Games Not on GamStop and Offshore Sites

Games not on GamStop are games offered by operators holding no Gambling Commission licence, so the national self-exclusion scheme never sees them. The scheme is often typed "gamestop". Great Britain's protections — the £5 slot stake limit, the ten-times bonus cap, access to adjudication — do not apply there.

The first thing to say is a legal one, and it is not a technicality. It is illegal under section 33 of the Gambling Act 2005 to provide gambling facilities to consumers in Great Britain without an operating licence. The offence sits with the operator, not the player: no adult has ever been prosecuted for placing a bet on an unlicensed casino. That asymmetry explains a great deal about how this market looks from the outside — the regulator can disrupt the supply, but it cannot arrest the demand.

The second thing is arithmetic. The Gambling Commission licenses and supervises only sites that trade or advertise to customers here. Everything else lives somewhere else, under a licence issued in Curaçao, Anjouan, Kahnawake or nowhere at all, and the Commission's own enforcement numbers read like a man sweeping a beach with a broom. Between April 2024 and September 2026 its Illegal Markets team issued thousands of cease and desist notices and referred millions of URLs. Against roughly 586 illegal sites accessible to British consumers in September 2026, that is a lot of sweeping.

What follows is a look at what these sites actually are, what licence paperwork sits behind the logos, where the money sticks, and how the regulator's disruption strategy performs against the search terms that lead people to them. The short version: the good ones are real businesses with real rules and slow withdrawals, and the bad ones are indistinguishable from the good ones until something goes wrong.

Casino Games Not on GamStop Families

A casino game not on GamStop is not an exotic object. It is the same slot, the same roulette table, often the same software, served from a server outside the Commission's jurisdiction. What differs is the paperwork behind the URL, and there are three broad families of it.

Curaçao as a Register Mid-Rebuild

Curaçao is the largest and the messiest. The National Ordinance on Games of Chance took effect on 24 December 2024, replacing the old master-licence and sub-licence model with direct licensing by the Curaçao Gaming Authority. The legacy "orange" sub-licence certificates ended on 15 October 2025, and the four former master licensors stopped issuing between August 2024 and January 2025. The practical consequence is that a historic /JAZ number or a legacy seal proves nothing about whether the operator is licensed today.

The licensing itself is cheap and quick to describe. A B2C application fee is a one-time, non-refundable €4,592; the annual total is €47,450, split between a €24,490 licence fee and a €22,960 supervisory fee, payable by 15 January. A B2B supplier licence runs to €24,490 a year. Set that against a British licence, with its suitability assessments, its levy and its personal management licence holders, and the commercial logic of the offshore market becomes obvious. None of it is illegal in Curaçao. All of it is a lighter touch than the Commission's.

The verification side is currently awkward. The CGA announced on 7 October 2026 that its previous online portal would not return to service and that it was working on an alternative way to verify licensed domains, because the old digital seal may be affected by the transition. A third-party tracker reading the register in November 2026 found 704 licences held by 698 operators, of which 552 were active — a figure from an aggregator, not the regulator, and one I would treat as indicative rather than authoritative.

Anjouan Low Fees and Contested Authority

Anjouan, a constituent territory of the Union of the Comoros, licenses internet gaming under legislation adopted in 2005. Issuance and annual renewal are each €17,828, with €500 per additional domain.

The authority's standing is contested, and unusually publicly so. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around €17,000 each per year, that Comoros financial intelligence officials described a related entity as operating illegally, and that a former attorney-general of the Comoros called the licensing body "an illegal entity". Anjouan Gaming has since said, in a statement reported on 10 June 2026, that an Anjouan licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world" — which is the sensible half of the argument, and also an admission that the licence does nothing to authorise the site for a British customer. The authority also states that an independent legal opinion from a firm regulated in England and Wales and Quebec confirms its competence; that is the licensee's own position and I record it as such.

Kahnawà:ke as the Oldest Register and Strictest on Self-Exclusion

The Kahnawà:ke Gaming Commission was established in 1996 and has regulated interactive gaming since 1999, longer than almost anyone. Operators must be hosted at Mohawk Internet Technologies, a data centre in the Mohawk Territory. The fees are steep by offshore standards and rising on 1 January 2027: the client provider authorisation application goes from USD 35,000 to USD 40,000, the five-year renewal from USD 5,000 plus the annual fee to USD 40,000 including it, and key person permits from USD 5,000 to USD 6,000. The annual authorisation fee of USD 20,000 and annual key person fee of USD 1,000 are unchanged.

