Casino Secrets 2026: Offshore Casino Ownership & Licence Risks
Article OverviewThe Casino Secrets investigation raised questions about offshore casino ownership, licensing and regulatory oversight. CasinoIndex examines the published findings alongside official regulator information and explains what players can verify independently. Learn how to identify casino operators, check licensing across jurisdictions and understand why a licence alone does not guarantee reliable withdrawals.
The 2026 Casino Secrets investigation raised important questions about how offshore casino licensing, company ownership and national gambling laws fit together. International journalists examined confidential licensing records and reported concerns about some approval processes. Separately, the Curaçao Gaming Authority publicly acknowledged unauthorised access to its online gaming portal. Neither fact makes every licensed casino unlawful or establishes misconduct by a particular operator.
CasinoIndex examined the published reporting and public regulator information to answer a practical question: what can a player verify without access to confidential files? A licence, a casino brand and a crypto payment each provide different information. They do not, on their own, establish lawful market access, responsibility for a player balance or dependable withdrawals.
What the Casino Secrets Findings Mean for Players
Research scope — 30 October 2026: CasinoIndex conducted a desk review of published journalism, regulator statements and public registers. We did not access the leaked database, interview those involved, test casino withdrawals or obtain a complete time-coded transcript of the STRG_F documentary. Consequently, this article attributes findings to the journalists and treats our player-risk conclusions as separate editorial analysis.
Three things the evidence changes for players
Licence: Confirm the current permission for the exact country, domain and gambling product.
Ownership: The brand, contracting operator, licence holder and ultimate controller may differ.
Payouts: Licensing evidence alone cannot determine whether an individual withdrawal will succeed.
What the Public Evidence Actually Establishes
STRG_F published the documentary Casino Secrets: Wer casht ab mit illegalen Casinos? as part of an international collaboration. Researcher Lilith Wittmann, journalists at Follow the Money and other partners published related reporting. Together, the reports describe access to confidential licensing material held by the Curaçao Gaming Authority (CGA) and analysis of company and ownership records. See Follow the Money’s published findings.
Instead of treating every dramatic headline as an equivalent fact, we group the evidence by what readers can verify today.
| Finding | Evidence and date | What it does not prove |
|---|---|---|
| Access to the licensing portal | The CGA published notices about unauthorised portal access and reported launching an interim portal on 19 October 2026. | That every licence or player account was compromised, or that all published claims about the data are independently established. |
| Ownership questions in the reporting | Follow the Money described ownership patterns in the licensing records it examined in September 2026. | That every named or licensed operator deliberately concealed ownership or committed a crime. |
| Questions about licence review | Journalists reported concerns about the adequacy of ownership and funding checks in some applications; CasinoIndex did not review those confidential files. | That every Curaçao licence is invalid or that an individual operator’s current status can be inferred from an old application. |
| Cross-border legality | Germany’s GGL says the official register identifies authorised online gambling websites. | That foreign permission automatically authorises German operations; the product, domain, territory and current permit must match. |
| Advertising and streaming | The GGL explicitly addresses gambling influencers, casino streams and affiliate marketing as potential advertising. | That every casino stream is advertising, or that every streamer has received unlawful payments. |
Why the distinction matters for players
CasinoIndex assessment:
one useful contribution of Casino Secrets is its challenge to
licence-as-trust-badge thinking
. The investigation makes ownership checks more important, but also shows why individual conclusions require specific dates, entities, jurisdictions and documents.
Player implication: If the operator on the terms page, the licence register and the payment recipient cannot be reconciled, pause before depositing. Record the exact names and ask which entity is legally responsible for the player balance.
How CasinoIndex Checked the Public Record
To test those claims, our review used three separate evidence tracks. First, we examined the documentary’s official publication and the investigation partners’ written reports. Second, we checked the Curaçao Gaming Authority’s public notices. Third, we compared the legal implications for a German-facing casino with the German GGL list of authorised operators and its public advice about online gambling advertising.
We did
not
obtain or republish leaked passports, financial statements or personal records. Nor did we attempt access to non-public authority systems. The most useful independent contribution here is a reproducible
source-to-claim check
: a reporting claim is identified, the public counterparty response is inspected, and the remaining uncertainty is kept in the conclusion. This approach is consistent with CasinoIndex’s trust-first methodology.
