MGA vs Curacao licence

Malta asks more on the points that decide whether a player gets paid, and the biggest difference is player money: Maltese rules keep it legally apart from the operator's assets and beyond its creditors' reach, while Curacao's crypto policy asks for player funds in segregated wallets. Curacao asks more on the mechanics of self-exclusion.

The table sets the two regimes against each other point by point. Our team tests casinos under both regimes and checks every point here against each regulator's own pages. Detail that does not fit a cell follows in the sections after it.

Maltese rules rest on the Gaming Act (Cap. 583). The Player Protection Directive and the Gaming Authorisations and Compliance Directive came into force on 1 August 2018, and the ADR Directive followed on 3 December 2018.

Player money if an operator fails

The operator's creditors have no claim on money held for a player, and insolvency or bankruptcy law does not touch it. If the operator becomes insolvent, or the Authority requires it, the funds must be handed over on demand of a player or the Authority to whoever the Authority names. Several players' money may share one account, but each player's share must stay separately identifiable.

An operator that outsources the handling of player funds stays fully responsible for the rules and is liable to players for loss caused by the third party's acts, omissions or insolvency. Failing to pay players when lawfully due is a criminal offence under the Third Schedule to the Gaming Act. Failing to meet commitments to players on time, or being about to, is a ground for suspending a licence.

One operator's liquidation shows the rule in use. Outstanding player balances were transferred to the Authority through proceedings before the First Hall Civil Court (Commercial Section), and players entitled to funds could send a formal claim with evidence. Where possible, balances go back to the account the money came from.

Complaints with deadlines and a binding end

A Maltese operator must give the result of a complaint inquiry within ten days of receiving the complaint. It may extend by a further ten days only by telling the player within the first ten days and giving the reason. The reply must explain how to go to an ADR entity and to the Player Support Unit.

An ADR entity must be established in the EU or EEA and competent for gambling disputes. Its services must at minimum include arbitration or adjudication with an outcome that binds both operator and player, and they must be free of charge to the player. An operator with no ADR arrangement of its own must refer the player to a listed entity within twenty days of the player saying the dispute was not resolved. For disputes outside the reach of the Small Claims Tribunal in Malta, the operator may offer non-binding routes such as mediation. Players must also be told how an ADR decision affects their right to take further legal action.

Alongside that route, the Player Support Unit examines complaints independently of any ADR dispute, can demand information from the operator and escalates possible breaches to the Authority's compliance directorate. The complaint form is reviewed in English or Maltese. It asks for the website, the operator, the username, the game, the disputed amount and the date and time of the incident. Trying the operator's support and management first is strongly recommended. The listed reasons run from payment and withdrawal problems and bonuses to identity verification, fraud and account closure.

Who may hold a licence, and for how long

Only a person established in the European Economic Area may hold a licence. The Authority must refuse one if it is not satisfied that the applicant and all relevant persons are fit and proper, and a qualifying interest starts at ten percent, or lower if the Authority sets a lower figure. Fitness is judged on integrity, honesty, reputation, competence and capability, at application and on an ongoing basis. A licence must also be refused where the games do not meet the minimum fairness requirements for their type.

Minimum paid-up share capital is €100,000 for Type 1 and Type 2 games and €40,000 for Type 3, Type 4 and a Critical Gaming Supply licence. Type 1 covers house games decided by a random generator, such as roulette, blackjack and baccarat.

A licence runs for ten years, original or renewed, and renewal depends on compliance with the Act and other applicable laws during the previous term.

People who carry out a key function for a licensee, including the compliance and anti-money-laundering roles, need a certificate of approval from the Authority. Doing the job without one is an offence. Critical gaming supplies must come from a provider holding a B2B licence or a recognition notice.

