The Kansspelautoriteit (KSA), the Dutch gambling regulator, has confirmed the extension of the CRUKS national self-exclusion database cross-check to foreign operators as of 1 January 2027. The rule change was published in the Staatscourant on Thursday and closes a gap that has drawn public criticism since CRUKS launched in October 2021.
Under the new rules, any operator that accepts a wager from a person located in the Netherlands must run the CRUKS cross-check before the bet is placed, regardless of where the operator is licensed. Non-compliance carries the same administrative fines as the existing rule for Dutch-licensed operators and, for foreign operators, adds a permanent inclusion on the KSA's payment-processor blacklist. That last point is where the real weight sits, and we explain why below.
Background on CRUKS and why the loophole existed
CRUKS, the Centraal Register Uitsluiting Kansspelen, is the Dutch central register that lets a person voluntarily self-exclude from all licensed gambling in the Netherlands for a minimum of six months. The register launched alongside the Remote Gambling Act (Wet KOA) that legalised online gambling in October 2021. Licensed operators must query CRUKS before accepting a deposit or a wager and, if the player is on the list, refuse the transaction.
The gap in the design was straightforward. Foreign operators without a KSA licence never signed the compliance framework, so they were never required to run the CRUKS check. A Dutch resident who had voluntarily self-excluded could open an account at an offshore casino targeting the Netherlands, deposit and play. Consumer groups estimated that between 4% and 9% of active CRUKS entries had at some point wagered at an offshore site during their exclusion period. The rule change closes that door.
How the enforcement will work
Payment providers Adyen, Trustly and iDEAL have all issued statements confirming that they will refuse settlement to foreign operators that cannot demonstrate CRUKS cross-check compliance. That is the enforcement teeth in practice: the fine is a theoretical liability against an offshore entity, but the loss of Dutch payment rails is a business-model breaker.
The KSA has also extended its "unrestrained" enforcement powers to include the ability to demand a technical audit of any operator's CRUKS integration, with 72 hours notice. Two foreign operators are already reported to be in preliminary discussions with the KSA about pre-January compliance testing. The audit itself is straightforward: the KSA requests a set of test BSN-linked identifiers and expects the operator to correctly reject the CRUKS-listed subset within a fixed response window.
The payment-rail lockdown that gives the rule its teeth
Understanding the enforcement mechanism matters, because the fine on its own would not shift operator behaviour. A KSA administrative fine against an offshore entity is difficult to collect. The payment-rail lockdown is a different animal, because it targets the settlement pipes rather than the operator's balance sheet.
The table below summarises which Dutch payment channels have committed to the blacklist enforcement and when their controls come online.
| Payment channel | Enforcement status | Effective from | What operators lose |
|---|---|---|---|
| iDEAL | Confirmed | 1 Jan 2027 | Dutch bank push payments |
| Adyen (card) | Confirmed | 1 Jan 2027 | Visa / Mastercard settlement in EUR |
| Trustly (Pay N Play) | Confirmed | 1 Jan 2027 | Bank-linked instant deposits |
| Klarna | Under review | Q2 2027 (indicative) | Buy-now-pay-later at cashier |
| Local e-wallets (Bunq, Revolut EU) | Announced compliance | 1 Jan 2027 | Domestic wallet top-ups |
The one gap that concerns consumer groups is crypto. Neither the KSA nor the payment schemes have jurisdiction over on-chain settlement, and the rule text is silent on stablecoin flows. In practice, foreign operators without banking rails will still be able to accept Dutch crypto deposits, but the friction is much higher than a click on iDEAL. Consumer groups have asked the KSA to add a further "crypto declaration" requirement for KSA-licensed operators, though nothing has been proposed formally.
What it means for Dutch players
For players not on the CRUKS list, nothing changes at the cashier. Deposits and withdrawals at licensed and grey-market foreign sites will work as they do today, subject to whatever operator-side KYC applies. There is no new consumer identification step, no BSN entry, no bank-verification detour on the way to a first deposit. The KSA integration runs behind the scenes.
For players who are on CRUKS, the closing of the offshore workaround is the point of the rule change. Public consultation responses on the rule change ran three-to-one in favour, with player protection groups and licensed operators aligned on the outcome. Licensed operators framed the rule as competitive parity, since they had been carrying the compliance cost that offshore operators were sidestepping.
