We tested Curacao's new licensing portal: sign-in is now by invitation only

What we saw on 21 October

We opened the portal address, portal.cga.cw, on 21 October 2026 at 20:13 UK time. It forwarded us straight to a sign-in page headed "Sign in to the CGA Licensing Portal", aimed at the CGA's licence applicants and licensees. ^[1]

The page offers two ways in:

• Sign in with Microsoft, using "the Microsoft account of the email address the Authority invited"
• I have an invitation code, to redeem an invitation from the CGA

There is no public registration form, no menu and no published information on the page, only the two sign-in options, a contact link and a privacy notice. We did not try to log in, because only applicants and licensees with an invitation can.

The licence certificates still work. We opened the certificate for licence CGA/2025/2375/1259, and cert.cga.cw showed the licensee, the approved domains and the status "Active". ^[8]

The old portal let anyone register

The difference from the old system is the point of the change. On 13 September 2026, days before the breach was announced, portal.cga.cw was a public "License Management Portal" with a menu for publications, FAQs and licences, and two buttons: Login and Register. ^[7]

That open registration is how the breach started. According to the CGA, the researcher got in through the customer-facing part of the portal, using "an account registered in December 2025 under a false identity". The researcher used a variant of a real person's name and an existing company in the Curacao Chamber of Commerce register. Access ran from December 2025 until September 2026. ^[6]

^[1][2][6][7]

From breach to new portal in five weeks

• 17 September: the CGA says it has found unauthorised access to its online gaming portal and that the access has been contained. ^[5]
• 22 September: the CGA confirms that a German security researcher's claims match its own findings. ^[6]
• 2 October: the portal is offline. Operators are told not to send portal documents by email, and deadlines are postponed until the portal is back. ^[4]
• 7 October: the CGA announces that its "current online gaming portal will not be returned to service" and that the service arrangements behind it have ended. It also warns that the digital seal will be affected. Existing licences stay valid. ^[3]
• 19 October: in a press release, the CGA says the interim portal is scheduled to launch that day. The licence register and the digital seal system are scheduled to come back with it. ^[2]

The 19 October release also says the CGA has reported the breach to the authorities in Curacao, Germany and the Netherlands, has hired specialist companies to remove the leaked information from the internet, has commissioned an independent technical investigation and is considering civil legal action. ^[2]

What is still open

The interim portal is a stopgap. The CGA says it is preparing to develop and manage a new portal itself, instead of relying on an external company as it did after the 2024 reform. It has not said when that portal will be ready. ^[2]

"The temporary portal must be carefully prepared before it can be used," the CGA wrote on 19 October. It said the internal system, the digital seal and the licence register were ready for security checks by independent specialists, while the client portal was still being adjusted, with security testing to follow. ^[2] As of 21 October, the notice on the CGA homepage still said the portal "will launch" on 19 October, and the CGA had not published a confirmation that it went live. ^[1]

How much data was taken is also not settled. The CGA says it "will not repeat figures it cannot verify and will state what was taken once the investigation supports it". ^[6] The documents themselves were published by the media consortium behind CasinoSecrets, the investigation into who owns Curacao's online casinos.

What it means for players

Nothing changes for your account at a Curacao-licensed casino. "Closing the previous portal does not invalidate existing licenses," the CGA wrote on 19 October, and it has said the same since the portal went offline. ^[2][3][4]

What matters to players is the licence check. On 7 October the CGA warned that the digital seal would be affected and promised an alternative way for operators to show that a domain is licensed. ^[3] On 21 October the certificates behind the seal loaded normally. Click the licence seal in the casino's footer: it should open a certificate on cert.cga.cw that lists the exact domain you are on. Our article on the dbdbet.com and hi5win.com licence walks through the check step by step. If you compare overseas casinos accepting UK players, make that check before your first deposit. ^[8]