Kahnawà:ke is also the jurisdiction that does most about self-exclusion — its own, not GamStop's. Under its rules a voluntary self-exclusion is permanent and irrevocable, and a player who breaches one forfeits deposited or won funds to a charity chosen by the Commission. I have some sympathy for that design and no sympathy for how it is marketed. It is not a substitute for GamStop, because it only binds sites in that jurisdiction, and a person cannot self-exclude from a market they are not registered in.

Malta and Costa Rica as Two Ends of the Scale

Malta is the respectable offshore address. The Malta Gaming Authority charges a €5,000 application fee, a €25,000 annual licence fee and 5 per cent gaming tax, with minimum share capital of €100,000 for Type 1 and Type 2 B2C licences. Malta is not Great Britain, and an MGA licence confers none of the Commission's protections — but the authority publishes a list of Unauthorised URLs and states plainly that Maltese licence references on those domains are false.

Costa Rica is the absence of a regime. It operates no comprehensive gambling licensing system; the "data processing licence" sometimes cited is not a licence in any strict sense. Its Legislative Assembly rejected Bill No. 25,057 in early 2026, which would have created a mandatory regime. Games of chance are generally prohibited there, which tells you how much weight the local paperwork carries.

Gambling Sites Not on GamStop and the Block

A gambling site not on GamStop is outside the scheme because participation is a licence condition, and it holds no British licence. Since 31 March 2020 all online operators licensed here must be part of GAMSTOP as a condition of that licence, sitting in social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice. Since April 2020 the Commission has required operators to check their entire customer base against the register at least every 24 hours, which also stops registered people receiving direct marketing.

The Commission's teeth are sharp where licence holders are concerned. On 3 April 2020 it suspended the licences of two online operators for failing to integrate the scheme by the deadline, using section 118(2) of the Gambling Act 2005. That is enforcement with a bang, and it works precisely because those businesses wanted to keep trading here.

Offshore, the same rule has no traction. GamStop Online blocks access to sites licensed in Great Britain and can only exclude people from participating operators; it cannot prevent access to services run by organisations that do not participate. That is not a loophole anyone left open by accident. It is the boundary of the scheme's jurisdiction.

I want to be careful here, because this is the point where trade coverage tends to get coy. Self-exclusion through GamStop holds for its full term and stays in place afterwards until the person contacts GamStop to remove it. An offshore site is not a way round that, and any operator that presents itself as one is telling you what it thinks of its customers. The Commission issued an industry warning notice on 20 January 2025 specifically about licensed casino games appearing on unlicensed sites available to British consumers, noting that such sites often target people who have self-excluded and may have inadequate social responsibility and anti-money-laundering controls. That is the regulator saying out loud what the affiliate pages do not.

The scale is worth putting in one place. The Commission's November 2026 analysis estimated that 0.6 per cent of the whole adult population engaged with an illegal gambling website in the past four weeks, rising to 2.5 per cent among those who had gambled online in that period. Its dashboard recorded 586 illegal sites accessible to British consumers in September 2026, 4 per cent more than a year earlier. H2 Gambling Capital puts stakes with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019, with the legal share falling from 97 per cent to 92 per cent. Commission methodology is more conservative and explicitly admits it cannot see activity hidden behind VPNs.

Regulatory Limits on Slot Stakes

A slot game not on GamStop is a slot game without the £5 maximum stake per game cycle. That limit went live on 9 April 2025 for all adults, with a £2 limit for 18- to 24-year-olds from 21 May 2025, attached to every remote casino operating licence by the Gambling Act 2005 (Operating Licence Conditions) (Amendment) Regulations 2025. It applies to online slots only, not roulette or blackjack, and a minimum of 2.5 seconds must elapse between game cycles under RTS 14D.

Offshore, none of it applies. The slot spins as fast as the software allows, at whatever stake the wallet permits. The Commission's figures show how much of the British market is built on slots: remote casino gross gambling yield was £5.0 billion in April 2024 to March 2025, of which £4.2 billion came from slot games. Slots are where the money and the harm concentrate, which is exactly why the stake limit exists and exactly why its absence abroad matters.

The design difference is stark when you look at the bonus terms. From 19 January 2026, British licensees cannot apply wagering requirements above ten times, and cannot offer mixed-product promotions requiring two or more types of gambling. The Commission chose a cap over an outright ban partly because it judged operators would otherwise introduce terms preventing customers cashing out, and it said the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". Offshore multipliers commonly sit in the 25x to 50x band for welcome offers and 40x to 60x for no-deposit bonuses, with cashout caps in the €50 to €100 range on the free offers. Anyone who has compared the two markets side by side knows which terms are easier to leave with money under.

