Gambling not on GamStop means an operator outside the British self-exclusion scheme, almost always because it holds no Gambling Commission licence. It sits outside UK protection and outside the 0808 8020 133 safety net. The regulator's answer is disruption rather than arrest: 3,140 cease and desist and disruption notices since April 2024.
The phrase gambling not on GamStop sounds like a loophole. It is really a description of a gap in the law's reach, and the gap is the interesting part. Any online casino licensed in Great Britain must be in the national self-exclusion scheme — that is Licence Conditions and Codes of Practice provision 3.5.5, in force since 31 March 2020 — so a site that is not in it is, by definition, not licensed here. There is no third category of operator. When people ask what gambling sites are not on GamStop, the honest answer is: sites the Gambling Commission has no power to licence, no power to fine and no power to close, only the power to make difficult to find. I have watched that distinction get lost in the marketing fog for years. This page is about the other half of the story, the half that rarely makes it onto the comparison sites: how a licence outside Britain works, what the regulator is doing about it as of 13.11.2026, and why the disruption numbers are the most useful thing on this page.
Shortly after GamStop launched in April 2018, a colleague told me the scheme would simply push the determined punter offshore. It has pushed a small slice of one, and the size of that slice is now measured quarterly by the regulator itself. What follows is what those measurements show, and what they do not.
Table of Contents9
- What the Regulator Does About Sites Outside the Scheme
- How a Licence Outside Britain Compares With a British One
- Sites That Delay on Purpose
- Identity Checks and What Actually Happens
- Five Signs a Site Can Be Trusted
- How to Check a Site Outside the Scheme
- What the Disruption Numbers Say About the Market
- Questions About Sites Outside the Scheme
- The Gap Doesn't Close, It Just Gets Shorter
What the Regulator Does About Sites Outside the Scheme
The Gambling Commission cannot prosecute a company in Curaçao, so it does the next most useful things instead: it asks, it blocks, it delists.
The legal position, stated early. It is illegal under section 33 of the Gambling Act 2005 to provide facilities for gambling without an operating licence, and that section applies to remote gambling if at least one piece of remote gambling equipment used is situated in Great Britain — and, under the post-2014 wording, if the person providing the facilities knows or should know that they are being used, or are likely to be used, here. The offence is the operator's, not the customer's. The Commission has said plainly that offering commercial gambling services to consumers in Great Britain without a Commission licence is illegal, including where the operator holds a licence somewhere else.
The scheme itself. GamStop — often typed "gamestop", which is the single most common spelling slip in this niche — blocks a person from signing up for or using online accounts with gambling companies licensed in Great Britain for six months, one year, five years, or five years with auto-renewal. A registration cannot be cancelled during the exclusion period, and the exclusion stays in place after the chosen period ends unless the person contacts GamStop to remove it. If they do not, the scheme holds the data through a further automatic seven-year self-exclusion period during which operators are told they were previously excluded. An offshore site is never a way round this. It is a way round the operator's obligation to check, which is a different thing and a worse one.
The disruption toolkit. Since April 2024 the Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 C&Ds, 774 registrar referrals, 402 host referrals and three payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs and secured 287,961 removals. Across 160 illegal gambling websites for which traffic data existed, engagement fell by an average of 32 per cent after disruption. By method, registrar blocks and website suspensions produced the largest average falls at 91 per cent each, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. That ordering is the single most instructive number the regulator publishes, because the weakest tools are the ones an ordinary player notices most.
The most recent quarter. Between July and September 2026 the Commission referred 1,835 websites to search engines — 7,677,211 URLs — and issued 546 cease and desist notices. In April to June 2026 it began zero criminal investigations; across April 2025 to March 2026 every quarter recorded zero or one prosecution commenced, one in total, in the quarter to December 2025.
One benchmark, from the regulator's own dashboard. The Commission recorded 586 illegal gambling websites accessible to GB consumers in September 2026 — 4 per cent fewer than the previous three-month average and 4 per cent more than in September 2025. In the same release it reported that 311 illegal gambling websites had disruption action taken against them in Quarter 2 of 2026 to 2027, 38 per cent more than the previous quarter, and that 77 per cent of disrupted websites saw a reduction in estimated traffic. That is the whole enforcement story in three figures: the population is roughly flat, the effort is rising fast, and the effort works three times in four.
