A mobile casino not on GamStop is an operator outside the British licensing system: it holds no Gambling Commission licence, so GamStop Online cannot block it, UK consumer protections do not reach it, and pay-by-mobile deposits are its usual hook. Using one is a legal grey zone for the player — the offence under section 33 of the Gambling Act 2005 is the operator's, not the punter's.
The promised convenience of a pay-by-mobile casino that sits outside the national self-exclusion register is real, and so are the numbers attached to it. GamStop Online, the scheme run by The National Online Self Exclusion Scheme Limited from Harrogate, had 561,983 active exclusions at the end of 2025 and reported 614,738 people on the register by July 2026 — more than one in two of them on the maximum five-year term. That is the population these sites are built to catch. It is often typed "gamestop"; the scheme is always written GamStop.
I have watched the Commission's Illegal Markets team grind through this market for years, and the honest reading of the figures below is that disruption works at the margin and does not close the door. What follows is how mobile billing deposits actually work, where the money gets stuck, what the enforcement data says, and the signs that separate a careless operator from a predatory one.
Table of Contents9
Mobile Billing Deposits and Financial Flows
Payment Rails for Mobile Deposits
A "pay by mobile" deposit is not really a payment method so much as a billing arrangement wearing one. On a British site it is almost always a card, a bank transfer or an e-wallet underneath; on an unlicensed site the phrase usually means one of three things: carrier billing through a premium SMS or direct-billing operator, a mobile-money wallet, or a crypto deposit made from a phone. The first is the one to look at closely, because it charges a telephone account rather than a bank account.
Carrier billing exists in the UK, and for a small recurring subscription a phone bill is a perfectly ordinary way to pay. Applied to a casino, it has one useful and one nasty one. It is fast and needs no card details, which is why a disproportionate share of mobile deposit casino traffic reaches for it; and it can be debited against a mobile account that a bank block does not touch, because the bank never sees the merchant. The Gambling Commission's list of banks offering gambling blocks, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling — all of which work by declining payments to merchants categorised under gambling Merchant Category Codes. A premium SMS charge is not one of those. It carries no gambling MCC, so the block that would stop £50 going to a bookmaker does not automatically stop £50 going to a shortcode.
That is the practical difference between a blocked deposit and an unblocked one, and it is worth stating without drama: a bank gambling block is applied at card level, must be activated on each card, and most banks impose a 48-hour or 72-hour cooling-off period before gambling transactions are allowed again once it is switched off. The cooling-off period is the part that matters. It is a speed bump designed for exactly the moment when someone has decided to reverse a decision, and carrier billing removes the bump.
How Mobile Billing Charges Appear
Here is where the trade's house style starts to show. A charge that arrives as a premium SMS shows a shortcode and a string of digits, not a casino's name. Reconciliation is therefore awful: a pay with mobile phone bill casino deposit can be hard to identify on a statement, hard to dispute, and hard to unpick if the operator is unresponsive. If a dispute arises, the ordinary route — the operator's complaints procedure, then an Alternative Dispute Resolution provider — exists only where an operator chooses to be bound by one.
The Commission's own position on this is narrower than people assume. It states plainly that it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a licence from the Commission, including where the operator holds a licence in another jurisdiction. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and it is immaterial whether the facilities are provided wholly or partly by remote communication, or provided inside or outside the UK. On summary conviction the offence carries up to 51 weeks' imprisonment, a fine not exceeding level 5 on the standard scale, or both. None of that touches the customer. Which is exactly why the model survives.
Delays in Mobile Withdrawal Processes
The cleverest terms in this corner of the market are not the wagering requirements. They are the ones that manufacture a pause between winning and being paid. A term permitting a single withdrawal at a time, with no second request until the first has been authorised, is a delay device dressed as administration. So is a rule requiring extra documents only at the withdrawal stage — the very practice the Commission's blog of 12 August 2026 flagged, noting that over a quarter of complaints reaching its Contact Centre concern identity verification, and that customers raise it when documents are demanded only on withdrawal.
The Commission has been blunt about the pattern. Operators must not introduce friction when a customer tries to withdraw rather than when they deposit, and the Commission does not consider it fair, transparent or necessary to delay or prevent withdrawals purely for customer-interaction purposes. LCCP licence condition 17.1.1 goes further: a withdrawal request must not result in a demand for information the licensee could reasonably have requested earlier. Reverse withdrawals have been banned outright since 31 October 2021 under RTS requirement 14B — "Consumers must not be given the option to cancel their withdrawal request". A British-licensed operator therefore cannot legally build the trap. An unlicensed one has never signed up to it.
