Curaçao FIU goAML: NORUT Reporting Mechanics for Post-LOK Licensees

As of October 2026, a Curaçao licensee works with two AML triggers that run on different logic, and the two are easily conflated. Customer due diligence is triggered cumulatively at NAf 4,000. An unusual transaction report to FIU Curaçao, filed through goAML under the National Ordinance on the Reporting of Unusual Transactions (NORUT), is triggered by an indicator of NAf 5,000 or more, by a sanctions-list match, or by suspicion. The CDD trigger arrives first, so a licensee that has not finished CDD when the first reportable transaction lands is already in breach on one limb before it files on the other.

This article draws on the Gaming Control Board (GCB) AML/CFT Policy of January 2025, the GCB Compliance Officer requirements, the official English translation of the National Ordinance on Games of Chance (LOK), and the Legal 500 Curaçao guide for 2025. It takes the position that the post-LOK exposure sits in the filing pipeline and in CDD timing, and that the published text leaves several operational questions open. Licensees should take qualified Curaçao counsel on how the FIU applies these provisions to their own product mix.

The Statutory Stack Behind a Curaçao Report

The GCB policy states that the NORUT, the National Ordinance on the Identification of Clients when Rendering Services (NOIS), the Sanctions National Ordinance and the Kingdom Sanctions Act form the main legal basis for combating money laundering, terrorist financing and proliferation financing in the gaming sector. The policy applies to Curaçao casinos and providers of other online games, and its definition of “casino” covers both land-based and online casinos. The Money Laundering and Terrorism Financing Penalisation Ordinance (MLTFPO) is also part of the Curaçao AML framework, but the GCB guidance reviewed here does not reproduce its provisions.

The LOK, enacted as the National Ordinance of 20 December 2024 (Publicatieblad 2024 No. 157), ties licensing to this stack. The translated text lists violations of rules under the NORUT and the NOIS among the circumstances the Curaçao Gaming Authority (CGA) can act on against a licence holder. Legal 500 identifies AML/CFT or sanctions breaches, and non-compliance with reporting or recordkeeping obligations, as key enforcement triggers. A late or missing unusual transaction report is therefore a licensing issue as well as an AML one.

Legal 500 reports that the GCB’s AML Regulations became a mandatory component of the casino licensing regime effective 10 April 2025, after a three-month transition. The policy itself is dated January 2025. The table below sets out the dated components, as of October 2026 and the sources reviewed.

Instrument or event	Date	What it fixes
Ministerial Decree on Indicators of Unusual Transactions (N.G. 2015 no. 73)	1 December 2015	Indicators under NORUT article 10, including the NAf 5,000 limb
NOIS amendment (adopted 2 May 2024)	In force 15 May 2024	CDD on financial transactions of NAf 4,000 or more
LOK, Publicatieblad 2024 No. 157	20 December 2024	Direct CGA licensing, NORUT and NOIS breaches as enforcement grounds
GCB AML/CFT Policy	January 2025	CDD, reporting, goAML, compliance programme, audit
GCB AML Regulations mandatory (per Legal 500)	10 April 2025	End of three-month transition

What Is the NAf 5,000 Unusual Transaction Threshold?

As of October 2026, the NAf 5,000 threshold is a single objective indicator under the Decree on Indicators of Unusual Transactions: a transaction of NAf 5,000 (EUR 2,406) or more is deemed unusual and must be reported to FIU Curaçao. The GCB policy applies it regardless of whether the transaction is made in cash, by cheque, by other form of payment, or through electronic or other non-physical means.

The policy deems three categories of transaction unusual. The first is any transaction reported to the Police or the Department of Justice in connection with money laundering or terrorist financing. The second is any transaction by or on behalf of a person or entity on a list adopted under the Sanctions National Ordinance (N.G. 2014 no. 55). The third is the NAf 5,000 limb. The policy defines a cashless transaction for this purpose as a transfer from a bank account of the casino to a local or international bank account at the request of the client, and says its list of examples is not limited, naming credit card transactions among others.

Internally, the policy requires all unusual individual transactions or series of transactions to be reported to the compliance function without delay, with supporting documents. Externally, the casino reports the details through goAML. The NAf 5,000 limb is drafted around a “transaction”, and the policy’s aggregation language (“series of transactions”) appears in the internal-reporting sentence and in the CDD footnote on occasional transactions. The reviewed text does not say in terms whether the FIU treats structured sub-NAf 5,000 payments as reportable on the indicator alone. Treat that as an open interpretive point, and screen for structuring as a pattern under the suspicion limb rather than relying on the per-transaction trigger.

Sanctions matches work differently from the amount threshold. The policy requires a mechanism that checks the sanctions status of a withdrawing participant so that a listed person cannot remove money that should be frozen. Where that happens, a report must be filed with the FIU and the casino must follow the freezing process. The Compliance Officer guidance separately requires familiarity with EU and OFAC sanctions screening.

When Must CDD Be Completed Under the NAf 4,000 Threshold?

