MGA vs Curaçao Licence: Costs, Rules and Market Access Compared

The Malta Gaming Authority (MGA) licence is the heavier, costlier and more widely accepted of the two: a ten-year EU licence with revenue-linked fees, share capital rules and deep supervision. The Curaçao Gaming Authority (CGA) licence, rebuilt under the LOK from 24 December 2024, is cheaper, flat-fee and faster on paper, but it opens fewer doors with banks, suppliers and regulated markets. Neither one lets an operator serve a country that runs its own licensing system.

Verdict: MGA or Curaçao?

Choose the MGA when your revenue plan depends on mainstream payment acquirers, tier-one game studios, listed-company partners or a credible path into national licensing later; its cost, around EUR 82,500 a year at EUR 5 million of casino revenue before staff, buys acceptance. Choose Curaçao when you serve markets with no local regime, need a fixed and predictable regulatory bill of EUR 47,450 a year, and can live with narrower banking. A Curaçao licence is no longer a sublicence, but its 2026 portal breach and young enforcement record still weigh on how counterparties price the risk.

How do the MGA and Curaçao licences compare side by side?

Across 15 factors, the MGA regime under Malta’s Gaming Act (Cap. 583, in force 1 August 2018) is stricter on capital, substance and supervision, while the Curaçao regime under the LOK (P.B. 2024, no. 157) is cheaper and sets statutory decision deadlines. The table below uses only figures each regulator publishes, as of October 2026.

Two rows in that table do most of the deciding: the revenue-linked compliance contribution, which makes Malta progressively more expensive as an operator grows, and the counterparty acceptance that comes with an EU regulator. The rest of this page works through each factor. For the detail of each regime on its own, see our guides to the Malta Gaming Authority licence and the Curaçao licence under the LOK.

What does each licence cost at different revenue levels?

At EUR 1 million of casino revenue, an MGA B2C licence costs about EUR 40,000 a year in fixed fee and minimum compliance contribution, less than Curaçao’s flat EUR 47,450. From roughly EUR 2 million upwards the MGA becomes the dearer option, reaching about EUR 202,500 at EUR 20 million, per the MGA’s 2023 fees guidance note and the CGA’s October 2025 fee note.

The calculation for Malta uses the Type 1 (casino) compliance contribution bands: 1.25% on the first EUR 3 million of gaming revenue, 1.00% on the next EUR 4.5 million, 0.85% on the next EUR 5 million, 0.70% on the next EUR 7.5 million, 0.55% on the next EUR 10 million and 0.40% beyond that. Curaçao’s figure does not move with revenue.

Three caveats keep this honest. The table excludes Malta’s 5% gaming tax, which applies only to gaming revenue from players in Malta, so for an operator with no Maltese customers it adds nothing. It also excludes the MGA’s start-up concession: under the MGA’s directive on start-up undertakings, qualifying new businesses get a twelve-month moratorium on compliance contributions, and the full minimum is not due until a full licence period has elapsed. Finally, regulatory fees are rarely the largest cost of either licence. Staff, local directors, a compliance officer, audits, testing, legal counsel and premises usually exceed them, and Malta’s substance expectations push those costs higher than Curaçao’s.

Capital is a separate line. An MGA Type 1 casino operator must hold at least EUR 100,000 of issued and paid-up share capital; adding Type 2 betting takes the cumulative requirement to EUR 200,000, with a ceiling of EUR 240,000 across all types. The LOK sets no share capital figure, but article 2.2 lets the CGA refuse an applicant who cannot show enough liquid funds to pay the prizes that can reasonably be expected. In both regimes the regulator examines source of funds and source of wealth of the owners.

How do game types and supplier fees differ between the two?

The MGA splits B2C activity into four game types, each with its own compliance contribution scale, minimum and maximum, and share capital floor. Curaçao’s B2C licence covers all verticals under one EUR 47,450 annual fee, with each extra domain approved separately at EUR 250. For suppliers, the MGA charges a fixed B2B fee of EUR 25,000 to EUR 35,000 by revenue, against Curaçao’s flat EUR 24,490.

The type system matters most for sportsbooks. An MGA betting operator pays 4% on its first EUR 3 million of Type 2 revenue, so a sportsbook with EUR 3 million of gaming revenue owes EUR 120,000 in compliance contribution alone, on top of the EUR 25,000 fixed fee. A combined casino and sportsbook pays per type and needs EUR 200,000 of share capital. In Curaçao, the same combined business pays the single B2C fee whatever its mix, which is one reason betting-led brands serving unlicensed markets often look there first.