I think the fairest reading is that search removal is a nuisance tax, not a wall. It makes a site harder to find without making it hard to reach, and the Commission says as much itself.
How a Licence Outside Britain Compares With a British One
British-licensed operators are the benchmark: every one of them must participate in the national self-exclusion scheme, must check its entire customer base for self-excluded people at least every 24 hours, may not accept credit cards, must cap slot stakes at £5 (£2 for 18 to 24s), must cap bonus wagering at ten times, and must not impose any maximum limit on what a customer can withdraw from their deposit balance. Offshore regulators impose none of that as a package. What they impose instead varies enormously, which is why licence shopping is the industry's oldest sport.
| Licence and where it sits | Cost and term | Self-exclusion | Dispute route and its clock | What it buys a player |
|---|---|---|---|---|
| Great Britain (Gambling Commission) | Licence conditions attach to every operating licence; the statutory levy runs at 1.1 per cent of previous-year gross gambling yield for online operators | Mandatory participation in the national scheme; customer base checked at least every 24 hours | ADR free of charge if unresolved after eight weeks; ADR providers record roughly 20 to 31 days to resolve domestic disputes | The full UK rulebook: £5 slot stake cap, 10× wagering cap, credit card ban, no cap on withdrawals from deposit balance |
| Curaçao (CGA under the LOK) | Application fee €4,592 one-time, non-refundable; total annual fee €47,450 payable by 15 January; supplier registration fully mandatory from 24 December 2026 | Not covered | Licence-holder terms, not a UK-style ADR scheme | A real authority since 24 December 2024, but a portal that is not returning to service and a seal system under transition |
| Anjouan (Gaming Authority) | €17,828 for issuance and €17,828 annually, one-time and renewal both; €500 per additional domain | Not covered | Authority-approved ADR: EGIS ADR, Axion ADR, iGaming ADR or an operator-appointed provider; operator has 30 days to resolve first | Published standards on segregated player funds, certified RNGs and AML controls — on the regulator's own site, at least |
| Kahnawà:ke (KGC) | CPA application fee rising from US$35,000 to US$40,000 on 1 January 2027, with a US$20,000 annual fee | A voluntary self-exclusion that the Commission describes as permanent and irrevocable | A full-time Dispute Resolution Officer; the Commission's logo generates a Certificate of Good Standing | The oldest interactive-gaming regime in this table, since 1999, plus a rule that breaching a self-exclusion forfeits funds to charity |
| Costa Rica (no regime) | No licence to buy | Not covered | None | Nothing. The Legislative Assembly rejected the bill that would have created a mandatory licensing regime in early 2026 |
One column deserves a second look. In the UK, a self-excluded customer's account must be closed and the funds returned — the LCCP says it is not sufficient merely to prevent withdrawal while still accepting wagers. In Kahnawà:ke, a player who breaches a self-exclusion prohibition forfeits funds deposited or won to a charity chosen by the Commission. Both are serious. Only one of them is enforceable by a body that answered a public complaint this decade.
Sites That Delay on Purpose
The most sophisticated offshore terms are not the ones with the biggest wagering multipliers. They are the ones that build in delay. A term permitting only one withdrawal request at a time, with no second request until the first is authorised, is a delay machine dressed as housekeeping — and the UK regulator has already found exactly that term unfair under the Consumer Rights Act 2015, in a regulatory settlement of £900,000 announced on 21 October 2026, alongside a finding that manually reviewing every fifth or tenth withdrawal for some customers led to extra information being required before processing. Offshore versions of the same clause usually add a maximum cashout expressed as a percentage of the bonus, a maximum bet of 20 per cent of the deposited amount, and a list of prohibited play patterns that the operator alone decides the player has breached.
British rules point the other way, and it is worth knowing precisely how. LCCP licence condition 17.1.1 states that a customer's withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier — while expressly preserving requests it must make at that moment under anti-money-laundering law. Condition 17.2 forbids confiscating funds because identity has not been provided; the CMA's position is that consumers are legally entitled to deposited money, to winnings from money deposited and gambled, and to bonus winnings where conditions are met. Reverse withdrawals — the option to cancel a withdrawal request — have been banned under RTS 14B since 31 October 2021, though the ban binds only operators the Commission licenses.
