Games Not on GamStop and the Limits of Enforcement

Games not on GamStop are, with very few exceptions, games on sites that hold no Gambling Commission licence. They are not connected to the scheme, so a self-exclusion does not reach them, and none of the protections that come with a British licence apply. The Commission's disruption teams chase them; the numbers show it is a long job.

I have spent years reading the Gambling Commission's enforcement paperwork, and the phrase "games not on GamStop" always strikes me as a polite way of describing something less polite. What it usually means is games on a website that has no British licence, which is not a gap in the scheme but a gap in the law's reach. GamStop — the regulator's own pages write GAMSTOP — only ever bound operators licensed here; the scheme's rules could hardly bind a company that never asked permission. So the interesting question is not why such sites exist. It is what the regulator does about them, and whether the answer is getting better or merely busier. The Commission publishes more enforcement data than it used to, which is one small mercy. Read those numbers closely and you find a regulator winning individual skirmishes daily and losing the arithmetic: sites removed, domains resurfaced, the same crowd under a new name by the weekend.

What Games Not on GamStop Actually Are

GamStop is often typed "gamestop", which is a fact about the name and nothing more. The scheme itself is the UK's national online self-exclusion register, run by The National Online Self Exclusion Scheme Limited, free to use, and open to anyone who wants a break. Registering blocks a person from gambling with every online operator licensed in Great Britain, for six months, one year, five years or five years with auto-renewal. Signing up takes minutes; the block can take up to 24 hours to bite.

That word "licensed" is doing a great deal of work. Since 31 March 2020, participation in the scheme has been a condition of holding a Gambling Commission licence, sitting in the Licence Conditions and Codes of Practice at social responsibility code provision 3.5.5, and operators have been required to check their whole customer base against the register at least every 24 hours since April 2020. The Commission made its point early: on 3 April 2020 it suspended the licences of two online operators that had failed to integrate by the deadline.

So games not on GamStop means games offered by companies outside that obligation. They are not licensed in Great Britain, UK protections do not apply to them, and a self-exclusion placed here carries no weight there. That last point matters and is worth stating without decoration: the exclusion holds for its full term, and then stays in place until the person contacts GamStop to remove it. An offshore site is not a way round it; it is a way round every protection attached to it.

Britain's legal baseline is blunt. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, on summary conviction carrying up to 51 weeks in prison, an unlimited-ish level 5 fine, or both. It is immaterial whether facilities are provided wholly or partly by remote communication, or inside or outside the UK. The Commission's own words, published in October 2024: it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence somewhere else.

There is one narrow category worth naming for accuracy. Some operators hold a licence here but sit outside the scheme's practical reach for a particular product, and the betting-shop and casino schemes are separate animals: SENSE covers land-based casinos, and Gamstop Betting Shops — formerly MOSES — covers bookmakers' shops, working with more than 60 operators across roughly 6,000 shops. Most bingo games not on GamStop that surface are simply unlicensed rather than exempt.

The Regulator's Own Scoreboard

The site angle of this whole subject is the Commission's enforcement record, so let us read it. Between April 2024 and the publication of its report, the Illegal Markets team issued 3,140 cease and desist notices and disruption notices — 2,032 C&Ds, 774 registrar referrals, 402 host referrals and three payment provider referrals — while referring 447,778 Bing and Google URLs and securing 287,961 removals. Across 160 illegal sites with traffic data, engagement fell an average of 32 per cent after disruption.

Then the pace changed. In the quarter from April to June 2026 the Commission referred 366 websites to search engines, covering 147,721 URLs. In July to September 2026 it referred 1,835 websites and 7,677,211 URLs, and issued 546 cease and desist notices. Compare that with January to March 2026: 226 website referrals and 98 C&Ds. These are not the numbers of a market shrinking.

The regulator is candid about which tools work. By disruption method, registrar blocks and website suspensions each produced an average fall in engagement of 91 per cent, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. Its conclusion is refreshingly unsentimental: search-engine removal makes a site harder to find but does not block access.

Scale is the stubborn part. Over the monitored period from May 2024 to July 2025, just over 1,000 unique illegal gambling websites were accessed by consumers in Great Britain. The Commission's dashboard recorded 586 illegal sites accessible to GB consumers in September 2026, and of the 311 sites disrupted in the second quarter of 2026–27, 77 per cent saw a reduction in estimated traffic. H2 Gambling Capital puts stakes with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019, with the legal share of gambling falling from 97 per cent to 92 per cent.

