Curaçao Licence Portal Shut After the Casino Secrets Leak: What South African Players Should Check

Curaçao licence South Africa: what the regulator announced on 7 October

If you play at an offshore casino from South Africa, there is a fair chance its footer carries a Curaçao licence badge. On 7 October 2026 the regulator behind that badge, the Curaçao Gaming Authority (CGA), said its online gaming portal will not be returned to service. iGamingToday reported the announcement on 12 October. The authority said it is moving to a new regulatory platform and will run licensing, compliance and supervision through alternative arrangements while an interim solution is put in place.

The CGA stressed that retiring the portal does not change the validity of existing licences, the duties of licensed operators, or its own supervisory responsibilities. It also said the change affects its digital seal, the clickable badge casinos use to show a domain is licensed. According to the same report, the authority will "shortly" introduce another way for operators to show that a domain is licensed by the CGA.

That is the news. The reason it matters for a South African reader is the context: the portal was the system at the centre of last month's Casino Secrets leak. This post explains what is confirmed, what is disputed and what a Curaçao licence does and does not tell you when you are deciding where to deposit rand.

A short reminder first. No South African operator currently holds a licence to offer remote casino games under the National Gambling Act, so a casino that accepts South African players is, by definition, licensed somewhere else. Our South Africa legal guide explains the difference between "accepts South African players" and "licensed in South Africa", and why no local body can step in if a dispute goes wrong.

How the leak led to the portal shutdown

The CGA issued a press release dated 17 September 2026 saying it had identified unauthorised access to its online gaming portal. According to that statement, the authority and its service provider activated incident response procedures, the provider started a forensic investigation, and extra monitoring and security measures were added as a precaution. The CGA said the investigation had not yet established the full scope or impact, and that any licensee whose information was affected would be told directly.

Days later, a consortium of European newsrooms began publishing what it called Casino Secrets. As Bitcoin.com News reported on 24 September, the investigation was led by the Dutch outlet Follow the Money with partners in Germany, Norway, Sweden and Austria. A searchable archive of more than 40,000 documents went public the day after the first stories. The reporting says the files came from a breach of the licensing portal by Berlin-based security researcher and journalist Lilith Wittmann, who first logged in under an assumed identity in December 2025. Follow the Money said the files identify roughly 800 owners of nearly 650 licensed companies.

The Guardian covered the same material on 26 September. It described the files as detailing the inner workings of some of the world's largest online casinos and noted that the CGA confirmed unauthorised access. When asked questions, the CGA told the paper it could not answer on an ongoing and complex forensic matter and would issue further updates.

The portal decision on 7 October is the latest of those updates. We have not reviewed the leaked files ourselves. Everything here comes from the CGA's own statements and from the outlets named, and where a company or the regulator disputes a point, we say so.

What the reporting says about how Curaçao licences were granted

The most serious claim is not about the hack. It is about licensing practice. Our earlier news brief covered the first wave of coverage. In short, Follow the Money reports that the files show the regulator routinely granted licences without establishing whether the declared owners were really in charge, including in cases where applicants left out important information. The Guardian cited one example where regulators questioned who really owned a business after finding millions of dollars moving to companies tied to its founders, and a licence was still issued. The Guardian also reported that the island hosts more than 8,000 casinos, which it put at one for every 20 residents.

The CGA has not accepted the picture. According to Bitcoin.com News, the authority told reporters it keeps no classification of licensees into a network and could not confirm a grouping that it said the journalists had fabricated. It said a shared technology platform is common across the industry and does not turn separate licensed entities into one regulatory network. It also said it has rejected about 28 per cent of applications since 2023.

Public records give some support to the regulator's side of the story. The same report notes that the CGA's enforcement register, dated 14 September, lists 32 licences revoked or not extended, including one in May. The licence registry dated 21 September lists several companies named in the coverage as holding indefinite licences, while one is marked as under assessment. The report also says a Curaçao licence costs about US$54,400 a year, and that the CGA tightened rules for crypto operators in June.

Companies named in the coverage have pushed back too. A software supplier mentioned in the reporting said through its lawyers that it runs no online casinos itself and compared its role to that of a standard software vendor. A lawyer for one founder said he held full ownership of two companies before selling them, without being involved in running them. Both points were relayed by Bitcoin.com News, quoting a lawyer's letter published by German broadcaster NDR.

Our reading: the facts that are not in dispute are that the portal was accessed without authorisation, that a large archive is public, and that the regulator has now abandoned the system. Whether licensing standards fell short is the live argument, and the forensic findings, plus any reviews of licences, will matter more than any single headline.