On the supplier side the MGA scales its fixed B2B licence fee with revenue: EUR 25,000 where annual revenue does not exceed EUR 5 million, EUR 30,000 up to EUR 10 million, and EUR 35,000 above that. The CGA’s B2B supervisory fee is EUR 24,490 regardless of size, with no Treasury licence fee for suppliers. Our B2B supply chain guide covers supplier licensing in other markets.

How long does each application take?

Curaçao has statutory clocks: under article 5.1 of the LOK the CGA must decide each of two phases within eight weeks of a complete file, extendable by four weeks, so about 24 weeks of regulator time in the worst case. The MGA publishes no end-to-end deadline; its February 2023 application guidance describes stages and two 60-day windows, not a target total.

The MGA’s stages are: completeness check (an incomplete file gets one 60-day “Incomplete” window, then closes), fitness and propriety review of shareholders, UBOs and key persons with probity checks through other regulators, a funding review of source of funds and source of wealth, a business plan and policies review, then technical review. After that, the applicant has 60 days to stage its systems for an external system audit by an MGA-approved service provider. Any change to more than 75% of ownership, control or funding during the process requires a fresh application.

The CGA’s stages are compressed into two phases. Phase one covers integrity of owners, policymakers and key persons, plus financial standing and viability. Phase two covers everything else: policies, technical systems, game certification, domains and the ADR agreement. During phase two the CGA may issue a provisional licence for up to six months, extendable once by six months, which is why the CGA register shows many licences in six-month windows.

Two practical notes. Curaçao’s clocks only run from a complete file, and the CGA’s portal outage after September 2026 has postponed submission deadlines until a replacement platform is in place, per its notices of 2 and 7 October 2026. In Malta, timing depends heavily on how prepared the applicant is when it files, especially its technical documentation and its key function holders.

Does an MGA licence let you operate across the EU?

No. There is no EU passport for online gambling. In case C-440/23, decided on 16 April 2026, the Court of Justice of the European Union held that member states may prohibit online casino games or make them subject to their own authorisation, and that a Malta licence does not replace a national one, such as Germany’s.

The ruling settled what most compliance teams already assumed. Markets such as Germany, the Netherlands, Sweden, Denmark, Italy, Spain and France require their own licence for operators targeting their residents, and some enforce that with payment blocking or domain blocking. An MGA licence is lawful in Malta and can be relied on in countries that do not require a local licence, but it is a base, not a key to the single market.

Malta’s own statute adds a further twist. Article 56A of the Gaming Act, introduced in 2023 through what became known as Bill 55, allows Maltese courts to refuse enforcement of foreign judgments against MGA licensees where the activity was lawful under Maltese law. According to reports, the European Commission opened infringement proceedings over it in June 2025 with a letter of formal notice. For operators facing player reclaim actions, especially from Germany and Austria, that provision is a live legal risk rather than a guaranteed shield, particularly after C-440/23.

Curaçao, outside the EU, makes no single-market claim at all. Its value is in markets with no licensing regime of their own, or where offshore supply is tolerated. Our European markets guide lists which countries license locally and how they enforce.

How do banks, payment providers and B2B partners treat each licence?

Counterparties treat an MGA licence as a recognised EU authorisation subject to EU AML law, which usually means broader access to card acquirers, e-money institutions and premium game content. A Curaçao licence is accepted by many crypto processors, aggregators and offshore-focused suppliers, but tends to face stricter onboarding and narrower bank access, a gap the LOK reform aims to narrow over time.

Specific acceptance policies are set by each provider and change often, so treat any claim that “provider X accepts licence Y” as something to confirm in writing. Card schemes classify gambling merchants as high-risk, and acquirers decide case by case on the licence, the target markets and the operator’s controls. In practice, three questions shape the outcome more than the licence badge:

1. Which countries will the brand accept players from, and does each one require a local licence?
2. Can the operator evidence KYC, source-of-funds checks and transaction monitoring that match the provider’s own regulatory duties?
3. Does the regulator publish a reliable register the provider can check at onboarding and at renewal?

The third point currently favours Malta. The MGA runs an online licensee register and enforcement register; the CGA publishes PDFs and, since its portal was breached in September 2026, has said the availability of its digital seal is affected while it introduces an alternative way to show a domain is licensed. Payment teams should expect extra manual checks on Curaçao merchants until that mechanism is running. Our gambling payments section covers acquiring, e-money and crypto rails in more depth.