Here is the sting. The Commission has commenced 0 or 1 prosecutions in every quarter from April 2025 to March 2026 — a single prosecution, in October to December 2025 — while issuing thousands of disruption notices. Prosecuting an operator hosted abroad is hard; blocking it is possible; the arithmetic of deterrence is worse than the arithmetic of takedowns.

How Offshore Sites Compare With British-Licensed Ones

The British licence is the standard of comparison, so it is worth setting out what it buys. Take bonuses. Since 19 January 2026, LCCP social responsibility code 5.1.1 caps wagering requirements at ten times, bans promotions that mix two or more types of gambling product, and requires terms that are clear, transparent, fair and readily accessible. The Commission's own reasoning for choosing a cap over a ban was that the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements".

Offshore, nobody is applying that cap. Trade coverage describes typical welcome offers at 25x to 40x, with no-deposit bonuses at 40x to 60x and a cashout cap of €50 to €100. Those figures are reported rather than regulated, but the direction is unmistakable.

Terms that build in delay are the other tell. The Commission's fair-terms guidance says operators may not impose any maximum limit on what a consumer can withdraw from their deposit balance, and its example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". Offshore terms routinely cap cashouts, cap maximum bets while wagering, and reserve the right to void winnings.

Notice the last row. A regulator's funding is a fair proxy for how much supervision a licence buys. The Curaçao Gaming Authority's total annual B2C fee is EUR 47,450, and Anjouan charges EUR 17,828 for issuance and the same again for annual renewal. The Commission's levy alone takes 1.1 per cent of an online operator's previous-year gross gambling yield. These are not comparable regimes, and pretending otherwise is the trade's favourite sleight of hand.

The Licence Behind the Seal

If one thing decides whether a site's games are not on GamStop for good reason or bad, it is the licence, and the licence is checkable. Start with Curaçao, because it is the one most often misrepresented. The National Ordinance on Games of Chance, the LOK, took effect on 24 December 2024 and made the Curaçao Gaming Authority the direct licensing and supervisory authority. The old master-licence and sub-licence model is gone: the legacy "orange" sub-licence certificates of operation ended on 15 October 2025, and licensing activities ceased for the four former master licensors between 18 August 2024 and 31 January 2025. A historic /JAZ number or legacy seal is not proof of a current licence.

First time round, the mechanism matters. Operators holding a valid licence when the LOK commenced received a six-month provisional licence by operation of law, due to expire on 24 June 2025; the CGA extended those for a further six months to 24 December 2025. Verification then became awkward: the CGA announced on 7 October 2026 that its previous online gaming portal would not return to service and that it is working on an alternative way to verify licensed domains, because the previous digital seal may be affected by the transition.

The warning signs are specific. A CGA Certificate of Operation Seal must, on clicking, redirect to cert.cga.cw; if the design, colour or format differs, the site is not authorised. If the certificate behind the seal shows a different domain name from the site being accessed, someone is displaying another operator's paperwork. Anjouan works differently: licences carry a unique number and a QR code linking to a public register, and the authority says certificates that cannot be verified through that register should not be relied on. Anjouan's own statement of 10 June 2026 concedes the essential point: "An Anjouan Internet Gaming Licence is not, and has never been presented as, a universal authorisation to operate in every country in the world."

And then there is Costa Rica, where the industry's favourite phrase — the "data processing license" — is not a licence in any legal sense. Costa Rica operates no comprehensive gambling licensing regime; its Legislative Assembly rejected the bill that would have created one in early 2026. That is the bluntest warning sign available: no regulator, no seal, no register, nothing to check.

Five Signs an Operator Can Be Trusted

Trust here is not a matter of tone or design. It is a set of documents anyone can check in ten minutes, which is why the operators worth avoiding make the checks difficult.

A licence you can verify at source

Not a logo, not a footer badge — the actual record. Check: click the seal. A Curaçao Certificate of Operation must land on cert.cga.cw, an Anjouan certificate must resolve through the public register by licence number or QR code, and a British licence must appear on the Commission's public register with matching domain names and activity. A seal that does nothing when clicked has told you everything.

Terms that state the withdrawal limit in figures

The fastest way to judge an operator is to find the sentence about maximum cashout. Check: search the terms for "maximum", "cash-out" and "withdraw" and see whether a figure appears. A site that limits what can be taken out from a bonus to a multiple of that bonus is telling you the house keeps the tail. Prohibited in Britain, ordinary offshore.

A named dispute route with a named provider

Anjouan requires licensees to designate an authority-approved ADR provider and list it in player-facing terms; Kahnawà:ke employs a full-time Dispute Resolution Officer. Check: look for the provider's name and contact details in the terms, not just a promise to "consider" complaints. Operators that name nobody have effectively reserved the argument to themselves.

