Gambling Sites Not on GamStop and Regulator Enforcement

Gambling sites not on GamStop are operators with no Gambling Commission licence, so the national self-exclusion scheme cannot reach them. Offering gambling to consumers in Great Britain without that licence is illegal under section 33 of the Gambling Act 2005. UK protections, the ten-times bonus cap and the eight-week complaint route all stop at the licensed market's edge.

It is often typed "gamestop", but the scheme's name is GamStop, and the distinction matters more here than anywhere else on a gambling site: the register is a British licensing instrument, and it only binds the businesses that hold that licence.

What "not on GamStop" Actually Means

A gambling site not on GamStop is not a maverick insider of the British system. It simply sits outside it. The Gambling Commission states plainly that it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, and that this includes the case where the operator holds a licence somewhere else but trades into Britain without one.

The scheme's own terms keep it narrow. GamStop Online blocks access to gambling websites and apps licensed in Great Britain only, and can only exclude a person from participating operators; Gamstop states it cannot prevent access to services run by organisations that do not participate. Offshore sites holding no Commission licence are not connected to the scheme and are not covered by it — [unconfirmed] reported by trade and press sources rather than a regulator page, though consistent with the scheme's own terms of use.

So the honest framing is this: what gambling sites are not on GamStop is a definitional question, not a moral one. Every operator is not on GamStop until it takes a British licence, and the interesting question is what that absence changes for whoever opens the account.

Plenty, as it happens. Since 31 March 2020 every online gambling operator must be part of GamStop as a condition of its Commission licence. The requirement sits in Licence Condition 3.5.5, which says licensees must participate in the national multi-operator self-exclusion scheme. In April 2020 the Commission added the 24-hour rule: operators must check their entire customer base against the register at least daily, which also stops registered people receiving direct marketing. On 3 April 2020 it suspended two online operators' licences for missing the integration deadline.

That is the machinery on the licensed side. None of it reaches a site with no British licence, whatever its homepage claims about player protection.

Where self-exclusion comes up, the fact does not bend. Registration with GamStop Online blocks a person from gambling with all online gambling companies licensed in Great Britain for 6 months, 1 year, 5 years, or 5 years with auto-renewal. Signing up takes minutes; the block can take up to 24 hours to become effective. It cannot be cancelled during the term, and it stays in place after the chosen period ends until the person contacts GamStop to remove it. An offshore site is not a way round that.

And if anyone is struggling now: the National Gambling Helpline, run by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year, with live chat and WhatsApp on the same number. In Wales the number published is 0808 2819 265. Help does not depend on which licence an operator holds.

The Regulator's Own Scoreboard

If you want a checkable measure of what the Commission does about the sites our cluster of searches is really about, take the figures its Illegal Markets team published on 21 October 2025, covering its disruption work since April 2024.

Since April 2024 that team issued 3,140 cease and desist and disruption notices: 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and 3 payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs (339,757 to Google and 108,031 to Bing) and secured 287,961 URL removals. Measured across 160 illegal gambling websites for which traffic data existed, engagement fell by an average of 32 per cent after disruption action.

Read that ratio carefully, because the trade rarely does. 447,778 URLs reported, 287,961 removed, and web traffic on the survivors down by roughly a third. Nobody should imagine that a referral to a search engine is a closed door. The Commission itself says GEO IP blocking and registrar blocks work better than search-engine removals, precisely because removal makes a site harder to find without blocking it.

The enforcement picture got noisier, not quieter. In January to March 2026 the Commission referred 226 websites to search engines and issued 98 cease and desist notices. In April to June 2026 it referred 366 websites, covering 147,721 URLs. In July to September 2026 it referred 1,835 websites covering 7,677,211 URLs and issued 546 cease and desist notices. And across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced — a total of one, in October to December 2025.

That last line deserves a pause. Britain's gambling regulator does not prosecute its way through this. It disrupts, delists, blocks and refers to payment providers; criminal proceedings against illegal operators are vanishingly rare. Anyone weighing how much risk an unlicensed operator actually faces should start from that asymmetry rather than from the headlines about crackdowns.