And the delay is measurable, because it has been measured. Commission data for June to September 2024 covers 44.2 million withdrawals by customers of large online operators: 96.3 per cent cleared automatically, 3.5 per cent within 24 hours, 0.1 per cent up to 48 hours. Complaints coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025 — falling, but still the number one topic consumers raise. Which authority would a player call about a stuck withdrawal from a site outside the scheme? None, is the short answer.
Identity Checks and What Actually Happens
Identity is where the offshore pitch gets its traction, so it pays to be exact about what a licence buys.
The first time. Under LCCP licence condition 17, a licensed operator must obtain and verify information establishing a customer's identity before that customer is permitted to gamble. The Commission's expectation, restated in August 2026, is that those checks come before a deposit or a stake, not after — and that onboarding on initials instead of full names, nicknames or commercial addresses is not sufficient. In practice many operators identify at registration and match the customer against credit reference agencies, the electoral roll or similar databases, in which case no documents are asked for at all. Under the anti-money-laundering Regulations, a remote casino must identify and verify when deposits or withdrawals reach €2,000, and transactions that "appear to be linked" count towards that threshold together — same game, same session, or the same logged-on period. That is the "hybrid approach" the Commission describes.
Later, and the trap. The trap is a withdrawal request that suddenly produces a demand for a passport photograph. Condition 17.1.1 was written to stop exactly that, and research reinforces why it matters: in August 2026 the Commission reported that over a quarter of complaints reaching its Contact Centre concern identity verification — a concern customers raise when documents are demanded only on withdrawal — and it has flagged concern about third-party providers using "fuzzy matching" to onboard customers on partial verification. One paper-thin check has a second consequence that rarely gets mentioned. Onboarding a customer using a middle name instead of a forename creates mismatches with records held elsewhere, including GamStop, which undermines the self-exclusion that person believed was ironclad.
The warning signs. A demand for documents on the first withdrawal, if none was needed to deposit. A cashout limit that appears nowhere in the headline offer. A maximum bet while wagering that is a fifth of what was deposited. A verification requirement that arrives with a countdown attached. And a term reserving the operator's sole discretion to void winnings — which the Commission's guidance treats as unfair under the Consumer Rights Act 2015, full stop.
Where help is, and is not. The National Gambling Helpline is operated by GamCare, free, on 0808 8020 133, 24 hours a day, every day of the year; in Wales the number given is 0808 2819 265. BeGambleAware is the public face of the charity GambleAware and points to the same line. GamFam supports families, Gamblers Anonymous England, Wales & Ulster runs around 250 meeting locations on 0330 094 0322, Gam-Anon supports the friends and family of compulsive gamblers whether or not the gambler attends, and the NHS National Gambling Clinic in London takes self-referrals. Not one of those bodies has any leverage over an operator outside the scheme, which is the point worth taking away.
Five Signs a Site Can Be Trusted
These apply to any operator, licensed or not. The first three take two minutes.
The licence check
Look for a claim of a Gambling Commission licence, then click through to the Commission's public register and check that the operator's name and the domain you are on both appear. The Commission's own advice is to do exactly that: see whether the site's activities and domain names match. A licence number with no working link to a register is decoration. If the seal shown belongs to another regulator, read the terms underneath it — a Curaçao Certificate of Operation Seal must redirect to the CGA's verification domain, and if the certificate behind it displays a different site's domain, that certificate belongs to somebody else.
The self-exclusion clause
Find the term about self-exclusion and read what happens to a balance. Under the LCCP, a licensed operator must close the account of a self-excluded individual and return the funds held — preventing withdrawal while still accepting wagers is expressly not enough. A site whose terms say a self-excluded player's balance is void has told you what it thinks of the scheme. Try to check it from outside: a legitimate operator checks its customer base for self-excluded people, and registered people are also protected from direct marketing.
The withdrawal terms
Read the withdrawal page before the bonus page. A prohibition on more than one withdrawal request at a time is a delay; the UK watchdog has already found that term unfair under the Consumer Rights Act 2015. Look for a maximum cashout clause, a cap on deposits, winnings or bonuses withdrawable, and any monthly or weekly ceiling. UK guidance forbids any maximum limit on what a consumer may withdraw from their deposit balance, and gives "You may withdraw up to £50 per day and up to £500 per week" as its example of a prohibited term.