Wagering requirements that attach only to the bonus

The clean structure is the one the Competition and Markets Authority describes: requirements that only attach to the bonus are unlikely to be unfair. The abusive structure puts a playthrough obligation on a person's own deposit. Check: read the sentence that defines the wagering base. Twenty-five times the bonus is a different animal from twenty-five times the deposit plus bonus.

A published identity-verification process

The Commission has said the largest single source of complaints is identity verification, with over a quarter of complaints to its Contact Centre concerning it. Check: whether the site says before the first deposit what documents may be needed, when, and in what form. A site that discloses this early has thought about it; one that produces a demand only when a withdrawal is requested has not.

How to Check One Yourself

Five or six steps, all of them ordinary and none of them clever. The point is to do them before any money moves, because afterwards the leverage belongs to the operator.

1. Verify the licence at its source, not on the site. Open the regulator's own register — the Commission's for a British licence, the CGA's or Anjouan's for those — and confirm the domain matches. Reason: seals are images and images are copyable; registers are not.
2. Read the maximum cashout clause before the welcome offer. Find the figure, or confirm the absence of one. Reason: it determines the largest sum a bonus can ever yield, and it is usually buried.
3. Work out the wagering base and multiply it out. Multiply the requirement by the amount it attaches to, then ask whether the figure is plausible at the stakes the game allows. Reason: a 40x requirement on a £100 bonus is £4,000 of play, and the arithmetic is worse where only some games contribute fully.
4. Check whether a self-exclusion reaches the site at all. If it holds no British licence, it is not in GamStop. Reason: a self-exclusion holds for its full term and then remains until the person contacts GamStop to remove it; it is not transferable and should never be treated as optional.
5. Install blocking software as well, if gambling is a real concern. GamStop itself signposts Gamban and BetBlocker, which work at device level; BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, and bank-level blocks from the eleven banks the Commission names also decline gambling transactions at card level. Reason: the scheme binds licensed operators, and software binds the browser.
6. Save the terms, dated, before depositing. A screenshot with a date settles arguments that memories do not. Reason: the Commission has fined operators for terms that changed under customers' feet, and an offshore site has no obligation to keep the version you agreed to.

If something has gone wrong, the order is: the operator's own complaints process, then its nominated ADR provider, then the Commission — which records complaints and refers disputes on, but is a regulator, not an ombudsman, and cannot get anyone's money back. The National Gambling Helpline, run by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year, and Citizens Advice offers free confidential help with debt including gambling debt.

Which Sites Are Not on GamStop?

Anyone who has ever tried to answer "what gambling sites are not on GamStop" has found the problem with the question: the answer changes weekly, and the lists circulating online are mostly affiliate pages. A site's absence from the scheme is not a listable quality but a legal one — it follows from holding no British licence, or from being one of the small number of operators whose product sits outside the scheme's practical scope.

So the honest answer is by category rather than by name. There are sites licensed by another authority: Curaçao under the LOK, Anjouan under its 2005 legislation, Kahnawà:ke, Malta. There are sites licensed nowhere meaningful, including the Costa Rican operators whose supposed licence does not exist in law. And there are operators that held a British licence and no longer do — the Commission reported in May 2025 that one group was leaving the GB market following an investigation and that sites it had operated were unlicensed, which is exactly the moment when a player's protections quietly evaporate.

The regulator's own warning notice of 20 January 2025 is the most useful document on this, because it identifies the mechanism rather than the names: casino games supplied by licensed operators appearing on unlicensed websites available to GB consumers, with such sites often targeting customers who have self-excluded via GamStop and often holding inadequate social responsibility and anti-money-laundering controls. The machinery of the grey market runs on licensed content and unlicensed distribution.

That is why the search term itself is a slightly odd thing to want. Searching for games not on GamStop is searching for an absence of oversight, and the ones that market hardest on that absence are the ones whose terms are most likely to be built on delay, cashout caps and discretionary clauses.

What the Rules Say When It Goes Wrong

British-licensed operators operate under a complaints architecture that is, on paper, unusually consumer-friendly. LCCP social responsibility code 6.1.1 requires arrangements for a customer to refer a dispute to an ADR entity free of charge if it is not resolved within eight weeks, and a consumer must first have gone through the operator's own procedure. ADR providers on the Commission's list generally may require submission within a period of not less than 12 months from the operator's notice that it could not resolve the matter.

