyourcountry.com/country-reports/curacao/) - [https://www.legal500.com/guides/chapter/curacao-gambling-law/](https://www.legal500.com/guides/chapter/curacao-gambling-law/) - [https://www.curacaochronicle.com/post/unknown/cbcs-tightens-sanctions-procedures-as-financial-institutions-face-24-hour-alerts](https://www.curacaochronicle.com/post/unknown/cbcs-tightens-sanctions-procedures-as-financial-institutions-face-24-hour-alerts) - [https://www.cga.cw/notifications](https://www.cga.cw/notifications) - [https://www.curacaochronicle.com/post/main_news/curacao-to-conduct-ongoing-national-risk-analyses-to-track-money-laundering](https://www.curacaochronicle.com/post/main_news/curacao-to-conduct-ongoing-national-risk-analyses-to-track-money-laundering) - [https://www.curacaochronicle.com/post/unknown/curacao-reports-major-progress-in-fight-against-money-laundering-and-financial-crime](https://www.curacaochronicle.com/post/unknown/curacao-reports-major-progress-in-fight-against-money-laundering-and-financial-crime) - [https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/Curacao-MER-Evalution-CFATF-round4.pdf.coredownload.inline.pdf](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/Curacao-MER-Evalution-CFATF-round4.pdf.coredownload.inline.pdf) - [https://www.curacaochronicle.com/post/unknown/curacao-fintech-association-urges-parliament-to-fast-track-payment-services-law](https://www.curacaochronicle.com/post/unknown/curacao-fintech-association-urges-parliament-to-fast-track-payment-services-law) - [https://www.ftm.eu/articles/curacao-secretive-gambling-industry-exposed-in-leak](https://www.ftm.eu/articles/curacao-secretive-gambling-industry-exposed-in-leak) - [https://www.casinonewsdaily.com/blog/2026/10/15/curacao-gaming-authority-plans-new-licensing-procedures/](https://www.casinonewsdaily.com/blog/2026/10/15/curacao-gaming-authority-plans-new-licensing-procedures/) - [https://www.curacaochronicle.com/post/unknown/curacao-claims-cfatf-progress-but-key-follow-up-report-remains-unpublished](https://www.curacaochronicle.com/post/unknown/curacao-claims-cfatf-progress-but-key-follow-up-report-remains-unpublished) - [https://ofac.treasury.gov/recent-actions/20261005](https://ofac.treasury.gov/recent-actions/20261005) - [https://www.cga.cw/home](https://www.cga.cw/home) - [https://legalbison.com/blog/is-your-gambling-license-at-risk-after-the-curacao-gaming-authority-data-leak/](https://legalbison.com/blog/is-your-gambling-license-at-risk-after-the-curacao-gaming-authority-data-leak/) - [https://www.centralbank.cw/publications/press-releases/2024/pb2024-023-mandatory-registration-for-virtual-asset-service-providers-payment-service-providers-and-electronic-money-institutions](https://www.centralbank.cw/publications/press-releases/2024/pb2024-023-mandatory-registration-for-virtual-asset-service-providers-payment-service-providers-and-electronic-money-institutions) - [Caribbean Financial Action Task Force (CFATF)](https://www.fatf-gafi.org/en/countries/global-network/caribbean-financial-action-task-force--cfatf-.html) - [Curaçao's measures to combat money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/mer-curacao-2025.html) - ["Black and grey" lists](https://www.fatf-gafi.org/en/countries/black-and-grey-lists.html) - [Assessments](https://www.fatf-gafi.org/en/calendars/assessments.html) - [Replace this default image with country image Anti-money laundering](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/Curacao-MER-Evalution-CFATF-round4.pdf.coredownload.inline.pdf) - [Countries / Jurisdictions](https://www.fatf-gafi.org/en/countries.html) - [Jurisdictions under Increased Monitoring - 13 February 2026](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html) - [High-risk and other monitored jurisdictions](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions.html) - [Progress in fighting money laundering and terrorist financing in the Caribbean and Central American Region](https://www.fatf-gafi.org/en/documents/progressinfightingmoneylaunderingandterroristfinancinginthecaribbeanandcentralamericanregion.html) - [FATF changes its grey listing criteria to further focus on risk](https://www.fatf-gafi.org/en/publications/Fatfgeneral/FATF-grey-listing-criteria.html) - [Curaçao