Curaçao's Leaked Files, Brazil's Betting Shutdown

Follow the Money published its Casino Secrets investigation on 22 September 2026, based on files taken from the Curaçao Gaming Authority's licensing portal by German researcher Lilith Wittmann. In a release dated 22 September the CGA confirmed the access ran through an account registered in December 2025 under a false identity and lasted until September 2026. FTM says 646 organisations held licences as of December 2025 and that it verified 897 beneficial-owner records covering 767 individuals.

A searchable archive went live on 23 September at 08:00 CEST at casinosecrets.lol and curacaofiles.com. It claims more than 84,000 documents from Curaçao, over 40,000 of them CGA records searchable by company and domain. Bitcoin.com and Protos cite about 40,000 documents. The CGA said it "will not repeat figures it cannot verify".

FTM reports a recurring pattern across dozens of applications: assessors flagged unclear sources of wealth or foreign blacklistings, applicants answered vaguely, and the final recommendation still stated the licence "could be granted". Stake's Medium Rare N.V. application lists Mladen Vuckovic as sole owner; founders Ed Craven and Bijan Tehrani are absent. FTM says 1xBet's Caecus N.V. was licensed in 2024 despite suspected "multiple owners"; the register shows an indefinite licence dated 24 December 2025. The files show Blaze's Prolific Trade N.V. co-owned by Nick van Gorsel and Nicholas Beugg.

1xBet and its trust office said they were unable to respond to assumptions based on documents they had not seen. Blaze's owners did not respond. Industry body COGA said on 24 September that the access was comparable to breaking into a secured location. Responding to FTM, the CGA cited a phased transition under the 2024 law and a rejection rate of about 28 per cent since 2023.

The CGA's licence register dated 21 September lists 665 entries: 207 indefinite licences (178 B2C, 29 B2B), 281 marked "Assessment in progress", 60 expired, 67 provisional entries with no status, and the remainder revoked. Since 22 July, indefinite licences rose from 193 to 207 and assessments in progress from 225 to 281. At least two provisional B2C licences, Aquarius Entertainment N.V. and King Enterprises N.V., are dated 17 September, the day the breach was disclosed.

The CGA's first release, dated 17 September, said the access was contained, the source identified and no core infrastructure compromise identified. The 22 September follow-up called the event "a serious breach under Curacao law", said the portal's back office and customer interface have been hardened, and urged licensed operators to implement changes as soon as possible.

On 25 September the CGA withdrew from SBC Summit Lisbon, describing the intrusion as limited to a single account. On 28 September it said legal proceedings against Wittmann are under consideration and that it has filed reports with authorities in Curaçao and abroad. According to the Curaçao Chronicle, it has told the sector the entire portal database was accessed and searched.

Norway's Lotteritilsynet announced on 23 September that it will block 62 more sites, 28 of them Curaçao-linked, for a total of 238. In Chile, according to Chócale, Subtel blocked 37 domains on 21 September. As of 30 September the CGA portal is offline behind an undated notice. On 1 October at 14:00, Curaçao's parliament is due to question Finance Minister Charles Cooper over his claim that portal contractor Random Consulting receives XCG 8.3 million a year, a figure the contractor disputes.

We are following developments as they happen, and we are ready to support companies affected by this situation, in Curaçao or elsewhere. Talk to us.

President Lula signed Provisional Measure 1.394 on 25 September 2026, effective on publication. Article 1 bans the operation, offer, intermediation and advertising of fixed-odds betting across Brazil, including by operators abroad serving people in Brazil. Article 4 extinguishes every Lei 14.790 authorisation on 25 October with no refund of the R$30m outorga. Brazilian sources count 85 licences; iGaming Business counts about 90.

The ban covers bets on real sporting events and on virtual online-game events. Other lottery products authorised by law, including Caixa's, are exempt, and article 49 of Lei 14.790 on fantasy sport is not revoked. Article 2 ends state and Federal District concessions on the same timetable. Article 16 bans all advertising, marketing and sponsorship, with materials and sponsor signage down within ten days.

Article 7 froze new deposits into player accounts from 25 September. Agência Senado's calendar runs voluntary withdrawals until 23:59 on 5 October and takes sites, apps and app-store listings offline from 6 October. Unsettled bets are voided and refunded in full. Article 8 gives operators until 8 October to guarantee refund liquidity and send CPF-indexed balance lists to their banks and the Secretariat of Prizes and Bets, under a R$200,000 daily fine.

Article 9 gives banks and payment institutions seven days from receipt of the lists to refund bettors in full into an active CPF-identified account; the calendar sets this at 9 to 14 October. Article 14 bars banks, payment institutions and Pix participants from processing betting transactions other than wind-down and refund flows. Article 15 orders the Banco Central to build a system for rejecting and returning such transfers.

As of 29 September the Banco Central had not issued the implementing rule, Yogonet Brasil reported, and CMN Resolution 5.320/2026 on account blocking remains in force. Banco Central data reported by Agência Brasil show Pix transactions fell 10% and value fell 15.5% over 26 to 28 September against the prior four-week average; the bank did not confirm the ban as the cause.

The fiscal estimate attached to the measure puts lost revenue at R$1.541bn in 2026, R$5.150bn in 2027 and R$5.330bn in 2028, according to Agência Senado. On 28 September the Attorney General's Office (AGU) sued 17 operators in a Pernambuco federal court for at least R$1bn in collective moral damages, The Rio Times reported. Companion bill PL 5.477/2026 would criminalise operating fixed-odds betting and financial facilitation of it, including via virtual assets.

Entain said Brazil was to be about 5% of FY26 online NGR and cut online NGR growth guidance to 4 to 6%, calling the move a 'sudden development without consultation of industry stakeholders'. Flutter, which says it suspended its Brazilian platforms on 26 September, expects about $70m less 2026 revenue and is 'reviewing all available options, including the potential to appeal', its Form 8-K said. Allwyn withdrew its 2026 margin guidance and said Betano is preparing legal action.

At the STF, Anseja filed ADI 8024 seeking suspension of the measure or a transition of at least 180 days, and ANJL filed ADI 8027. The AGU asked Justice Luiz Fux for 72 hours from 28 September before any injunction ruling; none was reported by 29 September. In Congress, amendments close on 1 October, no rapporteur is named and the first 60-day window ends on 23 November. Dr Luizinho (PP) told O Globo the measure will be dealt with after the 4 October election.

This reaches operators, their banks and payment partners, and the businesses that serve them. We are ready to support companies affected by it, whatever their position in the wind-down. Talk to us.