The scale is contested, which is itself instructive. The Commission's September 2025 work identified just over 1,000 unique illegal gambling websites accessed by consumers in Great Britain over May 2024 to July 2025, with its affiliate-page method finding the number rising from 364 in May 2024 to 535 in July 2025 once crypto-casino search terms entered the methodology. Its figures published in November 2026 put 586 illegal gambling websites accessible to GB consumers in September 2026. H2 Gambling Capital, a market-intelligence firm, estimated stakes with illegal operators in the UK reached £16.6 billion in 2025, up from about £5 billion in 2019. The Commission's own analysis, published 5 November 2026, estimates that 0.6 per cent of respondents across the whole population engaged with an illegal gambling website in the past four weeks. Same market, different rulers; treat any single number as a range.

Reading the Payout Difference

Payouts are where the licensed-versus-offshore comparison stops being theoretical.

The Commission's own data for June to September 2024 records 44.2 million withdrawals by customers of large online operators. Of those, 96.3 per cent cleared automatically and 3.5 per cent within 24 hours. Earlier data from some of the largest companies showed around 99 per cent of withdrawal requests approved, processed and fulfilled within 24 to 48 hours. Consumer research published in July 2026 found 49 per cent of people who had gambled in the past 12 months agreed that it is quick and easy to withdraw and collect winnings, with 33 per cent neutral and 18 per cent disagreeing.

That is the standard of comparison, and it is a middling one. Complaints to the Commission's Contact Centre coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025 — a decline, but from a base where withdrawal problems were the number one topic raised by consumers, with around 2,000 complaints a year still arriving in July 2024. The Commission's Annual Report 2024-25 says issues relating to withdrawals continue to cause most of the complaints it receives. A British licence is not a guarantee of a same-day cheque. It is a floor with a complaints route above it.

British-Licensed Casino

Payout speed sets the benchmark because the regulator measures it. Withdrawals must not be delayed by a demand for documents the operator could reasonably have requested earlier (Licence Condition 17.1.1), fair-and-open terms apply under Condition 7.1.1, reverse withdrawals have been banned outright since 31 October 2021 under RTS requirement 14B — "Consumers must not be given the option to cancel their withdrawal request" — and maximum withdrawal caps on a deposit balance are prohibited. The LCCP sets no fixed number of days for payment; it relies on the fair-and-open condition instead. Terms that build in delay, such as one withdrawal at a time, have been found unfair under the Consumer Rights Act 2015.

Offshore Casino on a Non-UK Licence

No Condition 17.1.1, no Condition 7.1.1, no RTS 14B, no ADR entity the Commission has approved. Anjouan requires licensees to designate a regulator-approved ADR provider and lists EGIS ADR, Axion ADR, iGaming ADR and one licensee, with complaints expected to be resolved within 30 days before escalation. Kahnawà:ke requires a contractual relationship free of unfair or unreasonable terms and employs a full-time Dispute Resolution Officer. Those are real structures — thinner and further away. A Curaçao licence now comes directly from the Curaçao Gaming Authority under the LOK, which took effect on 24 December 2024 and replaced the master-licence model; the old orange sub-licence certificates ended on 15 October 2025.

Licence Claims and What Sits Behind Them

A licence claim is only worth the register behind it. The CGA issues two separate seals: a Certificate of Operation Seal for B2C operators, valid only for an approved and registered player-facing domain, and a License Certificate Seal open to B2B and B2C entities and not domain-specific. Clicking a Certificate of Operation Seal must redirect to cert.cga.cw; if the design, colour or format differs, the site is not authorised by the CGA, and if the certificate behind the seal names a different domain from the one being visited, the site is showing another operator's certificate. The Gambling Commission's advice is blunter: check the business holds a British licence and click through to the public register to see whether the site's activities and domain names match.

Bonus Terms Built In

Wagering is where an unlicensed offer usually hides its cost. From 19 January 2026, Commission licensees are banned from offering mixed-product promotions requiring two or more types of gambling, and wagering requirements on bonus funds are capped at ten times. The Commission chose a cap over an outright ban, noting the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements".

Offshore, no cap applies. A single offshore operator's published terms can set a 25× playthrough requirement, weight slots and specialty games at 100 per cent of contribution while roulette and baccarat count at 5 per cent and live dealer games at 0 per cent, and limit withdrawal of bonus-generated winnings to 300 per cent of the credited bonus, with the excess voided. None of that would survive a British fair-terms test. All of it is legal in the jurisdiction that issued the licence.