As of October 2026, verification of identity must be complete when a player engages in financial transactions equal to or above NAf 4,000 (EUR 1,926). The policy’s footnote on occasional transactions adds that a transaction may be a single transaction or a series, combination or pattern of transactions above that sum. The policy confirms the NOIS amendment adopted on 2 May 2024 and effective 15 May 2024. Below the threshold, the licensee must still collect name and surname, permanent residential address and date of birth at account opening and run PEP and sanctions screening.

The threshold is to be calculated on a daily basis taking into account all deposits and withdrawals made by the player since the establishment of the business relationship, including any peer-to-peer transfers.

That calculation is cumulative from the start of the relationship and refreshed daily, so an active account can cross NAf 4,000 quickly. Once it does, the licensee must carry out a customer risk assessment and complete the full CDD measures. The policy sets a 30-day window from the date the threshold was reached. If the requested information and documents have not arrived by then, the licensee must terminate the relationship. It must report to the FIU if a presumption of money laundering or terrorist financing exists. If no such presumption exists, the funds go back to the bank account or wallet they came from. If a presumption does exist, internal procedures must say whether funds are blocked, and the policy cautions that blocking may tip off the customer.

The policy bars the licensee from establishing or maintaining the relationship, or carrying out the transaction, where CDD cannot be completed. It must also keep a record of every attempt to obtain the information. Enhanced due diligence applies to higher-risk customers, with residents of higher-risk geographic areas as one named example, and Legal 500 adds PEPs and users of new technologies such as crypto.

The table below compares the three triggers as of October 2026, using the policy text and the EUR equivalents given by Legal 500.

Trigger	Amount	EUR equivalent (Legal 500)	Counting basis	Consequence
CDD	NAf 4,000	EUR 1,926	Cumulative deposits and withdrawals since relationship start, checked daily, including peer-to-peer	Full CDD and risk assessment, 30-day document window
Unusual transaction indicator	NAf 5,000	EUR 2,406	Per transaction, any payment method	Internal report without delay, then goAML filing
Sanctions list match	No minimum	Not applicable	Transaction by or for a listed person or entity	Report to FIU and freezing process

goAML Registration and Filing Mechanics

Each casino must register with the FIU and obtain access to the goAML reporting portal after validation by the FIU. Registration therefore has to be completed before the first reportable event, not after it. The policy states that the FIU allows bulk reporting, and that a licensee should contact its account manager at the FIU so the FIU can decide whether it qualifies for the service. A licensee with high ticket sizes can generate NAf 5,000 events at a volume that makes manual single-report entry unworkable, so the bulk-reporting conversation belongs in onboarding.

The Compliance Officer prepares the report of all unusual transactions for external reporting according to the FIU’s reporting regulations. The reports and all supporting documents must be submitted in English. The policy says the casino and its directors, officers and employees are protected by law from criminal and civil liability for breach of any restriction on disclosure when they report to the FIU. Tipping off the customer is prohibited, per Legal 500’s summary of the framework.

The casino shall report to the FIU the details of these transactions by means of the goAML reporting portal.

The statutory position of the Compliance Officer is set by the NOIS and NORUT. The GCB requirements call for a senior officer at management level who is independent of operations and has timely access to customer identification data, CDD information and transaction records. The Compliance Officer must complete at least 10 hours of AML-related training each year. A candidate with two years of experience in a Money Laundering Reporting Officer role elsewhere can qualify. The operator submits a Personal History Disclosure Form with a CV and supporting documents for GCB fit-and-proper review. Legal 500 notes that licensees must keep compliance officers suitable throughout the licence term and notify the CGA of changes to key functionaries.

Records of all transactions must be kept for at least five years and be sufficient to reconstruct individual transactions. CDD records, account files and business correspondence must be kept for at least five years after the business relationship ends. The compliance programme must be tested at least annually by an adequately resourced internal audit function or an independent outside party. That audit must include a sampling of unusual transactions on and beyond the threshold, with review against internal and external reporting requirements. The policy names CAMS, CAMS-Audit and the AMLFC certification as recognised qualifications for auditors.

The policy also keeps accountability inside the licensee. The decision whether to onboard or continue a customer relationship cannot be outsourced, and a customer onboarded by an agent or group company must undergo the same checks as one onboarded by the casino. In practice, this reaches white-label structures and payment-agent arrangements, because the GCB treats the activity of an agent or group company as the licensee’s own activity.

Where the Published Text Is Thin

The strongest counter-argument to a stricter reading is that the GCB policy was written in the language of “casinos” and “providers of other online games” rather than the licence categories of the LOK. A licensee could argue that the policy binds only through the licence conditions the CGA chooses to attach, and that the FIU, not the CGA, interprets the NORUT indicators. That argument carries weight on the question of the FIU’s own reporting rules, which the reviewed material cites but does not reproduce. It carries less weight on enforceability. The policy states that the AML/CFT regulations are an integral part of the land-based and online licence requirements, the LOK lists NORUT and NOIS breaches among licence-level enforcement grounds, and Legal 500 reports mandatory effect from 10 April 2025.

