Casino Sites Not on GamStop and Enforcement

Casino sites not on GamStop hold no Gambling Commission licence, so the scheme cannot touch them. In 2026 the Commission's Illegal Markets team refers thousands of URLs to search engines a quarter, yet opens hardly any prosecutions. A site's absence from the scheme is therefore a clue about its licence, not proof of anything else.

It is often typed "gamestop", which is worth noting once, because the spelling and the scheme are different things: GamStop is the national online self-exclusion scheme, run by The National Online Self Exclusion Scheme Limited in Harrogate, free to use, and backed by a licence condition rather than goodwill.

The odd thing about this corner of the market is how much paperwork surrounds a group of sites that have none. The Gambling Commission's Illegal Markets team published figures in October 2025 covering the period since April 2024: 3,140 cease and desist and disruption notices, made up of 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and three payment provider referrals. Over the same stretch it referred 447,778 Bing and Google URLs and secured 287,961 removals. Those are not small numbers. They are also, by the Commission's own admission, a different kind of work from enforcement: search-engine removal makes a site harder to find rather than impossible to reach, and across 160 illegal gambling websites with usable traffic data the average fall in engagement after disruption was 32 per cent.

So the honest framing for anyone weighing up casino sites not on GamStop is this. There is a regulated market, worth £8.3 billion in remote casino, betting and bingo gross gambling yield in the year to March 2026, and there is an unlicensed margin around it. The Commission's own survey work, published in November 2026, put engagement with illegal gambling websites at 0.6 per cent of adults in the past four weeks. Small. But 586 illegal sites were identified as accessible to British consumers in September 2026 alone, which tells you the margin is persistent and cheap to replenish.

Why the Licence, Not the Brand, Is the Whole Story

A British-licensed operator is bound by the Licence Conditions and Codes of Practice. That is the standard against which everything else should be measured.

It means the operator must participate in the national multi-operator self-exclusion scheme, under social responsibility code provision 3.5.5 — a requirement in force since 31 March 2020. It means the operator must check its entire customer base against the register at least every 24 hours, a rule introduced in April 2020 that also stops registered people receiving direct marketing. It means wagering requirements on bonus funds are capped at ten times, from 19 January 2026. It means the operator must be connected to an approved alternative dispute resolution provider, free to the consumer.

Offshore sites inherit none of that. An offshore licence is real in the sense that the regulator named on the certificate exists; it is simply not the British one, and it does not carry these obligations. Curaçao, for instance, finally replaced its master-licence model when the National Ordinance on Games of Chance took effect on 24 December 2024, with direct licensing by the Curaçao Gaming Authority. Operators holding a valid licence at that moment got a six-month provisional licence, later extended to 24 December 2025. Legacy "orange" sub-licence certificates ended on 15 October 2025. A historic /JAZ number is not proof of anything current.

The Commission's language on this is unusually blunt. It states it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, and that this includes an operator holding a licence in another jurisdiction. Section 33 of the Gambling Act 2005 makes providing facilities for gambling without an operating licence an offence, and it is immaterial whether those facilities are provided wholly or partly by remote communication, or inside or outside the UK.

Let me be clear about what that does and does not mean, because both sides of this argument overreach. It does not mean a player commits an offence by opening an account on an unlicensed site — the Act's general gambling offences attach to those providing facilities, not to adult consumers. It does mean the protections evaporate. No GamStop block. No statutory ADR route. No fair-terms condition. If the operator's terms say it reserves the right to void winnings at its sole discretion, and it exercises that right, there is no licence condition to breach and no regulator to complain to.

What the Regulator Actually Does

The site angle of this page is the enforcement, so let me put the numbers where they belong — in sequence, without the press-release gloss.

Search-engine referrals have risen sharply. The Commission referred 124 websites to search engines in July to September 2024. By April to June 2025 that was 321. In January to March 2026 it was 226, then 366 in April to June 2026, then 1,835 in July to September 2026 — alongside 7,677,211 URLs referred and 546 cease and desist notices in that last quarter.

Cease and desist notices show a steadier grind: 113 in July to September 2024, 83 in October to December 2024, 129 in January to March 2025, 145 in April to June 2025, then 98 in January to March 2026 and 546 in July to September 2026.

Criminal investigations are where the strategy falls silent. Across April 2025 to March 2026, every quarter recorded zero or one prosecutions commenced — one prosecution in total, in October to December 2025. April to June 2026 began zero.