Which Mobile Deposits Clear, and How Fast
Withdrawal speed by method, on the payment rails themselves rather than any operator's marketing. Where a number appears here it appears in the text for the same reason.
| Method | Typical arrival | Notes that matter |
|---|---|---|
| Bank transfer (Faster Payments) | Over 90% complete in under 2 seconds | Scheme ceiling £1 million per transaction; individual banks set lower limits; limits are per transaction, not per day |
| Bank transfer (CHAPS) | Same working day | No scheme upper limit; daily cut-off applies |
| Card payout (Visa Direct Fast Funds) | Funds available within 30 minutes of approval | Real-time confirmation; a push-payment model |
| Bitcoin | ~10 minutes per block on average | ~63% chance of a block inside any 10-minute window; most services require 6 confirmations |
| Litecoin | ~2½ minutes for 1 confirmation, ~15 for 6 | Only about 55.43% of modelled six-confirmation spans finish inside 15 minutes |
| USDT on TRON (TRC-20) | Seconds on-chain | Without staked Energy, roughly 13 TRX burned; ~26 TRX to a new wallet |
| Ethereum / ERC-20 | Seconds on-chain | Standard transfer costs exactly 21,000 gas; fee is paid even if the transaction fails |
| E-wallets | Minutes to hours | Skrill and Neteller each charge 2.80% (minimum EUR 3.50 / USD 3.50) for bank withdrawals |
Two caveats. First, on-chain speed is not the same as payout speed: the operator decides when the transaction is broadcast, and that decision is where the delay lives. Second, a fee schedule can be perfectly honest and still cost more than the deposit. Skrill's foreign-exchange fee is 4.49% when conversion is needed, against 2.49% for crypto-asset transactions on non-EUR/USD accounts; Neteller charges 1.50% as a crypto fee on its Standard level on top of its 12.75 USD member wire. On a £30 mobile deposit that arithmetic is unforgiving.
The Gambling Commission's data, cited in a speech of 6 November 2025, covered June to September 2024 and recorded 44.2 million withdrawals by customers of large online operators in that period: 96.3% cleared automatically, 3.5% within 24 hours and 0.1% up to 48 hours. That is the standard British sites are held to. Earlier Commission data from some of the largest companies showed around 99% of withdrawal requests approved, processed and fulfilled within 24 to 48 hours. Compare it with what unlicensed terms actually say: one published schedule limits bonus-derived withdrawals to 300% of the credited bonus amount, with any excess voided. No British licence permits a maximum cashout clause of that kind at all.
The Licence Is the Whole Argument
The single thing this topic turns on is not the deposit method. It is whether anybody with real authority is standing behind the account.
The British baseline is the licence. All online operators have had to be part of GamStop since 31 March 2020 as a condition of their Gambling Commission licence, the requirement sitting in social responsibility code provision 3.5.5 — "Licensees must participate in the national multi-operator self-exclusion scheme". Since April 2020 those operators must also check their entire customer base against the register at least every 24 hours, which incidentally prevents registered people receiving direct marketing. In April 2020 the Commission suspended the licences of two online operators for failing to integrate by the deadline, using section 118(2) of the Gambling Act 2005. The point is not that British operators are saints. It is that they can be hit.
Offshore sites hold no such licence, so GamStop Online does not cover them; that is consistent with the scheme's own terms of use, though the proposition is more often stated by trade and press sources than by a regulator page [unconfirmed]. And here the brief's three questions resolve into one, because the offshore licence is usually the weakest part of the offer. Malta's Authority requires a one-time non-refundable application fee of EUR 5,000, a fixed annual licence fee of EUR 25,000 and 5% gaming tax on revenue, plus minimum paid-up share capital of EUR 100,000 for its Type 1 and 2 B2C licences. Curaçao's reforms under the LOK, in force since 24 December 2024, replaced the master-licence model with direct licensing by the Curaçao Gaming Authority; the annual B2C total is EUR 47,450, split between a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee. Anjouan's published schedule is EUR 17,828 for a B2C licence and the same again annually. That is not a measure of rigour, but it is a measure of price, and the price is what a licence costs when the supervision is thin.