One further thing that the offshore market does not have: the Reverse Withdrawals ban. RTS requirement 14B, in force since 31 October 2021, states that consumers must not be given the option to cancel a withdrawal request. On a British site, once you press withdraw, the money is gone from the balance and the temptation is removed. Elsewhere, that button often sits there.

Identity Verification Checks

If you want one fact to carry away from this page, take this one: over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and the concern is usually raised when a customer is asked for documents only on attempting to withdraw. Licence condition 17.1.1 says a customer's withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier. That single sentence is the difference between a well-run site and a cash-flow strategy.

Here is how it works the first time on a British site. A remote casino may identify a customer and verify age at registration and defer full verification until the anti-money-laundering threshold of €2,000 in deposits or withdrawals is reached — what the Commission calls the hybrid approach. Most now verify earlier, because the Commission expects checks before a customer deposits or stakes and has said onboarding on initials instead of full names, or a commercial address instead of a residential one, is not sufficient. Electronic verification against credit reference and electoral roll data is usually instant and document-free; where documents are requested, the Commission will not give a timescale because it varies.

The second time, and every time after, the check is supposed to be invisible. Customer due diligence is ongoing, but the practical rule is that the operator already holds what it needs and does not ask again. Watch for the pattern where a withdrawal that cleared in an hour in month one suddenly needs a bank statement in month four.

The warning signs are specific. A site that lets you deposit instantly without verification but stops your first withdrawal for documents is working the friction in the wrong direction — the Commission has said explicitly that it is not acceptable to introduce friction when a customer tries to withdraw rather than when they deposit. A term permitting only one withdrawal at a time, with no new request until the last is authorised, is unfair under the Consumer Rights Act 2015, as one operator found when it paid a £900,000 regulatory settlement in October 2026 covering, among other things, unnecessary delays to consumer withdrawals. And any term letting the operator confiscate a deposit on the basis that identity has not been provided is contrary to the fair-terms guidance; un-staked deposits remain the customer's.

Offshore, none of that is enforceable here. The Gambling Commission cannot resolve an individual complaint — it is a regulator, not an ombudsman — and has no jurisdiction over a site it does not licence. Disputes go to whatever alternative dispute resolution provider the offshore regulator approves, such as EGIS ADR, Axion ADR, iGaming ADR or an Anjouan-approved body under Anjouan rules, or to the Kahnawà:ke Commission's full-time dispute resolution officer. Both are real routes. Neither is the British one.

Five Signs an Operator Can Be Trusted

I have spent enough years reading licence registers to have a short list. None of these signs is about the brand, the graphics or the welcome offer.

The Licence Is Verifiable Where the Regulator Says It Is

Check the seal, not the logo. A Curaçao Certificate of Operation Seal must redirect to the CGA's certificate domain; if the seal differs in design, colour or format, the site is not authorised by the CGA. If the certificate behind the seal shows a different domain from the one being accessed, the site is displaying another operator's paperwork and should be treated as unauthorised or fraudulent. A licence certificate is not interchangeable with a Certificate of Operation. For Anjouan, certificates carry a unique licence number and a QR code linking to the public register; anything that cannot be verified there should not be relied on. For Malta, cross-check the authority's Unauthorised URLs list. The quick test: click the seal and read what loads.

Funds Are Disclosed Before the First Deposit

Customer funds held by a remote operator must sit in a separate client bank account, and the business must declare one of three ratings — not protected, medium protection or high protection — in its terms and conditions, with an operator rated "not protected" reminding the customer every six months. Crucially, a separate client account does not guarantee the money back on insolvency, and operators may hold it in overseas bank accounts. The quick test: find the insolvency rating before depositing, not after. If the site has no rating because it has no such obligation, that is the answer.

Withdrawals Are Priced and Timed in Writing

Look for terms that state any processing fee, any limit on the size or number of withdrawals, and the scheme the payout uses. A cost-reflective fee is permitted in Britain, and so is a reasonable limit on withdrawal size, provided it is fair, transparent and clear before deposit. A maximum cap on what can be withdrawn from a deposit balance is not permitted here at all. The quick test: search the terms for the word "withdraw" and read every sentence it appears in.

