Who Really Owns an Online Casino? Curaçao Leak Puts Gambling's Beneficial-Ownership System Under the Microscope

A vast leak of confidential licensing records from Curaçao has exposed ownership, financial and compliance information behind some of the world's largest offshore online casinos, creating a major test for the Caribbean jurisdiction's recently reformed gambling regime.

The Casino Secrets investigation analyzed more than 84,000 documents and over 2TB of data involving more than 1,000 iGaming companies. On September 26, new reporting by The Guardian revealed details from the files involving major international gambling businesses, including the Santeda casino network.

The CGA [Curaçao Gaming Authority] has confirmed that its online licensing portal was subject to unauthorized access and says a forensic investigation is ongoing. However, the regulator has not publicly confirmed all of the individual claims contained in the leaked material.

The documents and reporting raise serious questions about casino ownership and regulatory due diligence, but allegations concerning individual companies should not be interpreted as findings of criminal or regulatory wrongdoing.

The bigger question exposed by the leak is nevertheless difficult to ignore: Does a gambling regulator really know who ultimately owns the casino it licenses?

More Than 84,000 Documents Put Offshore Ownership Under Scrutiny

Casino Secrets describes itself as an international investigative project based on leaked regulatory and corporate material. Its database includes more than 84,000 documents, over 2TB of analyzed data and information concerning more than 1,000 iGaming companies.

The importance of those files goes beyond their scale.

Offshore casino ownership can be difficult for players, journalists and even business partners to establish through public information alone. Companies may operate multiple brands and domains through corporate structures spread across several jurisdictions.

The leaked Curaçao records potentially offer something much more revealing: information companies themselves submitted during the licensing process.
This includes UBO [Ultimate Beneficial Owner] information, corporate structures, personal history disclosures, financial declarations and source-of-wealth information. These are precisely the areas Curaçao's reformed licensing system is supposed to examine. Under the LOK [Landsverordening op de Kansspelen - National Ordinance on Games of Chance], which came into force in December 2024, Curaçao moved toward direct licensing and stronger central supervision.

The CGA's own licensing guidance says an application can face refusal when the identity and involvement of ultimate beneficial owners cannot be sufficiently established or when the source of funds financing an operation cannot be adequately traced. That makes the Casino Secrets material particularly significant.

Santeda Records Raise Questions

The leaked documents contain information relating to Santeda International, a casino network previously investigated over allegations that some of its brands targeted UK consumers despite not holding a British gambling license.

Documents submitted to Curaçao reportedly identify Georgian national Onise Chimakhidze as Santeda's owner. The Guardian also reported that some documents contained contact details associated with gambling technology company Upgaming and that files submitted to the regulator included references to Upgaming in their filenames. Upgaming has denied operating Santeda. Its lawyers said the contact information could relate to a previous commercial relationship between the companies that has since ended.

Another part of the leaked material concerns six loans reportedly made by Santeda to Luxembourg-based Buda Capital, totaling €15.59 million. The Guardian reported that people owning Buda Capital have connections through ownership or directorships with Upgaming. Again, these documentary connections are not findings of criminal conduct. But they illustrate why modern gambling regulators increasingly examine not only shareholders but lenders, related businesses, financial flows and other parties that may have influence over an operator.

Crypto Makes Source-of-Wealth Checks Even More Important

Another revealing example involves Oddsbet, a gambling company focused on high-value players.

According to the leaked documents reported by The Guardian, material submitted to the CGA said that former owner Robert Bostock's source of funds included long-term cryptocurrency investments and a £100,000 loan. Bostock's lawyers told the newspaper that the loan was never drawn and said the business served customers outside the UK.

The example highlights a wider challenge for regulators. Cryptocurrency wealth is increasingly relevant to gambling ownership, investment and payments. But crypto can also make traditional source-of-wealth verification more technically demanding.

A regulator may therefore need to establish not simply that an applicant owns digital assets, but how those assets were acquired, how ownership can be verified and whether the transaction history satisfies AML [Anti-Money Laundering] requirements. Curaçao's licensing framework explicitly includes source-of-funds and AML requirements. The Casino Secrets investigation now provides a real-world look at how difficult those checks can become.

The Other Scandal Is Cybersecurity

There is another major story inside the leak, and it has little to do with casinos themselves. It concerns the regulator. The CGA confirmed in September that unauthorized access had occurred within its online gaming portal. It said the access had been contained and that its service provider had begun forensic work to determine what information may have been accessed.

The portal is not simply an administrative website. It is the system through which gambling companies submit license applications and regulatory information. CGA guidance requires personal history disclosure forms for certain beneficial owners, directors, trustees, lenders and other key individuals. That means regulators can hold extraordinarily sensitive collections of personal, corporate and financial information. Passports, ownership structures, financial declarations and source-of-wealth evidence are exactly the information regulators need to perform serious suitability checks. They are also exactly the kind of information that makes regulatory systems attractive targets.

This creates an uncomfortable paradox for modern gambling regulation: the more information regulators require in order to understand casino ownership, the more valuable their own databases become to attackers.

Why This Could Matter Far Beyond Curaçao

The potential consequences do not end in Willemstad. Online casino companies often operate across multiple jurisdictions. The leaked files could therefore provide journalists and potentially authorities elsewhere with information to compare against corporate and licensing disclosures made in other markets.

Any discrepancy would require investigation and context. A difference between two documents does not automatically indicate misconduct because ownership structures, financing and corporate arrangements can legitimately change over time. But cross-jurisdiction comparison could become one of the most consequential aspects of the leak.

The UK Gambling Commission has already told The Guardian that it could not comment on leaked documents, while emphasizing that illegal gambling activity remains an enforcement priority.

The 2027 Question: Who Really Owns the Casino?

Curaçao has spent years attempting to move away from its reputation for opaque offshore licensing. The LOK reform was supposed to strengthen direct regulatory oversight, beneficial-ownership verification, financial scrutiny and accountability. Casino Secrets therefore arrives at a particularly sensitive moment. The investigation does not prove that Curaçao's new system has failed. Much of the leaked material concerns precisely the type of information a serious regulator should be collecting and examining. But it does create two important tests.

The first is whether regulators can reliably determine who ultimately owns, finances and controls increasingly complex international gambling businesses. The second is whether they can protect the highly sensitive information they collect while doing so.

Those questions will become even more important as crypto wealth, cross-border corporate structures, AI-driven compliance systems and global casino platforms make gambling businesses more technologically and financially complex.
​​​​​​​
For years, players have been told to check whether an online casino has a license. Heading into 2027, there may be a more fundamental question worth asking, who is actually standing behind that license?