That gap is worth sitting with. The Commission describes its own approach as disruption rather than prosecution, and the reason is arithmetic: an unlicensed operator can be stood up in a jurisdiction with a cheap licence and cheap hosting, and a criminal case takes years. Disruption is faster and, on the Commission's evidence, more effective than one might guess — registrar blocks and website suspensions produced an average 91 per cent fall in engagement, GEO IP blocking 60 per cent, Bing removal 52 per cent, Google removal 30 per cent and Facebook removal 8 per cent.

The comparison is instructive for anyone choosing where to play. Having your site delisted by Google is a marketing problem. Having your domain suspended by a registrar is an existential one. Which is why the Commission refers so heavily to search engines and says openly that this makes a site harder to find rather than blocking access — a distinction that matters enormously if you happen to already know the address.

Reporting payment transaction data to the Visa Operator Scheme is described by the Commission as critical and still early-stage; its first referral followed a test purchase in January 2025, with three more since. That is the lever that would actually bite. It is also the one still being built.

The Comparison Table

The table below compares four licence positions by what they oblige an operator to do, not by who holds them. The figures come from the regulators' own published fees and rules.

Read the last column again. The annual supervisory cost of a British licence is not a fee at all — it is 1.1 per cent of gross gambling yield, which on any serious book dwarf the flat charges elsewhere. Anjouan's entire yearly cost is €17,828. That is the economic fact underneath this whole subject: the regulatory overhead in Great Britain is orders of magnitude larger, and the difference is precisely what gets bought with it.

The Terms That Build In Delay

A subtler thing to watch than any licence seal is the structure of the withdrawal terms. Delays usually are not hidden; they are written down and normalised.

British-licensed operators face a specific rule here. LCCP licence condition 17.1.1 says a customer's withdrawal request must not trigger a demand for additional information that the licensee could reasonably have requested earlier — subject to genuine anti-money-laundering duties, which are separate. The Commission has said it is not acceptable for operators to introduce friction when a customer tries to withdraw rather than when they deposit, and that where there are no regulatory concerns there is no valid reason to delay a payout.

A specific example makes the point. On 21 October 2026 the Commission announced that one licensee would pay £900,000 in a regulatory settlement for failures including unnecessarily delaying consumer withdrawals. The withdrawal failures included a term stating customers could request only one withdrawal at a time and could not request another until the original was authorised — found unfair under the Consumer Rights Act 2015 — and manual review of every fifth or tenth withdrawal for some customers, which led to extra information being required before processing.

Now notice the asymmetry offshore. There is no licence condition 17.1.1 on an offshore site. Terms such as a maximum cashout clause, a single-withdrawal-at-a-time rule, a fee for a second withdrawal in a month, or a manual review triggered at a particular threshold are all perfectly permissible under a Curaçao or Anjouan licence, because nothing prohibits them. Am I saying every offshore site uses them? No. I am saying the choice is theirs, and there is no regulator standing behind the choice.

The playback is instructive. Complaints coded "Withdrawals and/or financial transactions" to the Commission's Contact Centre fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025 — in a regulated market. The Commission's Annual Report for 2024-25 still records withdrawals as the cause of most complaints it receives. If the licensed sector, with a fair-terms condition, a banned reverse-withdrawal function and a live ADR network, cannot fix payouts entirely, an unregulated one has no reason to try.

How Identity Checks Work, the First Time and Later

This is the single thing the whole topic turns on, because a withheld withdrawal nearly always turns into an identity argument.

For a British-licensed operator, licence condition 17 requires information establishing a customer's identity — name, address and date of birth at minimum — to be obtained and verified before that customer is permitted to gamble. That condition arrived on 7 May 2019. The Commission expects checks to be brought forward to before a deposit or a stake, and says onboarding on incomplete information — initials instead of forenames, nicknames, commercial addresses instead of residential ones — is not sufficient.

The first time, then, should be quick and dull. Most operators verify against credit reference agencies and the electoral roll, in which case no documents are asked for at all. If documents are needed, the Commission names passports, driving licences and household bills, and says it cannot give a timescale because the process varies — instant when electronic verification succeeds, slower when paper is involved. A selfie may be requested where fraud is suspected, such as identity theft.

Later, the checks change character. They become ongoing, and they can be triggered by the money rather than the signup. Under the Money Laundering Regulations 2017, a remote casino must identify and verify when a customer deposits or withdraws €2,000 or more — and the threshold applies to linked transactions, not just single ones. Financial vulnerability checks have been a licensing requirement on remote operators since August 2024, at a threshold lowered to £150 net deposits over a 30-day period from 28 February 2025. Financial risk assessments are coming in stages, announced 7 July 2026, starting with the largest operators at £5,000 net deposits in a rolling 24-hour period for customers aged 25 and over and £2,500 for under-25s.

