Dutch online gambling licence renewals: what the KSA now tests

On 17 September 2026 the Kansspelautoriteit granted the first eight follow-up licences (vervolgvergunningen) for online gambling in the Netherlands. The licences that opened the regulated market in 2021 expire at the end of September 2026, and the replacement licences run from October 2026 to the end of September 2031. The KSA said the new round is not a formality: for the first time it explicitly assessed the violations it had definitively established against an applicant in the past five years, required each applicant to explain what it had done to remedy them and prevent repetition, and left some providers with “additional points of attention.” All eight providers met the requirements for a licence.

Executive takeaway: treat a Dutch follow-up licence as a fresh, evidence-backed assessment of the last five years of conduct, not an administrative rollover. Reconstruct the remediation file from the regulator’s own enforcement record, treat the exit plan as a systems and data-continuity deliverable rather than a legal annex, and expect previous Dutch penalties to be weighed as “supervisory experience” under Paragraph 20 of the BRVKOA 2026 policy rules.

Who received the first eight renewals

The KSA named the eight holders and the legal entities behind them, and published each licence document.

Legal entity	Brand(s)
TOTO Online B.V.	TOTO, Winnitt
Holland Casino N.V.	Holland Casino Online
Play North Limited	Kansino
FPO Nederland B.V.	FairPlay Casino
Bingoal Nederland B.V.	Bingoal
Hillside (New Media Malta) Plc	Bet365
NSUS Malta Limited	GG Poker
Betent B.V.	Betcity

The statement does not say how many applications it received, which providers were refused or remain pending, or which providers received the additional points of attention. GEN infers none of those facts. The statement’s only assessment conclusion is that all eight named providers meet the requirements for a licence.

The renewal is an assessment of conduct

The change that matters sits in Paragraph 20 of the BRVKOA 2026 policy rules (Beleidsregels vergunningverlening kansspelen op afstand 2026), which took effect on 1 January 2026 and replaced the 2023 rules. Paragraph 20 exists specifically for an applicant the regulator already supervises.

• Article 20.1 requires the applicant to file a document describing the concrete measures it took for every violation of the remote-gambling rules the board has spoken to it about. The document must show the operator’s concrete learning capacity and expertise applied inside the organisation after supervision, and how it prevents the same or similar violations from recurring.
• Article 20.2 requires the board to weigh its supervisory experience with the applicant, and frames the purpose of that weighing: to decide whether to refuse the licence, grant it under restrictions, attach one or more special conditions, or apply more targeted supervision after grant.
• Article 20.3 lists what may be weighed: sanctions under section 5:2 of the General Administrative Law Act — an administrative fine, an order subject to a periodic penalty, or an order subject to administrative coercion — plus other measures such as a warning, a summons, a (binding) instruction, a norm-setting conversation, a proposed sanction that did not become final, and correspondence about the establishment of a violation.
• Article 20.4 allows equivalent sanctions and measures imposed by foreign gambling regulators to be taken into account.
• Article 20.5 sets the contextual factors: the seriousness and culpability of the underlying conduct, the operator’s attitude towards the sanction or measure, earlier sanctions for the same or similar conduct, and the time elapsed since both the conduct and the sanction.

The practical consequence is that a Dutch fine or order issued in 2022 or 2023 is not a closed cost. Under the new rules it is an input to a 2026 licensing decision, and the operator is the one expected to produce the learning-and-prevention document. An operator that treated past enforcement as a cost of doing business has been building a file it may now have to answer for.

Two boundaries matter. First, “supervisory experience” is not limited to final sanctions. A warning, a summons, an instruction or even a proposed sanction that did not become final can be weighed, so an operator cannot assume that only formal penalties count. Second, the KSA did not name which of the eight received additional points of attention, and it did not publish the points. A constraint that is not published is still a condition on the licence, and it is discoverable to the licensee long before it is discoverable to the market.

The exit plan is now part of the application

Article 2.4 of the BRVKOA 2026 requires every applicant to file an exit plan describing how it would wind down its gambling offering, whenever and for whatever reason the licence ends. The KSA states the exit plan is a new requirement for applications submitted from 1 January 2026, that its legal basis is Article 31a of the Gambling Act, and that a condition about having and following an exit plan is added to the model licence.

Article 2.4(3) sets out what the plan must cover at least:

• legal, financial, tax, organisational, technical and communication aspects of winding down, particularly towards former players and the KSA;
• how the operator documents and completes all obligations fully and on time;
• how it stays reachable for former players and the KSA, including a named contact for the wind-down and how its details are published;
• how it settles and pays out player balances, and what it will do if a balance cannot be repaid through the player’s action or omission despite its efforts — the KSA references the Consignatiekas (the public deposit fund) and similar provision; and
• how it will meet the control-database (CDB) obligations and retention periods on wind-down, under Article 4.13 of the Remote Gambling Regulation.

The KSA’s own guidance adds the operational detail: the operator must report an approaching wind-down to the KSA at least 72 hours before the exit plan takes effect, and must keep control-database data for 12 months, keep the CDB accessible to the parties named in Article 5.3(3) of the Remote Gambling Decree, protect it against loss and re-identification, transfer it securely, and — the fallback clause — set out how the KSA obtains the CDB data if the operator can no longer guarantee its integrity or availability. The KSA describes that handover as an emergency provision, not a routine control, and says it will recover the cost from the licensee or the estate.

For a technical team, that turns the exit plan into a data-continuity requirement. Someone has to own the CDB retention clock, the access model, the export format and the fallback path, and be able to demonstrate them — not merely write them into a PDF.

