Online casinos not on GamStop are casinos holding no Great Britain licence, so the self-exclusion scheme never reaches them. They are unlawful to offer to British customers, the protections that cover licensed sites do not apply, and the Gambling Commission disrupts them rather than polices them. Help is on 0808 8020 133.
The marketing around online casinos not on GamStop rests on one promise: freedom from the scheme. Read the small print and the promise usually turns out to be an absence — no British licence, no GamStop block, and no complaints route worth the name. What interests me here is not the offer but the response to it. The Gambling Commission's Illegal Markets team has, since April 2024, issued 3,140 cease and desist and disruption notices, referred 447,778 Google and Bing URLs and secured 287,961 removals. Across 160 illegal sites where traffic data existed, engagement fell by an average of 32 per cent after action. That is the honest framework for this subject: a regulator running a disruption campaign, not a licensing regime, and a market that keeps shifting its domains.
I have covered this trade long enough to be sceptical of both ends of the argument. The sites oversell. So, occasionally, does the enforcement data — search-engine removal makes a site harder to find, and the Commission says so itself, ranking GEO IP blocking (60 per cent average fall in engagement) and registrar blocks (91 per cent) above it. And a British licence is not a guarantee of virtue either; it is a guarantee that terms are capped, complaints go somewhere, and a self-exclusion holds. That difference is worth understanding properly before anything else.
Table of Contents7
What a British Licence Actually Does
Start with one checkable number, because the enforcement totals above tell you about policy rather than about a casino's cashier. The Gambling Commission's own data for June to September 2024 covers 44.2 million withdrawals by customers of large online operators: 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent took up to 48 hours. A licence does not merely permit a business; it imposes a payout expectation the regulator has measured.
The rest of the licensed standard is condition-by-condition. LCCP condition 17.1.1 says a withdrawal request must not trigger a demand for extra information the licensee could reasonably have asked for earlier. Condition 4.1.1 requires customer funds to sit in a separate client account. Condition 7.1.1 requires terms to be fair under the Consumer Rights Act 2015. Licence condition 5.1.2, effective 31 January 2024, restricts payment methods to providers regulated under the Payment Services Regulations 2017. Reverse withdrawals were banned outright on 31 October 2021 under RTS 14B.
None of that follows a player offshore. The numbers show the gap clearly.
| Aspect | GB-licensed operator | Offshore operator, no GB licence |
|---|---|---|
| Self-exclusion via GamStop | Required under SR code 3.5.5 since 31 March 2020, checked at least every 24 hours | Not connected to the scheme |
| Wagering on bonus funds | Capped at 10× from 19 January 2026 | 25× to 60× commonly published |
| Maximum cashout on bonus winnings | Maximum limits on withdrawal of the deposit balance prohibited | Clause can void everything above a multiple of the bonus |
| Withdrawal data | 96.3% of 44.2m withdrawals cleared automatically, June–September 2024 | No published figures |
| Complaint escalation | Free access to an approved ADR entity after eight weeks | Foreign ADR, if any, with no GB enforcement |
| Card payments | Credit cards banned since 14 April 2020 | Terms set by the operator |
The table is deliberately boring, and that is the point. The differences are not about excitement or generosity. They are about which party holds the discretion when a dispute starts, and a clause that gives the operator discretion is worth more to the operator than any headline bonus percentage is to a player. Two regulatory settlements in the last two years show how that discretion gets used: one licensee was fined £170,000 in July 2025 for a term letting the firm close accounts or forfeit winnings at its own discretion, and a £900,000 settlement in October 2026 involved, among other things, delaying consumer withdrawals. Both were licensed businesses. Offshore, there is nobody to fine.
Licence Conditions and Codes of Practice
The LCCP is the document that converts a licence into behaviour: which conditions attach, which codes are mandatory, what a breach means. Social responsibility code provision 3.5.5 simply states that licensees must participate in the national multi-operator self-exclusion scheme, and a breach of an SR code is a breach of licence condition under section 82(1) of the Gambling Act 2005.
