From the journal

Curacao gaming license requirements for an Armenian casino platform

An Armenian software company has developed an online casino platform. Its owners are comparing their own Curaçao operator with a white label casino arrangement in which an existing licensee contracts with players. Great Britain is a proposed future market, and the commercial decision turns on who controls the gambling business and which countries that business may serve.

29 min read

Executive Summary

  • For this hypothetical Armenian business, remaining a technology supplier is the defensible starting position while the founders select player markets and allocate operational powers. A genuine white-label contract can support that choice, provided the licensed operator actually controls the player relationship. Curaçao law prohibits transferring a licence or allowing another person to use it. (Landsverordening op de kansspelen, P.B. 2024, no. 157, “LOK”, art. 1.2.)
  • A direct Curaçao licence becomes commercially coherent when the founders want their company to accept stakes, owe player balances and direct compliance. The applicant needs a Curaçao company, resident management and evidenced ownership and funding. These requirements survive outsourcing. (LOK, arts. 2.1, 2.2 and 5.2.)
  • The statutory operator annual charges total €47,450, before application charges, operating costs and other regulatory payments. Two assessment phases do not establish a guaranteed launch date. Critical-supplier licensing in or from Curaçao and the prohibition on using unregistered critical suppliers commence on 24 December 2026. (LOK, arts. 5.1, 5.18, 5.19 and 15.10(3).)
  • Armenian incorporation is compatible with software supply, but operations conducted in Armenia require their own classification. The operative Armenian definition reaches authorised intermediaries who create access to internet gambling. Excluding Armenian players does not establish a general exemption. (Armenian Law HO-1-N of 13 December 2003, arts. 2 and 4(1)–(2).)
  • British customers require a British licensing strategy. A Curaçao licence alone cannot authorise the proposed casino to serve them. The software supplier may also need permission, and hosting games can require a further operating licence. (Gambling Act 2005, ss. 5, 33, 36 and 41; Gambling Commission, Licence Conditions and Codes of Practice, “LCCP”, condition 2.2.1.)
  • Payment acceptance, player-fund protection and data transfers need separate contractual and operational evidence. A payment provider’s freeze does not discharge the operator’s player obligations. Geographic filters and supplier indemnities cannot substitute for lawful operation. (LOK, arts. 5.3, 5.8 and 5.9; Curaçao Gaming Authority, “CGA”, Indefinite-term Online Gaming Licence Conditions, arts. 3, 6 and 9.)
  • If the affiliate attracts British players prematurely, the operator should immediately stop British acquisition and further gambling, preserve records and organise lawful withdrawals and complaint handling. The founders’ recourse against the affiliate or payment provider depends on the actual contracts and the reason for the freeze; recovery cannot be assumed.

The choice depends on the powers the founders retain

The founders should initially preserve the Armenian company’s role as a supplier. Before taking deposits, they should select the player markets, establish the operator’s permissions and secure an accepted payment arrangement. Those decisions determine whether the proposed business can proceed lawfully and meet its player obligations.

Three functions distinguish the alternatives. The direct operator contracts with players and owes their balances. A genuine white-label operator performs those same functions for a branded product supplied by another business. A technology supplier provides software under the operator’s instructions without independently accepting players, controlling their money or deciding whether they may gamble.

The LOK prohibits organising gambling or providing an opportunity to participate in or from Curaçao without the required permission. It also prohibits transferring a gambling licence or allowing another person to use it by contract or otherwise. A white-label agreement must therefore describe services delivered to the licensee’s business. It cannot grant the founders an independent right to operate through someone else’s licence. (LOK, art. 1.2(1)–(3).)

The operational evidence matters more than the agreement’s heading. Investigate who accepts the player terms, sets wagering rules, approves accounts, releases withdrawals and decides whether suspicious activity requires escalation. Inspect permissions in the player-account system, payment dashboard and compliance tools. Routine technical access does not itself prove that a developer operates the casino. Independent authority over the business decisions those systems implement can support that conclusion.

