The licence arrives and most operators celebrate. Then, within a few days, the reality sets in.

There are reports to file, policies to maintain, a renewal to think about, and a regulator who expects to hear from you on a schedule you may not have fully read. Most compliance consultants hand over the licence and step away. That is where the problems start.

The post-licence period is where your relationship with the regulator actually begins. It is also where most first-time operators make their most expensive mistakes, not from bad intentions, but from not knowing what the clock started on the day the licence was issued.

Before You Take a Single Real-Money Bet

There are go-live obligations that must be completed before you open to players. These are not optional and they differ by jurisdiction.

MGA: Submit a Go-Live Declaration via LRMS at least 2 days before going live, and within 90 days of the licence date. That 90-day window is a hard deadline. If you do not go live within it, you must notify the MGA, and the licence may be reviewed. One important detail that catches operators out: the annual licence fee clock starts from the licence date, not from the day you go live. You are paying from the moment the licence is issued.

Curaçao: Register all domains on the CGA portal and activate the Green Seal before going live. Upload your AML policy to the CGA portal (required from May 2025 for all licensees). Activate goAML transaction monitoring from the first player transaction. Pay your first annual fee within 14 days of licence grant notification — the fee is pro-rated for Year 1, but the invoice arrives quickly and the deadline is firm.

Anjouan: Register all domains with ALSI. Your complaints and self-exclusion email address must be live and actively monitored before you open — it is publicly listed on the ALSI register and regulators check it. Your site seal must be displaying and linked to a working self-exclusion mechanism. Any self-exclusion request received must be reported to Anjouan Gaming within 1 working day. That clock starts from the moment the request arrives, not from when you notice it.

Monthly Obligations Most Operators Do Not See Coming

This is the section most operators wish someone had shown them earlier.

MGA has the heaviest monthly reporting cycle of the three jurisdictions. By the 20th of the month following each reporting period, B2C licensees must submit a Tax Report, a Player Funds Report (with supporting bank statement evidence), and an ADR Report. These are not optional and they are not forgiving. The first missed report typically generates a warning. The second attracts a fine. MGA penalties for reporting failures run from EUR 10,000 to EUR 500,000, with higher bands for repeat offenders.

Curaçao requires quarterly operational reports to the CGA portal. The monthly obligation is lighter than MGA, but ongoing requirements do not stop: transaction monitoring must be active at all times, STRs must be filed via goAML without delay on any confirmed suspicion, and your complaints inbox must be checked and responded to actively. The CGA adopted a formal player complaint reporting policy in June 2025, and licensees are required to submit aggregated complaint data periodically.

Anjouan has the lightest formal reporting burden. There is no confirmed mandatory monthly report cycle. But the obligations that do exist are time-sensitive: self-exclusion must be reported to Anjouan Gaming within 1 working day, STRs go to ABGB/ALSI on confirmation of suspicion, and any complaints that are not resolved internally within 30 days must be escalated to an ADR entity. ADR participation is mandatory for all Anjouan licensees.

Your Compliance Documents Are Not Set-and-Forget

You submitted an AML policy, a KYC procedure, and a responsible gaming policy to get the licence. Those documents need to be maintained as living records, not filed and forgotten.

For Curaçao: any material change to your AML policy must be uploaded to the CGA portal. The Operations Manual must be updated bi-annually or on material change, and you must be able to provide the current version to the regulator within 5 working days of a request.

For MGA: the policies you submitted form part of your System Documentation. They must remain current and consistent with how you actually operate. The MGA's System Review (MGA-F-020), which typically occurs after your first year of operation, will assess whether your live environment matches your declared documentation.

For Anjouan: ALSI expects a current AML policy on file and available. If your business changes materially, the policy needs to reflect that before the next regulatory interaction.

The policies you submitted to get the licence are version 0.1. Over time they need to become documents that describe how you actually operate, not how you planned to operate when you applied. The gap between those two things is where regulatory risk lives.

Renewal: Do Not Leave This Until the Last Month

MGA has a 10-year licence term with no annual renewal. Annual fees, compliance audits, and reporting continue throughout that term. Your first significant post-licence checkpoint is the Compliance Audit, which the MGA typically requires within 90 days of giving notice, after the first year of operation. This is conducted by an MGA-approved Authorised Service Provider and covers your live operational environment against your declared documentation.

Curaçao issues licences with no fixed expiry under the LOK, but annual fees must be paid by 15 January each year without fail. Two invoices arrive simultaneously: one to the National Treasury (EUR 24,490), one to the CGA (EUR 22,960). Missing either triggers a suspension process. There is no grace period. Set a calendar reminder in November to confirm both invoices have been received and paid by the deadline.

Anjouan licences run for 1 year. Start the renewal process 3 to 4 weeks before your expiry date. The process takes 5 to 10 business days with a complete document pack, but that assumes nothing needs chasing. At renewal you will need: updated KYC documents for all directors and UBOs dated within 90 days, updated policies if anything has changed, current RNG certificates, and a disclosure of any changes to your corporate structure, domains, or game providers. The renewal fee is EUR 13,300 to EUR 17,000 depending on your structure.

If there is any gap in your Anjouan licence, you lose the legal basis to operate for that period. Operators who start the renewal process in the final week regularly create exactly that gap.

Regulatory Changes Are Your Problem to Track

Nobody sends you a reminder when the rules change.

The Curaçao LOK came into force in December 2024. New T&C guidance came from the CGA in April 2026 with an October 2026 enforcement deadline. The MGA published a self-exclusion thematic review in February 2026, identifying gaps in cross-brand exclusion controls and Reality Check implementation. These are real changes with real deadlines, and licensees are expected to identify them and act on them.

This is the part of post-licence compliance that operators most frequently find themselves unprepared for. Applying for a licence is a project with a start and an end. Staying compliant is an ongoing process with no end date.

The Mistakes That Cost Operators Their Licence

Licence suspensions and revocations rarely happen because an operator did something deliberately wrong. They happen because of accumulation: a missed report, a policy that was never updated after a framework change, a renewal that started too late, a regulator query that went unanswered for three weeks because nobody owned the inbox.

The MGA published its enforcement actions publicly. Reading through them, the pattern is consistent. Operators who lose their licence or receive significant fines typically have a history of small compliance failures that individually might have been manageable, but together represent a picture of a business that is not taking its regulatory obligations seriously.

The regulator's job is not to catch you out. But it is also not to remind you of your own obligations. You are expected to know them, track them, and meet them without prompting. The operators who do that consistently rarely have regulatory problems. The operators who treat compliance as something to return to when they have time usually find that time runs out before they get there.

What Ongoing Compliance Support Looks Like

After licence issuance, ICOS offers a maintenance arrangement for operators who want this managed rather than tracked themselves.

It covers monitoring for regulatory updates across your active jurisdictions, flagging changes that require policy updates, managing annual renewals including document preparation and submission, drafting policy updates when the framework changes, filing monthly and quarterly reports for MGA and Curaçao, and responding to regulator information requests.

This uses the same AI-assisted model as the initial application work. The output is reviewed by a practitioner before anything is submitted. It keeps the cost at a level that is proportionate to where most early-stage operators actually are financially.

The licence is the beginning of the compliance relationship, not the end of it. What happens next is either managed proactively or managed reactively. The difference in cost between those two approaches, when something goes wrong, is significant.

If you have recently received your licence, or are about to, and want to know what ongoing compliance looks like at a fixed monthly cost, the intake form is the starting point.