The providers are approved, not chosen by the operator at random, and they publish their own numbers. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, of which 150 valid disputes concerned deposits and withdrawals, an average 31 days to resolve domestic disputes, and 17.8 per cent of completed disputes ruled in favour of the consumer. IBAS's 2024–25 report records 3,721 domestic disputes, 217 of them categorised as banking or financial, an average completion time of 20 days, and 65 consumer complaints upheld by written decision against 693 not upheld. eCOGRA also notes that 361 of 499 invalid disputes — 72.3 per cent — had not been through the operator's internal procedure first.

None of this exists for a site the Commission cannot regulate. The Commission's regulatory remit covers only gambling websites that trade or advertise to customers in Great Britain while holding a Commission licence, and its own guidance is that self-exclusion from online operators is delivered through GAMSTOP while separate multi-operator schemes cover land-based gambling.

Where money is held matters too, and the contrast is instructive rather than comforting. Customer funds at a British-licensed remote operator must sit in a separate client account, and operators must declare an insolvency protection rating — "not protected", "medium protection" or "high protection" — with a reminder every six months to anyone rated not protected. Even that does not guarantee a return: keeping funds separately does not mean customers get their money back if the operator becomes insolvent, and the Commission notes that gambling businesses may hold customer money in overseas accounts. If the disclosure is thin under a British licence, imagine it under a licence whose regulator has no power to ask.

Questions About Games Not on GamStop

Which gambling sites are not on GamStop?

Any site without a Gambling Commission licence. Since 31 March 2020, scheme membership has been a licence condition under LCCP social responsibility code 3.5.5, so an operator here cannot opt out. Offshore sites licensed in Curaçao, Anjouan, Kahnawà:ke or Malta are outside it, as are operators with no meaningful licence at all. There is no complete public list, and the ones circulating online are commercial.

Are the games different on sites not on GamStop?

Sometimes, and not for the reason people assume. British-licensed slot games carry stake limits — £5 per game cycle for all adults since 9 April 2025 and £2 for those aged 18 to 24 since 21 May 2025 — plus a minimum 2.5 seconds between game cycles. Offshore versions of the same titles are not bound by those limits, so the games feel faster and permit larger stakes. The maths of the games themselves is largely unchanged.

Why does a UK gambling site not on GamStop matter legally?

Because the operator is providing facilities for gambling without a licence. Section 33 of the Gambling Act 2005 makes that an offence, and it applies whether the facilities are provided wholly or partly by remote communication and whether inside or outside the UK. The Commission said in October 2024 that holding a licence elsewhere does not make operating in Britain lawful. The offence sits with the operator, not the customer.

Do VPNs hide these sites from the regulator?

Partly, which the Commission acknowledges. Its October 2024 methodology for estimating the unlicensed market combines web-traffic data with a licensed-play assumption and notes explicitly that it does not capture activity hidden by VPNs. That is one reason estimates diverge so widely — one market-intelligence firm puts illegal stakes at £16.6 billion for 2025, while an industry-commissioned study put online black-market stakes at £2.7 billion.

Can a self-exclusion be lifted early to use one?

No. A GamStop registration cannot be cancelled or deactivated during the chosen period, and the exclusion stays in place after that period ends unless the person contacts GamStop to remove it. On the five-year auto-renewal option, renewal may only be switched off during the last six months, and it otherwise continues for up to four further five-year periods. The scheme's 2025 annual report devotes a section to its refusal to remove registrations early.

Is it true that Welsh gambling sites not on GamStop are different?

No. Licensing is a reserved matter and the Gambling Commission's remit covers Great Britain, so the position in Wales is the same as in England and Scotland, and there is no separate Welsh scheme. The one Welsh difference is practical: the National Gambling Helpline gives a separate number for callers in Wales, 0808 2819 265, alongside 0808 8020 133.

The Long Game the Regulator Is Playing

The honest summary is that games not on GamStop exist because the scheme's obligations attach to licences, and the sites that most want to escape the obligation have simply declined to hold one. What follows is a permanent enforcement treadmill rather than a fix: sites removed, domains registered again, engagement falling 32 per cent on average where disruption lands and by 91 per cent where registrars act. Since April 2024 the Commission has issued 3,140 cease and desist and disruption notices and secured 287,961 URL removals, and in July to September 2026 alone it referred 1,835 websites and 7,677,211 URLs. Over April 2025 to March 2026 it commenced a single prosecution.

So the checks are the player's, not the regulator's: the licence verified at its source, the cashout clause read before the bonus, the wagering base multiplied out, the self-exclusion understood as something that holds for its full term and then remains until the person contacts GamStop to remove it. And if any of it stops being academic, the National Gambling Helpline on 0808 8020 133 is free and answers 24 hours a day, every day of the year. Everything else on this page is paperwork. That number is not.