On September 22, 2026, an international team of journalists published the Casino Secrets investigation, focused on the workings of the Curaçao Gaming Authority, the owners of companies licensed on the island, and the ties between online casino operators, software suppliers, and payment infrastructure.

The project brought together information security specialist Lilith Wittmann, the German broadcaster NDR, Norway's NRK, Sweden's SVT, and the outlet Follow the Money. The authors say they worked with internal regulatory materials and corporate registry data from several countries. In total, the project reportedly covers more than 84,000 documents, over 2 TB of data, and around a thousand iGaming companies.

One of the publications examines the structure of licensing in Curaçao, while another looks at the group of companies operating under the SOFTSWISS brand and its possible ties to a number of formally independent operators.

For the industry, this story matters less for its list of names and companies than for the questions it puts to the market. Where does the platform developer's responsibility end and the operator's begin? How much does a license actually reveal about who truly controls a casino? Can companies be considered independent if they are linked by funding, infrastructure, and money flows? Is it enough for an affiliate to check a license and a legal entity's name before entering into a partnership?

So far, the published materials have not led to final court or regulatory rulings. A number of the investigation's conclusions are disputed by the parties named. It is therefore more accurate to treat Casino Secrets not as a ready-made legal verdict, but as grounds for a closer look at how offshore iGaming is structured and at the potential weak points of the established model.

Casino Secrets: How the Investigation Came to Be

According to Lilith Wittmann, in December 2025 she discovered a vulnerability in the information system of the Curaçao Gaming Authority. The access she obtained allegedly made it possible to view licensing applications, details on company owners and directors, business plans, financial documents, correspondence, internal comments, and audit results.

The researcher claims the access remained in place for roughly nine months. The CGA reported that the vulnerability had been closed and stated that it takes the incident seriously. Yet the situation raises a separate question: just how well protected are the documents operators hand over to regulators as part of licensing?

Such systems can hold copies of passports, bank statements, details on sources of wealth, corporate structures, residential addresses, criminal record certificates, and other sensitive information. A leak of this kind poses a risk not only to the regulator, but also to the owners, directors, employees, and counterparties of licensed companies.

The authors of Casino Secrets used the obtained documents alongside information from corporate registries in Malta, Cyprus, Estonia, Germany, Curaçao, and other jurisdictions. This allowed them to cross-reference formal company ownership, the movement of funds, software licensing agreements, and the actual operations of casinos.

It is important to bear in mind that some of the published findings amount to a journalistic interpretation of a large body of data. The mere existence of a contract, a payment, or a shared supplier does not yet prove common control. But a cluster of such links can serve as grounds for further scrutiny.

Licensing in Curaçao: What the Investigation Found

Curaçao has remained one of the most visible jurisdictions in international online gambling for years. Its licenses are used by operators working across multiple GEOs at once, including countries where local regulators do not recognize that license as sufficient grounds for accepting players.

One of the investigation's main contentions is that the CGA and the consultants it engaged may have known about certain operators' presence in problematic or closed markets.

The published documents mention risks of operating in Germany, Austria, Australia, South Africa, and several other countries. In some cases, reviewers demanded geoblocking of the US, the Netherlands, Curaçao, Ontario, and sanctioned territories. At the same time, operating in other jurisdictions where a Curaçao license likewise grants no local authorization could be treated more as a manageable commercial risk.

This point is fundamentally important. A license confirms that a company has obtained authorization from a particular jurisdiction. But it does not turn into a universal right to accept players anywhere in the world.

An operator is obliged to separately account for the legislation of each target market. If a country requires a local license, a Curaçao permit does not replace it. The same applies to advertising, payments, affiliate marketing, KYC, responsible gambling, and personal data protection.

For players and some commercial partners, the distinction between "the company holds a license" and "the company has the right to operate in a specific country" remains far from obvious. The investigation once again shows just how dangerous it is to conflate the two.

Issuing Gambling Licenses: Who Really Makes the Call

Another key finding concerns the role of outside contractors.

