The Netherlands KOA Regime: KSA Licensing and CRUKS

The licence requirements the KSA applies in the Netherlands sit among the most prescriptive in Europe, and the 2026 renewal cycle has tightened them again. Operators permitted under the KOA regime check every player against Cruks before a session opens, hold deposits inside statutory ceilings and evidence their duty of care continuously. GICNT-LS treats the country as one of the recognised licensing jurisdictions, on condition that those controls are documented rather than asserted.

How the KOA Act Opened the Dutch Market

The Wet kansspelen op afstand, the remote gambling act that gives the KOA regime its name, took effect on 1 April 2021, and the regulated market opened on 1 October 2021. Licences run for a maximum of five years. The founding cohort therefore expires on 1 October 2026, which is why the Kansspelautoriteit (KSA), the Netherlands Gambling Authority, is working through a full renewal round rather than a routine supervisory year.

Two structural conditions sit underneath every other obligation. The game system must be located inside the EEA, and the control database recording sessions, transactions and player interactions is hosted in the Netherlands with direct access for the regulator. Supervision is data led as a result: the KSA reads the operator’s own records instead of waiting for periodic reporting.

The commercial context has moved against licensed supply. Gambling duty rose to 37.8% of gross gaming revenue on 1 January 2026, up from 34.2% the previous year. In its June 2026 progress letter to parliament the government cited KSA estimates placing the illegal market at EUR 617 million against EUR 600 million for the licensed one, the first assessment in which unlicensed supply is the larger share.

What the 2026 Licensing Policy Rules Require of Applicants

The Beleidsregels vergunningverlening kansspelen op afstand 2026, the licensing policy rules that replaced the framework used since 2021, apply from 1 January 2026 to new entrants and incumbents alike.

• Exit plan. Each application sets out how the offering would be wound down if the licence ends, covering legal and financial obligations, the technical steps to close the product, and how players, partners and the regulator are informed.
• Wwft risk analysis. Applicants file a money laundering and terrorist financing risk assessment under the Dutch anti-money laundering act.
• Change notification. A separate document explains how material changes in policy or business operations will reach the KSA in good time.
• Reliability. An applicant that has not complied with an enforceable court ruling at the point of application is treated as unreliable, which is grounds for refusal.
• Renewal procedure. Incumbents face a reassessment of player protection and advertising policy plus a fresh integration test of the control database, and must explain breaches recorded over the previous five years together with the corrective measures taken.
• Fees. The charge for handling a remote licence application rose from EUR 48,000 to roughly EUR 61,300 on 1 April 2026.

Operators arriving from Malta or Curaçao will recognise the components, though the Dutch pack runs heavier than the gambling licence application filed in either regime. The KSA published the first renewed five-year permits in August 2026, so anyone preparing a KSA licence renewal in 2026 now has a working precedent for the standard of evidence expected.

Why Every Session Starts With a Cruks Check

The self-exclusion register known as Cruks, in full Centraal Register Uitsluiting Kansspelen, is maintained by the KSA and covers online gambling, land-based casinos and arcades alike. Players enrol through DigiD using their citizen service number, or in person at the regulator, and the entry generates a Cruks code held against the account. Exclusion lasts a minimum of six months.

The operator obligation is mechanical rather than discretionary. The gaming system queries the register when an account is created and again before play begins, and a positive match blocks access with no override available at operator level. Licensees also maintain an interruption protocol for periods when the connection is down, so affected sessions are either logged or closed once service returns. Cruks belongs to the small group of national self-exclusion registers that block at the point of login instead of relying on lists circulated between operators.

Enrolment is climbing. Figures reported in mid-2026 put registrations above 111,500 by the end of January 2026, against roughly 61,000 during 2024. Operators also refer players for involuntary registration where behaviour and duty of care point that way, and those referrals have risen alongside voluntary sign-ups.

Deposit Limits and Affordability Contact Under the Dutch Duty of Care

The zorgplicht, the duty of care that Dutch law places on gambling operators, became quantified on 1 October 2024 through the Regeling speellimieten en bewuster speelgedrag and the KSA policy rules on responsible play. Deposit limits for online gambling in the Netherlands now work on two tiers, one triggering contact and one triggering a block.

