Ksa acts after Cruks registrants used other people's ID to enter Dutch gambling venues

The Kansspelautoriteit says people registered in the Netherlands' Cruks self-exclusion system were able to enter gambling halls and casinos by using identity fraud. Its 3 September response followed a PowNews investigation and says at least one excluded person entered a venue with somebody else's identity document.

The regulator draws a precise technical boundary. Cruks worked when a visitor identified with their own document. If staff accept a document belonging to another person, the register checks the identity on that document rather than discovering the real visitor's exclusion. A correct database result cannot repair a false identity match at the entrance.

Ksa guidance requires a venue to establish the player's identity and check Cruks every time the person enters. On a first visit, staff must see an original valid document. If the photo, age or other details create doubt, the guidance says the visitor must not be admitted.

The same principle applies to membership or loyalty cards used on repeat visits. A unique identifier must belong to one player, and venues need technical and organisational measures that stop another person using it. The guidance specifically lists borrowed cards, forged documents and another person's ID among known failure patterns.

The regulator says it is taking action towards the gambling halls and casinos named in the programme. The public response does not name them, count the entries or identify a formal enforcement measure. No fine, warning, licence condition or closure order appears in the two official sources reviewed for this file.

That means the event is developing. The Ksa has acknowledged a serious signal and a control failure that should not have happened, but the next document must establish which venue did what, whether the regulator confirms a breach and how the operator responds.

A system outage prevents or disrupts the register query. The reported route here is different: the query can complete against the wrong person's identity. Describing the event as Cruks failing would therefore place the defect in the wrong part of the process.

For venue operators, the practical lesson is that access control cannot be reduced to receiving a green answer from software. Staff training, photo comparison, escalation when details do not match and controls around repeat-visit identifiers are part of the same protective chain.

The Ksa has enough information to approach the venues shown in the investigation. A later inspection result or sanction should identify the legal entity, site, failed control, evidence period and required remediation. A venue response would add the operator's explanation and any corrective action.

Until then, the supported conclusion is narrow but important: excluded people reportedly bypassed entry controls through identity misuse, the regulator says the Cruks check itself worked for the identity presented, and venue-level enforcement outcomes remain pending.