The route for existing holders re-tests the whole licence

Article 2.2 creates a dedicated application procedure for existing licence holders. Under it, the holder declares, per component of the application, that it meets all applicable rules, rather than resubmitting everything. That shortcut is not available where a relevant change was not notified to the board, or where the holder cannot truthfully make the declaration for a component; in those cases the full documents must be supplied. Article 2.3 requires the forms and supporting documents in Dutch. Article 3.2 makes the reliability assessment lean on data already supplied with the current licence or under the change-notification duty.

This is why the renewal is best read as a re-test of the whole control set, not just of conduct. The BRVKOA 2026 attaches a holder-specific application article to nearly every control area:

BRVKOA 2026 area	Holder article	What the renewal re-tests
Information duty	2.5	The document evidencing how the remote-gambling information duty is met
Integrity policy	4.3	The integrity policy and the money-laundering risk analysis
Continuity	5.3	Continuity declarations and confirmation
Payment transactions	6.2	The safe-processing controls for payments
Player balances	7.7	The provision that safeguards player balances
Financial security	8.2	The financial-security arrangement
Anti-money-laundering	9.4	AML policy, customer due diligence and unusual-transaction reporting
Outsourcing	11.3	The outsourcing policy and third-party controls
CRUKS	12.2	Connection to the central self-exclusion register
Internal supervision	14.2	The internal-supervision system
Control database	15.3	CDB assessment and test programme
Game system	16.2	The approved game system and its review

An operator that only updates the documents that changed since 2021 is likely to miss the point. The declared components are the ones the regulator can challenge, and a false or unavailable declaration switches the application back to full evidence.

What this means for operators, platforms and payment teams

Operators own the remediation file. It should be assembled from the regulator’s own record — every warning, instruction, penalty and correspondence — with the measure taken, the owner, the system changed and the evidence that the failure cannot recur. That is a compliance-engineering deliverable, not a legal letter.

Platform and CDB suppliers should be able to demonstrate CDB retention, access, export and fallback behaviour as a product feature. If the platform holds the control-database records, the exit plan cannot be completed without the supplier’s cooperation, so the exit and data-continuity clauses belong in the platform contract and the platform RFP evidence set.

Payment teams carry the player-balance obligation on wind-down. The exit plan has to state how balances are paid out efficiently and how failed repayments are documented, which is a reconciliation and reporting problem before it is a policy problem; GEN’s wallet reconciliation guide covers the failure paths.

Responsible-gambling and identity teams should expect the CRUKS connection (Article 12.1/12.2) and the player-protection documents to be re-declared, since these are exactly the areas where Dutch enforcement has been most active.

Aggregators and white-label providers should not assume the operator’s renewal covers them. Where the control database, the game system or the payment flow is supplied, the obligations under Articles 15.3, 16.2 and 6.2 still have to be evidenced by the licensed entity.

A five-step readiness sequence

1. Reconstruct: pull the complete Dutch supervisory record for the entity and every group entity in scope, including warnings, instructions and proposed sanctions.
2. Remediate: for each item, state the measure taken, the control changed, the owner, and the test or evidence that shows recurrence is prevented.
3. Declare: map every BRVKOA 2026 component to a truthful declaration, and flag the ones that cannot be declared so full documents are prepared.
4. Plan the exit: build the exit plan around the CDB retention and fallback path, the 72-hour notification, and the player-balance payout and reconciliation.
5. Evidence: keep the assembled file version-controlled and re-verified before each application or licence-condition review, not assembled once.

Frequently asked questions

Is a Dutch online licence renewed automatically?

No. A follow-up licence is a new application assessed under the BRVKOA 2026, and for existing holders it follows the Article 2.2 procedure for licence holders. The KSA weighs five years of supervisory experience and can refuse the licence, grant it under restrictions, attach special conditions or apply more targeted supervision.

What is the KSA exit plan?

It is a document every applicant must file under Article 2.4 of the BRVKOA 2026 describing how the gambling offering would be wound down. It covers legal, financial, tax, organisational, technical and communication aspects, player-balance payout, a named wind-down contact and the control-database retention and handover duties. The KSA states it is a new requirement for applications submitted from 1 January 2026.

Which violations does the KSA consider?

Under Article 20.3 the board considers sanctions under section 5:2 of the General Administrative Law Act — administrative fines, orders subject to a penalty and orders subject to administrative coercion — and other measures including warnings, summonses, instructions, norm-setting conversations, proposed sanctions that did not become final, and correspondence establishing a violation. Article 20.5 adds contextual factors such as seriousness, culpability, attitude and elapsed time.

Did any of the eight providers fail?

The KSA’s statement says all eight providers meet the requirements for obtaining a licence. It does not identify which providers received additional points of attention, and it does not disclose the number of applications, refusals or pending cases. GEN makes no finding about any named provider’s conduct or licence conditions.

Is this the whole 2021 cohort?

No. The statement covers the first eight follow-up licences. The remaining 2021 licences run to the end of September 2026, so the second tranche and any non-renewals are a separate, later disclosure.

The decision rule

A Dutch follow-up licence is now a conduct test with a data-continuity tail. Assume the regulator will read its own five-year record, build the remediation document from that record rather than from memory, treat the exit plan and the control database as engineering deliverables, and declare nothing you cannot evidence. The eight holders that cleared the first tranche met the bar; the harder question for every other operator in the cohort is how much of its own supervisory history it can answer for.