One line from the CGA deserves attention from South African readers. Bitcoin.com News reports the authority said a Curaçao licence does not authorise an operator to run activities in Germany, and that registering extra domains is not permission to target a country where an operator is not legally entitled to operate. The same logic applies here. A Curaçao licence says what Curaçao permits. It says nothing about whether South Africa permits the operator to serve you, and under the National Gambling Act it does not. The Guardian also reported that the UK Gambling Commission would not comment on leaks but described illegal gambling as a threat it takes seriously. Regulators in other markets are watching, which is worth knowing when you weigh how long a particular brand might stay available.

What changes for a South African player depositing at a Curaçao casino

Start with what the CGA says does not change: licences that were valid before the shutdown remain valid. If a casino you use holds a Curaçao licence, the announcement does not by itself mean it stopped being licensed.

What does change is how you check. The digital seal has been the usual shortcut: a badge on a casino's footer that links to the regulator's register. The CGA says the current seal will be affected and that a replacement is coming. Until that replacement exists and you have seen how it works, a badge on a casino site is weaker evidence than it was a month ago. Treat it as a claim and verify it somewhere else.

It also helps to be clear about what a Curaçao licence never gave a South African player:

• It is not a South African licence. No South African authority supervises it, and the National Gambling Board has no power to resolve a complaint against an offshore operator.
• It is not a guarantee about payouts. We have not verified payout speeds or limits for any casino mentioned in the coverage, and our own data on most operators is still marked as not yet researched.
• It is not a statement about who owns the casino in a way you can see. That is exactly the point the leaked files raise, and it is why ownership transparency belongs on your checklist.

We are not telling anyone to stop or to carry on. Online casino games remain unlicensed in South Africa, and any decision to play is yours. If you do play, keep deposits to money you can afford to lose, and read our responsible gambling page for the tools and helplines available in South Africa.

A practical checklist while the seal system is in flux

These steps take a few minutes and do not rely on any badge. They build on our wider guide, how to check a casino licence in South Africa.

1. Note the licence details. Find the licence number and the legal company name in the casino's terms and conditions, not only in the footer. A casino that gives a brand name but no company is hard to hold to account.
2. Look up the regulator yourself. Type the regulator's own web address into your browser and search its public registry. The CGA publishes a licence registry and an enforcement register. Do not click through from the casino's own badge, because that is the link the seal change affects.
3. Check the status wording. The registry coverage mentions entries described as indefinite or as under assessment. Those mean different things. A licence still being assessed is not the same as an issued one.
4. Check the NGB list too. The National Gambling Board runs a public list of operators licensed in South Africa, which we covered in our news brief on the verified operators tool. An offshore casino will not be on it for casino games, which is a useful reminder of what you are dealing with.
5. Test the money route on a small amount. Use a payment method you understand, read the withdrawal terms before the first deposit and expect identity checks. Our FICA verification guide explains what documents sites usually ask for, and our payment methods page lists the options.
6. Keep records. Screenshot the terms, licence details and any chat messages. If something goes wrong, you will need them for any complaint to the operator or the licence issuer.

None of this makes an offshore site safe. It only reduces the chance of dealing with an operator that cannot show who it is.

What we do not know yet and what to watch next

Several things are unresolved, and we would rather list them than guess.

• The forensic findings. The CGA has not published a full account of what was accessed. Its 17 September statement said the scope was not yet established, and the 7 October announcement said containment of the data leak continues.
• The replacement seal. The CGA says an alternative mechanism is coming shortly. We do not know what it will look like, who can verify it, or whether older badges will keep working.
• Licence reviews. Nothing in the sources we read says the CGA has opened formal reviews of licences named in the coverage. The enforcement register shows revocations happen, but we cannot say how many relate to this story.
• Other regulators. Our earlier news brief noted that regulators elsewhere were assessing the material. The National Gambling Board had not, in the material we reviewed, commented on the leak.
• Court action. Bitcoin.com News reports that the Malta Gaming Authority, whose systems the same researcher breached earlier this year, has an injunction against her before a Berlin court. How the law treats the way the files were obtained could affect how long the archive stays public.

We will update our reviews as facts are sourced. Until then, anything on our casino pages that we have not verified is marked as not yet verified, and we do not rate a casino's licence quality from badges alone.

For readers who run their own checks, the practical lesson is to make the verification step independent of the casino. Whatever replaces the seal, the safest habit is to start from the regulator's own site, search by company name and licence number, and compare the result with what the casino says in its terms. If the two do not match, or the casino cannot tell you who the licensed company is, that is information too.

Frequently Asked Questions