The Licence Behind the Lobby

If one thing on this page turns on a single fact, it is the licence — not the bonus, not the design, not the welcome offer.

The British version works like this. Licence Condition 17 was introduced on 7 May 2019 and requires operators to obtain and verify information establishing a customer's identity before that customer is permitted to gamble. The information includes, but is not restricted to, name, address and date of birth. Before permitting a deposit, licensees should tell customers what types of identity documents they may need, in what circumstances and in what form. That is the first-time experience: tell the player what is coming, then check before the money moves.

For anti-money-laundering purposes the picture has a threshold on top. In remote casinos, identification and verification are required when a customer deposits funds to take part in remote gambling, or withdraws such funds or winnings, amounting to €2,000 or more — and the threshold catches linked transactions, such as those forming part of a customer's overall activity during a single logged-on period. A remote casino may use the Commission's "hybrid approach": identify the customer and verify age at registration, then defer full verification until the €2,000 threshold is triggered.

The later experience should be duller. Documents a business can ask for include passports, driving licences and household bills, though companies can often verify by matching against databases such as credit reference agencies and the electoral roll, in which case no documents are needed. Electronic verification may be instant; where documents are requested, it takes longer, and the Commission says it cannot give a timescale because the process varies. Ongoing monitoring means checks can resurface when circumstances change.

Then there is the failure mode that has produced the most paperwork. Licence Condition 17.1.1 states a customer's withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier — though that does not prevent seeking information it must obtain at that time under another legal obligation, such as an AML requirement. Where a business delays a withdrawal because of insufficient ID, it may be in breach of Licence Condition 17 and face regulatory action. More than a quarter of complaints reaching the Commission's Contact Centre concern identity verification, a concern customers raise when asked for documents only on attempting to withdraw, and the Commission has criticised operators using "fuzzy matching" through third-party verification providers and onboarding customers on partial or equivocal verification.

Two warning signs are worth naming. A site that asks for nothing at sign-up and everything at cash-out has its checks the wrong way round. And an operator that lets a customer onboard with a middle name instead of a forename can create mismatches with records held elsewhere, including GamStop, which undermines the effectiveness of self-exclusion — the Commission has said so directly.

Offshore, none of those requirements bind. Anjouan's published standards do require operators to segregate player funds, use random number generators certified by an approved independent testing facility, and implement AML/CTF controls and age verification. That is more than nothing. It is also a nine-word list against a British licence condition set running to dozens of pages, enforced by a regulator with a statutory levy behind it.

Five Signs an Offshore Operator Is Worth Trusting

Trust here is not a vibe. Each of these signs is checkable in a few minutes, and each has a specific place to look.

The Licence Is Real and Currently Valid

Check the register, not the footer. Curaçao's reform is the sharpest test available: the LOK took effect on 24 December 2024 and closed licensing to the four former master licensors — Gaming Curaçao (365/JAZ) on 18 August 2024, Curaçao eGaming (1668/JAZ) on 1 October 2024, an operator (8048/JAZ) on 1 November 2024 and Curaçao Interactive Licensing (5536/JAZ) on 31 January 2025. A historic /JAZ number or legacy seal must not be treated as independent proof that an operator currently holds a valid CGA licence. Verify through the regulator's own register.

The Seal Points Where It Should

If a site displays a CGA Certificate of Operation Seal, click it. It must redirect to cert.cga.cw. If the seal differs in design, colour or format, the website is not authorised by the CGA. If the certificate shown behind the seal displays a different domain name from the site being accessed, it belongs to another operator and the site should be treated as unauthorised or fraudulent. Note too that the CGA announced on 7 October 2026 that its previous online gaming portal would not return to service and that it is working on an alternative mechanism for verifying licensed domains, so a stale seal is not automatically a fraud — but an unverifiable one is not evidence either.