Judging by the materials reviewed, a substantial part of the preliminary vetting of applicants was carried out not directly by CGA staff, but by private consulting firms based in Malta and Cyprus. They reviewed documents, analyzed owners, and prepared opinions on whether an applicant met the requirements.

Using external consultants is not unusual in itself. Regulators need specialists in corporate law, financial monitoring, technical auditing, and international compliance.

The problem arises when the line between consulting and the regulatory decision becomes blurred. If a contractor not only gathers information but effectively determines whether an applicant is fit to receive a license, questions arise around independence, conflicts of interest, and accountability for flawed decisions.

For the market, this means that verifying a license should not stop at finding a company in an official registry. It matters to understand what procedures sit behind that registry entry, who conducted the due diligence, and how regularly the licensee is monitored after the permit is issued.

Formally strict vetting at the application stage helps little if subsequent oversight does not track changes in ownership, the emergence of new domains, entry into prohibited markets, and shifts in payment infrastructure.

Why Casino Ownership Structures Keep Getting More Complex

A modern online casino rarely amounts to a single company that owns the brand, takes deposits, runs the platform, performs KYC, sources games, and pays affiliate rewards all on its own.

Typically, the structure involves:

  • the licensee;
  • the brand owner;
  • the casino platform provider;
  • the game aggregator;
  • game studios;
  • payment companies;
  • crypto processors;
  • KYC and AML providers;
  • customer support;
  • marketing agencies;
  • the affiliate program;
  • the owners of domains and intellectual property.

Each participant may be registered in a different country. On top of that, some functions are outsourced, with compensation structured as a fixed fee or a percentage of gaming revenue.

From a commercial standpoint, such a structure is understandable. It allows risks to be spread, specialized suppliers to be brought in, and new brands to be launched without building the entire infrastructure from scratch.


But the more elements appear in the chain, the harder it becomes to answer a basic question: who actually runs the product and captures the bulk of the economic benefit?

That is precisely the question at the heart of the SOFTSWISS publication. Officially, the brand presents itself as a B2B technology provider for iGaming. The authors of the investigation do not dispute the existence of that business, but suggest that relationships with certain formally independent operator companies could have been considerably tighter than the usual "supplier–client" model.

SOFTSWISS rejects the conclusion that the company runs casinos and stresses its role as a software provider. With regard to specific brands, the company has also stated that it may have supplied software components or access to game providers, but was not involved in operational activity. The CGA, for its part, disagreed with how the journalists described the alleged network of connected companies.

So far, these disagreements have not received a final legal assessment. Yet the very emergence of such a dispute shows just how outdated the formal approach to defining an operator is becoming.

When a Supplier Stops Being Just a Supplier

If a company sells an operator a standard software license, it usually does not control that operator's day-to-day activity. But in iGaming, relationships are often structured in more complex ways.

A single technology partner can simultaneously provide:

  • the platform;
  • game integration;
  • a payment orchestrator;
  • CRM;
  • anti-fraud;
  • affiliate software;
  • crypto processing;
  • technical support;
  • hosting;
  • analytics;
  • player retention tools.

Fees for these services may depend on GGR or other operator metrics. Sometimes the supplier helps launch a brand, set up payment routes, and onboard affiliates.

None of these factors, on their own, turns a supplier into a casino owner. Even taking a percentage of revenue is a common payment model in B2B.

But the combination of factors can change the assessment:

  • the supplier funds the operator's launch;
  • the supplier's staff take part in key decisions;
  • the operator has no team or capital of its own;
  • the same circle of companies services payments, the platform, and marketing;
  • profits are regularly redistributed within a connected structure;
  • the declared owner cannot explain the source of funds or their managerial role;
  • a change of legal entity produces no real change in how the brand operates.

In such a situation, a regulator needs to examine not only the platform usage agreement, but actual control.

For the entire B2B industry, this is a potentially significant shift. It is no longer enough for suppliers to say that the client is responsible for choosing the GEO. If the platform knows where players come from, processes transactions, sees the domains, and takes a share of revenue, regulators may demand more active oversight.

Why a Formal UBO Does Not Always Give the Full Picture

A UBO, or ultimate beneficial owner, is meant to show who actually owns or controls a company.