The strongest objection to remaining a supplier is commercial. The founders surrender control over player relationships and depend on the operator’s liquidity, service quality and continuity. If those constraints undermine the business model, a directly licensed operator may justify its higher cost. The answer changes only when the founders can fund that responsibility and establish lawful access to the intended markets.

The LOK permits a licensed Curaçao operation within its approved scope

The LOK entered into force on 24 December 2024, subject to specific delayed provisions. The CGA licenses remote gambling and critical suppliers under separate statutory provisions. The contemplated casino needs the operator route, commonly called B2C, if its Curaçao company supplies the gambling facilities and contracts with players. A supplier licence does not authorise that player business. (LOK, arts. 1.1, 1.2, 5.1, 5.13 and 15.10.)

A new applicant cannot acquire current authority by purchasing a historic master-licence or sub-licence package. The LOK’s transitional provisions concern defined existing permissions and applications. They do not create a new sub-licensing route. The CGA’s reclassification notice records the expiry of the former orange transitional certificates on 15 October 2025. (LOK, arts. 15.1 and 15.9; CGA, Licence Reclassification, 15 October 2025, pp. 3–5.)

A provisional licence is also a specific permission. Article 5.1 allows the CGA to issue one during the second assessment phase, for up to six months with a possible further six months. An application receipt does not establish that permission. An indefinite licence remains subject to its conditions and the CGA’s suspension and revocation powers. (LOK, arts. 2.1(5), 2.3, 2.4 and 5.1(8)–(10).)

Before contracting with a proposed white-label operator, obtain its actual licence, conditions, approved domains and current status evidence. The CGA distinguishes an entity’s licence certificate from the domain-specific Certificate of Operation for a player-facing website. The displayed certificate must match the precise domain and operator. The public register itself warns that its overview does not guarantee continuing validity. A seal should therefore corroborate the licence documents, rather than replace them. (CGA, Certification Policy; CGA, Licence Register.)

Permission to operate from Curaçao leaves destination law applicable. The CGA’s operator conditions expressly require compliance with the law of the jurisdictions in which gambling is offered. No proposed player country becomes approved merely because a platform accepts its address or a payment provider processes its cards. (CGA, Indefinite-term Online Gaming Licence Conditions, art. 3(1).)

Ownership and local management require evidence before application

A direct applicant must be a Curaçao-incorporated NV or BV with its statutory seat there. Its management must include a Curaçao-resident natural-person director, or a Curaçao corporate director managed by at least one resident natural-person director. A registered address supplied by an incorporation agent does not establish compliance with the management requirement. (LOK, art. 2.1(1), (4).)

The founders must disclose the ownership chain and the people who actually direct the business. The LOK distinguishes a qualified interest of at least 10 per cent from its beneficial-owner definition, which includes ownership of more than 10 per cent. Effective control and significant influence over management, assets or operating policy also matter to the key-person analysis. Splitting nominal shareholdings cannot resolve a continuing control relationship. (LOK, art. 1.1(c), (p), (q).)

The application should connect each funding contribution to its source and the contributor’s identity. The CGA’s forms require corporate records, ownership diagrams, financial forecasts and information about loans and funding. The statutory assessment also addresses integrity, financial viability, payout liquidity, complaint resolution and financial-intelligence registration. A bank’s additional onboarding requests remain distinct from these licensing requirements. (LOK, arts. 2.2 and 5.2; CGA, Online Gaming Application Form and Business and Corporate Information Form, version 3.)

The founders should approve a governance plan before engaging a resident director. It should identify decisions reserved to the operator, the evidence directors receive and their ability to stop unlawful activity. Appointing a local director while Armenian staff exercise undisclosed control would weaken the application’s account of the business and create a separate Armenian classification question.

Local substance relief does not remove the resident director

Article 5.12 separately requires additional resident key personnel and premises. Its baseline is one permanent full-time key person during the first four years after the LOK’s commencement, excluding the director, and three from the fifth year. Those periods run from the legislation’s commencement, not from each company’s incorporation. (LOK, art. 5.12(1).)