The warning signs are easy to list. A demand for documents that arrives only when a withdrawal is requested. A source-of-funds request that asks for bank statements covering years rather than the transaction in question. A mismatch that has been sitting in the account since signup and is discovered on the way out. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and the Commission has flagged concern about operators using fuzzy matching — onboarding people on partial or equivocal verification — which then surfaces as a problem months later.

One consequence is worth spelling out. A middle name entered in place of a forename, or a slight misspelling, can create a mismatch with records held elsewhere, including GamStop's. That is how a self-exclusion quietly fails to hold.

Five Signs an Operator Can Be Checked

Not a scoring system. Just five things that can be verified before any money moves, each of which tells you something real.

The Licence Is on the Public Register, and the Domain Matches

The Commission advises consumers to click through to its public register and check whether the site's activities and domain names match what is listed. A licence entry for one domain does not cover a sister site on a different address. If the register shows a different trading name, or nothing at all, that is the answer.

The Regulator's Name Points to a Verifiable Certificate

Curaçao's rules are unusually specific here. A Certificate of Operation Seal is issued only for an approved player-facing domain, and clicking it must redirect to cert.cga.cw. If the seal differs in design, colour or format, the site is not authorised by the CGA. If the certificate behind it shows a different domain from the one being viewed, the site is displaying someone else's certificate. A licence certificate is not interchangeable with a Certificate of Operation.

Anjouan's framework is similar in shape: certificates carry a unique licence number and a QR code linking to a public register, and certificates that cannot be verified there should not be relied on.

The Terms State the Customer-Funds Rating

British licensees holding customer funds must state clearly in their terms whether those funds are protected in the event of insolvency, at which of the three ratings — not protected, medium protection, high protection — and by what method. An operator rated "not protected" must remind customers every six months, stating the value of funds held. Customer funds must sit in a separate client bank account, and money staked within an open bet is not customer funds at all. Offshore, none of this is required, and a claim of "segregated funds" is a statement by the operator rather than a regulatory position.

Withdrawal Terms Are Short Enough to Read

Look for withdrawal caps, per-transaction limits, charges for processing, review triggers and any clause granting the operator sole discretion — "may" or "reserve the right" — to void or withhold winnings. British guidance treats such discretion clauses as unfair under the Consumer Rights Act 2015, and prohibits maximum withdrawal limits on the deposit balance. Offshore, a maximum cashout clause — for instance a cap at 300 per cent of the credited bonus amount, with the excess voided — is simply contractual.

There Is a Named ADR Provider in the Terms

British licensees must let customers refer an unresolved dispute to an ADR entity free of charge after eight weeks. The Commission's approved list includes IBAS, eCOGRA, CEDR, ProMediate, ADR Group, Pegasus ADR Service, Blexr and Tattersalls Committee. Anjouan requires a designated, approved ADR provider with contact details in the player-facing terms; its current list is EGIS ADR, Axion ADR, iGaming ADR and one provider. If no provider is named, there is no dispute route beyond emailing the operator.

What a Careful Check Looks Like

The method below is ordinary diligence. All of it uses public information.

1. Check the public register first, and match the domain. The Commission's register lists licensed activities and domain names. If the site is not there under the address you were about to use, you have learned the main fact already, and everything below becomes academic.
2. Follow the seal rather than trusting the picture of it. Click it. A Curaçao Certificate of Operation must redirect to cert.cga.cw, and the certificate must show the domain you are on. Anjouan certificates carry a licence number and a QR code that should resolve on the public register.
3. Read the withdrawal section before the bonus section. The bonus page is written to be attractive; the withdrawal page is written to be survived. Look for caps, per-transaction limits, processing fees, review triggers and sole-discretion language.
4. Find the customer-funds sentence. British licensees must disclose their insolvency rating and get an acknowledgement before funds are used for gambling. Offshore, the absence of the sentence is itself the finding.
5. Identify the ADR provider, then check it is really approved. A named provider that does not appear on its own regulator's list is worse than no provider, because it looks like a route where none exists.
6. Decide what you are actually buying. A British licence buys a GamStop block that holds, statutory ADR, fair-terms conditions and a 24-hour customer-base check. An offshore licence buys whatever the operator chose to write. Those are the two products; the headline offers are decoration.

Before Any of That, Understand What GamStop Cannot Do

GamStop Online blocks access to gambling websites and apps licensed in Great Britain only. It can only exclude a person from participating operators, and cannot prevent access to services run by organisations that do not participate — which, by definition, includes unlicensed sites. This is not a loophole; it is the boundary of the scheme, and it is stated plainly in GamStop's own terms.