First-time behaviour is where the licence shows. On a British site, since Licence Condition 17 was introduced on 7 May 2019, a customer must be identified and verified before being permitted to gamble, and the information must include name, address and date of birth. Under the money-laundering Regulations, remote casinos must identify and verify at €2,000 of deposits or withdrawals, and the threshold applies both to a single transaction and to transactions that appear to be linked. Many British sites use what the Commission calls a hybrid approach: identify at registration, verify age, defer full verification to the €2,000 point. Later, verification becomes ongoing — it must be refreshed when circumstances or details change, and non-face-to-face business is treated as high risk absent safeguards, requiring enhanced due diligence.
The warning signs are consistent across the whole market. Fuzzy matching through a third-party verification provider, onboarding on partial verification, a middle name entered where a forename belongs — the Commission's blog of 12 August 2026 noted that the last of those creates mismatches with records held elsewhere, including GamStop, and so undermines self-exclusion itself. On the withdrawal side: documents demanded only at cash-out, a limit on the number of simultaneous withdrawal requests, and a term giving the operator sole discretion to void winnings. A British operator may not rely on that last one at all; the Commission's guidance says terms using "may" or "reserve the right" to void or withhold winnings are unfair within the meaning of the Consumer Rights Act 2015.
Five Signs Worth Checking
The register entry, not the badge
The Gambling Commission advises consumers to check that a business holds a British licence and to click through to the public register to see whether the site's activities and domain names match. It takes a minute and it settles most arguments.
A seal that actually resolves
Offshore seals are verifiable if you do the work. Clicking a Curaçao Gaming Authority Certificate of Operation Seal must redirect to cert.cga.cw; a seal differing in design, colour or format means the site is not authorised, and if the certificate behind the seal shows a different domain the site is displaying another operator's paperwork. Curaçao's old "orange" sub-licence certificates of operation ended on 15 October 2025, and a historic /JAZ number is not proof of a current licence. The CGA also warned on 7 October 2026 that its previous online portal would not return to service and that the digital seal may be affected while an alternative verification mechanism is built.
The name on the terms
An operator that cannot be identified in its own terms is an operator that cannot be complained about. This matters more on unlicensed sites, where the ADR route is voluntary. Anjouan requires licensees to designate an approved ADR provider and list it in player-facing terms, with complaints resolved within 30 days before escalation. Kahnawà:ke requires a licensee's relationship with players to be contractual and free of unfair terms and employs a full-time Dispute Resolution Officer. Both are real. Neither is enforceable from Britain.
Where the money sits
British licence condition 4.2.1 forces a published insolvency rating — "not protected", "medium protection" or "high protection" — with disclosure on the first deposit and after any terms change. Customer funds must be held in a separate client account, though the guidance is honest that this does not guarantee repayment on insolvency, and that money staked in an open bet is not customer funds at all. Anjouan's standards require segregation of player funds and certified random number generators. A promise is not an audit.
Whether the phone bill is the only option
If an operator pushes carrier billing and nothing else, ask why. A payment route that leaves no gambling Merchant Category Code is convenient for the customer and more convenient still for a business that would rather its charges were not obvious on a statement.
How to Check an Operator, Step by Step
- Search the Gambling Commission's public register for the domain. The Commission's remit extends only to sites that trade or advertise to customers in Great Britain, and those must hold its licence. If the domain is absent, nothing else on this list applies.
- Read the licence, not the logo. Note the regulator, the licence number and whether the certificate resolves to the regulator's own verification page. Check the domain shown matches the domain you are on.
- Find the self-exclusion term in the operator's own words. On a British site, participation is compulsory and the account is closed with any balance returned — the LCCP states it is not sufficient merely to prevent the individual from withdrawing funds while still accepting wagers.
- Read the withdrawal clause before depositing. Look for a cap on the number of simultaneous requests, a maximum cashout figure, or discretion to void winnings. Then read the bonus terms for the wagering multiple and the maximum bet while wagering.
- Test the deposit method with a small amount. Verify that the charge is identifiable on the statement and that the cooling-off point, if any, exists. If a £10 deposit cannot be found on a statement afterwards, neither can a dispute.
- Check the complaints route exists before there is a complaint. Confirm the operator's own procedure, then the ADR provider named. ADR providers will not accept a dispute that has not been through the operator's internal process first — 361 of 499 invalid eCOGRA disputes in the year to 30 September 2025 failed on exactly that point.