Timeline: what changed between September and October 2026?
December 2025:
Wittmann says she obtained access to the CGA portal and subsequently examined licensing material.
17 September 2026:
the CGA published a statement about reported unauthorised access.
22 September:
STRG_F and other investigation partners published their findings, while the CGA issued a follow-up statement.
7 October:
the authority announced a planned platform transition.
19 October:
its website said a new interim online gaming portal had launched.
However, these events do not establish the claim that the authority is permanently compromised or that its entire licensing system stopped operating. The regulator’s statements acknowledge an incident and remedial action; the journalists’ accounts challenge the quality of supervision and the security of information held in the system. Both are relevant, and neither removes the need to verify a particular casino’s current legal position.
Scope and update note (30 October 2026):
The CGA announced an interim portal during the investigation period and can change registers, certificates and enforcement information again. Date any historical screenshot or archived application; readers must consult the current CGA notices and the current destination-country register before drawing conclusions about a casino’s present legal status.
Finding One: The Company on the Licence May Not Explain Who Controls the Casino
In practice, online gambling frequently involves several entities. A consumer sees the brand and domain. The terms may identify a legal operator or licence holder. A local company-service provider may administer filings, while a separate software supplier delivers the games and an unrelated processor moves payments. Investors, lenders and beneficial owners can sit outside this visible chain.
One logo cannot answer who controls money, decisions and liability.
Follow the Money reported reviewing applications that, in its assessment, left questions about ownership or funding unresolved. CasinoIndex attributes those conclusions to the journalists and has not audited the confidential files. Its investigation used leaked application files and corporate records to identify people and companies that were difficult to trace through casino websites alone. The article describes the journalists’ effort to map legal and beneficial ownership across multiple businesses. CasinoIndex has not independently validated the underlying dataset or individual named cases.
Five identities a player should separate
- Brand and domain: the name used in advertising and the exact website where deposits are requested.
- Contracting operator: the company named in the terms as responsible for player accounts and payouts.
- Licence holder: the legal entity and licence or certificate number in the regulator’s current records.
- Beneficial owner and controller: the person or organisation ultimately owning or directing the business, which may require company filings to investigate.
- Technical and payment intermediaries: game suppliers, platform companies, trust offices and processors; participation alone does not make them the licensed casino operator.
When the entity named on a licence differs from the terms or the current domain, however, the correct next step is to reconcile the mismatch. It is not automatically proof of fraud: brands may change operator or corporate structure. It is, however, a material reason to hold off on making a deposit until the documents match. Our casino ownership verification guide sets out the underlying checks.
Finding Two: A Curaçao Licence Is Not a Passport to Every Country
Crucially, this is the most consequential practical distinction in the investigation. A Curaçao licence concerns authorisation under Curaçao’s regulatory system. It does not grant an operator permission to offer gambling in Germany, Great Britain or every other country. The local rules, licensed product types, actual operating domain and permitted territory determine the answer. Curaçao revised its regulatory framework in December 2024, but
reform of the issuing regulator does not replace the law of the destination market
.
For example, in Germany, the GGL’s official list of authorised operators is the practical starting point. The authority says it publishes the permitted providers and websites under German gambling rules, including certain offers overseen by state authorities. The GGL record consulted for this article carried an update dated 2 October 2026. A site that displays only an offshore badge is not thereby authorised in Germany. Product categories also matter: online casino table games and virtual slots are regulated separately.
What about the Curaçao certificate and licence register?
The CGA’s public register page itself warns that its published overviews do not guarantee a licence remains valid at every moment. That is a reason to check the latest status, the exact legal entity and the listed domains, not to assume that any certificate screenshot found in a casino footer settles the issue. In other words, a valid foreign record is relevant to
where the company is licensed
; it is not proof of authorisation to target a different market.
Read the separate CasinoIndex guides to verifying a casino licence and comparing gambling licensing regimes for the ordinary step-by-step process. This case study adds a further lesson: a regulator’s approval process and ownership checks are themselves subjects for scrutiny.