Offshore Regulators in Curaçao, Anjouan, Kahnawake and Malta
Offshore licensing is not one thing, and the differences matter when a player weighs a site. Curaçao's National Ordinance on Games of Chance took effect on 24 December 2024, replacing the master-licence model with direct licensing by the Curaçao Gaming Authority; legacy "orange" sub-licence certificates ended on 15 October 2025, and a historic /JAZ number is no longer proof of a current licence. The application fee for a B2C licence is a one-time EUR 4,592 and the total annual B2C fee is EUR 47,450. Anjouan prices a B2C licence at EUR 17,828 for issuance and the same for annual renewal, and says its licences carry no territorial restrictions — while adding that holders must comply with local law where authorisation is required. Kahnawake has regulated interactive gaming since 1999, requires operators to be hosted at a data centre in its own territory, and charges a CPA application fee rising from USD 35,000 to USD 40,000 on 1 January 2027. Malta's MGA charges EUR 5,000 to apply and EUR 25,000 a year.
Malta is the awkward case in that list and deserves saying plainly: an MGA licence is a serious licence, but it is not a British licence. The regulator publishes a list of Unauthorised URLs precisely because operators falsely claim Maltese authorisation. A licence from anywhere else does not make a site lawful here.
Do Offshore Casinos Ever Accept a Self-Exclusion?
The scheme is the whole reason this corner of the market exists. A GamStop registration blocks a person from gambling with all online operators licensed in Great Britain for six months, one year, five years, or five years with auto-renewal. Signing up takes minutes but the block can take up to 24 hours to bite. What people miss is the tail: the exclusion cannot be cancelled inside its term, and it stays in place after the chosen period ends until the person contacts GamStop to remove it. Fail to act and the scheme holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded. GamStop never removes a registration early, and its 2025 annual report devotes a section to saying so. The scheme is also often typed "gamestop"; the name is GamStop.
That is a firm arrangement, and it produces its own frustration. A person who chose five years at a low ebb may find the decision outlives the crisis, and under the terms of use the auto-renewal option can only be switched off in the last six months of a five-year minimum exclusion period. I think the rigidity is the correct design — a self-exclusion with an easy exit is decoration — but it is rigidity, and it explains why offshore operators target the excluded so deliberately. The Commission's January 2025 warning notice said as much: games from licensed operators were appearing on unlicensed sites that often target people who have self-excluded through GamStop.
Offshore sites built on delay terms are the worst of it. A term that pays out only after repeated manual review, or that lets the operator require documents it could have requested at sign-up, converts a licence into a lever.
The scope is smaller than the marketing suggests. Commission analysis published 5 November 2026 estimates that among adults who had gambled online in the previous four weeks, 2.5 per cent had engaged with an illegal gambling website, with another 1.5 per cent in the past twelve months. Among the whole population, including non-gamblers, 0.6 per cent had done so in the previous four weeks. Those are not trivial numbers, but they describe a fringe, not a parallel industry — while industry-commissioned research puts the stakes figure in the billions, which tells you how much the participants want the market to look large.
Warning Signs Including Slow Withdrawals and No Licence
The Commission's Contact Centre answers over 6,000 calls a year, and withdrawal problems have long been the number one topic. By July 2024 it was still receiving around 2,000 complaints a year about withdrawal delays, and its Annual Report 2024-25 records that withdrawal issues continue to cause most of the complaints it receives. A 2026 blog added that over a quarter of complaints concern identity verification, raised when documents are first requested at the point of withdrawal.
The rule that matters here is simple: where the operator has no regulatory concerns about a customer, the Commission says there is no valid reason to delay a payout. Offshore, that rule does not exist, and a five-day "processing" window in the terms is doing the work a licence condition would otherwise do.
Bonus terms are the second front. Britain capped wagering on bonus funds at ten times from 19 January 2026 — the Commission noted that licensees had been applying up to 60 times — and banned mixed-product promotions. Offshore, twenty-five times is modest and fifty is ordinary. Ignition Casino publishes a 25× playthrough with a contribution chart giving table games 20 per cent and live dealer games nothing; BlueChip Casino reserves the right to limit withdrawals from bonus-derived winnings to 300 per cent of the credited bonus. Those clauses are lawful in their home jurisdictions and ruinous in practice.