The CGA announced on 23 January 2026 that the Minister had granted an extension under article 5.12(6), with compliance not required before 1 April 2027. That published position concerns article 5.12. It does not postpone the separate resident-management requirement in article 2.1(4). The operating budget should therefore include resident management from application and a funded staffing and premises plan for the substance obligation. (CGA, Postponement of Local Substance Requirement under LOK, 23 January 2026.)

The statutory start-up exception has cumulative conditions. Incorporation must be no earlier than one year before application. No beneficial owner may also be, or have been in the preceding two years, a beneficial owner of another local or foreign remote-gambling business or gaming-related supplier. Gross gaming revenue must remain below the statutory NAf 20 million threshold in the preceding calendar year and in each of the first three financial years after licensing. An independent financial expert must certify the continuing revenue condition every six months. Ordinary substance duties then apply from the fourth financial year. The founders’ ownership of the Armenian supplier may therefore defeat the exception despite the Curaçao company’s recent incorporation. (LOK, art. 5.12(4)(a)–(e), (5).)

An argument that the Armenian business is still developing an internal product, rather than supplying gaming services, could change that application. The relevant evidence would be its actual activities, customer contracts and the owners’ interests during the statutory period. A service provider’s description of the group as a start-up cannot settle the issue.

Curacao gambling license cost includes distinct regulatory charges

For B2C, the base application fee is €4,592. The current fee schedule adds €150 for each beneficial owner and €150 for each qualified-interest holder, with a separate listed-owner charge where applicable. The annual charges are €24,490 to the National Treasury and €22,960 for CGA supervision, totalling €47,450. Initial annual charges are prorated; subsequent annual invoices are payable in full by 15 January. (LOK, arts. 5.18 and 5.19; CGA, Licence Fees under the LOK, version 2.0, pp. 4–5.)

Other events attract separate charges. The schedule includes €250 for an application to add a main domain, €383 for a gaming-related services or goods certificate application and €128 for a change or addition of a beneficial owner or qualified-interest holder. The €250 domain charge is not described as an annual per-domain levy. Article 5.7 also provides for guarantee-fund membership and premiums, so the headline annual fee cannot represent every potential regulatory payment. (LOK, arts. 5.7, 5.17 and 5.18; CGA fee schedule, pp. 3 and 6.)

A Curaçao business-to-business, or B2B, licensee has an annual supervisory fee of €24,490 and no corresponding B2C Treasury licence fee. That comparison does not establish the registration costs or other obligations of every foreign supplier. Each entity must be classified before its fees can be budgeted. (LOK, art. 5.19(2), (5); CGA fee schedule, p. 5.)

Commercial costs sit alongside these charges. Resident management, staff and premises require funding. The operating model also needs testing, compliant hosting, legal and accounting work, verification services and payment arrangements. A payment service provider (PSP) may require a rolling reserve or prefunding. That contractual liquidity cost should not be presented as a CGA licence fee or assumed to cover player liabilities.

The statutory process has two assessment phases. Each has an eight-week decision period after the relevant complete submission, with a possible four-week extension. Completeness reviews, requests for missing information and the applicant’s preparation of second-phase material affect the actual schedule. The provisional route is discretionary. The founders should approve launch only after the necessary permissions and operational dependencies are satisfied, rather than date it by adding two eight-week periods. (LOK, art. 5.1(2)–(10).)

Technical evidence is a further launch dependency. The CGA’s published conditions require security and integrity testing of equipment and application software by an approved independent qualified entity. Both operator-owned games and games supplied by third parties require certification by an approved testing laboratory. A vendor’s assertion that its platform is ready should be checked against the actual product and certificates. (CGA, Indefinite-term Online Gaming Licence Conditions, arts. 7 and 10.)

Supplier permissions require a separate December transition plan

The Armenian platform may provide critical services. The statutory definition covers services indispensable to determining game outcomes, or so important that a failure could significantly affect compliance with the LOK. The actual software functions must meet that threshold. Classification does not depend on whether the contract uses the word platform. (LOK, art. 1.1(g).)

Two related duties commence on 24 December 2026. Article 1.5 requires a licence for supplying critical services in or from Curaçao. Article 5.16(4) prohibits a remote operator from obtaining critical services from an unregistered supplier. Article 15.10(3) delays both provisions for two years from general commencement. The CGA’s Q2 2026 bulletin also identifies 24 December 2026 for the critical-supplier register. (LOK, arts. 1.5, 5.16 and 15.10(3).)