Servers, game approval and return to player

The key technical setup must sit in Malta or another EU or EEA state. A live or real-time mirror server of essential regulatory data must be readily accessible to the Authority at all times. A game that uses a random number generator or engine the Authority has not yet approved needs prior written approval, and changes to essential components need prior written approval too. Test labs must be independent and accredited in an EU or EEA state, or in another jurisdiction the MGA approves or recognises.

Online games with a random outcome must pay out on average at least 85% of the money wagered, or more where the licence says so, measured over one calendar year unless the Authority decides otherwise. Curacao has no technical standards of its own for comparison: the CGA accepts those of New Jersey, Pennsylvania, Ontario, British Columbia, the United Kingdom and Malta.

Enforcement made public

Suspensions and cancellations must be made public. Other sanctions stay private unless the Authority finds a public interest or another law requires publication. The enforcement register can be filtered by year from 2013 to 2026. Normally an operator gets at least twenty days' written notice to show cause before a suspension, but the Authority can suspend at once when an operator presents an imminent threat of serious prejudice to players. Continuing to operate while suspended is a ground for cancellation.

Recent entries show the range. Licence MGA/B2C/717/2019 of Winzon Group Limited was cancelled effective 11 March 2026, and the operator was ordered to notify players by email and on its website for 30 days, refund all player money and remove any reference to the Authority. Condor Malta Limited's licence MGA/B2C/340/2016 was suspended effective 16 September 2026: it can no longer run gaming but must keep player accounts accessible. In another notice, administrative penalties of €147,080 were issued for numerous shortcomings.

Terms that favour the player

If a clause in the terms is unclear or open to reasonable doubt, the reading most favourable to the player applies. Where language versions conflict, the version most beneficial to the player prevails. Players must expressly accept material changes before they take effect. One who declines cannot keep playing but can withdraw the balance under the terms originally agreed. An operator may keep only one version of its general terms at a time (one per brand for multi-brand licensees), and terms, including promotion terms, must not be unfair under the Consumer Affairs Act.

Online, a player's balance and currency must be visible at all times, and the gambling history for the past six months must be available. For random-outcome house games, players can set a pop-up alert at chosen intervals that suspends play and shows time and money spent in the session.

Self-exclusion and cooling-off

Players must be able to complete a self-exclusion fully online, without emailing the operator or waiting for approval, and the steps must take no more than 15 minutes. Once confirmed, it cannot be revoked by the player before the period ends. Maltese rules differ here: a player can ask to end a self-exclusion, and the change takes effect after at least 24 hours for a set period and at least seven days for an indefinite one.

On full self-exclusion, remaining funds go back to the original payment method within two business days, except any frozen under anti-money-laundering rules. Direct marketing, including emails, messages and bonuses, is banned during any cooling-off or self-exclusion. If a self-excluded person or a minor still gambled, all deposits must be refunded within two business days, again except frozen funds.

Operators must also offer cooling-off periods of 24 hours, 7 days, 1 month or 3 months, during which the player is temporarily restricted from gambling.

Safer gambling duties around the casino

Every operator must write a responsible gaming policy, upload it to the CGA Licensee Portal and have the CGA review it. Mandatory elements cover age verification, information access, self-assessments, behaviour tracking, cooling-off and self-exclusion, and deposit limits. Players must not be able to deposit or bet until the operator is satisfied they are 18 or older, and age checks should at least include a valid government-issued ID. Article 1.4(e) of the LOK bars an operator from letting someone play who must within reason be assumed vulnerable.

Deposit limits can be daily, weekly or monthly. A request to lower a limit takes effect at once, while a request to raise one waits seven days, against 24 hours for loosening a limit under Maltese rules.

Marketing is covered as well. Advertising must not mislead, encourage excessive gambling or target vulnerable people, and operators must make sure affiliates, influencers, VIP representatives and marketers follow the same framework. The site footer must show that under-age gambling is prohibited, the licence holder's name and registered address, the official licence number, a statement that the CGA oversees the operations, the CGA digital seal, and links to support such as GamCare, Gamblers Anonymous and GambleAware.

