For nine months, a Berlin researcher could read every application, memo and support ticket that passed through the Curaçao Gaming Authority's licensing portal. They claim to have gotten the access on 3 December 2025 by registering under the nickname of a trust-office manager, and that a simple security flaw opened full access to the regulator's servers within eight hours. The CGA closed the hole on the evening of 17 September, about half an hour after being asked for commentary.

Various media began publishing the findings on 22 September under the name Casino Secrets, identifying about 800 owners behind nearly 650 licensed companies. There is a public database where anyone can search companies and domains across tens of thousands of CGA documents. The CGA has said only that the vulnerability is closed and that it takes the incident very seriously. The Malta Gaming Authority, whose systems they had breached earlier, tried to stop leakers in a Berlin court and lost in late September. The CGA called the breach a serious offence under Curaçao law.

The leaked set covers what a licence application normally contains: trade register extracts, group charts, business plans, explanations of how the company is funded, CVs, and proof of wealth for owners and directors and even phones, emails and addresses of them. From what we've seen, the public search doesn't display passport scans. Journalists hold the full set, though, and they are publishing it story by story.

The set also includes what licensees never see: support tickets, reviewers' comments and the conditions attached to each licence. Bank statements and balance sheets show how cash moves between group companies: intra-group loans, service fees, payments to a director's other business. Statements showing one games company moving more than €2.5 million into a single account in one month have been found. Media reports that in the Stake file, CGA reviewers noticed payments and loans running to hundreds of millions from the licensed company to entities linked to people the application never named.

Anyone holding your file can now put the ownership chart next to the bank statements and see whether they tell the same story. The CGA, for its part, says it has rejected about 28% of applications since 2023, and that an internal memo is not a final assessment. It has also called one reported network of about 1,000 domains "fabricated".

The portal leakers got into no longer exists. On 7 October the CGA said it "will not be returned to service" and that licensing and supervision would continue "through alternative arrangements" while an interim system is built. Filing deadlines have moved, operators have been told not to email documents in the meantime, and the digital seal in every licensee's footer is being replaced. Existing licences remain valid.

The stories have moved past operators, too. The Guardian found a contract in the files under which SIS, the racing-content supplier part-owned by Ladbrokes and William Hill, licensed its feeds to five Curaçao-licensed sites for a share of revenue. Anything filed with an application, commercial contracts included, is now part of the record.

Other offshore licences are getting the same attention. The Guardian describes Kahnawake, Tobique and Anjouan as places casinos go for lighter rules. After the FATF published its first detailed report on gambling risks in September, Anjouan said it had tightened its licence conditions and application requirements. Most offshore regulators publish their licensees, so anyone can trace a brand that leaves Curaçao for another licence in minutes. A migration has to make sense to someone reading the old and new records side by side.

Curaçao isn't an isolated case. The same researchers had already breached the MGA. The CGA also outsourced due diligence to a Maltese firm and suitability reviews to a Cypriot consultancy, so a single application passed through three organizations in three countries. A file is only as safe as the least careful hand it passes through.

Filing less isn't an option. Requirements are fixed, and an incomplete file causes more trouble than a leaked one. What you can control is precision: answer what the regulator asks, completely and accurately, and leave out commentary, internal emails and documents nobody requested. Keep a single channel for regulator correspondence, so you always know what was sent and when. The same goes for everyone you hire: ask your trust office and your lawyers where your documents are stored, who can open them, and how long they keep them.

This is where an intermediary earns its fee. At Rikk, our lawyers handle submissions and follow-up questions on the operator's behalf, check every document before it goes out, and keep a record of exactly what each regulator holds.

Many owners would rather their names didn't appear on public registers, company websites or search results, and after this month that is an understandable wish. Nominee directors and shareholders are the standard way to achieve it.

The leak shows what separates a nominee arrangement done properly from one done badly. CGA reviewers flagged declared owners who had neither the wealth nor the experience to plausibly own the business. One network was traced through a CFO shared by about ten companies, whose email address sat on a software supplier's domain, and through an ownership change dated the same day Germany's new gambling treaty took effect. Those arrangements drew attention because the people behind them weren't declared.

A proper arrangement works the other way round. The regulator, the bank, and the PSPs shouldn’t see the full ownership; instead, they should see the nominee, which is supported by documents that they and the public should be able to see.

Rikk has secured more than 100 licences across jurisdictions for over 100 operators.

For licensees dealing with the leak, we:

If your adviser has only ever filed in one jurisdiction, a second opinion on your business structure is worth having. Perhaps your setup was no longer optimal. On top of that, when you next compare jurisdictions, add a question to the fees and timelines: who reads your passport, and where is it stored?