MGA vs Curaçao GCB The Malta and Curaçao gambling licences compared, side by side

The Malta Gaming Authority and the Curaçao Gaming Control Board sit at opposite ends of the operating-theory spectrum for an internationally facing online gambling business. Malta is the original EU online-gambling hub: the first Member State to license remote gambling under the Remote Gaming Regulations of 2004, the home of 311 active licences (164 B2B and 147 B2C at end of 2024), and the issuer of a Gaming Service licence that European banks, payment providers, software vendors and recognition-pathway markets treat as the standard hub authorisation. Curaçao is the rebuilt offshore default: until December 2024 the world’s largest concentration of online operators by share of brands, channelled for three decades through four privately held master licensees that issued sublicences in volume under the 1993 National Ordinance on Offshore Games of Hazard (NOOGH).

The MGA Gaming Service licence is built around commercial recognition. The Gaming Act 2018 (codified as Chapter 583 of the Laws of Malta) consolidates a previously fragmented framework into a single technology-neutral regime, crosses two licence categories (B2C and B2B) with four game types (Type 1 casino, Type 2 sports betting, Type 3 peer-to-peer, Type 4 controlled skill), and runs for up to ten years per grant. The CGA LOK licence is built around supervisory consolidation. The Landsverordening op de Kansspelen (LOK), published and entered into force on 24 December 2024, replaces the NOOGH master tree with a single direct authority and offers two clean shapes: a B2C grant for player-facing operators and a B2B grant for platform and game-content suppliers.

The choice between the two is commercial-versus-coverage. The MGA is the priced-in recognition: higher counterparty acceptance, EU recognition pathways, mature supervisory machinery, and a tax regime that taxes only Malta-resident GGR. The CGA is the direct extraterritorial offshore option: rest-of-world coverage outside the regulated EU and the regulated United States, FATF-aligned AML supervision through the FIU Curaçao, and a 0 percent GGR-based gaming tax under the LOK. For the regulator profiles in full, see the MGA cornerstone and the Curaçao GCB cornerstone.

The Curaçao reform is the more architectural of the two. Under the NOOGH framework the state authorised four master licensees (Cyberluck 1668/JAZ, Antillephone 8048/JAZ, Curaçao Interactive Licensing 5536/JAZ, Gaming Curaçao 365/JAZ) and the masters in turn authorised the operators; oversight was diffused across four private holders with no common standard, and the sanctioning loop ran through the master holder rather than through the state regulator. The LOK removes that intermediate layer. The CGA, statutorily competent under the LOK as sole issuer, now signs the operating grant, conducts the fit-and-proper assessment of beneficial owners, evaluates the technical infrastructure, supervises ongoing compliance and exercises the sanctioning power. The four master holders retain corporate identity, but their NOOGH licensing function is exhausted; the master licences themselves expired across 2024 into January 2025, and the orange-seal provisional regime that bridged the run-off closed on 15 October 2025.

The Maltese reform is narrower but consequential at the after-tax line. The Gaming Tax (Amendment) Regulations 2026, issued as Legal Notices 84 and 86 of 2026 and effective 1 October 2026, lift the gaming-tax rate from a flat 5 percent across game types to 15 percent for Type 1 (casino) and 10 percent for Types 2, 3 and 4 (sports, peer-to-peer, controlled skill). The tax base does not change: it remains the gaming revenue generated by the operator from end customers physically located in Malta under the Gaming Tax Regulations (S.L. 583.10). For most internationally facing MGA licensees the Malta-player share is a small slice of the book, but a Type 1 operator with material Malta-resident exposure will absorb a tripling of the marginal rate from October.

The structural point for the operator is that the MGA matrix asks the licensee to declare its product perimeter at game-type level, with a different cost-stack consequence for each. The CGA matrix asks the licensee to declare its B2C-or-B2B role and certifies the product scope through technical attestation rather than through the licence class. Adding sports betting to a Type 1 MGA portfolio is a Type 2 extension with its own Compliance Contribution scale; adding sports betting to a B2C LOK portfolio is a platform-certification matter handled within the existing grant. The MGA scales cost by activity; the CGA scales cost by role.

Two caveats on the modelling. First, the Maltese Compliance Contribution scale is type-specific: a Type 2 sports-betting operator hits a higher cap (€600k) than a Type 1 casino operator (€375k), and a Type 4 controlled-skill operator caps at €500k from a low €5k floor. The cost stack of a multi-type MGA portfolio is the sum of the type-specific contributions, capped separately. Second, the Curaçao flat fee model has no revenue ceiling on the cost line precisely because there is no revenue-scaled component; what the operator buys with EUR 47,450 is the entire CGA recurring obligation, regardless of GGR. Counterparties, banking and payment access are valued separately.