What players on CRUKS will notice from 1 January 2027 is the same "self-exclusion active" refusal message they see at licensed sites, appearing at offshore sites that previously took their deposits without a check. The register itself is not visible to operators; they only receive a match / no-match response.
Operator readiness by market segment
Offshore operators fall into three groups when it comes to CRUKS readiness, and the three groups face very different levels of business disruption from the rule change.
| Operator category | Typical licence | Readiness status | Likely impact |
|---|---|---|---|
| MGA-licensed offshore | Malta Gaming Authority | Most integrating ahead of deadline | Low: keeps Dutch traffic with CRUKS on |
| Curaçao / Anjouan | Anjouan or Curaçao eGaming | Case-by-case, cost concerns | Medium: some will pull out of NL |
| Crypto-only offshore | Often minimal / self-declared | No banking rails to lose | Payment blacklist bites less |
| Grey-market unlicensed | None visible | Unlikely to comply | Effective exit from Dutch market |
The MGA-licensed set is the largest by traffic and the one most likely to complete integration before the deadline. Several major MGA operators already run CRUKS-style APIs in adjacent European markets, so plugging the KSA feed into an existing self-exclusion framework is a matter of weeks rather than months.
Compliance timeline and key dates
The KSA has published a compliance calendar that offshore operators are expected to follow. The dates are firm.
- 1 September 2026: KSA opens the technical documentation portal for foreign operators.
- 1 October 2026: Test-integration sandbox available, dummy BSN identifiers issued on request.
- 15 December 2026: Operator declarations of compliance intent due at the KSA.
- 1 January 2027: Rule takes effect; live enforcement begins.
- 1 April 2027: First scheduled audit cycle for early-declaring operators.
Penalties for non-compliance
The KSA has published a tiered penalty schedule. The base administrative fine for a single confirmed CRUKS-bypass wager is EUR 8,750, doubling for each subsequent confirmed instance in the same audit period. The maximum fine per audit cycle is capped at EUR 900,000 or 10% of Dutch-attributable turnover, whichever is higher. Payment-rail delisting is automatic on any confirmed non-compliance finding and is separate from the fine.
Operators can appeal a fine but not the payment-rail delisting, which is contractually enforced by the schemes themselves rather than by the KSA. In practice, the delisting is the sanction that changes behaviour.
What we will change on Keira
Our Dutch market pages currently flag whether an operator takes Dutch players and, separately, whether that operator holds a KSA licence. From 1 January 2027 we will also flag whether the operator has confirmed CRUKS integration compliance. The check will run on a rolling monthly basis, using published KSA audit reports as the primary source and operator self-declaration as a fallback.
Any operator continuing to accept Dutch stakes without CRUKS confirmation after the deadline will be dropped from our reviewed list for the Dutch audience. Our Dutch-language market pages, /nl/, will carry a visible compliance badge on the operator cards from December 2026, giving readers a single indicator to check before signing up.
Frequently asked questions
Do I have to do anything as a Dutch player?
No. If you are not on the CRUKS register, the change is invisible to you. If you are on CRUKS, the change means offshore sites will refuse your deposits from 1 January 2027, which is the intended outcome of the register.
Will offshore casinos actually integrate CRUKS?
The MGA-licensed segment almost certainly will, because losing Dutch payment rails is more expensive than the integration. Curaçao operators are split, and unlicensed grey-market sites are likely to exit rather than comply.
Does the rule apply to crypto deposits?
The rule applies to any wager accepted from a Dutch resident, regardless of funding method. The enforcement mechanism, however, runs mainly through banks and card schemes. Crypto flows sit outside the payment-rail lockdown, so real-world enforcement on pure-crypto sites is weaker.
How can I check whether a casino is CRUKS-compliant?
From 1 January 2027 the KSA will publish a public list of confirmed compliant foreign operators. Our Dutch market pages will carry a compliance badge on operator cards that reflects that list on a monthly refresh cycle.
Can I self-exclude with CRUKS if I only play at offshore sites?
Yes. CRUKS registration is done at the KSA and does not depend on any operator. From January 2027 the exclusion will actually reach the offshore sites you might play at, which was the missing piece for many people.
How long does CRUKS self-exclusion last?
The minimum period is six months and it cannot be shortened once set. Longer terms are available in six-month increments up to a maximum of ninety-nine years. The register does not accept "cool-off" style short periods precisely to protect the exclusion from impulse reversal.