Kingdom of the Netherlands](https://www.fatf-gafi.org/en/countries/detail/Curacao-Kingdom-of-the-Netherlands.html) - [Digital Transformation of AML/CFT](https://www.fatf-gafi.org/en/publications/digitaltransformation/digital-transformation.html) - [Home](https://www.fatf-gafi.org/) - [Prepared Remarks of FinCEN Deputy Director Jamal El-Hindi, delivered at the 2019 Money Transmitter Regulators Association Annual Conference | FinCEN.gov](https://www.fincen.gov/news/speeches/prepared-remarks-fincen-deputy-director-jamal-el-hindi-delivered-2019-money) - [Vulnerabilities of Casinos and Gaming Sector](https://www.fatf-gafi.org/en/documents/documents/vulnerabilitiesofcasinosandgamingsector.html) - [Anti-money laundering and counter-terrorist financing ...](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/CFATF-Mutual-Evaluation-Report-Aruba-2022.pdf.coredownload.inline.pdf) - [Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Countering the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov](https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-3) - [News](https://www.fatf-gafi.org/en/the-fatf/news.html) - [Jurisdictions under Increased Monitoring - 13 June 2025](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-june-2025.html) - [Inside the Global Online Betting Empire of a Slain Turkish Cypriot Businessman | OCCRP](https://www.occrp.org/en/investigation/inside-the-global-online-betting-empire-of-a-slain-turkish-cypriot-businessman) - [Dutch Princess Under Kidnapping Threat from Organized Crime | OCCRP](https://www.occrp.org/en/news/dutch-princess-under-kidnapping-threat-from-organized-crime) - [Panama Papers: ICIJ To Release Searchable Online Database of Data | OCCRP](https://www.occrp.org/en/news/panama-papers-icij-to-release-searchable-online-database-of-data) - [Spain & Romania Shut Down Online Scam Operation | OCCRP](https://www.occrp.org/en/news/spain-romania-shut-down-online-scam-operation) - [Anglo Austrian Bank Files For Bankruptcy | OCCRP](https://www.occrp.org/en/news/anglo-austrian-bank-files-for-bankruptcy) - [Armenian-Belgian Gang That Fixed Tennis Matches Arrested | OCCRP](https://www.occrp.org/en/daily/8170-armenian-belgian-gang-that-fixed-tennis-matches-arrested) - [Organized Crime and Corruption Reporting Project | OCCRP](https://www.occrp.org/en) - [Operation Curacçao](https://www.unodc.org/cld/case-law-doc/moneylaunderingcrimetype/bra/operation_curaccao.html) - [Conflict-Tainted Venezuelan Gold Entered World Market Through Caribbean Island, Documents Indicate | OCCRP](https://www.occrp.org/en/investigation/conflict-tainted-venezuelan-gold-entered-world-market-through-caribbean-island-documents-indicate) - [All Investigations | OCCRP](https://www.occrp.org/en/investigations/page/1) - [Five Questions on the Gold Trade | OCCRP](https://www.occrp.org/en/feature/five-questions-on-the-gold-trade) - [Gold and Chaos in Orinoco | OCCRP](https://www.occrp.org/en/goldandchaos/) - [President Maduro Linked to Ugandan Gold Probe | OCCRP](https://www.occrp.org/en/daily/9381-maduro-linked-to-ugandan-gold-probe) - [Romanian Controversial Gold Mining Project Loses License | OCCRP](https://www.occrp.org/en/news/romanian-controversial-gold-mining-project-loses-license) - [Venezuela Cracks Down on Corruption at State-Owned Petroleum Company | OCCRP](https://www.occrp.org/en/news/venezuela-cracks-down-on-corruption-at-state-owned-petroleum-company) - [Blood Gold and New Opportunities: Foreign Firms Are Poised to Reenter Venezuela's Wild South | OCCRP](https://www.occrp.org/en/feature/blood-gold-and-new-opportunities-foreign-firms-are-poised-to-reenter-venezuelas-wild-south) - [Updated Advisory on Widespread Public Corruption in ...](https://www.fincen.gov/sites/default/files/advisory/2019-05-03/Venezuela%20Advisory%20FINAL%20508.pdf) - [How Conoco's Fight With Venezuela Landed in Curacao: QuickTake - Bloomberg](https://www.bloomberg.com/news/articles/2018-05-18/how-conoco-s-fight-with-venezuela-landed-in-curacao-quicktake) - [Summer 2023 consultation – Proposed changes to LCCP and RTS: Consultation Response - Executive