But a registry entry does not always reflect economic reality. A person may formally own a company that depends entirely on another party for financing, technology, and management decisions.

Conversely, the absence of substantial personal wealth or prior iGaming experience does not prove that an owner is a nominee. An entrepreneur may raise investment, take out a loan, or buy a business with deferred payment. Drawing conclusions about sham ownership therefore requires a more serious evidentiary basis than an unusual biography or a complex corporate structure.

For regulators, the key questions should be:

  • who provided the funds to buy and launch the business;
  • on what terms the financing was issued;
  • who can appoint and dismiss management;
  • who approves budgets and key contracts;
  • who controls the bank accounts;
  • who bears the main losses and receives the main profits;
  • whether the formal owner can switch the platform or payment partner;
  • whether the creditor has the right to intervene in operational management.

It is precisely the analysis of rights and economic dependence that helps distinguish ordinary commercial relationships from concealed control.

Casino Secrets Takeaways: What Could Change for Licensing

After investigations like this, regulators typically sharpen their focus not on one specific brand, but on the model the market relies on.

Deeper scrutiny across several areas can be expected.

Sources of funding

Regulators will be interested not only in the origin of initial capital, but in all subsequent loans between connected companies. Especially if a new operator is funded by organizations that use the same platform and payment infrastructure.

The operator's real independence

A company will have to show that its management makes decisions independently and is not a formal extension of a B2B supplier or a previous owner.

Contracts for the platform, games, payments, support, and marketing may be reviewed as transactions between related parties, even where there is no direct overlap of owners in the registries.

Sale of licensed companies

The transfer of shares should no longer be treated as a routine registration procedure. It matters for the regulator to verify the buyer's source of funds, their competence, and whether control genuinely changed after the deal.

Operating in external markets

A licensee will have to explain more precisely which countries it treats as target markets, where it holds a local authorization, and how it blocks prohibited territories.

Domains and mirrors

The investigation separately examines the ability to quickly add extra domains to a license. Technically, such a feature simplifies brand management, but it can also be used to rapidly replace blocked addresses.

Regulators and national authorities are likely to pay more attention not to an individual domain, but to the entire network of connected addresses, brands, and legal entities.

Implications for Operators

For operators, the key takeaway is that the corporate structure is no longer an internal matter for owners and lawyers.

It directly affects:

  • keeping the license;
  • access to banks and payment systems;
  • relationships with game providers;
  • the ability to buy advertising;
  • affiliate agreements;
  • the cost of raising capital;
  • brand reputation.

Even if an operator has not breached the requirements of its licensing jurisdiction, problems at a single key supplier can ripple across the entire infrastructure. A suspension of payment processing, termination of a platform contract, or a request for fresh KYC can halt operations faster than a regulator's decision.

Operators would therefore do well to separate critical functions in advance and understand which counterparties form a single point of failure.

The risk is especially acute when one group provides the platform, games, payments, crypto processing, CRM, and affiliate software. Such vertical integration is convenient and lowers operating costs, but it increases dependency.

An operator also needs to keep documents evidencing independent decision-making: board minutes, the rationale for choosing suppliers, financing terms, conflict-of-interest procedures, and proof of control over its own data.

Implications for B2B Providers

For a long time, software suppliers could occupy a relatively comfortable position: they provide the tool, and the operator bears responsibility for its lawful use.

That logic is gradually shifting.

Regulators, banks, and payment systems increasingly assess not only the direct client, but the entire service delivery chain. If a B2B company can technically see players' GEOs, domains, payments, and revenue structure, it may be expected to respond to obvious violations.

This does not imply that platforms should replace government regulators on their own. But the model of total non-interference is becoming less and less convincing.

B2B providers will have to develop:

  • their own KYB for clients;
  • regular monitoring of licenses and UBOs;
  • control over permitted GEOs;
  • rules for handling additional domains;
  • a procedure for terminating contracts in cases of material breach;
  • verification of funding sources;
  • management of conflicts of interest;
  • documentation of relationships with related parties.

For large suppliers, this raises compliance costs, but at the same time creates a competitive advantage. In a regulated market, the ability to prove transparency may become no less important than the speed of integration or the number of games in an aggregator.