Self-Exclusion Holds Its Term
This is stated as a fact because it is one: registering with GamStop Online blocks a person from gambling with all online gambling companies licensed in Great Britain for 6 months, 1 year, 5 years, or 5 years with auto-renewal. Signing up takes a few minutes; the block can take up to 24 hours to become effective. Once registered, the registration cannot be cancelled or deactivated during the exclusion period, and the exclusion stays in place after the chosen period ends until the person contacts GamStop to remove it. Auto-renewal can only be switched off during the last six months of a five-year term, and it continues for up to four further five-year periods. If nothing is done at the end, GamStop holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded.
An offshore site is not a way round that, and no honest reading of the scheme suggests otherwise. What an unlicensed operator offers is not an exit from self-exclusion but an absence of checks — which is precisely the gap the Commission's warning notice of 20 January 2025 identified, noting that unlicensed sites available to GB consumers often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls.
If gambling is causing harm, the National Gambling Helpline is run by GamCare on 0808 8020 133, free, 24 hours a day, every day of the year, also reachable by live chat and WhatsApp. Callers in Wales are given 0808 2819 265. Gamblers Anonymous England, Wales & Ulster is on 0330 094 0322 with around 250 meeting locations and no appointment needed.
What the Regulator Actually Does
The enforcement record is the most interesting material in this topic, and the least comforting if you are looking for a clean-up.
Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 C&Ds, 774 registrar referrals, 402 host referrals and 3 payment provider referrals — referred 447,778 Bing and Google URLs, and secured 287,961 URL removals. Across 160 illegal gambling websites with traffic data, average engagement fell 32% after disruption. By method the differences are stark: registrar blocks and website suspensions produced an average fall of 91% each, ahead of GEO IP blocking at 60%, Bing removal at 52%, Google removal at 30% and Facebook removal at 8%. The Commission says so itself — GEO IP blocking and registrar blocks beat search-engine removal, because removal makes a site harder to find without fully blocking it.
Then the volume. Websites referred to search engines rose from 124 in July–September 2024 to 321 in April–June 2025. In January–March 2026 the Commission referred 226 websites and issued 98 cease and desist notices; in April–June 2026 it referred 366 websites, covering 147,721 URLs, and began 0 criminal investigations; in July–September 2026 it referred 1,835 websites, covering 7,677,211 URLs, and issued 546 cease and desist notices. Across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced — the total for the year was one.
Read those two sets of numbers together and the shape of the thing appears. Referrals in the millions, ceasing and desisting by the hundred, and a single prosecution. Disruption is a tax on illegal operators, not a wall. The Commission's own estimate of consumer time on illegal gambling sites fell from 306 million minutes in January 2025 to 116 million in June and 152 million in July — real movement, and not zero.
Scale is contested because the methodologies differ, and it is worth saying which is which. The Commission's analysis published 5 November 2026, covering April 2025 to April 2026, estimates 0.6% of the whole population engaged with illegal gambling websites in the past four weeks and a further 0.4% in the past 12 months, with 94.4% showing no indication of use; among those who had gambled online in the past four weeks, the figure was 2.5%, plus 1.5% in the past year. Its illegal gambling dashboard recorded 586 illegal websites accessible to GB consumers in September 2026, 4% below the previous three-month average but 4% above September 2025. By contrast H2 Gambling Capital, a market-intelligence firm, estimates UK stakes with illegal operators reached £16.6 billion in 2025, up from about £5 billion in 2019, with the legal share of gambling falling from 97% to 92%. Frontier Economics, commissioned by the Betting and Gaming Council, put black-market online stakes at £2.7 billion a year, or 2.1%. Yield Sec, working for the Campaign for Fairer Gambling, put 2025 GB gross gambling revenue at £8.8 billion, split 91% regulated and 9% unregulated. When an industry's advocates and its critics differ by an order of magnitude, the honest conclusion is that nobody has counted precisely, and that the direction of travel is the only part most of these numbers agree on.
The channels have shifted accordingly. The Commission refers illegal gambling content to Meta, TikTok, X and YouTube; in April–June 2025, 84 illegal lottery URLs were removed from social media and 108 illegal lotteries were referred. Reporting payment transaction data to the Visa Operator Scheme is described by the Commission as a critical and still early-stage part of its financial disruption strategy. The Illegal Gambling Taskforce's terms of reference, published by DCMS on 13 May 2026, set three priorities: reducing payments to and from illegal operators, tackling online advertising of illegal gambling, and improving cross-agency enforcement. It runs for 12 months and meets at least twice a year.