summary](https://www.gamblingcommission.gov.uk/consultation-response/summer-2023-consultation-proposed-changes-to-lccp-and-rts-consultation/executive-summary-proposed-changes-to-lccp-remote-gambling-and-software) - [Gambling Commission website](https://www.gamblingcommission.gov.uk/) - [Licensees Hub](https://www.gamblingcommission.gov.uk/licensees-and-businesses) - [Upcoming changes to the LCCP](https://www.gamblingcommission.gov.uk/licensees-and-businesses/lccp/upcoming-changes) - [Summer 2023 consultation on proposed changes to Licence Conditions and Codes of Practice (LCCP), Remote Gambling and Software Technical Standards (RTS), and arrangements for Regulatory Panels - The Gambling Commission - Citizen Space](https://consult.gamblingcommission.gov.uk/author/summer_2023_consultation_lccp_rts_regpanels/consult_view/) - [Consultations](https://www.gamblingcommission.gov.uk/about-us/consultations) - [Gambling Licensing Policy 2024 Update - Kensington and Chelsea's Consultation and Engagement Hub - Citizen Space](https://consult.rbkc.gov.uk/communities/gambling-licensing-policy-2024/) - [Non-Remote Casino Sector – legislative changes guidance](https://www.gamblingcommission.gov.uk/licensees-and-businesses/guide/non-remote-casino-sector-legislative-changes-guidance) - [Gambling Policy 2025 - NPT Council](https://www.npt.gov.uk/business/licensing/gambling-and-lotteries/gambling-policy-2025/) - [CENTRAL BANK OF CURACAO AND ST. MAARTEN - LEI: 213800LVQN54C5LIXE21](https://lei.bloomberg.com/leis/view/213800LVQN54C5LIXE21) - [Operation Curacçao - UNODC's Sherloc](https://sherloc.unodc.org/cld/case-law-doc/moneylaunderingcrimetype/bra/operation_curaccao.html) - [DEPARTMENT OF THE TREASURY W A S H I N G T O N , D . C . 2 0 2 2 0 MUL-565595](https://ofac.treasury.gov/media/13781/download) - [Curacao | United Nations in Trinidad and Tobago, Aruba, Curacao and Sint Maarten](https://trinidadandtobago.un.org/en/about/curacao) - [Notifications made by the European Union to the UK under ...](https://assets.publishing.service.gov.uk/media/6957afd897f1c5e3c92a83ae/26-11-2025_-_EU_Notification_to_UK_-_NV-EU_to_UK_SC_LEJC_-_Part_Three_FINAL_Portugal_ONB_FINAL.pdf) - [Sint Maarten - International Partnerships - European Commission](https://international-partnerships.ec.europa.eu/countries/sint-maarten_en) - [Fincen](https://www.fincen.gov/system/files/schema/code/FinCENReferenceCodes.xsd) - [Timeline - EU sanctions against Russia - Consilium](https://www.consilium.europa.eu/en/policies/sanctions-against-russia/timeline-sanctions-against-russia/) - [Russia's war against Ukraine: EU sanctions - Consilium](https://www.consilium.europa.eu/en/policies/sanctions-against-russia/) - [EU sanctions against Russia: questions and answers - Consilium](https://www.consilium.europa.eu/en/policies/sanctions-against-russia-explained/) - [19th package of sanctions against Russia: EU targets Russian energy, third-country banks and crypto providers - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/10/23/19th-package-of-sanctions-against-russia-eu-targets-russian-energy-third-country-banks-and-crypto-providers/) - [Russia’s war of aggression against Ukraine: Council extends economic sanctions for a further 6 months - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/12/22/russia-s-war-of-aggression-against-ukraine-council-extends-economic-sanctions-for-a-further-6-months/) - [Russian hybrid threats: Council sanctions twelve individuals and two entities over information manipulation and cyber attacks - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/12/15/russian-hybrid-threats-council-sanctions-twelve-individuals-and-two-entities-over-information-manipulation-and-cyber-attacks/) - [Russia's war of aggression against Ukraine: Council sanctions 41 vessels of the Russian shadow fleet - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/12/18/russia-s-war-of-aggression-against-ukraine-council-sanctions-41-vessels-of-the-russian-shadow-fleet/) - [EU Plans Massive 21st Sanctions Package to Target Russian Banks and Crypto | OCCRP](https://www.occrp.org/en/news/eu-plans-massive-21st-sanctions-package-to-target-russian-banks-and-crypto) - [EU's 20th Russia Sanctions Package](https://www.chainalysis.com/blog/eu-russia-sactions-package-april-2026/) - [The