Curaçao gives existing remote-KYC systems until May 2027 to meet liveness and audit rules

Curaçao has given existing remote-identification solutions a defined route to compliance rather than forcing an overnight replacement. Systems already operating when the provisions took effect can continue until 1 May 2027, provided the service provider has begun the necessary work and can demonstrate that progress to a supervisor.

Technology not yet implemented receives no equivalent grace period. A new solution must meet the provisions before it goes live. The distinction prevents the transition from becoming a general delay while recognising that redesigning identity flows, contracts, testing and audit records can take time.

The framework permits several remote methods, including identity-document scanning, videoconferencing and biometrics. It does not treat the appearance of a document on camera as proof by itself. Videoconferencing must include controls beyond visual inspection, and unattended systems must collect current images or video and test that a live person is present.

Document verification must be robust enough for the risk and supported by a recorded rationale. The provisions point to internationally recognised ISO, IEC and NIST frameworks rather than prescribing one commercial product. This gives providers technical flexibility, but it also requires them to explain why their chosen method is reliable.

Remote onboarding is not allowed to drift forward when the evidence is poor. If image quality, document checks or identity comparison do not provide adequate assurance, the process must stop and restart or the customer must be identified face to face. That rule matters because a frictionless journey is not compliant if uncertainty is simply passed downstream.

Before implementation, providers must assess the solution, test end to end and consider impersonation fraud. Ongoing monitoring then has to respond to changes and warning signals. The framework therefore treats identity as a continuing control, not a one-time photograph collected at registration.

The provisions require an audit trail, data protection, encryption and safeguards against incorrect acceptance. Cloud and outsourced arrangements do not remove the provider's responsibility. Annual penetration testing is expected for relevant cloud or outsourced systems, alongside monitoring for bias and performance limitations in automated tools.

For gaming licensees, those requirements reach beyond the compliance department. They influence onboarding design, abandonment rates, vendor selection, evidence retention and incident response. A system can be fast and still fail if the provider cannot reconstruct what it checked, which version of a model it used or why an exception was accepted.

The announcement came through the Curaçao Gaming Authority, but the legal scope covers service providers subject to the National Ordinance on Identification when Rendering Services. The Central Bank of Curaçao and Sint Maarten and FIU Curaçao are joint authors. Money-transfer companies are expressly outside this specific set of provisions.

That broader scope is important for the headline. Curaçao has not introduced a gaming-only biometric mandate, nor has it alleged that every operator's current KYC fails. It has set a common evidential standard for remote identification, with a hard deadline for legacy systems and immediate obligations for new ones.

The framework explains what a defensible process should contain, but the first inspection or decision will show how supervisors judge proportionality in a real deployment. Liveness quality, document coverage, false acceptance and the handling of failed checks are likely to become the decisive evidence.

Until then, the operational message is clear. Existing systems have a transition, not an exemption. New systems need compliance before launch. Any provider relying on remote identity checks should be able to show not only that a customer passed, but why the result deserved to be trusted.