Five Signs That Separate a Straight Operator From a Costume
These are checks, not vibes. Each one takes minutes.
The Licence Matches the Domain
Find the regulator's public register and confirm that the licensed entity is the entity running the site you are looking at. A licence certificate behind a seal is not enough: Curaçao's own certification policy says that if the certificate shows a different domain from the site being accessed, the site is displaying another operator's certificate. The Gambling Commission's register lets you check whether a business holds a British licence and whether the activities and domain names match.
The Bonus Terms Are on One Page
A significant condition — a wagering multiple, a maximum cashout, a maximum bet while wagering — should be visible without hunting. If the multiple appears only in a linked document, treat the headline number as fiction.
Withdrawals Are Governed by a Deadline, Not a Discretion
Look for a stated processing time and for a term letting the operator require extra documents before paying. Licensed guidance is unambiguous that information reasonably obtainable earlier cannot be demanded at withdrawal; a site whose terms reserve that demand to the cashier window has built the delay in on purpose.
Disputes Go Somewhere Independent
A trustworthy operator names its ADR provider in its terms. eCOGRA recorded 911 disputes in the year to 30 September 2025, ruling in favour of the consumer in 17.8 per cent of completed cases; IBAS recorded 3,721 domestic disputes in 2024-25 and reports 100 per cent operator compliance with decisions that went the consumer's way. Those numbers are only possible because the route is contractual.
Customer Funds Have a Stated Protection Rating
British licensees must select one of three ratings — not protected, medium or high — and state it in their terms. An operator rated not protected must remind customers every six months that their funds are not protected if the business fails. A site that will not say which rating applies has answered the question.
Six Steps to Check Before Playing
- Search the regulator's public register for the trading name and domain. The Commission's own advice is to click through to the register and confirm the activities and domain names match, because a licence number quoted on a website proves nothing on its own.
- Verify any offshore certificate at the regulator, not on the site. Curaçao issues a Certificate of Operation Seal only for an approved and registered player-facing domain and says clicking it must redirect to its certification service; Anjouan's certificates carry a licence number and a QR code linking to a public register. A seal that goes nowhere is decoration.
- Read the withdrawal section of the terms before depositing. Note the stated processing time, whether documents may be requested at withdrawal, and whether there is any cap on withdrawals from the deposit balance. Licensed operators in Britain cannot impose such a cap; elsewhere the term is whatever the operator wrote.
- Convert the bonus into a number. Multiply the wagering multiple by the amount you must play through, then check the contribution chart. BlueChip's 300 per cent maximum cashout on bonus winnings tells you the real ceiling on the offer.
- Check the payment method route. Credit cards have been banned for British-licensed gambling since 14 April 2020, so a site accepting them is either not licensed here or not complying. Licence condition 5.1.2 also restricts licensed operators to payment service providers regulated under the Payment Services Regulations 2017.
- Set a limit before the first deposit and know the help routes. Since 31 October 2025 British operators must prompt customers to set a financial limit before the first deposit, under RTS 12E, and make it the default option. The National Gambling Helpline is free on 0808 8020 133, 24 hours a day; Gamblers Anonymous England, Wales and Ulster is on 0330 094 0322; NHS England now commissions treatment funded by the statutory levy, which raised just under £120 million in its first year.
What the Regulator Actually Does About Unlicensed Sites
The honest answer is disruption rather than closure. The Commission's Illegal Markets team cannot licence what was never licensable, so it works on access: registrar referrals, host referrals, GEO IP blocking, search-engine removal and, since January 2025, referrals to Visa. The totals since April 2024 — 3,140 notices, 447,778 URLs referred, 287,961 removed — are a campaign, and the commission reports that disarmingly: search-engine removal makes a site harder to find without fully blocking it, which is why registrar blocks and GEO IP blocking outperform it.
Watch the shape of the last few quarters. In January to March 2026 the Commission referred 226 websites to search engines and issued 98 cease and desist notices. In April to June 2026 it referred 366 websites covering 147,721 URLs and commenced no criminal investigations at all. In July to September 2026 it referred 1,835 websites and 7,677,211 URLs and issued 546 notices. Across April 2025 to March 2026, every quarter recorded zero or one prosecution commenced — one in total, in the December 2025 quarter. Meanwhile the dashboard counted 586 illegal gambling websites accessible to British consumers in September 2026, and 311 sites had disruption action taken against them in the second quarter of 2026-27, 77 per cent of which saw estimated traffic fall.