Fees and Standards Are Published

A regulator that publishes its fees is a regulator that exists. The Curaçao B2C application fee is a one-time non-refundable €4,592, with €150 per ultimate beneficial owner and €150 per qualified interest holder, and the total annual B2C fee is €47,450 — a €24,490 licence fee to the National Treasury and a €22,960 supervisory fee to the CGA, payable in full by 15 January. Anjouan's schedule is €17,828 for B2C licence issuance, one-time, and the same for annual renewal, with €500 per additional domain or URL. Malta charges a one-time €5,000 application fee, a non-refundable fixed annual licence fee of €25,000, and gaming tax of 5 per cent of gaming revenue, with minimum issued and paid-up share capital of €100,000 for Type 1 and Type 2 B2C licences. Kahnawà:ke's Client Provider Authorisation fees rise on 1 January 2027, with the application fee going from USD 35,000 to USD 40,000 and the annual CPA fee unchanged at USD 20,000. An operator whose regulator publishes nothing is telling you something.

The Complaints Route Is Named and Reachable

Look for a named ADR provider in the terms, with contact details, and a stated deadline. Anjouan requires licensees to designate an Authority-approved ADR provider and list its name and contact details in player-facing terms, with operators expected to resolve complaints within 30 days before a player may escalate. Kahnawà:ke's rules let a player set limits including zero and state its own voluntary self-exclusion is permanent and irrevocable. The British comparison: under Licence Condition 6.1.1 a licensee must let a customer refer a dispute to an ADR entity free of charge if it is unresolved within eight weeks, and the Commission maintains the list of approved providers. IBAS handled 3,721 domestic disputes in the year to 30 September 2025, with an average completion time of 20 days and 100 per cent operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. Ask yourself what the offshore equivalent would put in writing.

Withdrawal Terms Are Plain, Not Layered

Read the withdrawal clause before depositing. Warning signs include a maximum cashout on bonus winnings, a rule that only one withdrawal may be requested at a time until the previous one is authorised, and manual review of every fifth or tenth withdrawal. That last pattern is not hypothetical: in October 2026 an operator agreed a £900,000 regulatory settlement for failures including unnecessarily delaying consumer withdrawals, with withdrawal-specific failures including a one-withdrawal-at-a-time term found unfair under the Consumer Rights Act 2015 and manual review of every fifth or tenth withdrawal requiring extra information before processing. If that happened under a British licence, with Condition 17.1.1 in place, imagine the same clause where no one is watching. The Commission's position is that it is not acceptable to introduce friction when a customer tries to withdraw rather than when they deposit.

How to Check a Site Before You Register

Any adult can do all six of these in an evening. None of them requires an account, and none requires a deposit.

1. Check the British public register first. Search the Commission's register for the trading name, then check that the domain names and activities listed match the site in front of you. The Commission advises exactly this, and a licence held for a different domain is not a licence for this one. A site absent from the register is, by definition, one of the gambling sites not on GamStop — and that is a fact about its legal position in Britain, not a slur.
2. Verify any offshore licence on the regulator's own register. For Curaçao, use the CGA's verification route; for Kahnawà:ke, the Logo Certificate Program lets a player click the Commission's logo on a site to generate a Certificate of Good Standing confirming whether that site holds a valid KGC permit. Anjouan's certificates carry a unique licence number and a QR verification code linking to the public register, and certificates that cannot be verified there should not be relied upon as evidence of licensing status.
3. Read the withdrawal clause and the bonus terms before you deposit. Look specifically for maximum cashout language, wagering multipliers expressed as a multiple of bonus amount or bonus plus deposit, game contribution weights, maximum bet while wagering, and terms letting the operator void winnings at its own discretion. In the UK such a discretion clause is unfair within the meaning of the Consumer Rights Act 2015; it cost one operator £170,000 in July 2025 in a fine that included a term allowing it to close accounts or forfeit winnings at its own discretion.
4. Confirm what protection exists if the operator fails. Under Licence Condition 4.1.1, a remote operator's customer funds must sit in a separate client bank account, and every licensee must choose one of three published ratings — "not protected", "medium protection" or "high protection" — state which applies in its terms, and if rated "not protected" remind the customer every six months that funds are not protected in the event of insolvency, stating the value held. Keeping funds in a separate account does not mean customers get their money back if the business fails, and gambling businesses are legally allowed to hold customers' money in overseas bank accounts. Offshore, ask what the equivalent disclosure says; often nothing does.
5. Set the account limits before you play, not after. Since 31 October 2025 all British gambling businesses must prompt customers to set a financial limit before their first deposit, make it easy to review and alter, remind customers every six months to review their account and transaction information, and offer financial limits using a free-text box at account level. Under RTS 12E, setting a limit must be presented as the default option and the customer must take an action to decline and confirm. GamStop also signposts Gamban and BetBlocker as blocking software for phones, tablets and computers; Gamban states it blocks licensed and unlicensed sites and that its protection is designed to be as difficult to remove as possible.
6. Know the complaint route before you need it. A British-licensed operator must let you escalate to an approved ADR entity free of charge after eight weeks. The Commission's approved list is ADR Group, Pegasus ADR Service, one licensee, the Centre for Effective Dispute Resolution (CEDR), eCOGRA, IBAS, ProMediate and Tattersalls Committee — and IBAS and eCOGRA have historically handled most gambling disputes. The Commission is a regulator, not an ombudsman: it cannot resolve an individual complaint or get anyone's money back, though it records complaints. If a dispute is worth pursuing, that route matters more than any review page.

