KSA Licence Applications: Where Dutch Remote Gambling Compliance Breaks Down

The KSA has not published application rejection data broken down by cause, so the claim that localisation, responsible gambling tooling and cooling-off logic are the three requirements that sink Dutch applications cannot be traced to a primary source. What the published record does show is that these three areas generate the KSA’s inspection findings and fines against licence holders who already passed assessment. For applicants, the practical bottom line is to treat Assessment Scheme v2.1 as a build specification and to expect the regulator to test live behaviour after grant, not only design documents at filing. As of October 2026, that is the defensible reading of the evidence.

This article reads the framework as it stands under the Remote Gambling Act (KOA), the Remote Gambling Decree and the KSA’s Remote Gambling Gaming System Assessment Scheme, version 2.1, in force for all assessments from 1 October 2024. It separates what the text requires, what enforcement shows, and where our analysis goes beyond either. Licensing strategy for the Netherlands should be confirmed with Dutch qualified counsel.

What the published record actually shows

The KSA publishes outcomes at the level of licences granted, renewed and sanctioned. It does not publish a refusal register with reasons. As of October 2025, 30 remote gambling licences had been issued since the market opened on 1 October 2021, according to the ICLG 2026 Netherlands chapter. The first renewal round followed in September 2026, when the KSA reissued eight licences for 1 October 2026 to 30 September 2031, as reported by iGaming Business that month. The recipients included TOTO Online, Holland Casino Online, Play North (Kansino), FPO Nederland, Bingoal Nederland, Hillside (New Media Malta) for Bet365, NSUS Malta (GG Poker) and Betent (Betcity). iGaming Business also reported that no new entrants were approved in that round.

That list establishes who succeeded. It does not establish why anyone failed. Any article asserting a ranked list of rejection causes is inferring from incomplete data, and this one declines to do so. The evidence that exists points elsewhere, to post-licence supervisory findings as the KSA’s visible failures.

Dutch remote gambling application and enforcement parameters (as of October 2026)

Parameter	Figure	Source tier
Application fee	€48,000, non-refundable	ICLG 2026 Netherlands chapter
Security deposit	€50,000	ICLG 2026 Netherlands chapter
Assessment period	Six months, extendable by six months	ICLG 2026 Netherlands chapter
Licence term	Maximum five years	ICLG 2026 Netherlands chapter
Monthly deposit cap before means test, age 18 to 24	€300 net	iGaming Business, July 2026
Monthly deposit cap before means test, older players	€700 net	iGaming Business, July 2026
Maximum administrative fine	€1,030,000 or 10% of prior-year turnover, whichever is higher	ICLG 2026 Netherlands chapter
711 duty of care fine (June 2026)	€886,000	iGaming Business, June 2026
CRUKS registrations	Around 120,000	Trade press, July 2026

Localisation is a build requirement, not a translation task

As of October 2026, all application documentation must be in Dutch, with exceptions for ICT documents, contracts and audit reports, according to the ICLG 2026 summary of the application process. The KSA assesses seven modules: reliability, AML and match fixing, financial stability, addiction prevention, advertising, internal monitoring and the gaming system. Language is the visible layer. The structural layer sits in Assessment Scheme v2.1, which states that only the Dutch version is binding and that the English text is a courtesy translation.

The Scheme’s localisation requirements are technical. Every accessible part of the player interface must show the time in the Netherlands, the time elapsed since sign-in and the player’s balance. The landing page must show the date and time of the player’s penultimate registration, as defined in Section 1.1 of the Remote Gambling Decree. Registration cannot complete unless the licensee holds the player’s name, first names, date of birth, place of birth, citizen service number (BSN) where the player has one, physical address, email address and phone number. Standard KS.04.02_2.0 (Decree B20.3) restricts BSN use to consulting CRUKS on registration, verifying identity and uses permitted by other law, and requires the BSN to be removed from the licensee’s records immediately after receipt of the CRUKS code.

The control database (CDB) is the least portable component. The ICLG summary states the CDB must be physically located in the Netherlands and the gaming system within the EU or EEA. Standard KS.03.06_2.0 (Regulations R4.12) requires a control plan and an exit plan, both under one year old, adopted by the most senior responsible person, managed by a named officer and supplied to the KSA immediately on each new version. In practice, an applicant that builds a Malta or Curaçao stack and bolts on a Dutch front end will meet the language requirement and risk missing the data-handling and hosting expectations. That observation is our analysis, not a KSA finding.