The complaint route
A licensed operator must let a customer refer an unresolved dispute to an approved alternative dispute resolution provider, free of charge, if it is not settled within eight weeks — and must have dealt with it internally first. Check the provider is on the Commission's approved list rather than trusting the name in the footer, and check the clock: providers generally require submission within not less than 12 months of the operator's notice that it could not resolve the complaint, and eCOGRA may refuse a dispute that arose more than a year ago. Offshore, an Anjouan-licensed operator must name an approved ADR provider and resolve complaints within 30 days first. A site with no named provider listed to a regulator at all has no dispute route except goodwill.
The customer funds disclosure
A remote operator holding customer funds must keep them in a separate client bank account, must choose one of three insolvency ratings — not protected, medium protection or high protection — and must state in its terms which one applies. A "not protected" operator must remind customers every six months that their funds are not protected in the event of insolvency, with the value held. The sting: a separate client account does not mean the money comes back if the business fails, and operators may legally hold customer funds in overseas bank accounts.
How to Check a Site Outside the Scheme
Six steps, ordinary and lawful. Each one exists because the obvious version of the check fails in a specific way.
- Verify the licence claim against the regulator's own register, not the site's badge. Seals are images; registers are records. If the operator holds a Curaçao licence, click the Certificate of Operation Seal and confirm it redirects to the CGA's verification domain, then confirm the certificate displayed shows the domain you are on. Legitimate Curaçao operators have been sent a searchable public-register link for exactly this purpose.
- Read the self-exclusion clause in full, including the data retention sentence. A term that voids a self-excluded player's balance is the clearest signal you will get, and it usually sits in the same section as the abandonment clause. Remember that a registration in Britain holds for its full term and then stays in place until the person contacts GamStop to remove it — a fact about the scheme, not a recommendation about operators.
- Calculate the real cost of the bonus before claiming anything. Multiply the wagering requirement by the bonus, then apply the game-weighting table: slots at 100 per cent covers a 25× requirement in a quarter of the hands that a 10 per cent blackjack contribution would. A wagering requirement expressed as a multiple of bonus plus deposit is not the same offer as one expressed on the bonus alone, even when the headline multiplier is identical.
- Confirm the payment rails before you need them. The Commission received its first referral to Visa in January 2025 after a test purchase on an unlicensed website and has since made three more; card schemes and banks decline payments to merchants categorised under gambling MCC codes. Bank blocks are applied at card level, so each card needs switching on, and most banks impose a 48- or 72-hour cooling-off period before gambling transactions resume.
- Test the complaint route before you use it. One question to a site's support desk about its ADR provider tells you whether one is contractually named and whether the desk knows it. If the answer is vague, the term is decorative. A provider can also refuse a dispute that arose more than a year ago, so the clock matters more than the intention.
- Install blocking software as a backstop, not a substitute. GamStop signposts Gamban and BetBlocker. BetBlocker states it blocks over 1,368,000 websites and 3,100 apps, needs no registration and is free worldwide. Gamban blocks licensed and unlicensed sites and is built to be as hard to remove as possible; after TalkBanStop funding ended on 31 March 2026 it is free in Wales but costs £4.99 a month or £29.99 a year in England and Scotland after a 7-day trial. Unlike a self-exclusion, blocking software needs no operator's cooperation to work.
What the Disruption Numbers Say About the Market
Here is the oddity. The site population outside the scheme is large, the player population using it is small, and the loudest estimates belong to people with a commercial interest.
The Commission's analysis published on 5 November 2026 estimates that, across the whole population including non-gamblers, 0.6 per cent of respondents engaged with illegal gambling websites in the past four weeks and a further 0.4 per cent in the past 12 months, while 94.4 per cent showed no indication of using one; among those who had gambled online in the previous four weeks, 2.5 per cent had engaged with illegal sites, plus 1.5 per cent in the past year. Set against that, H2 Gambling Capital estimated £16.6 billion was staked with illegal operators in the UK in 2025, up from about £5 billion in 2019, with the proportion of gambling happening legally falling from 97 per cent to 92 per cent. A study by Frontier Economics for the Betting and Gaming Council put black-market online stakes at £2.7 billion a year, 2.1 per cent of the £128 billion staked with GB-regulated remote casino, betting and bingo operators, with £1.6 billion more possibly staked in person at illegal venues. Yield Sec, working for the Campaign for Fairer Gambling, put the GB online market at £8.8 billion of gross gaming revenue in 2025, split 91 per cent regulated to 9 per cent unregulated. PwC, for the same trade body as Frontier, found unlicensed online stakes rising from 1.2 per cent in 2018/19 to 2.3 per cent in 2020.
