This is the third and final post in our series on the Netherlands Gambling Authority (Kansspelautoriteit, KSA) tightened duty of care requirements for Dutch-licensed operators. Part one covered evidence-based income verification. Part two covered income calculation and exclusions. This post focuses on what ties it all together: real-time enforcement and the documentation trail that proves you got it right.

There’s a difference between having a compliant process and being able to prove it.

The first two posts in this series focused on what the KSA requires operators to do – verify income from evidence, not questionnaires; calculate net deposit limits correctly, excluding everything that must be excluded. This post is about what happens after: enforcing those limits in real time, and retaining a documentation trail that stands up when the regulator comes looking.

Unlike other regulators that rely on periodic audits or self-reported data, the KSA has built an infrastructure that lets it check your records whenever it wants.

The KSA’s control database: always-on oversight

Every Dutch-licensed operator is required to maintain a control database (CDB) – a dedicated data repository, physically or logically located in the Netherlands, that logs all gambling transactions, player sessions, and financial movements in near-real time. The KSA has 24/7 read access. They didn’t build a real-time oversight database to look at it occasionally.

In its February 2025 letter to operators, the KSA revealed that it had already used CDB data to identify operators who were allowing deposits after players had exceeded their net deposit limit. The regulator’s response was blunt: “This is not allowed. We have summoned these providers to immediately apply an automatic block after exceeding the net deposit limit.”

Then in July 2025, the KSA carried out a dedicated CDB data quality review and identified shortcomings across multiple licensed operators. A follow-up audit in October confirmed that corrections had been made – but the pattern is clear. The CDB is the KSA’s primary tool for real-time, data-driven supervision, and they’re actively using it.

For operators, this means every enforcement action you take – or fail to take – is visible to the regulator. A player exceeds their deposit limit and you don’t block them immediately? The CDB shows it. A bonus block that falls short of the mandatory 30 days? The CDB shows that too. A net deposit limit calculation that isn’t properly documented? The gap shows up the moment the KSA requests the file.

What the KSA requires on enforcement

The Financial Capacity Assessments: Duty of Care guidance sets out three specific enforcement obligations:

• Immediate deposit blocks. When a player’s net deposit limit is exceeded, operators must apply an automatic block immediately. Not at the end of the session, not at the next login – immediately. The KSA found that some operators were still allowing deposits after the limit had been breached, and has made clear this is explicitly non-compliant.

• Minimum 30-day bonus blocks. After a player exceeds their limit, operators must impose a bonus block for a minimum of 30 days. The KSA observed that some operators were imposing a bonus block only for the remainder of the calendar month – which could mean as little as a few days. This violates Article 6 of the Dutch Regulation on Recruitment, Advertising, and Addiction Prevention in Games of Chance. The minimum is 30 days, unless the player can demonstrate that they can bear the financial consequences of an increase.

• Documented and retained calculations. The calculation of the net deposit limit must be properly documented using supporting documentation and retained until the limit is adjusted based on more recent supporting documentation. The KSA’s own review of operator practices specifically noted that documentation is an area where they need to be able to verify the calculation. If they can’t, you have a problem.

Why this matters more in 2026 than ever

The first wave of five-year Dutch gambling licences, issued in October 2021, expires in October 2026. Every operator seeking renewal will undergo a full reassessment – including player protection measures, advertising policies, and a fresh integration test for the CDB.

Here’s the critical detail: the KSA has stated that any breaches or shortcomings over the past five years must be disclosed and explained. Operators must provide evidence showing how they have learned from mistakes to prevent recurrence. If the explanation is insufficient, the licence may be denied or additional conditions imposed.

Your enforcement track record isn’t just a compliance metric – it’s a licensing condition. An operator that can demonstrate a consistent, well-documented approach to deposit limit enforcement, affordability checks, and intervention measures is in a fundamentally stronger position than one that has to explain gaps, late blocks, or missing documentation.

The KSA designed the five-year licence system specifically so it could use supervisory experience to inform renewal decisions. Your conduct over the past five years will be assessed. The question is whether your documentation tells a good story or a bad one.

The gap between knowing and proving

Most operators understand the enforcement requirements. The challenge is operational: applying them consistently, in real time, across every player, and retaining a complete audit trail for each decision.

Think about what a compliant enforcement process actually requires in practice. A player’s net deposits approach or exceed their limit, and the system needs to block further deposits immediately. A bonus block of at least 30 days kicks in. If the player then requests an increase, a financial capacity assessment has to be conducted – based on verifiable supporting documents, with income correctly calculated and exclusions properly applied. That assessment, including the data sources, calculations, and outcome, needs to be documented and retained. And the documentation stays on file until the limit is next adjusted.

Each step needs to happen correctly and be provable. For an operator processing thousands of deposit limit events per month, this is a significant operational burden if it relies on manual processes. A compliance team that has to pull bank statements, interpret income data, apply exclusions, calculate the limit, document the rationale, and file the record – for every player who requests an increase – is a compliance team that’s either very large or very stretched.

And when the documentation isn’t complete, the operator can’t prove the process was followed. From the KSA’s perspective, that amounts to the same thing.