EU's 20th sanctions package targets the architecture of crypto sanctions evasion](https://www.elliptic.co/blog/eu-20th-sanctions-package-targets-the-architecture-of-crypto-sanctions-evasion) - [Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov](https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-5) - [Anti-money laundering and counter-terrorist financing measures Sint Maarten](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/Sint%20Marteen-MER-Evaluation-CFATF-round4.pdf.coredownload.inline.pdf) - [F I U 's in action](https://www.fincen.gov/sites/default/files/shared/fiuinaction.pdf) - [Drake, Adin Ross Have Unusual Win Rates at Crypto Casino Stake](https://www.bloomberg.com/features/2026-stake-drake-crypto-casino-adin-ross-gambling/) - [Operator InterStorm](https://www.gamblingcommission.gov.uk/about-us/freedomofinformation/print/operator-interstorm) - [RBC Royal Bank N.V. - LEI: 54930037GWKAHR99K624](https://lei.bloomberg.com/leis/view/54930037GWKAHR99K624) - [TMF Curaçao N.V. - LEI: 254900L1R8AI16P8IO53](https://lei.bloomberg.com/leis/view/254900L1R8AI16P8IO53) - [Stichting Particulier Fonds de Kastanjeboom - LEI: 254900FEDYHQALBH7217](https://lei.bloomberg.com/leis/view/254900FEDYHQALBH7217) - [Guidance on Beneficial Ownership of Legal Persons](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-Beneficial-Ownership-Legal-Persons.html) - [U.S. Beneficial Ownership Information Registry Now Accepting Reports | FinCEN.gov](https://www.fincen.gov/news/news-releases/us-beneficial-ownership-information-registry-now-accepting-reports) - [Beneficial Ownership](https://www.fatf-gafi.org/en/topics/beneficial-ownership.html) - [Beneficial Ownership Information Reporting | FinCEN.gov](https://www.fincen.gov/boi) - [Cyprus Launches New Registry that Identifies Company Owners | OCCRP](https://www.occrp.org/en/news/cyprus-launches-new-registry-that-identifies-company-owners) - [Frequently Asked Questions | FinCEN.gov](https://www.fincen.gov/boi-faqs) - [FINANCIAL ACTION TASK FORCE Mutual Evaluation Report](https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/MER%20Netherlands%20full.pdf) - [READOUT: FinCEN and Partner FIU Officials Meet in Canada for International Public-Private Partnership Events on Illicit Finance | FinCEN.gov](https://www.fincen.gov/news/news-releases/readout-fincen-and-partner-fiu-officials-meet-canada-international-public) - [FATF-X FINANCIAL ACTION TASK FORCE ON MONEY LAUNDERING ANNUAL REPORT 1998-1999](https://www.fatf-gafi.org/content/dam/fatf-gafi/annual-reports/1998%201999%20ENG.pdf) - [)$7);,, )HEUXDU\         ](https://www.fincen.gov/system/files/shared/fatftypologie.pdf) - [Counter Terrorist Financing Taskforce – Israel (CTFTI) - FIU Task Force Public Statement | FinCEN.gov](https://www.fincen.gov/news/news-releases/counter-terrorist-financing-taskforce-israel-ctfti-fiu-task-force-public) - [Curaçao travel advice - GOV.UK](https://www.gov.uk/foreign-travel-advice/curacao) - [Report fraud - European Anti-Fraud Office - European Commission](https://anti-fraud.ec.europa.eu/olaf-and-you/report-fraud_en) - [Curaçao - International Partnerships - European Commission](https://international-partnerships.ec.europa.eu/countries/curacao_en) - [Caribbean Financial Action Task Force (CFATF) / FATF](https://www.fatf-gafi.org/en/publications/Mutualevaluations/mer-curacao-2025.html) - [OCCRP](https://www.occrp.org/en/investigation/inside-the-global-online-betting-empire-of-a-slain-turkish-cypriot-businessman) - [OCCRP](https://www.occrp.org/en/investigation/conflict-tainted-venezuelan-gold-entered-world-market-through-caribbean-island-documents-indicate) - [Bloomberg](https://www.bloomberg.com/features/2026-stake-drake-crypto-casino-adin-ross-gambling/) - [Council of the European Union (Consilium)](https://www.consilium.europa.eu/en/press/press-releases/2025/10/23/19th-package-of-sanctions-against-russia-eu-targets-russian-energy-third-country-banks-and-crypto-providers/) - [European Commission (International Partnerships)](https://international-partnerships.ec.europa.eu/countries/curacao_en) - [Elliptic](https://www.elliptic.co/blog/eu-20th-sanctions-package-targets-the-architecture-of-crypto-sanctions-evasion) Coverage