WILLEMSTAD – The Curaçao Gaming Authority (CGA) has defended the decision to rely on external technology providers during the reform of the island's online gambling industry, while acknowledging that the recent data breach has made stronger internal capacity and improved digital security essential.
In a press release issued on October 18, the regulator explained the circumstances that led to the introduction of an externally managed licensing portal and outlined its plans to reduce dependence on outside advisers.
The explanation follows the discovery of unauthorized access to confidential information submitted through the online gambling licensing system.
According to the CGA, the reform process began in 2023, when the organization was still operating as the Gaming Control Board.
At that time, Curaçao was facing increasing international criticism over the activities of online gambling companies operating under its licensing framework.
The regulator identified several factors behind the government's decision to accelerate reform, including commitments made to the Netherlands under the Country Package, growing complaints from gambling players, negative international media coverage and the Caribbean Financial Action Task Force assessment conducted in June 2024.
The Ministry of Finance decided during the second half of 2023 to proceed with reforms rather than wait for the new National Ordinance on Games of Chance, known as the LOK, to enter into force in December 2024.
According to the press release, the reform required specialized knowledge that was not immediately available within the regulator.
External companies and advisers were therefore brought in to provide expertise in technology, licensing and supervision.
An externally managed digital portal was selected to process gambling license applications and approvals, with CGA employees supporting its operation.
The authority emphasized that while external advisers assisted with the technology, responsibility for licensing and supervision remained with the CGA.
Since the beginning of the reform in 2024, the regulator says it has recruited 14 employees, primarily in licensing, supervision and enforcement.
The objective, according to the authority, is to develop local expertise and gradually reduce reliance on external consultants.
The data breach has now placed the outsourcing arrangement under greater scrutiny.
The CGA confirmed that the affected portal and database were operated by an external company and that unauthorized access occurred between December 2025 and September 2026.
Following the discovery of the incident, the regulator decided to discontinue the existing system and develop a new platform under its own management.
The press release does not establish whether failures by the external provider contributed to the breach. It also does not disclose the contractual arrangements governing the provider's responsibility for protecting confidential information.
An independent technical investigation has been commissioned to determine the consequences of the incident.
Beyond the immediate security concerns, the CGA argues that the future of Curaçao's gambling industry depends on restoring confidence in the country's regulatory framework.
Under the LOK, Curaçao moved away from the former system of master licenses and sublicenses toward direct supervision of online gambling operators by the regulator.
The CGA describes the previous arrangement as outdated and says it did not generate financial benefits for Curaçao under that licensing structure.
The new framework is intended to improve transparency, strengthen supervision, protect players and increase the economic benefits generated by the sector.
However, the authority acknowledges that effective regulation requires more than new legislation.
According to the press release, gambling operators must be able to rely on professional supervision, accurate information, clear regulatory decisions and the secure handling of confidential documents.
The CGA also emphasized the responsibilities of trust service providers, gambling operators and government institutions in maintaining the credibility of Curaçao's licensing system.
It warned that the way institutions communicate, share information and respond to criticism influences how international operators and players view Curaçao.
The regulator has called for continued dialogue with the industry and other stakeholders, stressing that concerns arising from the breach must be addressed and that improvements should be based on the findings of the investigation.
Nevertheless, the incident raises important questions about the governance of outsourced regulatory technology, the protection of sensitive information and the oversight exercised during the implementation of the gambling reforms.
The CGA's decision to develop an internally managed licensing platform represents a change in approach, but the authority has not yet provided a timetable for completing the permanent system.
It has also not disclosed the total financial cost of the breach, the replacement technology or the external investigations.
The authority maintains that the long-term objective remains the development of a properly regulated gambling industry that contributes substantially to Curaçao's economy.
Rebuilding trust following the exposure of confidential information will now become an important test of the effectiveness of the reforms and the regulator's ability to supervise a major international industry.