The founders must distinguish local licensing from registration of a foreign supplier. A business supplying solely from Armenia must still address the register where its services are critical. Moving the supply activity into or through Curaçao can also engage the local licence requirement. The contract should require the correct status before the statutory deadline and permit suspension if that status lapses.

A supplier-only description becomes difficult to sustain if the founders independently manage player accounts or payment decisions. The CGA’s reclassification guidance treats player-account management involving player data and payments as material to B2C classification. Its application form also contemplates disclosed third-party provision of player-account services. Read together, those materials require scrutiny of actual powers and responsibility; they do not establish that every database administrator is an operator. (CGA, Licence Reclassification, pp. 3–5; Online Gaming Application Form, question 11.)

Armenia remains relevant where development becomes operation

The Armenian company can retain a development and support role, but the Curaçao subsidiary does not relocate activities that staff actually perform in Armenia. The operative law defines internet gambling broadly enough to include persons acting through agency, commission, representation or other authority who create a player’s opportunity to participate. Armenian internet-gambling organisation requires an Armenian-registered commercial organiser, the relevant licence and the separate right to accept stakes. The Ministry of Economy handles licensing and policy; the State Revenue Committee supervises the activity. (Law HO-1-N, arts. 2, 4(1)–(2) and 9; Ministry of Economy, Gaming Sector.)

The law also contains a conjunctive territorial rule involving Armenian servers, an Armenian IP address and resources in the .AM domain. An offshore-hosted business could argue that this defines the entire territorial test. Its interaction with the broader agency definition creates a legal classification issue where Armenian personnel perform operating functions. The structure should therefore not depend on foreign hosting alone. The same law expressly contemplates certain payments by foreign players abroad, which further undermines a blanket exemption based on excluding local players. (Law HO-1-N, arts. 2 and 6(2.1)(զ1).)

Armenia’s foreign-operator prohibition also matters to the product’s availability. Article 4.4 prohibits creating access to foreign-organised internet gambling by operators without the required Armenian licence, and advertising those games in Armenia or internet space accessible there. The proposed Curaçao service should therefore exclude Armenian participation and advertising before launch. Those exclusions address market access; they do not settle the classification of work performed by Armenian staff. (Law HO-1-N, art. 4.4(1).)

Software development without player contracting, balances or transaction authority supports the proposed supplier classification. Discretionary acceptance of players, release of winnings or direction of gambling operations from Armenia presents a different case. Customer support should follow documented operator decisions and escalation rules. Giving support staff an unrestricted ability to reopen accounts or approve withdrawals changes the activity under review.

The newer Armenian Law on Regulation of Gaming Activity, HO-263-N, cannot simply be applied as though its substantive transition were complete. Article 58 links implementation and repeal of the earlier laws to the day after six months expire following appointment of the monitoring operator. Government Decision 1155-A of 6 August 2026 made that appointment. The earlier casino and internet-gambling law therefore remains operative during the transition. A launch after the transition needs the successor rules applied to its actual date. (Law HO-263-N, art. 58(1), (4), (5), (9); Government Decision 1155-A, para. 1.)

Marketing conducted in Armenia also needs a distinct review. Armenian advertising law prohibits organisers lacking the appropriate Armenian gaming licence from advertising the corresponding activity in Armenia. Its territorial scope also addresses advertising created or disseminated in Armenia, so foreign audience targeting requires its own review. The supplier should contractually exclude player acquisition from its scope unless that activity has been separately cleared. (Armenian Law on Advertising, arts. 1 and 15(10).)

Great Britain requires its own operating and software permissions

If British players are a material revenue assumption, the founders should decide the British operating route before committing to a Curaçao structure. The Gambling Act regulates providing gambling facilities, including remote facilities used in Great Britain. For equipment wholly outside Great Britain, the offence provisions also address whether the provider knows, or should know, that the facilities are being or are likely to be used there. (Gambling Act 2005, ss. 5, 33 and 36(3), (3A).)

