As the global gaming industry embraces digital assets, regulators are stepping up to ensure security, transparency, and compliance. The Curaçao Gaming Authority (CGA) has released its Crypto Policy Guideline for Online Gaming Operators in December 2025, setting out minimum standards for handling cryptocurrency in remote gambling environments.
This blog provides a comprehensive summary of the CGA’s crypto policy, including governance, permitted assets, wallet management, AML/KYC obligations, and responsible gambling measures—all based on the official guideline.
1. Purpose and Scope of the Crypto Policy
The CGA’s crypto policy applies to all crypto-asset workflows within licensed operations:
- Deposits
- Wagering
- Withdrawals
- Treasury management
It covers all group entities supporting the licensed operation and does not replace other legal obligations, such as Virtual Asset Service Provider (VASP) registration or FATF compliance. Operators must ensure full adherence to applicable laws in addition to this policy.
The policy must be:
- Signed off by the Compliance Officer
- Approved by the operator’s board
- Include an effective date and review frequency
2. Governance and Accountability
- Ultimate accountability lies with the operator’s board.
- Day-to-day compliance is delegated to the Compliance Officer and payments team, including on-chain risk screening.
- Any change—such as adding/removing a crypto asset or VASP—requires:
- Documented risk assessment
- Formal sign-off
3. Permitted and Prohibited Crypto Assets
The CGA views cryptocurrencies as high-risk and mandates asset-specific risk assessments. The following are prohibited:
- Privacy coins (Monero, Zcash, Dash)
- Meme coins (DOGE, SHIB, PEPE)
- Wrapped tokens of unknown origin
- Deposits via sanctioned mixers/tumblers (e.g., Tornado Cash, Blender.io)
Operators should also:
- Set deposit/withdrawal limits
- Apply cooling-off periods
- Disclose fees and slippage rules
Stablecoins
- Preferred: Fiat-backed regulated stablecoins
- Heightened review: Unregulated or algorithmic stablecoins
4. Transaction Management
- Withdrawals must go to the same wallet used for deposit.
- Withdrawals must be in the same cryptocurrency as the deposit.
- Player-to-player transfers are prohibited.
5. Wallets, Custody, and Exchange Standards
Wallet Ownership & Segregation
- Only entity-owned wallets are allowed; personal or UBO-linked wallets are prohibited.
- Wallet architecture must segregate:
- Operational wallets (day-to-day transactions)
- Treasury wallets (strategic reserves)
- Player-flow wallets (customer deposits/withdrawals)
Exchange and VASP Standards
- All crypto transactions must go through regulated VASPs.
- VASPs must demonstrate:
- Robust AML/CFT controls
- FATF Travel Rule compliance
- Transaction monitoring capabilities
Access Security
- Multi-Factor Authentication (MFA)
- Hardware Security Modules (HSMs)
- Withdrawal whitelists
- Multi-signature protocols for treasury wallets
Operators cannot offer exchange services themselves; only links to exchanges on separate websites are permitted.
6. AML/KYC in Crypto Context
The CGA expects a heightened approach to crypto transactions due to elevated risk. Key requirements include:
KYC
- Verify customer identity and beneficial ownership.
- Apply Enhanced Due Diligence (EDD) for high-risk indicators.
Wallet Ownership & Origin Checks
- Evidence of wallet control (e.g., signed message, return transaction).
- On-chain tracing to detect exposure to:
- Darknet markets
- Mixers
- Sanctioned entities
- Fraud-linked wallets
FATF Travel Rule
- Ensure originator and beneficiary information accompanies crypto transfers.
Monitoring & Reporting
- Establish thresholds for crypto activity.
- Escalate suspicious activity and report to the FIU.
- Maintain typology libraries for crypto-related risks (e.g., chip-dumping, mixer adjacency).
7. Responsible Gambling in a Crypto Context
Operators must apply equivalent responsible gambling controls regardless of payment method:
- Markers of harm
- Affordability checks
- Self-exclusion tools
- Bonus restrictions
Crypto’s high velocity and micro-deposits can mask problem gambling, so behavioral monitoring is essential.
8. Incident, Fraud, and Cyber Response
Operators must define policies for crypto-specific risks:
- Compromised keys
- Suspicious deposit rings
- Smart contract failures
- Chain forks
- Exchange outages
9. Record-Keeping and Audit
- Retain:
- Travel Rule payloads
- On-chain risk reports
- KYC documentation
- Transaction logs
- Ensure reconciliation between:
- Blockchain explorers
- Exchange statements
- Internal ledgers
- Enable independent audit reproduction.
10. Implementation Timeline
- Consultation period: 1 month after release
- Effective date: Within 6 months of final version publication
Why This Matters for Operators
The CGA’s crypto policy reflects a global trend toward tightened oversight of digital assets in gaming. Compliance is not optional—failure to adhere can lead to:
- License suspension or revocation
- Administrative fines
- Criminal liability under AML/CFT laws
Key Takeaways
- Crypto is allowed but highly regulated.
- Operators must implement robust governance, AML/KYC, and responsible gambling controls.
- Only regulated VASPs and fiat-backed stablecoins are preferred.
- Record-keeping and audit readiness are mandatory.