The Investigation's Impact on Payment Companies

Payment infrastructure is one of the most vulnerable parts of offshore iGaming.

A bank or PSP signs a contract with a specific legal entity, but a player's payment journey may involve several companies, trade names, and processing partners. When the domain, the licensee, and the payment recipient do not match, identifying the actual seller of the service becomes difficult.

After publications like this, payment organizations may:

  • request documents from clients again;
  • check connected companies and directors;
  • revise the merchant category and risk profile;
  • demand a list of all serviced brands and domains;
  • restrict certain GEOs;
  • temporarily hold settlements;
  • terminate servicing of the entire connected group.

For operators, this creates the risk of a cash-flow gap. For players, the risk of delayed payouts. For affiliates, the risk of unpaid commissions, even in cases where the affiliate program itself formally continues to operate.

Crypto payments do not eliminate the problem. They change the way funds move, but they do not waive AML, sanctions checks, or the need to establish the parties to a transaction.

What Affiliates Need to Consider

For affiliates, the investigation is especially telling. Usually, before launching traffic, they check the license, brand reputation, payment history, and terms of the affiliate program.

That is no longer enough.

An affiliate may sign a contract with one company, send players to the brand of a second, see the license of a third, and receive payouts through a fourth. All of these companies may depend on a shared platform or payment infrastructure.

If a regulator, bank, or game supplier restricts the operations of a single participant, the fallout spreads quickly across the entire chain.

Before entering into a partnership, it is advisable to check:

  • the exact legal entity named in the affiliate agreement;
  • the holder of the license;
  • the owner of the brand and domain;
  • the GEOs permitted by the specific license;
  • the company that accepts players' money;
  • the company that pays the affiliate commission;
  • the rules for migrating players between legal entities;
  • the terms for brand closure or license change;
  • the program's right to withhold payouts;
  • any material dependence on a single PSP or platform.

Particular attention should be paid to brand migration between companies. For a player, the site may look unchanged, but for an affiliate, a change of operator can alter liability for old debts, statistics, negative carryover, and lifetime commission.

It is also important to keep your own evidence: contract versions, correspondence, screenshots of terms, statistics, and notices of a licensee change. If a dispute arises, the information in the affiliate dashboard may change or become unavailable.

Yet the potential tightening of liability is not just an extra burden for affiliates. For the partnership market, it could prove a positive development.

Over the past two or three years, affiliates have increasingly run into a stream of look-alike casinos that launch quickly on a shared platform, operate for a few months, aggressively buy traffic, and then shut down or stop honoring obligations to players and partners. One brand can be swiftly replaced by another, with a similar design, the same games, terms, and payment solutions, but a new domain and legal entity.

Not every short-lived brand is created with intent to defraud: closures can stem from flawed economics, payment problems, blocks, or weak management. But for an affiliate, the outcome is often the same: unpaid invoices, lost traffic, backlash from players, and no party from whom the debt can realistically be recovered.

Platform providers, payment partners, aggregators, and other contractors, meanwhile, traditionally point out that they are not responsible for the operator's actions. Formally, that position may match the terms of their contracts. In practice, it is precisely their infrastructure that enables rapid launches of new brands and the migration of activity from one company to another.

If client vetting requirements and the allocation of responsibility tighten, the flow of such clones could slow. Platforms and other B2B providers will be more cautious about onboarding projects that lack clear funding, an experienced team, and a transparent ownership structure. Regulators will be able to assess not just an individual brand, but the track record of the people, companies, and infrastructure behind a series of similar launches.

For conscientious affiliates, this could mean:

  • fewer short-term and opaque affiliate programs;
  • lower risk of unpaid commissions;
  • more careful vetting of operators by platforms and PSPs;
  • obligations surviving a change of domain, license, or legal entity;
  • clearer accountability for players and affiliate debts;
  • a gradual cleansing of the market of projects built on the constant relaunching of brands.

If every participant in the chain starts weighing not only revenue but its own risks, launching yet another clone will cease to be an almost cost-free move. This will not eliminate unscrupulous operators entirely, but it could make the "open for a few months, collect deposits and affiliate traffic, then vanish" model considerably harder and more expensive.