The proposed player-facing casino needs a Gambling Commission remote casino operating licence. An overseas company can apply; British incorporation is not itself the licensing test. A Curaçao company operating in or from Curaçao would still retain its Curaçao obligations. Alternatively, a genuine British-licensed operator can own the player relationship under a separate commercial arrangement. The trading arrangements must match the actual operator and licensed activities. (Gambling Act 2005, ss. 33, 36, 65 and 67; Gambling Commission, Remote Casino Operating Licence.)

The Armenian developer requires its own supply analysis. Section 41 regulates manufacturing, supplying, installing or adapting gambling software in the course of business, subject to the Act’s territorial application. LCCP condition 2.2.1 also requires relevant British licensees to use software manufactured and supplied, and installed or adapted, by appropriately licensed businesses. An overseas supply model therefore cannot assume that physical development outside Britain removes the licensing dependency. Hosting casino games through another operator’s platform can also require a casino game-host operating licence, even without a direct player contract. (Gambling Act 2005, s. 41; LCCP, condition 2.2.1; Gambling Commission, Remote Casino Game Host Operating Licence.)

Genuine work within a properly licensed operator’s business can fall within section 33(3), if authorised and compliant under that licence. The Commission also distinguishes a contractor supplying time and expertise under a licensed developer’s control from a business supplying its own gambling software. These qualifications matter to an Armenian services contract. They do not permit independent operation or product supply to be renamed as staff support. (Gambling Act 2005, ss. 5 and 33(3); Gambling Commission, What Is Gambling Software.)

Specified management offices require personal management licences, subject to the applicable small-scale operator exception. The operating model must also satisfy the remote technical standards and testing strategy. Gambling software, the platform and relevant changes need the required testing evidence before release. (LCCP, conditions 1.2.1, 2.2.1 and 2.3.1.)

The destination example is Great Britain. It does not establish permissions for Northern Ireland, the European Union or any other proposed player location. An approved country list needs a written decision for each intended market and a process for reviewing legal changes.

British economics can change the preferred corporate route

The British licence adds costs beyond the Curaçao budget. From 1 October 2026, the lowest remote-casino category, for annual gross gambling yield below £250,000, has an £8,185 application fee and a £7,000 annual fee. The first annual fee is due 30 days after issue and receives the prescribed 25 per cent reduction. Higher yield bands and additional licence activities have different charges. (Gambling (Fees) (Miscellaneous Amendments) Regulations 2026, SI 2026/828, regs. 24–26; Gambling Commission, Remote Casino Operating Licence.)

Remote Gaming Duty is 40 per cent of statutory remote-gaming profits for relevant accounting periods from 1 April 2026, with the statutory allocation for periods straddling that date. That base differs from ordinary corporation-tax profit. Its UK-person test also differs from the physical Great Britain licensing analysis. The tax does not disappear because gambling contracts are unenforceable or the operator lacks the required licence. The corporate provider’s directors can also be jointly and severally liable under the statutory recovery provisions. (Finance Act 2014, ss. 155, 157, 162 and 186, as amended by Finance Act 2026, s. 86.)

The statutory gambling levy is a further cost. Remote casino activity attracts 1.1 per cent of its statutory leviable amount, subject to the regulations’ calculation and payment provisions. Licensed gambling-software activity also falls within the 1.1 per cent category. The levy is separate from licence fees and Remote Gaming Duty. (Gambling Levy Regulations 2025, SI 2025/213, regs. 2–5.)

The Armenian supplier also needs ordinary corporate and related-party tax analysis. Armenia’s standard profit-tax rate is 18 per cent of taxable profit. Management exercised in Armenia can create a permanent-establishment question for a foreign company. Related-party development, support and intellectual-property charges require analysis under the transfer-pricing rules, including their annual controlled-transaction threshold. (Armenian Tax Code, arts. 27, 125 and 363–364.)

These rules support budgeting each entity’s real functions and revenue separately. Incorporation, a licence fee and a software invoice cannot establish the group’s final effective tax rate. If Britain is the intended main market, a genuine British-licensed operator or a direct British application may be more coherent than first building a Curaçao operation whose commercial purpose remains undefined.