gaps fim-int-2026-07-05-G001: No direct CBCS national supervisory… fim-int-2026-07-05-G001: No direct CBCS national supervisory enforcement-log primary was retrieved; independent verification of day-to-day AML supervisory/RegTech activity between MER cycles would require CBCS's own enforcement disclosure. [resolved] fim-int-2026-07-05-G002: Curaçao's 2024 TF and NPO risk asse… fim-int-2026-07-05-G002: Curaçao's 2024 TF and NPO risk assessment has not been published; the underlying assessment document would allow independent verification of its low-risk conclusion. [resolved] fim-int-2026-07-05-G003: No named-entity detail was availabl… fim-int-2026-07-05-G003: No named-entity detail was available for the EU 20th sanctions package's sectoral crypto ban as it applies to Curaçao-licensed VASPs; a Kingdom Sanctions Act extension notice would clarify actual applicability timing. [resolved] fim-int-2026-07-05-G004: Exact completion timeline and enfor… fim-int-2026-07-05-G004: Exact completion timeline and enforcement rigor for Gaming Authority re-licensing of legacy sub-licensed operators is not established; Gaming Authority licensing-decision publications would resolve the current uncertain risk-direction rating. [resolved] fim-int-2026-07-05-G005: No confirmed publication date exist… fim-int-2026-07-05-G005: No confirmed publication date exists for the underlying OCCRP Venezuelan-gold investigation; a dated primary or investigative-report timestamp would allow accurate recency dating of the conflict-gold claim. [resolved] fim-int-2026-08-05-G001: No general commercial beneficial-ow… fim-int-2026-08-05-G001: No general commercial beneficial-ownership registry data for Curacao was located this cycle; only sector-specific (gaming) UBO probity-check evidence exists. [resolved] fim-int-2026-08-05-G002: No T1 regulatory statement directly… fim-int-2026-08-05-G002: No T1 regulatory statement directly names Downtown E-commerce Company as Novatech's/Lalabet's administrator; reliance is on T3/T4 press. [resolved] fim-int-2026-08-05-G003: Precise vessel-level attribution li… fim-int-2026-08-05-G003: Precise vessel-level attribution linking specific CW-loitering tankers to the December 2025 OFAC designation list was not established this cycle. [resolved] fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', 'value': 'D3'}): No sourced D3 enabler-jurisdiction finding for Curacao this cycle. [resolved] fim-int-2026-08-20-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-08-20-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): No confirmed CBCS primary-source press release corroborating the intensified-enforcement statement. [resolved] fim-int-2026-08-20-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-08-20-G003 ({'scheme': 'financial_integrity', 'value': 'D7'}): The sanctioned entity name and remedial measures behind the disclosed IMF-flagged STR-failure fine remain unpublished. [resolved] fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): No standalone public UBO registry identified for Curacao; UBO verification occurs only at CGA/CBCS licensing-gatekeeper level rather than via a central register. [resolved] fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): No CW-specific sanctions implementation mechanism (Kingdom-level UN/EU sanctions ordinance) was independently confirmed this cycle. [resolved] fim-int-2026-09-28-G003: Tier-D watch jurisdictions (KH/LA/M… fim-int-2026-09-28-G003: Tier-D watch jurisdictions (KH/LA/MX/CO) are out of scope for this single-JID CW union dispatch and are covered under FIM's own standing cadence. [resolved] fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): Precise deposit/play/payout money thresholds for CDD completion for CW gambling operators were not located this cycle. [resolved] fim-int-2026-10-04-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-04-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): Exact unusual-transaction reporting deadline in hours/days under NORUT, and any consent/hold mechanism for suspicious transactions, was not located this cycle. [resolved] fim-int-2026-10-04-G003: D2 (beneficial ownership), D3 (enab… fim-int-2026-10-04-G003: D2 (beneficial ownership), D3 (enabler jurisdictions) and D4 (conflict finance) domains had thin or no coverage for Curacao this cycle. [resolved] fim-int-2026-10-11-G001: Primary CFATF follow-up assessment … fim-int-2026-10-11-G001: Primary CFATF follow-up assessment document not independently retrieved; relied on secondary press report of government statement. [resolved] fim-int-2026-10-11-G002: CGA's crypto-policy guideline PDF n… fim-int-2026-10-11-G002: CGA's crypto-policy guideline PDF not independently retrieved; relied on trade-press secondary reporting. [resolved] fim-int-2026-10-11-G003: Tier D jurisdictions (KH, LA, MX, C… fim-int-2026-10-11-G003: Tier D jurisdictions (KH, LA, MX, CO) not actively searched this cycle; pooled research budget allocated to CW. [resolved] fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): No Tier-1 sanctions action specific to a Curaçao entity was identified within this cycle's recency window. [open] fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): The CFATF enhanced follow-up report on Curaçao's AML/CFT progress remains unpublished, preventing independent verification of claimed improvements in UBO transparency and FIU capacity. [open] fim-int-2026-10-18-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G003 ({'scheme': 'financial_integrity', 'value': 'D4'}): No conflict-finance material specific to Curaçao was identified this cycle; this domain is not applicable in Curaçao's current risk profile. [open] fim-int-2026-10-25-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-25-G001 ({'scheme': 'financial_integrity', 'value': 'D7'}): The CFATF enhanced follow-up report on Curacao, discussed at the May 2026 CFATF plenary, remained unpublished as of early September 2026, preventing independent verification of the government's claimed progress on technical-compliance ratings. [open] fim-int-2026-10-25-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-25-G002 ({'scheme': 'financial_integrity', 'value': 'D2'}): The CGA has not itself confirmed the full scope of beneficial-ownership/due-diligence data exposed in the licensing-portal breach; the claim rests on T3 investigative commentary. [open] FIM-GAP-001 (D3): Curaçao's FIU (MOT) complies with technica… FIM-GAP-001 (D3): Curaçao's FIU (MOT) complies with technical FIU requirements but lacks full operational independence, per CFATF's 2025 MER (R.29), alongside understaffed law-enforcement agencies that leave high-risk sectors like e-zones and online gambling largely uninvestigated for ML. FIM-GAP-002 (D2): Despite the 2024 UBO Decree, CFATF found l… FIM-GAP-002 (D2): Despite the 2024 UBO Decree, CFATF found limited sanctions for non-compliance and gaps in director registration for certain entity types, with trustee CDD/BO record-keeping inadequately aligned to FATF definitions and lacking timely updates. FIM-GAP-003 (D5): For years Curaçao's master-licence/sub-lic… FIM-GAP-003 (D5): For years Curaçao's master-licence/sub-licence gambling model let operators proliferate globally with 'no oversight or legal right to operate in regulated jurisdictions,' a structure exploited by a Turkish organised-crime network (the Falyali betting empire) for large-scale mule-account laundering; the jurisdiction had never fined an operator or revoked a licence until 2025. FIM-GAP-004 (D6): No direct CBCS (Centrale Bank van Curaçao … FIM-GAP-004 (D6): No direct CBCS (Centrale Bank van Curaçao en Sint Maarten) enforcement-action primary publication could be retrieved within the 18-month window; the enforcement register for this baseline relies on the CFATF/FATF multilateral MER and Bloomberg/OCCRP investigative reporting rather than a national supervisory enforcement-log primary. ## Evidence #### Confidence-tiered claims CGA crypto guideline (June 2026) requires B2C licensees accepting cryptoasset payment to segregate player/operational/treasury wallets, screen deposits/withdrawals, trace fund origin/destination, exclude mixer/tumbler/sanctioned-address-linked funds, and conduct VASP counterparty due diligence, via a phased 2026-2027 timetable. [[Source 1]](#sec-sources) Probable · 1 source CBCS issued a public warning identifying three social-media-promoted