Complaints Go Somewhere Independent

A trustworthy operator has a complaints procedure with an eight-week limit and a route to an adjudicator who is free to the consumer. In Britain that route is an approved ADR provider — IBAS or eCOGRA handle most gambling disputes — and operators must respond to ADR requests for information within ten working days. eCOGRA's report covering 1 October 2024 to 30 September 2025 records 150 valid deposits-and-withdrawals disputes and a 31-day average domestic resolution time; IBAS recorded 217 banking and financial disputes among 3,721 domestic cases in 2024-25, with 20-day average completion. Offshore, an approved ADR provider is better than nothing and worse than a regulator. The quick test: the name and contact details of the adjudicator should be in the terms, not in a chat reply.

The Bonus Does Not Require You to Stay

A sane bonus caps wagering, keeps deposit and bonus balances visibly separate, and lets the customer leave with the deposit and any winnings from play with it. In Britain the cap is ten times and mixed-product offers are banned. Offshore, a 25x multiplier with a 5 per cent contribution from roulette is a very different product, and the contribution table is where the real cost hides: slots at 100 per cent, table games at 20 per cent, roulette and baccarat at 5 per cent, live dealer at zero. The quick test: find the game-weighting table before accepting anything.

How to Check an Offshore Operator Before Depositing

Six steps, in order of effort. All of them are lawful, ordinary checks, and none of them requires an account.

1. Read the licence footer and click the seal. Go to the regulator's own register and match the licence number to the domain you are on, not to the parent company's name. Reason: certificates are domain-specific in Curaçao, and a site can legitimately hold a licence that does not cover the domain it is serving.
2. Find the terms on self-exclusion and account restrictions. Reason: an operator that markets itself as sitting outside a self-exclusion scheme has told you its position in advance, and that position is the one it will take when a dispute arises.
3. Locate the withdrawal section and read the fee, the limits and the processing scheme. Reason: the Commission's own data shows withdrawal problems are the largest single category of consumer complaint in Britain, and offshore there is no regulator to escalate to.
4. Check the bonus contribution table and the maximum bet during wagering. Reason: a cap of a few pounds or euros per spin during wagering, breach of which forfeits the bonus and winnings, catches out more players than any multiplier does.
5. Identify the adjudicator and confirm it is one the offshore regulator actually approves. Reason: a named ADR provider that does not appear on the regulator's published list is decoration.
6. Run the numbers on the payment route before playing. Faster Payments settles over 90 per cent of transactions in under two seconds and carries a £1 million scheme ceiling, though individual banks set lower limits; crypto withdrawals depend on block confirmation, where six confirmations is the conventional merchant standard and both Bitcoin and Litecoin only average their target intervals rather than guaranteeing them. Reason: the method that is cheap to deposit with is often not the method that is quick to withdraw.

One further check, and it is the one people skip. A gambling blocking block at the bank is applied at card level, so it must be activated on each card, and most banks use a 48-hour or 72-hour cooling-off period before gambling transactions are allowed again once it is switched off. The Commission's list of banks offering the service names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. It costs nothing and it works on the payment rails, which is the one place where an offshore operator has no discretion at all.

And if any of this stops being an academic exercise, the routes out are free and open. The National Gambling Helpline, run by GamCare, is on 0808 8020 133, 24 hours a day, every day; callers in Wales can use 0808 2819 265. GamStop Online takes a few minutes to join and blocks all operators licensed in Great Britain; it can take up to 24 hours to take effect, cannot be cancelled during the term, and stays in force after the period ends until the person contacts GamStop to remove it. Gamblers Anonymous England, Wales and Ulster runs around 250 meeting locations and can be reached on 0330 094 0322. Citizens Advice Scotland's gambling support line is 0800 328 1131 on weekdays.

What the Regulator Actually Does

The Commission's Illegal Markets team is the most transparent part of this story, and the numbers deserve reading properly. Since April 2024 it has issued 3,140 cease and desist and disruption notices — 2,032 C&Ds, 774 registrar referrals, 402 host referrals and 3 payment provider referrals — referred 447,778 Bing and Google URLs, and secured 287,961 URL removals. Across 160 illegal gambling websites for which traffic data existed, engagement fell by an average of 32 per cent after disruption.

The composition of that work is the interesting part. By method, registrar blocks and website suspensions produced the largest average fall in engagement at 91 per cent each, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. The Commission says as much itself: GEO IP blocking and registrar blocks work better than search-engine removals, because removing a result from a search engine makes a site harder to find without blocking access to it.