The operator retains responsibility for customers and outsourced controls

Under either operating route, the licensee needs effective control over identity checks, financial-crime decisions and player protection. The CGA’s anti-money laundering (AML) regulations permit defined third-party reliance and outsourcing, while retaining the operator’s responsibility. The decision to accept or continue a customer relationship on the assessed risk cannot be outsourced. Identity collection, sanctions and politically exposed person screening, monitoring and enhanced checks must operate when the applicable rules require them. A withdrawal request should not become the first occasion for routine checks that should already have occurred. (CGA, AML/CFT/CFP Regulations for the Gaming Industry, January 2025, sections III.3, III.4 and III.9; CGA, Policy Guideline on Terms and Conditions, section 4.5.)

The LOK prohibits participation by minors and protected vulnerable persons. Operators must maintain responsible-gambling measures and self-exclusion arrangements. Complaints require a reasoned response within the statutory period, generally four weeks with a permitted further four weeks, and access to independent alternative dispute resolution at the operator’s expense. (LOK, arts. 1.4, 5.3 and 5.4.)

For a British-licensed service, age verification must precede deposits and gambling, while identity verification must precede gambling. The LCCP also requires customer interaction, financial-vulnerability checks and applicable self-exclusion measures, including participation in the national multi-operator scheme. Customer due diligence follows the legal business-relationship and risk triggers. LCCP condition 12.1.2 applies equivalent Money Laundering Regulations requirements to relevant overseas casino licensees, even where those regulations do not apply directly. The current complaints code requires access to an appropriately accredited ADR provider. (LCCP, conditions 17.1.1, 12.1.1 and 12.1.2; social responsibility code provisions 3.2.11, 3.4.3, 3.4.4, 3.5.3, 3.5.5 and 6.1.1; Money Laundering Regulations 2017, regs. 8, 18, 27, 28 and 33.)

The supplier contract should give the operator prompt access to verification results and underlying records. It should define who can stop play, restrict an account and authorise a lawful withdrawal. Licentium’s analysis of gaming and gambling financial-crime risks provides related context for examining ownership, intermediaries and payment flows. The governing duties still come from the applicable legislation and licence conditions.

Payment approval and player-fund protection need separate arrangements

A gaming licence does not oblige a bank, acquirer or PSP to accept the business. The founders should obtain written acceptance of the actual operator, product, countries, domains and settlement model before launch. The payment contract should identify reserves, chargeback allocation, permitted grounds for suspension and the evidence required for release. Those recommended protections should be negotiated before player funding begins.

The CGA’s operator conditions require sufficient funds for payouts and separation of player funds from operating funds. The LOK separately provides for a guarantee fund. Neither the statutory mechanism nor an ordinary segregated account should be described as an unconditional promise that players will recover every balance following insolvency. (LOK, arts. 5.7 and 5.8; CGA, Indefinite-term Online Gaming Licence Conditions, arts. 6(5) and 9(2).)

A British licensee holding customer funds must follow the LCCP’s segregation and disclosure requirements. The required disclosure distinguishes the level of protection on insolvency. Where funds are unprotected, the current rules also require periodic customer acknowledgement. Segregation and a provider’s reserve address different risks and may involve different legal owners. British remote casinos cannot accept credit-card gambling payments, including through a money service business. Covered payment services must also satisfy the LCCP’s PSP requirement. (LCCP, conditions 4.1.1, 4.2.1, 5.1.2 and 6.1.2.)

The operator should reconcile the player ledger, safeguarded accounts and PSP settlements daily as a contractual control. It should model a prolonged settlement delay and preserve an authorised alternative payout route. A contract between the operator and PSP cannot extinguish a player’s separate claim merely by naming the PSP as the party responsible for processing.

The data architecture must satisfy all three locations

The platform design must accommodate Curaçao’s regulatory access requirement. Article 5.9(1)(j) requires the specified player, game and financial information to remain accessible to the CGA on a server in a Tier-IV-certified data centre in Curaçao. That provision does not require every component of the software stack to be hosted there. The application should identify the relevant records, copies, access rights and recovery arrangements. (LOK, art. 5.9.)