Terms, payouts and a local base

Terms must be reachable within one click from the homepage, registration page and account area. Players must actively accept them at registration: ticking a box counts, "by using the site you accept" does not. Terms must name the licensee, its registered address, Chamber of Commerce number, licence number and issue date. They must state that games are fair and use certified RNGs, and set out clearly when winnings may be confiscated or payouts limited or refused. They must also state withdrawal conditions, especially identity checks once cumulative deposits and withdrawals pass XCG 4,000 (circa EUR 2,000). As a general rule, funds go back only to the account they came from.

Every B2C licence holder must keep an up-to-date operations manual and produce it to the CGA within five working days of a first request. The manual must set out the operator's maximum payout and withdrawal limits, including any caps per bet, per event or per period. It must also set out how disputes are settled, with timeframes, escalation steps and the ADR providers used, and the measures that keep banned persons out. Operators must identify the Tier-IV certified data centre registered in Curaçao. Third-party game content must be checked against the official CGA supplier list.

The terms guideline is Version 1.0 from April 2026 and applies to all B2C licensees within 6 months of its release. Sanctions run from directives to correct the terms, through administrative fines, to suspension or revocation. The local substance requirement in Article 5.12 of the LOK has been postponed: operators need not meet it before 1 April 2027.

Crypto controls

Licensees may accept crypto for gambling only. They must tell players clearly that they are not responsible for any exchange used to buy or sell crypto, and they must not themselves act as an exchange, a payment services provider or a virtual asset service provider. Crypto is treated as high risk, fiat-backed regulated stablecoins are preferred, and crypto linked to sanctioned mixers or tumblers is prohibited. By default, a withdrawal goes to the same wallet and in the same asset as the deposit.

Wallets must be split by purpose, player flow, operations and treasury, so that player and company funds do not mix, and player funds should sit in segregated wallets. The bans on sanctioned wallets, mixers, prohibited assets, personal or owner-linked wallets and operators acting as exchanges took immediate effect. Wallet segregation, blockchain analytics, reconciliation, withdrawal whitelisting and audit-ready records must be fully in place within 12 months (June 2027).

Test houses

A test house on the CGA's list must hold current accreditation under BS EN ISO/IEC 17025 from a body that signs the ILAC Mutual Recognition Arrangement, or from another body such as UKAS. It must also give a signed declaration that it works independently of operators and software suppliers. Being listed is not an endorsement or guarantee. GLI, eCOGRA and BMM Spain Testlabs hold CGA test lab certificates.

How the regulator changed

The regulator began as the Gaming Control Board, a foundation set up on 19 April 1999. When the National Ordinance on Games of Chance (LOK) came into force on 24 December 2024, it became the Curacao Gaming Authority and an independent administrative body. A phased reform of the online gaming regime had begun in November 2023. Political responsibility for the CGA passed from the Minister of Finance to the Minister of Justice on 19 August 2025.

The Orange Seal (Certificate of Operations) expired on 15 October 2025, which ended the former sublicence system. A company may hold one or more B2C licences or one or more B2B licences, but not both. Until 24 December 2026 a B2B licence is not mandatory for entities serving Curacao-licensed B2C operators.

Fees and the unpaid-fee timetable

A B2C application carries a non-refundable fee of EUR 4,592. Annual fees are EUR 24,490 to the National Treasury plus EUR 22,960 supervisory fee to the CGA, EUR 47,450 in total, due by 15 January. First-year fees are pro-rata and due within 14 days of notification of the grant. A B2B licence carries a EUR 24,490 supervisory fee and no Treasury fee.

Non-payment moves quickly. On day 57 the licence is formally suspended for 21 days with notice of intent to revoke, and on day 71 it is revoked, removed from the public licence register and added to the enforcement register.

The practical questions for a UK reader are who hears a complaint, what an exclusion covers and how to confirm a licence is real.