The enforcement record is thinner than the text. No published CGA or FIU Curaçao penalty against a gaming licensee for a NORUT or NOIS failure appears in the sources reviewed for this article. Legal 500 describes what the GCB can examine, namely risk assessments, UTR logs, frozen accounts and audit findings. It also lists the CGA’s remedial powers, which are a corrective order with a noncompliance penalty (lump sum, per-day or per-violation), a corrective order with administrative coercion such as shutting down websites or seizing servers, and referral to the Public Prosecutor, with criminal exposure under the LOK for serious breaches. Licensees should plan for a UTR log and an audit sample to be requested, because those are the documents the regulator is described as able to inspect.

Several questions are unresolved in the published material. The policy does not state a filing deadline in days for goAML submission beyond “without delay”. It does not say how the FIU treats a transaction that crosses NAf 5,000 only through aggregated or peer-to-peer movements. The CDD calculation rule counts peer-to-peer transfers toward the NAf 4,000 threshold, but the reporting indicator is drafted by reference to transactions. A direct licensee should record its own interpretation of each point in the AML risk assessment and obtain Curaçao counsel’s view before relying on it. FIU Curaçao’s own guidance, which sits outside the documents reviewed here, is the authority for filing format and timing.

The transition from the master-licensee structure adds a practical point. Under the pre-LOK model, sub-licensees were accountable primarily to their master licensor, and under the LOK regulatory correspondence runs between the licensee and the CGA. The policy puts the FIU registration on the casino itself. A former sub-licensee now holding a direct licence therefore needs its own goAML access, its own validated Compliance Officer, and its own unusual transaction log. This is analysis based on the policy’s registration requirement, and the sources reviewed do not describe a transitional arrangement for reporting. The licensing context is covered in our review of the LOK transition.

What Compliance Teams Should Change

Monitoring rules need a cumulative NAf 4,000 CDD trigger that recalculates daily across deposits, withdrawals and peer-to-peer transfers, and a separate NAf 5,000 per-transaction alert that applies to every payment method. Add a sanctions check at the point of withdrawal, since the policy requires the mechanism to operate there. Document how structuring below NAf 5,000 is detected, given the open interpretive point above.

CDD operations need a 30-day countdown from the date the NAf 4,000 threshold is reached, with automated account restriction at expiry. Write down the decision tree for terminating the relationship, returning funds to the originating account or wallet, and deciding whether to block funds where a presumption of money laundering exists, with the tipping-off risk recorded in the procedure.

The reporting pipeline needs validated goAML credentials held by the licensee entity, a current fit-and-proper approval for the Compliance Officer, and a request to the FIU account manager about bulk reporting. Prepare reports and attachments in English. Keep an unusual transaction log that records recognition, documentation and reporting as separate steps, because the policy requires procedures covering all three.

Assurance needs an annual independent audit performed by a person holding a recognised certification, scoped to sample transactions on and beyond both thresholds. Set the retention schedule at five years from the end of the relationship for CDD records, and test that records can reconstruct individual transactions.

Frequently asked questions

What is the NORUT reporting threshold for online gambling in Curaçao?

As of October 2026, a transaction of NAf 5,000 (EUR 2,406) or more is deemed unusual under the Decree on Indicators of Unusual Transactions as applied in the GCB policy, regardless of payment method. Transactions by or for sanctioned persons, and transactions reported to the Police or the Department of Justice in connection with money laundering or terrorist financing, are also deemed unusual.

How do Curaçao licensees file reports with FIU Curaçao?

Licensees register with the FIU and obtain goAML access after FIU validation, then file the details of unusual transactions through the portal in English with supporting documents. The FIU allows bulk reporting where the licensee qualifies, which is arranged through the licensee’s FIU account manager.

What is the Curaçao CDD threshold and how are transactions aggregated?

CDD must be complete at NAf 4,000 (EUR 1,926), in force since 15 May 2024. The GCB policy calculates the threshold daily across all deposits and withdrawals since the relationship began, including peer-to-peer transfers.

What happens if a player does not provide CDD documents?

If documents are not received within 30 days of the NAf 4,000 threshold being reached, the licensee must terminate the relationship. It reports to the FIU if a presumption of money laundering or terrorist financing exists, and otherwise returns funds to the originating account or wallet.

Key Resources

Curaçao Gaming Control Board, AML/CFT Policy: Regulations for the combating of Money Laundering, the Financing of Terrorism and Proliferation of weapons of mass destruction, applicable to Curaçao casinos and providers of other online games (January 2025).

Curaçao Gaming Control Board, Requirements for Compliance Officer Based on NOIS/NORUT.

National Ordinance of 20 December 2024 containing Rules concerning Games of Chance (LOK), Publicatieblad 2024 No. 157, official English translation.

Legal 500 Country Comparative Guide, Curaçao Gambling Law 2025.