Curaçao’s personal-data law separately governs lawful processing, security and processor arrangements. Transfers outside the Kingdom require adequate protection or an applicable statutory alternative. A gambling-licence condition does not itself establish every privacy permission for copying identification documents or enabling access from Armenia. (Landsverordening bescherming persoonsgegevens, A.B. 2010, no. 84, arts. 4, 8, 13, 14, 51 and 52.)

Armenian law requires a written mandate for processing entrusted to another person and regulates transfers to other states. The applicable treaty or adequacy route must be established, or the required permission and safeguards obtained. The parties should identify the sender and recipient for each flow; a general clause allowing data to move within the group is insufficient. (Armenian Law on Protection of Personal Data, HO-49-N, arts. 14 and 27.)

Offering the casino to people in Britain can engage the UK General Data Protection Regulation, or UK GDPR, even where the operator is overseas. Separate organisations accessing data from Armenia or Curaçao can create restricted transfers. The organisation initiating such a transfer needs an applicable transfer mechanism and the required assessment. A processor agreement is separately required where that is the true relationship. A UK representative may also be required. (UK GDPR, arts. 3(2), 27, 28 and 46(1A), (2), (6)–(7).)

The founders should replace the loose concept of owning the player database with defined controller responsibilities, permitted access and contractual rights. An exit clause should preserve necessary records and support lawful migration. It cannot promise an unrestricted sale of player identities or automatic transfer of every account to a new operator.

Crypto deposits and sports betting require separate product decisions

The recommended initial product remains a fiat casino. Crypto deposits would change wallet custody, transaction tracing, withdrawal controls and payment-counterparty diligence. The CGA’s June 2026 crypto guideline addresses those matters and expressly preserves other regulatory obligations. It does not authorise a casino to operate an exchange, payment service or independent wallet business. (CGA, Crypto Policy Guideline for Online Gaming Operators, June 2026, pp. 4–10; Indefinite-term Online Gaming Licence Conditions, art. 9.)

The guideline has staged implementation. It identifies immediate prohibitions and further milestones in December 2026 and June 2027. Those later milestones do not suspend existing AML or player-fund duties. The operator should therefore approve a crypto-specific risk assessment, wallet model and provider contracts before adding the feature, and meet the requirements applicable on its launch date. (CGA crypto guideline, p. 11.)

Sports betting also changes the permission analysis. The LOK includes betting within its games-of-chance definition, but the operator’s approved activities and systems must cover the proposed product. In Britain, a remote casino licence does not by itself authorise real-event sports betting. The appropriate remote betting permission, applicable technical rules and betting-duty treatment require a separate assessment. No casino budget should assume those additions are already included. (LOK, arts. 1.1(d) and 5.2; Gambling Act 2005, s. 65; Gambling Commission, Remote General Betting Standard Real Events Licence.)

The affiliate incident requires immediate control of the player business

Assume the affiliate brings British players to the Curaçao casino before British permissions exist and the PSP freezes withdrawals. The operator should immediately stop the affiliate campaign, block further British registration, deposits and wagering, and preserve the affected accounts and evidence. Withdrawal and complaint channels must remain available to the extent legally possible. Closing access indiscriminately could prevent players from obtaining account information and seeking repayment.

Responsibility follows the activity. An affiliate’s breach of instructions does not supply the missing operating licence. For wholly overseas equipment, the Gambling Act’s knowledge qualification remains material to any criminal analysis. Effective country controls and an unauthorised affiliate’s conduct can affect what the operator knew or should have known. Once the incident is discovered, continued British play cannot be justified by ignorance of the traffic. (Gambling Act 2005, ss. 33 and 36(3), (3A).)

British advertising presents a separate issue before any player places a bet. Advertising unlawful gambling can engage sections 330 and 333, with distinct rules for intended or likely British access. The statutory reasonable-belief, knowledge and neutral-transmission protections depend on the participant’s actual role. An affiliate contract should therefore control the campaign before traffic reaches registration. (Gambling Act 2005, ss. 330(1)–(6) and 333.)