Control	Players aged 24 and over	Players aged 18–24
Default monthly limit on a new account	EUR 350	EUR 150
Level above which personal contact precedes any increase	above EUR 350	above EUR 150
Net monthly deposit at which further deposits are blocked	EUR 700	EUR 300
Window for detecting and acting on risky play	one hour	one hour

Limits are set by the player in a neutral screen with no pre-filled values and no promotional content alongside. Raising a limit past the contact threshold requires a direct conversation in which the operator explains the risk of losing the sum concerned and points to help resources. Crossing the net deposit ceiling blocks further deposits for the rest of the calendar month unless the operator has established that the player can carry the loss. Detection duties run in parallel: markers of harm must be identified and acted on within one hour, elapsed play time is surfaced through periodic pop-up messages, and all amounts are displayed in euros rather than credits.

What Dutch Advertising Rules Prohibit

The advertising rules for gambling in the Netherlands moved from conduct code to prohibition in stages, and the sequence matters when auditing historic campaigns.

• Untargeted advertising has been banned since 1 July 2023 under the Besluit ongerichte reclame kansspelen op afstand, covering television, radio, print and public space.
• Targeted online advertising remains lawful only where at least 95% of the measured audience is aged 24 or over, with an opt-out available to the recipient.
• Role models cannot appear in promotion of online gambling. The KSA reads the category broadly and names influencers and streamers alongside athletes and celebrities in its 2026 supervisory agenda.
• Sponsorship of programmes and events ended on 1 July 2024. The transition period for sports sponsorship, covering shirts, teams, competitions and venue signage, closed on 1 July 2025.
• Bonuses may not be aimed at vulnerable groups, young adults included, even where the offer itself is permitted.
• Chain liability reaches marketing intermediaries. Agencies placing paid content for unlicensed operators may be referred to the consumer authority ACM and to the Advertising Code Foundation.

Affiliate output is judged against the same standard as operator output, which places the Dutch regime at the strict end of the gambling advertising codes in force across Europe.

How the June 2026 Reform Package Would Change Operator Obligations

On 12 June 2026 the State Secretary for Justice and Security, Claudia van Bruggen, sent parliament a progress letter proposing a further round of tightening. None of it is law yet. Every element needs legislation and parliamentary approval, and drafting was still under way at the time of writing.

Four measures carry the weight. Advertising for online games of chance would be prohibited in principle, with only narrow exceptions. Bonuses would be banned outright, including sign-up free bets and loyalty rewards for existing customers. A single deposit limit would apply across all licensed operators rather than per account, closing the gap that lets one player set separate limits at several sites. Any request to lift that limit would trigger a draagkrachttoets, an affordability test examining guardianship or administration orders, payment arrears and the player’s wider financial position.

Ministers also want stronger instruments against unlicensed supply, including website blocking and explicit duties for payment providers and hosting companies, and have commissioned work on capping the number of licences issued. Raising the minimum age for high-risk online games from 18 to 21 has been argued repeatedly and remains tied to progress against illegal operators rather than settled as policy. For compliance planning the conclusion is narrow: build for a cross-operator limit and an affordability gate, and treat bonus mechanics as a feature with a limited remaining life in this market.

Where GICNT-LS and GICNT-PP Map Onto the Dutch Regime

Certification is not a substitute for a KSA licence, and GICNT holds no supervisory powers in the Netherlands. What the framework adds is a test of whether obligations already binding on a licensee are evidenced in a form an external auditor can examine.

Dutch obligation	GICNT domain	Evidence expected at audit
Valid KOA licence and permitted product scope	GICNT-LS	Licence status confirmed against the KSA public register at each annual review
Cruks integration	GICNT-PP	Check logs at registration and session start, plus a tested interruption protocol
Deposit limits and contact thresholds	GICNT-PP	Records of limit changes, contact conversations and blocks applied
Detection of risky play	GICNT-PP	Intervention records timestamped against the one-hour window
Advertising and affiliate control	GICNT-AM	Creative approval trail and affiliate contract terms
Control database and data handling	GICNT-DS	Access controls, retention schedule and incident response plan

The bi-annual cadence of GICNT-PP suits a regime where protection rules change between annual reviews, which is the practical reason the player protection requirements sit on a shorter cycle than licensing checks.