Curaçao vs MGA, UKGC and Anjouan: What Can a Player Verify?
Regulators differ in what they require from applicants and what the public can verify. The comparison below shows the practical checks—not a ranking that labels every casino under one authority safe or unsafe.
| Jurisdiction | What players can check | Important limitation |
|---|---|---|
| UKGC · Great Britain | Search legal names, domains, licences and regulatory actions in the UKGC business register. | Detailed ownership checks do not guarantee prompt payouts or authorise play in Germany. |
| MGA · Malta | Use the MGA licence and URL checker; the authority also documents beneficial-owner requirements. | A Malta licence does not automatically establish permission in another country. |
| CGA · Curaçao | Review licensing and enforcement entries in the CGA register. | The CGA warns that published lists may not reflect a licence’s current validity. |
| Anjouan | Its published application materials lists ownership and financial disclosures. | Application requirements alone do not prove enforcement quality, player remedies or foreign-market permission. |
Cross-border rule:
Always check the regulator for the player’s country and exact gambling product. Even a valid MGA, UKGC, Curaçao or Anjouan licence cannot replace local authorisation. The CasinoIndex licence comparison explains the wider differences.
Finding Three: Public Licence Badges Cannot Show Every Application Detail
One of the clearest findings in the published reporting concerns the gap between
regulator-held warnings
and the consumer’s view of a licence. Follow the Money reported questions about ownership checks, funding disclosures and application reviews in the files it examined. CasinoIndex cannot independently determine how each confidential application was resolved. The published report also quotes experts questioning aspects of the approval process. Their assessments are opinions attributed in that report, not findings independently reached by CasinoIndex.
However, a legal and factual boundary remains. For example, a regulator may approve an application subject to conditions. That does not, by itself, prove improper conduct. Conversely, transitional approval does not demonstrate that every open question has been answered.
CasinoIndex does not treat a historical licensing recommendation as a verdict on every current product, domain or withdrawal request.
For those journalistic allegations, the relevant source is Follow the Money’s original investigation. We use it as attributed reporting, not as if CasinoIndex had inspected each confidential application file ourselves.
Finding Four: A Technology Supplier Is Not the Casino Operator
A casino website can involve a brand owner, contracting operator, licence holder, platform supplier, game studio and payment service. These businesses may be connected through ordinary commercial agreements, but they do not automatically assume the same legal responsibilities. For example, a game studio that supplies roulette software is not necessarily the company that approves a player withdrawal.
For readers, the distinction matters when several legal names appear across the footer, terms and payment pages. Rather than inferring misconduct from a complex structure, identify the company responsible for accepting wagers and paying winnings. Then check whether the named legal entity corresponds to the current licence record. Our guide to identifying casino brands that share an operator explains how to trace these relationships using public information.
Three questions to resolve before depositing
Who contracts with the player? The terms should identify the legal operator. Who has the relevant permission? The regulator’s record should match the legal name, domain and activity. Who controls the withdrawal? The casino should publish clear payment, verification and complaint procedures. If those answers conflict, the evidence supports asking for clarification—not making a public accusation.
Finding Five: Financial Claims Need Context, Not Sensational Numbers
Investigative reports sometimes compare revenue, bets placed, customer losses, corporate profit or potential tax liabilities. Each is a different measurement. A financial estimate may also depend on assumptions about player locations, time periods, tax treatment or betting volume. It should therefore retain its original attribution, methodology and level of uncertainty.
To reduce the risk of misleading readers, this CasinoIndex article deliberately avoids repeating company-specific financial allegations or unadjudicated estimates. Those claims are not necessary to answer the core player question: can the reader establish which licensed entity operates the exact gambling website and what rules govern a withdrawal? The available public registers and operator terms give readers a more reproducible starting point.
Finding Six: Casino Marketing Is Not a Licence Check
The STRG_F documentary description highlights casino livestreams and the commercial incentives behind promotions. Marketing content can normalise an offshore brand before a viewer has checked its regulatory status. A public win, a sponsorship, a referral link or a polished studio does not establish that the advertiser and the underlying gambling offer comply with local rules.