The 2026 renewal cycle added a further localisation-adjacent item. Since 1 January 2026, reapplications must include an exit plan for ceasing operations, a WWFT risk analysis and documentation on informing the regulator of material business changes, per the ICLG summary. The KSA also required applicants to detail corrective actions taken after earlier breaches, according to iGaming Business in September 2026.

Responsible gambling tooling: where the CRUKS integration is tested

The Scheme tests CRUKS integration as a fail-closed control. Section 3.6 of the Scheme requires that a player is granted access only after a CRUKS consultation returns a “nohit”. The text is explicit about error states:

“In terms of design, confirm that players will not be registered if a consultation of the Register results in an invalid request for information (404 and no result) or a valid request for information with the notification that the player is known to CRUKS (200 +CRUKS code + registered).”

The Scheme’s CRUKS section also addresses service interruptions. Where CRUKS is unavailable, the gaming system must track which players signed in during the outage, consult the register as soon as possible after the interruption is resolved, sign out any player found in CRUKS and report how many were granted access and how many were signed out. In practice, a design that defaults to “allow” during a timeout will not meet this standard.

Limit-setting follows the Decree. Standard KS.06.03_2.0 (B4.14) requires players to set maximum time per day, week or month, maximum deposits per day, week or month, and a maximum balance. Section 3.10 then requires data capture that supports early detection of excessive play, including sign-in frequency, traceable to the individual player. Standard KS.10.05_2.1 requires appropriate measures where analysis points to excessive gambling, with a personal dialogue where there is reasonable suspicion. The Scheme also requires an intervention measure when a player reaches or crosses a limit under Section 4.14(2)(a) of the Decree, with the licensee weighing necessity, effectiveness and proportionality.

The means test is where the KSA’s findings are most specific. Since October 2024, licensees must run a means test when players apply to deposit above the monthly thresholds of €300 net for players aged 18 to 24 and €700 for older players, according to iGaming Business in July 2026. The KSA revised its “good and bad practices” guidance that month after inspections of 20 licence holders found shortcomings persisted despite sector-wide improvement. The guidance, which updates a February 2025 version, states that monthly limits must rest on structural, recurring income only. Savings, business assets and home equity are excluded, as are one-off payments, a partner’s income, loans and earmarked social benefits. It lists 13 bad practices, including reliance on unverified self-declarations, using the highest payslip instead of an average, and imposing bonus restrictions for less than the mandatory 30 days after a limit intervention.

The KSA’s fine against 711 illustrates the exposure. iGaming Business reported in June 2026 that 711 was fined €886,000 for failing to monitor and intervene in problematic gambling behaviour between 2022 and 2024. The conduct at issue falls within the Section 15 and 18 Decree obligations that Standards KS.10.03 to KS.10.05 test at assessment. In practice, a system that passes design review can still fail on whether interventions fire in production.

Cooling-off: one term, several different mechanics

The Assessment Scheme extracts reviewed for this article show no 24-hour limit-increase delay of the kind UK and Ontario licensees will recognise. UKGC Remote Technical Standards requirement 12D states that customer-led limits “must only be increased at the customer’s request, only after a cooling-off period of at least 24 hours has elapsed and only once the customer has taken positive action”. AGCO Registrar’s Standard 2.24 requires at least 24 hours before a relaxed or eliminated limit takes effect. The Danish inspection standard SCP.02.03 delays a higher deposit limit by at least 24 hours and requires a 24-hour break option. Counsel should confirm the Dutch position against the Decree and the Canvassing, Advertising and Addiction Prevention (Betting and Gaming) Regulations before finalising a product specification.

“Cooling-off” mechanics compared (as of October 2026)

Regime	Mechanic	Duration
UKGC RTS 12D	Limit increase requires waiting period and positive confirmation	At least 24 hours
AGCO Standard 2.24	Relaxing or eliminating a limit delayed	At least 24 hours
Spillemyndigheden SCP.02.03	Higher deposit limit delayed, 24-hour break option	At least 24 hours
KSA, CRUKS exclusion	Register-based block across all licensees	Minimum six months, 12 months proposed
KSA, terminated registration	No sign-in, player must register again	Permanent until re-registration

In the Dutch framework, the closest analogue to cooling-off is CRUKS exclusion. As of October 2026 the minimum exclusion period is six months, and State Secretary Claudia van Bruggen wants to extend it to 12 months, with KSA Chair Michel Groothuizen backing the proposal, as reported in July 2026. Standard KS.06.07_2.0 (B4.22) adds that once a registration is terminated the player cannot sign in, and the explanatory note states this “will remain the case in perpetuity” until the player registers again.