investment programmes (Quick Promo, Korsou Legacy Capital Group, Elite Wealth Forum) exhibiting pyramid-scheme and unauthorized virtual-asset-activity characteristics; no confirmed enforcement action against the operators this pass. [[Source 1]](#sec-sources) Probable · 1 source Curacao is not on the FATF Jurisdictions-under-Increased-Monitoring list as of the 19 June 2026 Plenary; its 4th-round CFATF MER (adopted May 2025, published July 2025) found it Compliant on 10 and Largely Compliant on 20 of the 40 Recommendations. [[Source 1]](#sec-sources) Probable · 1 source The GCB/CGA AML Regulations became a mandatory licensing component effective 10 April 2025 after a three-month transition, applying the NOIS (National Ordinance identification when rendering services) CDD framework to gaming service providers. [[Source 1]](#sec-sources) Probable · 1 source CBCS formalized a 24-hour supervised-institution notification procedure for UN/EU/Dutch sanctions-list changes under its Omnibus-Sanctiebesluit Curacao (PB 2025 nr. 52), evidencing continued gatekeeper-function build-out. [[Source 1]](#sec-sources) Probable · 1 source A draft National Ordinance on the Supervision of Payment Service Providers remains pending enactment; PSPs, EMIs and VASPs currently operate under CBCS registration (since 25 June 2024) rather than full licensing. [[Source 1]](#sec-sources) Probable · 1 source P.B. 2026 no. 144 amends the Omnibus Sanctiebesluit (P.B. 2025 no. 52) to integrate UN and EU sanctions measures directly into national legislation. [[Source 1]](#sec-sources) Probable · 1 source First CFATF follow-up assessment (reported Sept 2026) found 'significant progress' since the July 2025 fourth-round mutual evaluation; next full evaluation expected around 2032. [[Source 1]](#sec-sources) Probable · 1 source CGA crypto-handling rules for B2C gaming licensees bar VASP/exchange/PSP activity, require wallet screening, and reference FATF R.16 for originator/beneficiary information; phased deadlines Sept/Dec 2026, full compliance mid-2027. [[Source 1]](#sec-sources) Probable · 1 source The association wrote to Parliament's President warning the absence of an EMI/PI licensing mechanism causes daily operational obstacles limiting banking access and investment capital. [[Source 1]](#sec-sources) Probable · 1 source CGA licensing-portal breach exposed ~40,000 documents covering UBO, ownership structure and ID data for nearly 650 Curaçao-licensed gambling companies [[Source 1]](#sec-sources) Probable · 1 source CGA confirmed on 7 October 2026 the breached licensing portal will not return to service; terminated service arrangement reportedly linked to Random Consulting (Malta-connected) [[Source 1]](#sec-sources) Probable · 1 source CFATF enhanced follow-up report on Curaçao (discussed May 2026) remains unpublished despite government claims of significant AML/CFT progress including UBO transparency [[Source 1]](#sec-sources) Probable · 1 source Not on FATF list of jurisdictions under increased monitoring as of the 19 June 2026 plenary; July 2025 fourth-round CFATF mutual evaluation found Compliant on 10 and Largely Compliant on 20 of the 40 Recommendations [[Source 1]](#sec-sources) Probable · 1 source Crude-oil tanker re-flagged to Curaçao (from Tanzania) recorded in OFAC's 5 October 2026 SDN List update, part of a broader Iran-related designations/removals action [[Source 1]](#sec-sources) Uncertain · 1 source CGA confirmed unauthorised access to its externally-managed licensing portal and database between December 2025 and September 2026; portal permanently discontinued. [[Source 1]](#sec-sources) Probable · 1 source T3 commentary (not confirmed by CGA) describes exposure of UBO Personal History Disclosure Forms, passports and financial-disclosure material for ~646 licensed gaming companies. [[Source 1]](#sec-sources) Uncertain · 1 source LID and MOT ordinances (amended effective 16 May 2024) bring VASP/PSP/EMI within registration scope with CBCS; FIU Curacao is designated reporting body; CFATF is assessment body; 4th-round CFATF mutual evaluation (July 2025) rated Curacao Compliant/Largely Compliant on 30 of 40 Recommendations. [[Source 1]](#sec-sources) Probable · 1 source