The German GGL’s advertising guidance explicitly addresses gambling streams, influencer marketing and affiliate partnerships. It explains that whether content constitutes advertising depends on its circumstances and that German gambling rules prohibit advertising for unauthorised gambling. The authority also distinguishes advertising for a legal operator that violates marketing restrictions from promoting an operator that lacks the relevant permission.
For that reason, avoid two misleading extremes:
not every clip of someone playing necessarily constitutes a paid advert
, and a streamer showing a casino does not legalise the product. Readers can check the featured domain against the GGL list of authorised operators before treating an influencer’s presentation as relevant evidence of legitimacy. Gambling marketing often displays wins more prominently than losses; no video of a large win proves the audience would receive the same terms or outcome.
What This Means for Withdrawals and Player Protection
Even so, some parts of an offshore casino’s operation remain invisible after the player confirms the operator’s name and licence. The site still controls its internal account ledger, applies bonus rules, asks for KYC or source-of-funds documents, and decides whether to approve a withdrawal. Payment processing, liquidity and complaint handling can create additional problems that a licence badge does not resolve.
This is why CasinoIndex puts
trust before withdrawals, and withdrawals before product breadth or bonuses
. The publicly reported Casino Secrets findings raise questions about ownership and licensing scrutiny. However, they do not prove that an individual player will lose a particular withdrawal. For an individual casino, the decisive questions are its current terms, documented account restrictions, complaint patterns, licensing territory and available recourse.
Use our withdrawal approval checks explainer to understand the account stage. If a payment is already disputed, online casino dispute resolution explains why identifying the responsible operator and regulator matters before escalating a complaint.
Player implication: If a withdrawal is already pending, save the account terms, the withdrawal reference, communication with the operator and the applicable licence details. Similarly, a regulator security incident does not resolve an account dispute by itself; the responsible operator and available complaint channel still have to be identified.
Seven Checks Readers Can Make Without Access to Leaked Documents
Before registration: confirm identity and permission
- Record the exact domain and date. Casino names are not unique, and payment or licence arrangements can change over time.
- Identify the contracting company. Read the current terms, not just the homepage footer. Preserve the legal name and relevant registration number.
- Verify the licence directly with its issuer. Match the operator, current status, product and domain to the regulator’s record. Do not rely on an image badge.
- Check the target country’s authorisation. For Germany, search the GGL list of authorised operators for the precise site and product. A Curaçao record cannot replace this check.
Before depositing: check control, cashouts and promotion claims
- Investigate ownership and related entities. Compare disclosed company names with legitimate public registers. Missing or changing information is a reason to ask, not automatic proof of misconduct.
- Read the payout and complaint rules. Note KYC timing, deposit turnover, payout limits, staged settlements, complaint escalation and the entity responsible for decisions.
- Separate marketing from evidence. A streamer, affiliate ranking, major software brand or visible blockchain transfer does not establish compliance, ownership transparency or payout reliability.
A useful verification file contains the current terms page, screenshot or official reference for the licence, a dated check against the official list of authorised operators, the deposit and withdrawal conditions, and the regulator’s complaint contact. Do not send identity documents to an unverified third-party “recovery” service or attempt to obtain leaked private data. These checks are preventive; they do not make gambling risk-free.
What the Casino Secrets Investigation Does Not Prove
First, the evidence does not show that every Curaçao operator is illegal everywhere.
Cross-border legality depends on the country, product, exact site and applicable authorisation. The existence of a weak licensing decision does not automatically void every unrelated licence.
Second, the evidence does not establish that any particular player will lose a withdrawal.
Public licensing and ownership findings identify important risk factors; account-specific payout evidence is separate. CasinoIndex has not carried out real-money withdrawal tests for this article.
Third, an allegation does not become a judicial finding merely because investigators report it.
The reports combine documents with journalistic interpretation, and readers should review responses from affected organisations where available. Therefore, describe an alleged conflict or possible tax shortfall at the evidentiary level the sources support.
Moreover, the investigation does not mean the CGA took no action after the security incident.
The regulator acknowledged the unauthorised access and subsequently reported changes to its technology. Whether those changes fully solve longstanding issues about licensing scrutiny is a separate question that requires continued evidence.
