The Curacao Gaming Authority has issued a detailed crypto policy guideline for B2C license holders, setting out controls that will govern how operators accept, hold and pay out digital assets, and giving the industry until mid-2027 to reach full compliance.
The document, published in June 2025, covers the entire cryptocurrency lifecycle within a licensed operation, from deposit screening and wallet architecture to withdrawal processing and incident reporting. It applies to all group entities supporting the licensed operator, not just the entity holding the license itself.
The CGA is explicit that crypto is not a regulatory carve-out. The use of digital assets does not reduce or modify any obligation under the authority’s existing AML/CFT framework, and operators must detail their cryptocurrency-specific controls within their submitted AML policy on the CGA portal. The regulator classifies crypto assets as high risk by default and states a preference for fiat-backed regulated stablecoins where operators have a choice.
Central to the new requirements is a mandate for blockchain analytics capability, covering deposit screening, ongoing transaction monitoring, source-of-funds verification and withdrawal screening. The CGA does not prescribe a specific provider – naming Chainalysis, Elliptic and TRM Labs as examples rather than requirements – but makes clear that whatever solution or combination of tools an operator uses must deliver the full range of functionality, including the ability to trace fund origins, risk-score wallets, identify exposure to mixers and sanctioned addresses, and generate evidence suitable for suspicious activity reporting. Risk assessment work may be delegated to third parties, but visibility and accountability for crypto transactions remain with the licensed operator.
The guidelines require operators to address specific categories of digital asset in their policies. Privacy-enhancing cryptocurrencies – including Monero, Zcash shielded transactions, and Dash where privacy features are used – must be addressed given their capacity to obstruct transaction monitoring and source-of-funds verification. The policy does not impose an outright blanket prohibition on these assets but requires operators to have a documented position on each. On meme coins and highly speculative tokens, the CGA takes a calibrated approach, acknowledging that some are liquid and transparent while others present risks around volatility, market manipulation and financial crime. Operators must categorize such assets against objective criteria including liquidity profile, governance maturity and financial crime risk features.
Wrapped tokens and bridged assets represent a harder line. Operators are prohibited from accepting deposits involving these instruments where the provenance of the underlying asset cannot be independently verified. Outright prohibitions cover assets originating from sanctioned mixers or tumblers and any wallet addresses appearing on applicable sanctions lists or flagged by recognized blockchain analytics providers.
The policy imposes strict requirements on wallet ownership and architecture. All wallets connected to licensed operations must be held by the licensed entity or an approved group entity, personal wallets, UBO-linked wallets and informal arrangements are expressly prohibited. Operators must segregate wallets by purpose, separating player-flow, operational and treasury functions to prevent commingling of player and company funds. For hot, warm and cold wallet structures, the CGA requires documented risk assessment, multi-signature controls where proportionate, and full audit-ready records covering ownership, transaction history, access rights and fund movements between wallets.
On withdrawals, the default expectation is that funds should be returned to the same wallet and in the same asset as the original deposit. The authority acknowledges this is not always operationally feasible and permits alternative approaches – including withdrawal to a different whitelisted wallet or in a different asset – where equivalent controls are in place and conversions are conducted through a regulated VASP. Operators must also recognize and implement the FATF Travel Rule for transfers between regulated entities, and any third-party VASP relationships require documented due diligence. The CGA is clear that outsourcing payment infrastructure does not reduce the operator’s compliance obligations.
The transition period runs in four stages. Prohibitions on sanctioned wallets, mixers, personal wallets and operators acting as exchanges or VASPs take immediate effect. By September 2026, operators must have uploaded a compliant crypto policy to the CGA portal. By December 2026, documented crypto risk assessments, VASP due diligence, wallet controls, transaction monitoring procedures and staff training must be complete. Full implementation, including wallet segregation, blockchain analytics deployment, withdrawal whitelisting and audit-ready record-keeping — is required by June 2027, though the CGA reserves the right to demand accelerated compliance where material risks are identified.
The guidelines form part of a broader regulatory build-out under the LOK framework that took effect in December 2024, and arrive as crypto’s role in online gaming draws increasing scrutiny across multiple jurisdictions. For Curacao-licensed operators with significant crypto volumes, the document represents a substantial compliance uplift.