A further usage of the term concerns licensing itself. Unibet stated, according to reporting on the Dutch Supreme Court ruling in July 2026, that the KSA placed its brand under an eight-month cooling-off period in 2021 that delayed its market entry. That is Unibet’s account and relates to the transitional licensing period, not to player tooling.

Where KSA practice runs ahead of its text

Three developments sit between the written standard and current supervisory expectation. The first is the means test guidance discussed above, which converted an ambiguous duty into 13 enumerated bad practices after inspection findings. In practice, the guidance is the benchmark inspectors apply, whatever its formal status in the Scheme.

The second is legislative. The 2026 reform package seeks a near-total ban on online gambling advertising, a ban on welcome bonuses, centralised deposit limits across licensed websites and stricter duty of care, according to trade press coverage in June and July 2026. A cross-operator deposit limit changes the architecture of any limits engine built to the current per-licensee model. The government statement described a testing mechanism as still under development. Groothuizen has also urged linking CRUKS to the Central Curatorship and Administration Register, which covers 275,000 people under financial administration or curatorship.

The third is advertising supervision. Role-model bans have applied since 2022, untargeted advertising has been barred since 1 July 2023 and sports sponsorship has been banned since 1 July 2025, according to trade press in June 2026. The KSA warned TOTO Online in June 2026 over football club social media promotions, and in May 2026 it told licence holders ahead of the World Cup that breaches would meet swift enforcement.

The strongest counter-argument to the thesis that supervision, not entry, is the main risk is that the licensing gate is demanding in its own right. The €48,000 fee is non-refundable, assessment can run twelve months, and the first renewal round admitted only incumbents. The record is consistent with both a high entry bar and operators struggling after entry. Without a refusal dataset, neither can be quantified.

What compliance teams should change

Rebuild CRUKS handling as a fail-closed service. Test the 404 and error states explicitly, document the outage reconciliation process required by the Scheme, and verify that BSN deletion occurs on receipt of the CRUKS code. Evidence these tests in the assessment-body file.

Separate the Dutch limits engine from any UK-derived template. Map the Decree’s time, deposit and balance limits, the intervention trigger at Section 4.14(2)(a), and the 30-day bonus restriction following a limit intervention. Build the means test on averaged structural income only, with documentary evidence retained in the player record.

Audit the player interface for Netherlands time display, session elapsed time, balance and penultimate registration data on the landing page. Confirm that game explanations are identical across all languages offered, as Standard KS.09.33_2.0 requires.

Prepare the renewal-grade file even for a first application: a current control plan and exit plan for the CDB, a market exit plan, a WWFT risk analysis and a log of corrective actions for any earlier breaches in other jurisdictions. Teams moving from other regimes can compare self-exclusion architecture with the Spelpaus API requirements under SIFS 2026:3, and the 24-hour limit cooldown model in AGCO and AGLC internet gaming standards. Applicants routing from Curaçao should read the post-LOK Curaçao framework analysis, which covers the exclusion of European Netherlands from that regime’s geographic perimeter.

This analysis rests on a read of Assessment Scheme v2.1, the KSA’s updated means-test guidance as reported, the 2026 ICLG Netherlands summary and trade reporting on 2026 enforcement, not on any KSA refusal data, which does not exist in the public record.

Frequently asked questions

Does the KSA publish why licence applications are rejected?

No. The KSA publishes licences granted, renewed and sanctioned, but not refusal reasons. Claims about the most common rejection causes are inference, not published data.

Must Dutch licence applications be submitted in Dutch?

Yes, with exceptions for ICT documents, contracts and audit reports, per the ICLG 2026 summary as of October 2026. Assessment Scheme v2.1 is binding only in Dutch, and the English version is a courtesy translation.

What happens if CRUKS returns an error during player registration?

Registration must fail. Section 3.6 of Assessment Scheme v2.1 states players are not registered where the CRUKS consultation returns an invalid request (404, no result) or a registered hit.

What are the means-test thresholds for Dutch licensees?

As of July 2026, players must pass a means test before depositing above €300 net monthly (ages 18 to 24) or €700 net monthly (older players), per iGaming Business. Limits must rest on structural income only.

Key Resources

Primary sources are the KSA Assessment Scheme v2.1, the Remote Gambling Act (KOA), the Remote Gambling Decree, the Canvassing, Advertising and Addiction Prevention (Betting and Gaming) Regulations, and the KSA’s published updated means-test guidance and first follow-up licence announcement on kansspelautoriteit.nl. Comparative references are UKGC Remote Technical Standards requirement 12D, AGCO Registrar’s Standards for Internet Gaming standard 2.24 and the Danish inspection standard SCP.02.03.