When four well-funded analyses of the same market disagree by a factor of five, the honest response is to trust the method, not the headline. The Commission's own October 2024 methodology multiplies web traffic by a licensed-play assumption of £0.32 of gross gambling yield per minute for online slots, and it says outright that it does not capture activity hidden by VPNs. A regulatory method that admits its own blind spot is worth more than a consultancy figure with a press release attached.
Scale tells the same story from the other end. Total GB gross gambling yield was £17.5 billion in the year to March 2026, up 4.4 per cent, with remote casino, betting and bingo at £8.3 billion, up 6.9 per cent. The illegal market is a real number and a modest fraction of a growing legal one.
Questions About Sites Outside the Scheme
What gambling sites are not on GamStop?
Only sites the Gambling Commission does not license. Participation in the national self-exclusion scheme is a licence condition — LCCP provision 3.5.5 — so every GB-licensed online operator is in it, and any site outside it is unlicensed here. That includes operators holding a Curaçao, Anjouan or Kahnawà:ke licence, and operators holding nothing at all. There is no licensed British operator that has opted out.
Do offshore gambling sites let someone get round a self-exclusion?
No, and the framing is wrong. A registration holds for its full term and then stays in place until the person contacts GamStop to remove it, and if they do not, the scheme holds the data through a further automatic seven-year period during which operators are told they were previously excluded. A site outside the scheme simply has no obligation to check the register in the first place. That is a failure of licence condition, not an escape route.
How does the regulator find sites outside the scheme?
Through affiliate pages, search results and traffic data. The Commission's affiliate method identified 364 illegal sites in May 2024 and 535 by July 2025, with crypto-casino search terms added in December 2024; over May 2024 to July 2025, just over 1,000 unique illegal websites were accessed by consumers in Great Britain. From there it issues cease and desist notices, refers domains to registrars and hosts, and refers URLs to search engines.
What happens after a site is disrupted?
Usually less than the headline suggests, but more than nothing. Across 160 illegal gambling websites with traffic data, engagement fell an average of 32 per cent after disruption; registrar blocks and suspensions achieved 91 per cent falls, GEO IP blocking 60 per cent, and Google removal only 30 per cent. In July to September 2026 alone, 1,835 websites were referred to search engines. Prosecution is rare: one commenced across April 2025 to March 2026.
Are withdrawals from an unlicensed site protected in any way?
Not by British rules. The 96.3 per cent instant-clearance figure and the 0.1 per cent up-to-48-hours figure come from a Commission dataset covering 44.2 million withdrawals by customers of large licensed operators. Nothing comparable exists offshore. The complaint routes there are the operator's own terms, an ADR provider named under the licence, or the regulator that issued it — which is why a named ADR provider is worth more than a promise.
Is using an unlicensed gambling site illegal for the player?
The Act's gambling offences attach to those providing facilities, not to adult consumers: section 33 covers the operator, and sections 47 and 49 address inviting or permitting a child or young person to gamble. The Commission states plainly that it is illegal for anyone to offer commercial gambling services to consumers here without a licence. The risk to a player is not criminal; it is that no British rule, regulator or dispute scheme applies.
The Gap Doesn't Close, It Just Gets Shorter
The traffic-light theory of this market was always wrong. Nobody chose an offshore casino because the British ones were too safe; the gap exists because section 33 can be written in Westminster and enforced only as far as a registrar, a host and a card scheme can be reached.
Since April 2024 the Commission has issued 3,140 cease and desist and disruption notices, referred 447,778 Bing and Google URLs and secured 287,961 removals — and in the quarter to September 2026 alone, 1,835 websites and 7,677,211 URLs went to the search engines. The number that sticks with me is 77: the share of disrupted websites whose estimated traffic fell. Three in four. Not because a taskforce knocked on a door in Curaçao, but because making a site unfindable is cheaper than making it illegal. Meanwhile the population of reachable sites barely moved — 586 identified in September 2026, 4 per cent more than a year earlier. If anything goes wrong on one of them, the National Gambling Helpline is on 0808 8020 133, free, 24 hours a day, every day of the year.