For game suppliers the comparison is partly about their own licence. Large studios commonly hold an MGA B2B licence because many regulated markets ask for evidence of supervised supply, and some will only integrate with operators whose licence they consider adequate. Curaçao’s B2B supplier licence becomes mandatory for suppliers to Curaçao operators only on 24 December 2026, per the CGA’s reclassification policy, so the supplier side of that market is still formalising.

Which regulator offers players a better complaint route?

Both regulators now push individual disputes to the operator and then to independent ADR. The MGA’s Player Support Unit stopped ruling on individual disputes on 1 April 2019, though its complaints form remains open for regulatory follow-up. The CGA does not mediate disputes and requires every licensee to contract at least one of seven CGA-certified ADR bodies (list dated 31 August 2026), paid for by the operator.

The CGA’s rules are unusually specific. Players may complain free of charge within six months of the bet settling; operators must acknowledge within one week and give a reasoned final answer within four weeks, extendable once by four, under article 5.3 of the LOK. Responsible gaming complaints should be closed within five business days. The seven certified ADR bodies are Resolvo Curaçao N.V., ADR Curaçao B.V., Cadre BV, EGIS-FZCO, ABC-ADR Limited, iGamingADR Limited and the Independent Betting Adjudication Service (IBAS).

Malta’s route relies on its licensees’ ADR arrangements, with eCOGRA one of the established providers. Players can still lodge a complaint with the MGA through its formal form, in English or Maltese, and the MGA uses those complaints in supervision. For players in EU countries, the EU’s framework for consumer ADR adds a layer of familiarity that Curaçao’s system cannot offer.

From an operator’s point of view the difference is less about the route than about consequences. A pattern of unresolved complaints feeds supervision in both systems, and both regulators can suspend or revoke. For compliance officers, the useful comparison is the reporting cycle: the CGA wants complaint reports every 15 January and 15 June, broken down by category, ADR referrals and legal actions.

How do AML and player-protection duties differ?

MGA licensees fall under the EU anti-money laundering framework, supervised by Malta’s Financial Intelligence Analysis Unit together with the MGA, with customer due diligence triggered at EUR 2,000 in stakes or winnings. Curaçao licensees follow NOIS, NORUT and the CGA’s AML/CFT policy of January 2025, and must appoint a compliance officer who meets fixed experience thresholds.

On the EU side, the EUR 2,000 threshold comes from Directive (EU) 2015/849, article 11(d), which covers single transactions and linked ones. The EU’s new single AML rulebook, Regulation (EU) 2024/1624, applies from 10 July 2027 and will bring gambling operators under directly applicable EU rules supervised in coordination with the new EU AML authority. Malta’s own history matters to counterparties too: the Financial Action Task Force placed Malta on its list of jurisdictions under increased monitoring in June 2021 and removed it in June 2022.

On the Curaçao side, the CGA’s compliance officer rules (effective 1 January 2025) require two years of AML/CFT experience plus a degree or a certificate such as CAMS, or four years’ experience on its own. The role cannot be combined with UBO, CEO, CFO or COO functions, and one outsourced compliance officer may serve no more than ten operators. Registration in the goAML reporting system is a licensing condition under article 2.2. For both regimes, see our AML and KYC guide.

Player protection follows the same pattern. Malta’s player protection framework and technical requirements sit in MGA directives that have been tested over years of supervision. Curaçao’s are newer and more compact: a responsible gaming policy of 21 February 2025, self-exclusion for at least twelve months that the player cannot cancel early (article 5.4), and marketing that must not encourage excessive play, mislead or target vulnerable persons (article 5.6). Our responsible gambling compliance page compares those duties with UK and Nordic rules.

How mature is each regulator’s supervision and enforcement?

The MGA has operated under its current Gaming Act since 1 August 2018 and publishes regulatory sanctions and licence cancellations in an online enforcement register. The CGA has supervised online licensees directly only since its reform began in November 2023; its enforcement register of 14 September 2026 lists 30 entries, 29 of them revocations dated between June 2025 and July 2026.

Curaçao’s enforcement framework is now written down. Its compliance and enforcement policy (version of 31 March 2026, published July 2026) sets an escalation ladder from warnings and instructions to orders subject to penalty, administrative fines, suspension and revocation, with criminal referral to the Public Prosecutor for some breaches. Its priorities are protection of minors and vulnerable people, illegal gambling, financial crime, then advertising and responsible gaming rules.