The economics for a single-jurisdiction operator are straightforward. A 100 percent Malta-player Type 1 operator pays 5 percent gaming tax on all GGR through 30 September 2026 and 15 percent from 1 October 2026, before the Compliance Contribution and the income-tax line. A 100 percent non-Malta MGA operator pays 0 percent gaming tax regardless of the 1 October reform, because the base is zero. A CGA-licensed operator pays 0 percent gaming tax on GGR, and recovers tax on the net-profit line through the E-Zone effective 2 percent rate (or the 22 percent standard CIT, depending on E-Zone eligibility). The Pillar Two top-up changes the calculus for large multinational groups: an in-scope group with E-Zone effective rate below 15 percent will face top-up tax under the Income Inclusion Rule or the Under-Taxed Payments Rule, compressing the headline E-Zone advantage. Sub-Pillar-Two operators (consolidated revenue below EUR 750m) retain the historical effective rate.

Two structural points matter for an operator carrying or considering both licences. First, the statutory terminology differs. Malta uses the EU “suspicious” standard via the EU AML directive framework; Curaçao uses the Dutch-tradition “ongebruikelijk” (unusual) standard under NORUT, which triggers reporting objectively by indicators and thresholds rather than by a subjective suspicion test. A goAML filing for an above-threshold cash-equivalent movement is not optional; it is an objective obligation under the Curaçao framework. Second, the supervisory rhythm differs. The FIAU produces administrative penalty notices on its own cycle, separate from MGA action; the FIU Curaçao concentrates on the intelligence and reporting function, with the CGA exercising the administrative sanctioning power against the AML programme of the licensee under the LOK. Operators with mixed exposure should not assume Curaçao AML supervision is lighter than Maltese supervision; it is differently structured and rapidly maturing under the LOK regime. See the AML & Financial Compliance Hub for the cross-jurisdiction reporting-line comparison.

The residency-perimeter difference is the single most consequential policy choice between the two regimes. The MGA Gaming Service licence permits supply to Malta residents (subject to the gaming tax described above) and to any other market where MGA authority is recognised. The CGA LOK B2C licence is an offshore extraterritorial grant that permits supply to non-resident, non-European-Netherlands players in jurisdictions where such supply is permitted under host-state law; it does not authorise supply to Curaçao residents themselves, and it does not displace the domestic licensing requirements of the player’s home jurisdiction. The practical consequence is that an operator’s Curaçao-licensed brand must apply geo-blocking to Curaçao and the European Netherlands as a structural matter, and must apply additional geo-blocking to every regulated market (the United Kingdom, Germany, the Netherlands, Spain, France, Italy, Sweden, Denmark, the Czech Republic, the regulated United States states, Australia and others) where local authorisation is required.

The MGA enforcement toolkit is broader than a fine. In 2024 the regulator issued 35 warnings, 25 administrative penalties, two licence suspensions and eight cancellations, alongside three settlements; in 2025 the financial-penalty headline reached €2.8 million and four operator licences were suspended for compliance failures spanning AML deficiencies and unauthorised game offerings. The 2026 supervisory agenda escalates oversight in three directions at once: crypto and cash-equivalent payment controls under AML, the quality and consistency of responsible-gambling tools, and sports betting integrity. The cancellation and suspension powers are the most consequential outcomes in practice, and the public MGA Enforcement Register names operators that have lost or had their authorisations suspended.

The CGA enforcement story is at an earlier point in the cycle. Public enforcement actions in the early phase of the LOK have focused on the transition perimeter (compliance with the orange-seal conditions during 2025, then closure of the seal regime) and on the AML-programme readiness of operators moving from the provisional to the direct grant. Sanctioning powers under the LOK include warnings, administrative fines, suspension, revocation and precautionary measures including the publication of public notices and the imposition of operational conditions; removal from the public register itself functions as a market-facing sanction, because counterparties verify operator status against the CGA registry. Criminal-law coordination runs through the Curaçao Public Prosecutor for the predicate offences.

The dominant enforcement-risk axis for a Curaçao-licensed operator is extraterritorial. The Dutch Kansspelautoriteit has consistently asserted enforcement competence against Curaçao-licensed operators serving Dutch residents without a Dutch licence; the KSA’s high-fine programme on unauthorised supply has reached operators with Curaçao paperwork in multiple cases since 2022, and the LOK reform does not waive the host-state enforcement power. The same logic extends to every regulated EU market where local licensing is required; the Curaçao grant is not a defence against host-state enforcement.

The third pattern is dual-licensing. A meaningful share of internationally facing operators carry both: the MGA Gaming Service licence as the EU-recognised hub and the Curaçao LOK B2C licence as the rest-of-world platform. The compliance machinery is heavier (two regulators, two AML lines, two product configurations, two annual cost stacks) but the market-access surface is wider, and the operator captures the structural advantages of each. For comparison context, see the peer EU-EU comparison at UKGC vs MGA and the cross-EU advertising comparison at France vs Spain.