The Curaçao operator also remains accountable under its destination-law and outsourcing conditions. If a British-licensed operator is instead involved, LCCP social responsibility code provision 1.1.2 governs its responsibility for contracted third parties and requires contractual controls over relevant agents. That provision should not be treated as though it directly bound the original Curaçao-only operator. (CGA, Indefinite-term Online Gaming Licence Conditions, art. 3; LCCP, social responsibility code provision 1.1.2.)

The operator must establish the legal and contractual reason for the PSP freeze. A regulatory or sanctions hold cannot be solved by directing funds through an undisclosed replacement merchant. A commercial reserve dispute calls for the contract’s notice and challenge process. Preserve payment records, affiliate instructions, location checks, player communications and the chronology of decisions. Assess whether the incident triggers the LOK’s 24-hour reporting duty and any other applicable notification requirement. (LOK, art. 5.10(5), (6).)

Player balances require individual reconciliation and lawful treatment. The operator should distinguish genuine verification restrictions from a general shortage of accessible funds and provide accurate complaint responses. The CGA’s wind-down instructions require settlement of outstanding player debts; ending an operation does not discharge them. British law also preserves the distinction between a gambling contract and other grounds of illegality. It does not make every unlicensed gambling balance automatically unenforceable or automatically refundable. (CGA, Instructions on Wind-down, July 2026, sections 3 and 8; Gambling Act 2005, s. 335.)

Contractual recourse remains conditional. An affiliate indemnity may address loss caused by prohibited traffic, while a PSP claim may turn on whether suspension exceeded the agreed grounds. Causation, exclusions, liability caps, governing law and counterparty solvency can limit recovery. Those claims should proceed alongside the operator’s customer obligations, without a promise that the founders will recover the frozen amount or regulatory losses.

The contracts and launch sequence should preserve the chosen allocation

A genuine white-label agreement should name the licensed operator in the player terms and payment disclosures. It should reserve acceptance of players, control of balances and final compliance decisions to that operator. Branding and software rights can belong to the founders. Independent power to conduct the gambling business cannot be granted through a clause purporting to share the licence. (LOK, art. 1.2(3).)

The LOK requires the operator’s player contract to provide for Curaçao law and the Curaçao courts. That clause governs the contractual arrangement within the Curaçao regime. It cannot authorise conduct prohibited by British gambling law. Individual enforcement and mandatory consumer protections still require analysis of the player, forum and transaction. (LOK, art. 5.5; Gambling Act 2005, ss. 33, 36 and 335.)

The contract should make launch conditional on the actual permissions, domains, supplier status and payment acceptance. It should require notice of licence investigations, restrictions and material changes. Audit rights must extend to operational evidence, with subcontractor controls and direct cooperation with regulators. Service levels should cover withdrawals, reconciliation and complaints. These are recommended drafting positions designed to support duties that remain with the operator.

Marketing provisions should identify approved countries and channels, require prior approval of affiliates and creatives, and permit immediate takedown. Location controls should combine registration information, payment information and technical checks, with escalation for inconsistencies. A restricted-country list supplied by a vendor records that vendor’s position. It cannot establish the legal position for an unlisted country.

Termination provisions should address access to records, continued complaints handling, settlement of player balances and lawful migration. They should prohibit withholding player money to secure a dispute over branding or software fees. The migration process must obtain any necessary permissions and customer consents. Neither the licence nor the customer relationship should be treated as automatically transferable on contract termination. (LOK, arts. 1.2(3), 5.3 and 5.9; CGA, Instructions on Wind-down, sections 4–8.)

Implementation should follow the commercial dependencies. First settle the player markets and the actual allocation of powers, including the Armenian team’s role. Then select the operator and complete ownership, funding, licence and supplier work. Build and test the payment, customer-protection and data arrangements before accepting deposits. Keep Britain closed until its operating and software permissions and customer controls are in place. If the founders require the player relationship and can support those obligations, proceed through their own licensed company; otherwise, preserve the supplier role and negotiate the licensed operator’s responsibilities expressly.