Finally, our review does not give CasinoIndex independent access to the underlying leak.
This article is an original cross-source player-risk analysis using publicly available reporting and regulator material. The full time-coded film transcript was unavailable in the sources we could retrieve, so we avoid quoting unsourced conversations or assigning invented timestamps.
CasinoIndex Verdict: A Licence Is a Starting Point, Not the End of Due Diligence
Ultimately, the lasting contribution of Casino Secrets is not simply that offshore gambling generates large sums of money. It is the evidence that
licensing, real ownership, cross-border authorisation and the casino’s actual payout obligations can diverge
—sometimes in ways the player cannot discover from the website alone.
Our cross-check produces a practical conclusion: first establish whether the exact gambling domain is authorised for the product and territory; then identify the contracting operator and beneficial ownership information available from legitimate sources; only then evaluate withdrawal rules, historical complaints and product quality. A lack of transparency is a meaningful warning, but it is not permission to assert unproved crimes. This hierarchy is why CasinoIndex does not use an offshore badge, affiliate endorsement or broad game library as a substitute for a trust assessment.
Casino Secrets 2026: Frequently Asked Questions
What was the Casino Secrets investigation?
It was an international journalistic investigation, published in September 2026, into companies, owners and regulators involved in offshore online gambling. STRG_F released a documentary, and research partners published supporting reports based on licensing documents and company records.
What did the Curaçao regulator confirm about portal access?
The authority publicly acknowledged unauthorised access to its online gaming portal and later announced an interim portal. Check the regulator’s current notices for the latest assessment of scope and legal consequences.
Can CasinoIndex confirm every ownership claim in the leak?
No. The journalists examined confidential documents that CasinoIndex did not obtain. We instead explain how readers can check public licence records, company names and current operator terms.
Does a Curaçao licence make an online casino legal in Germany?
No. Check the relevant German authorisation separately against the official GGL list of authorised operators, including the exact website and type of gambling offered. A foreign licence alone does not substitute for the applicable German permit.
What is an ultimate beneficial owner of a casino?
An ultimate beneficial owner is the person who ultimately owns or controls a company under the applicable legal definition. The visible casino brand, a nominee director and the contracting operator can be different entities.
Did Casino Secrets prove that every offshore casino cheats players?
No. The published reporting raises questions about ownership, oversight and access to national gambling markets. They are not a universal finding that all offshore operators manipulate games or refuse withdrawals.
Can a software provider or famous streamer prove a casino is trustworthy?
No. Game suppliers are not necessarily the entities responsible for withdrawals. Streamer endorsements may involve marketing incentives. Neither establishes the operator’s licence, contractual obligations or treatment of player disputes.
How should I assess financial accusations in casino investigations?
Check who made the claim, whether it relies on estimates, which period it concerns, whether the affected organisation responded and whether any court or regulator issued a finding. Do not treat a journalist’s estimate as an established legal liability.
What is the first thing I should check before depositing?
Match the exact casino domain and product to the official authorisation for your country. Then identify the company responsible for the player account and read the withdrawal and verification conditions.
Does cryptocurrency make offshore casino ownership transparent?
No. A blockchain can show certain transactions, but it does not automatically establish the ultimate owner of the casino, the accuracy of its private account ledger or whether the casino will approve a particular withdrawal.
Research Sources and Editorial Scope
Source method and date: This desk review used public reporting and official regulator pages available on 30 October 2026. Links appear next to the claims they support. Regulators can update registers and requirements after publication.
Editorial limits: CasinoIndex did not access the confidential leak, interview subjects, independently check every documentary scene or conduct real-money payout tests. The article offers general consumer information, not legal advice or a finding against any specific casino.
Maria Hoffmann has worked in cryptocurrency content and digital publishing since 2017. She is a co-founder of Freecoins24 and CryptoMutant and has covered blockchain projects, crypto platforms and emerging industry trends for several years. She has also been active as a cryptocurrency investor since 2019. At CasinoIndex, Maria combines content research and SEO experience with a focus on casino trust, platform security, withdrawal processes, payment risks and user protection. Her work looks beyond bonuses and product features to examine how gambling platforms handle player funds, verification and account-related risks.
