Curaçao
In preparationHolder, number and validator will be published here once it is granted.
Compliance
Built to be licensed.
A technical file that logs every production change. No rounding up.
Licences
Only what can be verified.
Each one will appear here with its number, seal and the regulator's validator.
Frameworks
One technical file. Six frameworks.
Every production deployment is logged in it. Lab certification: planned.
GLI-19
Online gaming systems: security, RNG, game and financial controls.
Technical file kept against it. Laboratory certification planned.
GLI-33
Event wagering systems: how the sportsbook accepts, prices and settles bets.
Technical file kept against it. Laboratory certification planned.
MGA
Malta Gaming Authority rules on player protection, KYC, AML and reporting.
Requirements mapped in the technical file. No licence granted.
Curaçao (LOK)
The national gaming ordinance, with its player protection and AML rules.
Requirements mapped in the technical file. No licence granted.
ISO/IEC 27001, Annex A
Information security controls.
Controls mapped in the technical file. Not certified.
GDPR
Protection of personal data.
Obligations mapped in the technical file.
How the technical file is kept
Every production deployment is logged in the technical file with its commit, and its chapters are revised at each full audit.
Every finding has a stable identifier and is closed only with the commit and the test that prove the fix. Closed findings are never deleted.
What a laboratory will test
The scope for an accredited laboratory is already written down: random number generation, game rules and RTP, round records, the wallet and its ledger, and the documents a laboratory asks for. No laboratory has been engaged yet.
In the platform
Player protection, enforced by the server.
Three groups of controls, already deployed.
Responsible gaming
Limits and exclusions checked on every deposit and every stake.
- Deposit limits by day, week and month, a daily loss limit, session limits and reality checks.
- Lowering a limit is immediate. Raising or removing one waits at least 24 hours, for the player and for the operator.
- Time-outs from 1 hour and self-exclusion from 24 hours to permanent. Lifting it early is refused by default.
- Self-excluded and paused players are left out of email, SMS and WhatsApp campaigns, journeys, rewards and bonuses.
KYC and anti-money laundering
Identity, sanctions and suspicious activity, with a second pair of eyes.
- Sanctions screening against the official OFAC, UN, EU and UK lists at sign-up, at identity check and before withdrawals.
- Manual approvals for real-money operators and every sensitive case need two different people.
- Suspicious-activity cases are proposed by one officer and approved by another, with the report package for the financial intelligence unit.
Security and integrity
Money movements and records protected by design.
- Two-factor authentication is mandatory by default for admin, finance and compliance roles.
- Whoever approves a withdrawal never sends it, and above the operator's threshold it needs two approvers.
- A hash-chained audit log, checked every hour, with an alert if the chain breaks.
- The platform's own games draw their outcomes from a cryptographic random number generator.
Our games
Game certification: planned.
Our games publish their RTP and key figures. None is lab-certified yet.