Offshore gambling licensing exists to produce a piece of paper that says an operator is supervised somewhere. The Casino Secrets leak, reported by the Guardian with Follow the Money, is the first look at what that supervision consists of: tens of thousands of files held by the Curaçao Gaming Authority, published after a security researcher obtained access to the regulator’s own licensing portal. The filings set out who supposedly owns some of the largest online casinos in the world, where their money came from — and, in several cases, how little of that the regulator checked before issuing a licence.
Curaçao licenses more than 8,000 online casinos: roughly one for every 20 people on the island. Its licensing regime was for years the default stamp for operators who did not want a European or American licence, and the regulatory value it sold was, in effect, distance. The files show what that distance contains.
What the leak shows
Berlin-based researcher Lilith Wittmann says she obtained the documents by getting into the CGA’s portal. The regulator confirms it was subject to “unauthorised access” and calls the matter an “ongoing, complex forensic matter.” Per the consortium’s reporting, Wittmann registered as a trust-office manager on behalf of a fictitious foundation using a personal email address, was granted access within days, and remained in the system about nine months. The material she extracted includes licence applications, ownership declarations, regulatory assessments — and the underlying documents: passports, tax records, financial statements.
There is an irony worth stating plainly. The paperwork that offshore licensing requires is the most sensitive data an operator’s beneficial owners will ever hand over. It was available for nine months to someone who asked for it convincingly.
Ownership on paper, and the money behind it
The filings name the declared owners of some of the biggest brands. Stake.com’s Curaçao company, Medium Rare NV, listed Serbian national Mladen Vučković as owner, declaring assets of more than $1bn in 2024. Auditors for the regulator questioned whether he alone controlled the business after finding millions of dollars flowing to companies tied to Stake’s founders, Ed Craven and Bijan Tehrani — neither of whom appears on the licence application. The CGA issued the licence anyway. That sequence — red flag observed, licence granted — is the part of the story that travels, and Follow the Money reports it was not the only instance.
The Santeda network is the other thread. Santeda’s filing to the CGA names Georgian businessman Onise Chimakhidze as owner and gives Upgaming email addresses as contact details, with a cache of documents referring to Upgaming in their filenames. Upgaming’s lawyers deny operating the Santeda network — as they did when the Guardian and Investigate Europe first traced the digital paper trail in April — and say they cannot speculate about why a third party listed their contacts, describing the scrutiny as a campaign by “various parties, including with vested commercial interests of their own.” A 2025 filing names Tornike Kapanadze as Santeda’s finance chief, matching a LinkedIn profile at Upgaming; the lawyers point to the spelling difference and note the name is common in Georgia. Santeda also extended six loans totalling €15.59m to Buda Capital in Luxembourg, owned by Georgians who hold stakes in, or direct, Upgaming. Upgaming offered no explanation for the loans.
None of this is proof of a criminal enterprise. It is a demonstration that the ownership disclosures an offshore regulator collects can be answered with an entity that does not match the money moving behind the brand, and that the licence still issues.
Who bears the cost
The point of the arrangement is not that Curaçao has bad gambling. It is that the licence lets an operator keep selling into markets where it is not allowed to sell — and where the harm lands on the consumer protections of those markets.
The same network the files describe was the subject of the Guardian’s April investigation, which found casinos owned by Santeda appeared to have targeted vulnerable UK gamblers who had joined GAMSTOP, the national self-exclusion scheme, despite holding no Gambling Commission licence. Accepting UK bets without one is an offence under the Gambling Act 2005. BC.Game, a Leicester City sponsor that appears in the files, has previously been accused of taking UK customers after giving up its licence to do so. Oddsbet — a bookmaker built around “VIP” gamblers and, per the filings, owned until 2025 by Robert Bostock of Goole — declared the source of its owner’s funds as “long-term crypto currency investments” and a £100,000 loan from another UK person; lawyers for Bostock say the loan was never drawn and the business only served customers outside the UK.
The regulator’s answers so far are narrow. The CGA says it cannot discuss an active forensic matter, says it is “committed to transparency,” and promises updates. The UK Gambling Commission, which has no jurisdiction over a Curaçao licence, declined to comment on the leak and restated that illegal gambling activity is “a threat that we take seriously.”
That split — a regulator with the power to license and no interest in following the money, and a regulator with the interest and no power over the licensee — is the mechanism the documents expose. Gambling policy debates in the US and UK have moved toward advertising restrictions, deposit limits and self-exclusion registries, all of which assume the operator is subject to whoever is restricting it. The Curaçao files describe the other half of the market, where the operator’s only visible obligation is the licence itself.