Questions About Gambling Sites Not on GamStop UK

What gambling sites are not on GamStop?

Any operator without a Gambling Commission licence is outside the scheme. That covers crypto casinos on Curaçao or Anjouan licences, some Kahnawà:ke permit holders and sites with no real licence at all. Anjouan Gaming says plainly that an Anjouan licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world", and that no licensing authority can exempt an operator from local law where local authorisation is required. In Britain, that local authorisation is a Commission licence.

Are gambling sites not on GamStop legal in the UK?

Not for the operator. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and it is immaterial whether the facilities are provided wholly or partly by remote communication and whether inside or outside the UK. For remote gambling the section applies if at least one piece of remote gambling equipment used is situated in Great Britain, or if the provider knows or should know the facilities are likely to be used in Great Britain. On summary conviction the penalty runs to 51 weeks' imprisonment, a fine at level 5, or both.

Do UK gambling sites not on GamStop get shut down?

Slowly, and mostly not by prosecution. Since April 2024 the Commission's Illegal Markets team issued 3,140 cease and desist and disruption notices and secured 287,961 URL removals from 447,778 referrals to Bing and Google. It reports GEO IP blocking and registrar blocks as more effective than search-engine removals. Across April 2025 to March 2026 every quarter recorded 0 or 1 prosecutions commenced. Sites get delisted, geo-blocked and pushed away from payment rails; they rarely get charged.

Why do offshore casinos target excluded players?

Because the Commission's own warning notice of 20 January 2025 says so. It warned about casino games supplied by licensed operators appearing on unlicensed websites available to GB consumers, noting those sites often target customers who have self-excluded via GamStop and may have inadequate social responsibility and AML controls. The mechanism is simple: a person on the register cannot open an account with a licensed operator, and an unlicensed one never checks the register. That is not a loophole. It is the whole point of the scheme, and it is why the register's reach ends at the licence.

What about welsh gambling sites not on GamStop?

There is no separate Welsh licensing regime, so the question collapses into the same one. Self-exclusion is national: GamStop Online blocks all online operators licensed in Great Britain, and Wales is inside that. For anyone in Wales the National Gambling Helpline number published is 0808 2819 265, alongside 0808 8020 133 for England and Scotland. Another route exists locally: Citizens Advice Scotland runs a gambling support service advice line on 0800 328 1131, Monday to Friday, 10am to 3pm, for free confidential support on debt, housing, work and relationships linked to gambling.

Can an offshore site be trusted if it has a real licence?

Sometimes — a licence with a live register entry, published fees, segregated player funds and a named ADR provider is not nothing. But weigh what it does not carry. Malta's authority publishes a list of Unauthorised URLs, declaring it has no connection with those domains and that any reference to a Maltese licence on them is false and misleading, with recent entries carrying notice dates of 30 October 2026. A licence claim is the beginning of due diligence, not the end of it, and no offshore licence replaces a British one for dispute resolution.

The Short Version

Gambling sites not on GamStop are not a hidden corner of the British market but a different market entirely, and the figures the Commission publishes — 3,140 disruption notices, 287,961 URL removals, one prosecution commenced in a year — describe a regulator playing a long game of attrition rather than one closing doors. If any of this is closer to home than it should be, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day of the year. The register remains the cleanest instrument in British gambling: 614,738 people were on it as of July 2026, and more than one in two of them had chosen the maximum five-year exclusion.