How real-time data changes the enforcement model

The enforcement challenges above share a common thread: they require speed, accuracy, and a complete audit trail, all at once. Manual processes can deliver one or two of these, but rarely all three.

This is where real-time financial intelligence via open banking changes the model. When affordability data is generated automatically at the point of payment – rather than assembled manually after a threshold is breached – the enforcement sequence becomes fundamentally different.

Instead of reacting to a limit breach and then scrambling to conduct an assessment, the operator already has a continuously updated affordability picture for every consented player. Income has been verified. Exclusions have been applied. The gambling-to-income ratio is calculated in real time, both on-platform and – because the data comes from the player’s bank feed – across other operators too, giving a fuller affordability picture than per-operator data alone. When a limit is approached, the system already has the data it needs to act.

The block is instant because the trigger is automated. The assessment is immediate because the data is already there. The documentation is complete because it was generated as part of the payment flow, not assembled after the fact.

How Yaspa handles enforcement and documentation in practice

Yaspa’s Intelligent Payments platform is built to close the gap between knowing what to do and being able to prove you did it. None of this requires a separate compliance tool or an additional step in the player journey – it’s embedded in the deposit flow for all consenting players making a deposit via Yaspa.

Here’s how each enforcement requirement is addressed:

• Continuous affordability signal. Yaspa calculates the gambling-to-income ratio in near-real-time, giving the operator a continuous signal to trigger automatic blocks the moment a per-operator limit is approached or breached. The pan-operator view adds a layer of context that per-operator data alone can’t provide.
• Supporting fresh assessments after a block. When a player requests a deposit limit increase following a block, the operator needs to conduct a financial capacity assessment based on current data. Yaspa can provide a fresh assessment from the player’s latest bank transaction data – verified income, correct exclusions, up-to-date gambling spend – without asking the player to submit a single document. If the existing consent is still active, the assessment resolves in seconds. If not, the player reconnects their bank – or links a different account if salary needs to be evidenced – and the assessment is just as fast.
• Auto-generated audit trail. Every assessment Yaspa produces is timestamped and documented automatically. The full data trail – open banking consent event, transaction data, income categorisation, exclusions applied, gambling-to-income ratio, and affordability output – is retained as a dated record. When the KSA requests the supporting documentation for a net deposit limit calculation, it’s already there: structured, complete, and regulator-ready.

Beyond the KSA’s specific enforcement requirements, Yaspa also provides:

• Downloadable virtual bank statements. A player’s bank statement (with categorised transactions) can be downloaded, giving compliance teams a ready-made supporting document that shows income, excluded categories, and gambling spend in a single view – no manual assembly required.
• Pan-operator visibility: seeing what per-operator limits miss. Current KSA rules apply net deposit limits on a per-operator basis. But a player’s true affordability picture doesn’t stop at your platform. Because Yaspa’s data comes from the player’s bank feed, it captures gambling activity across other operators too. A player who appears comfortably within limits on your site may be spending heavily elsewhere – context that strengthens your duty of care decisions and gives you a commercial edge that single-platform data can’t provide.

The result is an enforcement process that’s both faster and more defensible. Faster because the data is already there when a limit event occurs. More defensible because every step – the data, the calculation, the decision, the outcome – is documented from the moment it happens.

What a licence renewal file looks like with Yaspa

When the KSA reviews an operator’s conduct over the past five years as part of the licence renewal process, what they’re looking for is evidence of consistent, effective player protection. Not a perfect record – but a demonstrable commitment to getting it right, and evidence that the operator can prove it.

With Yaspa’s Intelligent Payments platform, the documentation trail for each player tells a clear story – from when consent was granted and what data was accessed, through how income was classified and which exclusions were applied, to how the operator responded to limit events and what changed when the player’s financial situation changed. Each assessment point is timestamped and retained, building a continuous record rather than a retrospective summary.

This isn’t a report assembled for the renewal application. It’s a record that builds itself as part of the payment flow. The same data that protects players in real time is the data that demonstrates compliance to the regulator.

Completing the picture

This series has covered three interconnected requirements: verifying income from evidence, calculating limits correctly, and enforcing those limits with a complete audit trail. They aren’t separate compliance tasks – they’re stages of a single process, and the KSA assesses them as such.

Yaspa’s Intelligent Payments platform addresses all three within the same integration. Income is verified at the point of deposit. Exclusions are applied automatically by Yaspa’s proprietary AI transaction categoriser. Enforcement signals are generated in real time. And the documentation is built into every step – no manual assembly, no gaps, no separate tool.

For Dutch operators preparing for the KSA’s tightened oversight and the October 2026 licence renewals, the question isn’t whether your processes meet the standard. It’s whether you can prove they do.

To see how Yaspa’s Intelligent Payments platform works for the Dutch market, talk to one of our experts.

Read the full series: Part one – Evidence-based income verification | Part two – Income calculation and exclusions

Yaspa is an FCA-authorised open banking payment provider, operating across Europe. Our Intelligent Payments platform combines instant Pay by Bank deposits with AI-powered financial intelligence for iGaming operators. Learn more about Intelligent Payments.