MGA tightens, Curaçao reforms: how two of crypto gaming's biggest licensors diverged in 2025
For nearly two decades, the Malta Gaming Authority (MGA) and the Curaçao licensing regime have anchored the international online casino market — Malta as the European-Tier flagship, Curaçao as the offshore catch-all. In 2025 the two regulators moved in clearly different directions, and the practical gap between an MGA licence and a Curaçao OGL is now wider than it has been at any point in the last decade.
This article is informational. Always verify a licence against the issuing regulator’s public register before depositing.
MGA: stricter on player funds and AML
The MGA published a revised Player Protection Directive that came into force on 1 January 2025, layered on top of its existing licence conditions. The headline changes:
- Segregation of player funds is now enforced as a “fully segregated” standard for new and renewed licences, with trustee or insurance-bond mechanisms required. The older “high-segregation” tier — which permitted operator commingling under certain conditions — was retired.
- Real-time transaction monitoring obligations were extended, requiring MGA licensees to escalate suspicious patterns automatically to internal AML teams within defined SLAs.
- Affordability-style indicators (loss velocity, deposit frequency, time of day) are now expected to feed automated responsible-gambling interventions rather than only post-hoc reviews.
The MGA has also been visibly active in enforcement. Across 2025 the authority publicly cancelled or suspended around a dozen licences — including several previously prominent crypto-friendly brands — for breaches relating to AML, responsible gambling, or unpaid licence fees. Reported settlement values for compliance breaches climbed materially compared with 2023-24.
Curaçao: reformed model, lighter touch
Curaçao moved in the opposite tempo. The National Ordinance on Games of Chance (LOK) took effect on 24 December 2024, ending the four-master-licence sub-licensing model in favour of direct licensing by the Curaçao Gaming Authority (CGA). The new format issues two licence types:
- B2C (Online Gaming Licence, OGL). Direct authorisation for operators; annual fee around €47,450; mandatory player-protection tools.
- B2B. For software suppliers and platform providers operating into the licensed market.
LOK is a meaningful upgrade on the legacy NOOGH sub-licence model — direct CGA accountability, mandatory self-exclusion, mandatory deposit-limit tooling, and access to independent dispute resolution. But its standards remain materially lighter than the MGA’s: there is no mandatory full player-fund segregation, AML expectations are framework-level rather than prescriptive, and CGA enforcement bandwidth — though growing — is well below the MGA’s.
Where the trust gap lands
Both licences are real and verifiable through public registers. What differs is the depth of protection and the regulator’s willingness and capacity to act on complaints.
| Dimension | MGA (Malta) | CGA (Curaçao OGL) |
|---|---|---|
| Player fund segregation | Mandatory, full | Required in principle, lighter enforcement |
| Dispute resolution | MGA Player Support + independent ADR | CGA + independent ADR (newer process) |
| Crypto deposits | Permitted with strict KYC/AML | Permitted, lighter friction |
| Typical enforcement turnaround | Weeks to months | Months to year-plus |
| Marketing restrictions in EU | Heavily restricted in EEA outside Malta | Operator responsibility |
What this means for players
- For pure crypto play, a Curaçao OGL operator with audited provably-fair games (such as Stake, Shuffle, BC.Game) remains the dominant practical option. Just confirm the OGL number is live on the CGA register.
- For high-stakes fiat play or EU residency, an MGA-licensed operator gives meaningfully stronger fund-protection guarantees and a more responsive complaint pathway.
- A “Curaçao + MGA” combo is the gold standard for global crypto operators looking to attract European players — and it is the structure several mid-sized brands have moved toward in 2025-26.
The broader story is that the regulatory landscape has finished being binary “regulated versus offshore” — it is now layered. A 2026 player who only checks “is it licensed?” is asking the wrong question. The right one is which licence, with what protections, and how much enforcement bandwidth sits behind it.