The quarterly rhythm shows the treadmill. Websites referred to search engines rose from 124 in July to September 2024 to 321 in April to June 2025; cease and desist notices went 113, 83, 129 and 145 across those four quarters. Then the numbers climbed further: 226 sites referred in January to March 2026, 366 in April to June 2026 together with 147,721 URLs, and 1,835 sites with 7,677,211 URLs in July to September 2026, alongside 546 cease and desist notices. Meanwhile, across the whole of April 2025 to March 2026, the Commission commenced one prosecution. One.

That is the honest picture of the site angle this page exists to examine. Disruption is real — 77 per cent of disrupted websites saw a reduction in estimated traffic in the second quarter of 2026-27, according to the Commission's November 2026 dashboard — and it is also temporary, because a domain is cheap and a registrar is a commercial intermediary with no strong reason to care. The Gambling Commission's first referral to the payment network Visa came in January 2025, after a test purchase on an unlicensed site, with three more since; financial disruption is described in its own reporting as critical and still early-stage. The Illegal Gambling Taskforce, whose terms of reference DCMS published on 13 May 2026, has payments, advertising and cross-agency enforcement as its three priorities.

I would not hold my breath on any of it. The regulator can make an unlicensed site harder to find and slower to bank; it cannot make one safe, and it cannot make it honour a self-exclusion it never signed up to. That job belongs to the person holding the bank card, which is an uncomfortable place to leave it.

Frequently Asked Questions

What gambling sites are not on GamStop?

Any operator without a Gambling Commission licence. Participation in the scheme is a licence condition under social responsibility code 3.5.5, so sites licensed in Curaçao, Anjouan, Kahnawà:ke, Malta or nowhere at all sit outside it entirely. There is no list to consult, because there is no register of sites that do not participate — the test is whether a Commission licence exists, and the Commission's public register is where you check.

Are games not on GamStop UK sites legal to play?

The offence under section 33 of the Gambling Act 2005 attaches to the operator providing facilities without a licence, not to the adult customer placing a bet. There is no record of British consumers being prosecuted for gambling offshore. That is a description of the law, not an endorsement: lawful for the player does not mean the money is safe, the terms are fair, or any British protection applies.

Do Welsh gambling sites not on GamStop play by different rules?

No. Gambling is a matter reserved to Westminster, and the Gambling Act 2005 applies in Wales as it does in England and Scotland. The practical Welsh differences sit in support rather than regulation: the National Gambling Helpline number published for callers in Wales is 0808 2819 265, and Gamban blocking software is free for residents of Wales, unlike England and Scotland where it costs £4.99 a month or £29.99 a year.

Can a site outside GamStop accept my self-exclusion if I ask?

It can, but nothing obliges it to, and the arrangement dies with the account. Anjouan's rules require licensed operators to segregate player funds, hold certified random number generators and apply age verification; Kahnawà:ke goes further, making its own voluntary self-exclusion permanent and irrevocable, with funds forfeited to charity on a breach. Those are offshore regimes, not GamStop. A GamStop exclusion holds for its term and then continues until the person contacts GamStop to remove it.

Why do offshore sites ask for documents only when I withdraw?

Because a delay costs them nothing and a verified customer costs them work. The Commission has said it is not acceptable to introduce friction on withdrawal rather than deposit, and licence condition 17.1.1 forbids requiring extra information at withdrawal that could reasonably have been sought earlier. Offshore there is no such condition — the only constraint is the operator's own house rules and its appetite for the dispute.

What is the fastest-paying kind of site?

The uncomfortable answer is that speed correlates with regulatory obligation, not with jurisdiction. The Commission's data for June to September 2024 recorded 44.2 million withdrawals by customers of large online operators, of which 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent up to 48 hours. Consumer research published in July 2026 found 49 per cent of people who had gambled in the past year agreed withdrawals were quick and easy, 18 per cent disagreed. Offshore sites advertise speed because advertising it is free; measuring it is not.

The Sweeping Continues

Games not on GamStop come down to a single uncomfortable fact — a licence issued in Curaçao, Anjouan or Kahnawà:ke costs an operator between €17,828 and USD 40,000 a year and answers to nobody in Britain, and no amount of regulator disruption changes that arithmetic.

That is where the page has to stop, and it stops on the number the Commission published in November 2026: among people who had gambled online in the previous four weeks, 2.5 per cent had engaged with an illegal gambling website. In a market with roughly 13.4 million average monthly active accounts, that is not a fringe. It is a town.