That is the trade's real weather: huge volumes of takedown, negligible criminal enforcement, and a market that re-registers. The site count moved 4 per cent either side of flat year on year while URL referrals rose into the millions, which is what you would expect from a system that removes pages faster than it can remove businesses. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without a licence, and it is immaterial whether the facilities are provided inside or outside the UK; on summary conviction the penalty runs to 51 weeks' imprisonment, a fine, or both. The Commission has used that power against operators — in April 2020 it suspended two licences over failure to integrate GamStop by the 31 March deadline — and it is plainly more comfortable using licensing powers against businesses already inside the tent.
What none of this does is help an individual get money back. The Commission is a regulator and not an ombudsman; it cannot resolve individual complaints or recover funds. Once money is with an operator outside its jurisdiction, the levers are a foreign regulator with a foreign ADR provider, a payment provider referral, or a court in a country the player has never visited. I doubt the arrest figures will change much, because the practical difficulty of prosecuting an entity that exists only as a domain is not going away. The pressure will stay financial and technical — payment rails, hosting, search visibility — and it will keep landing on the market rather than on any single site.
FAQ
Are online casinos not on GamStop legal?
No — it is unlawful for an operator to provide commercial gambling facilities to consumers in Great Britain without a Gambling Commission licence, and that includes an operator licensed in another jurisdiction. The offence sits with the provider under section 33 of the Gambling Act 2005, not with the adult customer, and it is immaterial whether the remote equipment sits inside or outside the UK.
Do the same protections apply at a UK online casino not on GamStop?
No. GamStop's obligations bind only operators holding a British licence under social responsibility code provision 3.5.5, and the other conditions — capped wagering, protected customer funds, fair-terms rules, free access to an ADR provider — attach to that licence alone. Offshore, the terms the operator wrote are the whole regime.
Which offshore licences are worth anything?
Malta's MGA is a substantive regulator: EUR 5,000 to apply, EUR 25,000 a year, and a list of Unauthorised URLs for sites falsely claiming Maltese authorisation. Curaçao is mid-reform, having replaced the master-licence model on 24 December 2024 and retired legacy orange certificates on 15 October 2025. Anjouan costs EUR 17,828 a year, which tells you the depth of scrutiny.
Why are offshore bonuses so much bigger?
Because nothing caps them. British licensees have been limited to ten times wagering on bonus funds since 19 January 2026, with mixed-product promotions banned, and are barred from maximum withdrawal limits on a deposit balance. Offshore terms commonly publish 25× to 60×, contribution charts that discount table games heavily, and cashout ceilings that void winnings above a multiple of the bonus.
Why was my withdrawal held for documents?
In Britain the answer should be never in the cashier window: licence condition 17.1.1 forbids requiring information at withdrawal that the licensee could reasonably have requested earlier, and the Commission has said a delay on insufficient ID may breach licence condition 17. Offshore, identity verification is a contractual condition, not a regulated step, and it can be raised whenever the operator chooses.
Is any offshore casino a way round a GamStop exclusion?
No, and the question misunderstands the scheme. A GamStop registration cannot be cancelled inside its term and remains in place afterwards until the person contacts GamStop to remove it, with data held through a further automatic seven-year period. It exists to stop gambling, not to be routed around, and the Commission's January 2025 warning notice identified offshore sites targeting excluded players specifically.
The Gap Is the Product
The single sentence version is this: a casino outside GamStop is selling the absence of a licence, and everything a licence buys — a capped bonus, a funds rule, a complaint route, a payout expectation measured at 96.3 per cent cleared automatically — goes missing at the same time. The enforcement figures tell you why the market survives anyway: 3,140 disruption notices and 287,961 URL removals since April 2024, against a website count that barely moved.
Anyone who wants the underlying numbers can find them. The National Gambling Helpline, free and open 24 hours a day on 0808 8020 133, is the better place to start than any of this.