And the trade's exits are rarely dramatic. In May 2025 the Commission reported that TGP Europe was leaving the GB market following an investigation, that sites it operated were now unlicensed and might not provide protections against criminality or gambling-related harm, and that it had contacted five football clubs about sponsorship arrangements with unlicensed gambling businesses. No prosecution. A withdrawal from the market, a warning to sponsors, and the domains left running for whoever would still take them.
FAQ
Is a mobile casino not on GamStop legal to use?
Using one is not an offence for the player: section 33 of the Gambling Act 2005 targets the person providing facilities for gambling without an operating licence, and the Act's gambling offences attach to providers, not to adult consumers. The operator is committing an offence. That distinction protects the customer from prosecution, and it protects the customer from nothing else — no licence means no regulatory route to a complaint.
Can I use a pay by mobile casino not on GamStop while self-excluded?
A person can open an account, because the site has no access to the register — but doing so does not remove the exclusion, and the exclusion remains in force for its full term and afterwards until the person contacts GamStop to remove it. The Commission's January 2025 warning notice states that unlicensed sites often target customers who have self-excluded, and that their social responsibility and anti-money-laundering controls may be inadequate.
Why is a bank gambling block no help on mobile billing deposits?
Bank blocks work by declining payments to merchants categorised under gambling Merchant Category Codes, and they are applied at card level, so each card must be activated separately. A carrier-billing charge billed to a mobile account carries no such code. The bank never sees a gambling merchant, so there is nothing for the block to decline.
What happens to my winnings if the operator refuses to pay?
On a British-licensed site there is a route: the operator's complaints procedure, then a Commission-approved ADR provider free of charge, and ADR providers may consider disputes about account management or the ability to access funds. Offshore, that route exists only where the operator has voluntarily appointed a provider. Anjouan, for instance, requires a designated ADR provider and resolution within 30 days; Kahnawà:ke runs a Dispute Resolution Officer. Neither is bound by British consumer law.
Does a Curaçao licence mean anything?
It means the operator paid for supervision that exists, under a regime that has genuinely been rebuilt: the LOK took effect on 24 December 2024, replacing master licences with direct licensing by the Curaçao Gaming Authority, and the old orange sub-licence certificates ended on 15 October 2025. It does not mean the same protections apply. Gambling Commission licence conditions, the 10× wagering cap, the ban on reverse withdrawals and the GamStop obligation simply are not there.
How quickly must a British casino pay out?
There is no fixed maximum number of days; the regime relies on the fair-and-open condition 7.1.1, the identity-verification condition 17.1.1 and the prohibition on unfair terms rather than a stated deadline. In practice, Commission data covering June to September 2024 found 96.3% of 44.2 million withdrawals by customers of large online operators cleared automatically. Where there are no regulatory concerns, the Commission says there is no valid reason to delay.
Are pay by mobile phone bill casino bonuses worse value?
Usually, because the terms do the damage rather than the size of the offer. British licensees have been capped at wagering requirements of ten times since 19 January 2026 and cannot mix product types within one incentive, so "bet £5 to get 20 free spins" is now non-compliant here. Offshore schedules in the £17,828-licence class are not bound by that cap, and maximum cashout clauses — one published example voids anything above 300% of the bonus — remove the upside entirely.
The Convenience Is Real, and So Is the Bill
A mobile casino not on GamStop solves a problem the British licence is designed not to solve — instant deposits from a phone, no register, no MCC on the statement — and it solves it by removing every mechanism that makes a dispute winnable, from the GamStop check to the licensed ADR route to the ban on a maximum cashout clause.
The enforcement numbers tell you where this is going. In the quarter July to September 2026 the Commission referred 1,835 websites covering 7,677,211 URLs and issued 546 cease and desist notices, and in the twelve months to March 2026 it commenced exactly one prosecution. Carriers, registrars and payment providers are the levers that actually move traffic, and the Commission says so plainly. If the page above has one useful line, it is the one from its own Contact Centre: withdrawals from accounts remain the number one subject of consumer complaints. That has been true since at least July 2023, and it is still true. Anyone who needs it can reach the National Gambling Helpline on 0808 8020 133, free, 24 hours a day.
Checks as of 13.11.2026.