Self-exclusion and GamStop

A casino licensed in Malta or Curacao is never a way around a self-exclusion, and a player who has excluded through GamStop should stay excluded whatever licence a site shows. More on this is on the responsible gambling page.

An exclusion under either regime reaches only the operator concerned. In Malta, a multi-brand licensee with no unified self-exclusion database may limit an exclusion to the brand where it was requested, although an exclusion based on signs of a gambling problem must cover every brand. In Curacao, a player who excludes is excluded from all of that operator's domains and should be encouraged to exclude elsewhere.

Complaints from the United Kingdom

The MGA complaint form lists the United Kingdom among its countries of residence. Curacao works through the operator first. A response is due within four weeks, extendable once by another four weeks with written notice. Complaints about self-exclusion, cooling-off or targeting of vulnerable players are prioritised, and operators must make best efforts to resolve them within five business days. A complaint can be lodged free of charge up to six months after the bet settled or the incident, and only the registered account holder can make it.

A player still unhappy must be told they can escalate to an independent ADR entity free of charge, with the operator bearing all costs. Operators may attach conditions, such as ADR before court, a binding outcome or a minimum claim value. Certified ADR providers include Resolvo Curaçao, ADR Curaçao, Cadre and IBAS. Unless a complaint was handled inadequately, the CGA will not review or overturn a decision of the operator or the ADR provider, though players may contact the CGA about malpractice, breaches of licence conditions or whistleblowing. Terms must provide that the player agreement is governed by Curacao law, with disputes going to a competent court of Curacao, which matters to a UK reader weighing legal action.

Checking a licence before you play

A Maltese operator must show, in a way readily visible to players, that the MGA licenses it. The licensee register can be searched by licensee name, authorisation status, URL or gaming service. A separate list names web addresses the MGA declares it has no connection with, and any MGA reference on them is false and misleading. Several entries carry a UK name, with notice dates in 2025 and 2026.

Each Curacao registry entry carries the licence number, licensee, company type, company registration number, issue date, expiry date and status. Statuses vary: Assessment in progress, Expired, Indefinite, and in one case "Expired. Re-evaluating in administrative appeal". Some entries print no status. Some with a past expiry date still read Assessment in progress, and licence number OGL/2024/1397/0784 is printed against two companies, Grrr Tech B.V. and Olympus Holdings N.V. The CGA says its overviews do not guarantee that a licence is currently valid. Its enforcement register covers only actions that change licence status, such as the revocations of Novatech Solutions N.V. (effective 22 May 2026) and Nexo Global N.V. (effective 20 January 2026), and may not be fully accurate or up to date.

The online gaming portal is offline and, as announced on 7 October 2026, will not return to service. Existing licences, operators' obligations and CGA supervision are unaffected, but the current digital seal is affected and an alternative way to show a domain is licensed is promised. An unauthorised access incident is also being handled, with the resulting data leak still being contained.

Before choosing a casino under either licence, find the licence number in its footer, match it to the regulator's register and read the complaints clause in its terms to see which ADR body it names. The steps are set out in how to check a casino licence, and fake and cloned licences covers copied claims.

Pages to read next

Each regime has an explainer with its own casino list, and the UK comparisons put either one beside a British licence.

• MGA licensed casinos
• Curacao licensed casinos
• Malta gaming licence (MGA) explained
• Curacao gaming licence explained
• UKGC vs MGA licence
• UKGC vs Curacao licence

When a regulator changes a rule, or a point on this page is wrong, write to info@biglicence.co.uk. The team reads the regulator's own page or register again and corrects this page. Both regimes changed rules and systems this year, so a correction is welcome.

• Big Licence team checks of the licences we cover
• mga.org.mt Used for the Malta Gaming Authority's own pages and licensee register.
• legislation.mt Used for the Maltese gaming regulations.
• cga.cw Used for the Curacao Gaming Authority's own pages and register.
• spin-cdn.com Used for complaints.