Operational resilience is the CGA’s weak point for now. Its online gaming portal was accessed without authorisation, which it confirmed on 17 and 22 September 2026; the access ran from an account registered in December 2025 under a false identity until September 2026. The CGA says existing licences remain valid, and on 7 October 2026 it announced the portal would not return, with an interim arrangement for licensing. Counterparties will judge the reform partly on how smoothly that transition goes. Our enforcement section follows actions by both regulators.

How do groups run an MGA and a Curaçao entity side by side?

A dual structure usually means two separately licensed companies, each with its own directors, policies, player terms, domains and AML controls, sharing a platform under documented intra-group service agreements. Both regulators assess where management and control sit, so the split has to be real, not cosmetic.

1. Map target countries into three groups: those needing a national licence, those where an MGA licence is the safer base, and those served from Curaçao.
2. Form the Maltese (or other EU/EEA) company and the Curaçao N.V. or B.V. separately, with the Curaçao entity managed by at least one resident director as article 2.1 of the LOK requires.
3. Apply to each regulator with matching but entity-specific documentation: business plans, financial projections and source-of-funds evidence will be read side by side by counterparties, so they must reconcile.
4. Keep player databases, wallets and self-exclusion lists clearly allocated per licence, and apply both regimes’ responsible gaming rules where a player could reach either brand.
5. Geo-block each brand from the other’s markets and from all national-licence markets, and record the controls for audits.
6. Run separate complaint and ADR arrangements: the MGA entity under its ADR provider, the Curaçao entity under a CGA-certified ADR body with reports filed each 15 January and 15 June.

Costs roughly add up rather than overlap. A group with EUR 5 million of casino revenue in each entity would pay about EUR 82,500 a year to Malta and EUR 47,450 to Curaçao in regulatory charges, before people and audits.

Who should choose which licence?

The MGA suits operators and suppliers that need EU credibility, mainstream banking and a platform for later national licences; Curaçao suits cost-sensitive operators serving markets without local licensing, crypto-first brands and start-ups testing product-market fit. Many groups end up with both, in separate companies, because the two licences serve different lists of countries.

Structure carefully if you hold both. The CGA does not allow one company to hold B2B and B2C licences at the same time, and the MGA’s corporate group licence requires the parent to control more than 90% of the group entities it covers. Shared staff, shared platforms and shared player databases between a Maltese and a Curaçao entity raise questions about where the business is managed, and both regulators look at that.

What about Anjouan, Kahnawake or the UK?

Some teams compare Malta and Curaçao with a third option. Anjouan offers a cheaper offshore licence with a weaker reputation, set out on our Anjouan vs Curaçao page. Kahnawake, which has licensed online gaming since 8 July 1999, is a niche alternative. For Great Britain, neither Malta nor Curaçao is enough: every operator serving British players needs a Gambling Commission licence, described in our UK Gambling Commission guide.

Frequently asked questions

Is an MGA licence worth the extra cost over Curaçao for a small casino?

At EUR 1 million of casino revenue the MGA’s regulatory fees are actually lower, about EUR 40,000 against Curaçao’s EUR 47,450. The real extra cost in Malta is substance: share capital of at least EUR 100,000 for a casino, key function holders and audits. Whether that pays off depends on how much banking and supplier access the brand needs.

Can an operator move from a Curaçao licence to an MGA licence?

Yes, but it is a new application in Malta by an EU/EEA company, with full fitness and propriety, funding, business plan and technical reviews. A Curaçao track record helps only if complaints, AML and responsible gaming records are clean.

Does the MGA charge gaming tax on revenue from foreign players?

No. The MGA’s 5% gaming tax applies to gaming revenue from players in Malta. Revenue from players elsewhere carries the compliance contribution and fixed licence fee, not the 5% tax.

Which licence is faster to obtain in 2026?

Curaçao has statutory deadlines of eight weeks per phase, each extendable by four, while the MGA publishes no total deadline. Since the CGA’s portal was taken offline after the September 2026 breach, its submission deadlines have been postponed, so its practical speed depends on the interim arrangements.

Do German courts respect an MGA licence in player reclaim cases?

Not as a substitute for a German permit. The CJEU ruled in C-440/23 on 16 April 2026 that member states may require their own authorisation for online casino games and that a Malta licence does not replace it. Malta’s article 56A Gaming Act may block enforcement in Malta, but it is under EU challenge.

Can one company hold both an MGA and a Curaçao licence?

Not in practice: the MGA licences EU/EEA companies and the CGA licenses only Curaçao N.V.s or B.V.s, so a group needs separate entities. The CGA also bars a single company from holding B2B and B2C licences together.