For the affiliate industry, such an outcome would likely be one of the most useful consequences of greater market transparency.

Will the White Label Market Change?

White label remains an important iGaming model. It allows an entrepreneur to launch a casino without building their own platform, integration team, and complex payment infrastructure.

Using white label does not, in itself, signal a violation. Thousands of legal products operate on a similar scheme.

But the investigation highlights the model's core risk: the formal operator may have too little real control over the product.

If the platform defines the technical architecture, connects payments, provides support, manages the games, and takes a percentage of GGR, the regulator is bound to ask who should really be undergoing the main vetting.

In the coming years, white-label providers will likely need to draw sharper lines around:

  • brand ownership;
  • ownership of player data;
  • decision-making on KYC and AML;
  • management of payouts;
  • selection of target markets;
  • responsibility for advertising;
  • access to bank and crypto accounts.

The model will not disappear, but it may become less anonymous and more expensive. Launching a "turnkey casino" will require not just a marketing budget, but proof of managerial competence, independent capital, and real control.

Why the Fallout Could Extend Beyond Curaçao

It would be a mistake to read Casino Secrets purely as a story about a weak offshore regulator.

Complex corporate networks are not unique to Curaçao. Companies from the same ecosystem may hold licenses from Malta, Estonia, and other countries, as well as registrations in Cyprus, the Isle of Man, Poland, Lithuania, Costa Rica, or Canada.

This means the fallout could reach:

  • European corporate registries;
  • national tax authorities;
  • banks and EMIs;
  • crypto platforms;
  • game studios;
  • ad networks;
  • hosting providers;
  • affiliate platforms;
  • regulators of local markets.

For a national regulator, it is sometimes more effective to act not against an offshore casino, but against its infrastructure. A domain can be blocked temporarily, whereas restricting payments, games, or software can affect dozens of brands at once.

That is precisely why B2B providers are increasingly becoming part of enforcement. Their role can no longer be considered entirely neutral, especially if they hold data on clients, domains, transactions, and target countries.

What Remains Unproven in This Story

When analyzing the investigation, it is important not to substitute ready-made conclusions for open questions.

The published materials alone do not prove that:

  • all companies within a single technology ecosystem are under common control;
  • every intra-group loan conceals nominee ownership;
  • a software supplier is responsible for every violation committed by a client;
  • a complex corporate structure was automatically created to circumvent the law;
  • all casinos using the same platform amount to a single operator.

Such conclusions require decisions by competent authorities and analysis of contracts, governance rights, banking data, and testimony from the parties involved.

But the investigation provides ample grounds for deeper scrutiny. It reveals a mismatch between the simple picture in the licensing registry and a far more complex system of economic relationships.

That is likely to be its main consequence.

The Market Will Have to Prove Substance, Not Form

Casino Secrets landed at a time when iGaming is already moving from formal compliance toward an assessment of actual risk.

Previously, a company only had to show a license, a UBO, a platform agreement, and a set of AML policies. Now regulators and financial partners want to understand how these documents work in practice.

Who makes the decisions? Who funds the company? Where does gaming revenue go? Who controls the domains? Which company is accountable to the player? Can the operator change suppliers on its own? And does the platform know that its technology is being used in a market without local authorization?

For conscientious market participants, this translates into rising costs for vetting and reporting. But at the same time, transparency can become a competitive advantage. Operators with a clear structure will gain more stable access to banks, providers, and regulated GEOs. Affiliates will be able to assess risk more accurately, and B2B companies will be able to separate their own reputation from the conduct of dubious clients.

The main takeaway from the investigation is not that an offshore license is necessarily unreliable, or that a large technology supplier necessarily runs its clients.

The takeaway is different: a license and a formal list of owners are no longer enough to understand how a modern operator is put together.

The market will have to learn to see the entire chain, from the source of capital and software to payments, domains, affiliate traffic, and the ultimate recipient of profit. And the longer the industry puts off this work, the higher the odds that transparency rules will be imposed on it by regulators, banks, and law enforcement.