Self-exclusion under the scheme is worth describing precisely, because the terms are stricter than most people assume. It can be set for six months, one year, five years or five years with auto-renewal. It cannot be cancelled or deactivated during the exclusion period. And when the chosen period ends, it stays in place until the person contacts GamStop to have it removed — the default is that nothing happens. Under the terms last updated 20 May 2026, auto-renewal can only be switched off during the final six months of a five-year minimum exclusion period, and if the person does nothing after their chosen term, GamStop holds the data through a further automatic seven-year self-exclusion period, during which operators are told the person was previously excluded. The Group's 2025 annual report devotes a section to its refusal to remove registrations before the chosen term ends.

That is the point at which the "not on GamStop" question becomes a test of character rather than of software. An offshore site is never a way round a self-exclusion. It is a way round the register, which is a different thing: the register is the mechanism, and finding something the mechanism does not cover does not change the commitment.

The scale is not marginal, either. GamStop recorded 117,756 new registrations during 2025 and had 561,983 active exclusions at the end of the year. By July 2026 it reported 614,738 consumers currently on the register, with more than one in two having opted for the maximum five-year term. Of the exclusion periods chosen in 2025, 29 per cent were six months, 24 per cent a year, 25 per cent five years and 22 per cent auto-renewal. In the first half of 2026 registrations rose 16 per cent year on year, with a record 12,236 in May 2026, and under-25s accounted for nearly one in three of all self-exclusions in that half-year.

The Commission knows exactly where those people are targeted. Its warning notice of 20 January 2025 said casino games supplied by licensed operators were appearing on unlicensed websites available to British consumers, and that such sites often target customers who have self-excluded via GAMSTOP and may have inadequate social responsibility and anti-money-laundering controls. That is the trade described by the body that regulates it.

For land-based exclusion, the schemes are separate. SENSE covers licensed casinos, with a six-month minimum extendable to twelve, removal only in person with a manager during the following six-month "Thinking" period and a 24-hour cooling-off period after that. GamStop Betting Shops, formerly MOSES, is telephone-based, excludes a customer from named bookmakers' areas for a fixed twelve-month term that cannot be ended early, and covers roughly 6,000 shops with over 60 operators. Bingo clubs and arcades have their own arrangements.

New Sites, and Why Their Age Is Not the Signal

People ask constantly about new operators, as if a recent launch were evidence of either appetite or risk-taking. It is neither. The age of a site tells you almost nothing; the licence behind it tells you most of what matters, and the terms tell you the rest.

What does vary with newness is the practical stuff. A newer British-licensed operator may still be building out payment rails, so Faster Payments may be routed oddly or a card withdrawal may take an extra day. Older operators have had longer to discover which withdrawal rules attract complaints. What newness never changes is the licence floor: the ten-times wagering cap, the ban on mixed-product promotions that took effect on 19 January 2026, the ADR requirement and the customer-base checks all apply from day one.

Payments deserve a note, because the method often matters more than the operator. A British licensee must accept payment from Great Britain customers only by a method whose provider is a payment service provider under the Payment Services Regulations 2017 — a condition effective 31 January 2024. The credit card ban has been in place since 14 April 2020, and operators must also ensure that money arriving via e-wallet was not loaded from a credit card. Offshore sites face neither rule.

Two payment paths are frequently searched and worth separating. For pay by phone, British operators can accept it only where the provider qualifies under those regulations; an offshore site may accept it where the provider is unregulated. For PayPal, a personal UK account charges nothing to withdraw a balance to a bank account when no currency conversion is involved, but that is PayPal's fee schedule — the operator's own payout terms sit on top of it, and they are where the delay lives.

The volume of legitimate-looking payment choice is not a signal of regulatory quality. The signal is whether the flow of money is reversible, traceable and inside a scheme with a complaints route.

The Scheme's Numbers, Read Properly

While the market data is out, the enforcement picture is worth completing, because a page about unlicensed sites should not leave the totals vague.

The Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026 — four per cent below the previous three-month average and four per cent above September 2025. That stability is the finding. Disruption is working on individual sites without shrinking the pool, which is what you would expect when the cost of entry is a five-figure annual fee.

Look at the engagement data and the same story appears. The Commission estimates total time spent on illegal gambling websites by British consumers at 306 million minutes in January 2025, falling to 116 million in June 2025 and 152 million in July 2025. The movement tracks enforcement intensity closely. It is a level that can be pushed down and does not stay down.

On scale, the estimates diverge so widely that the honest answer is that nobody knows. H2 Gambling Capital put the amount staked with illegal operators in the UK at £16.6 billion in 2025, up from about £5 billion in 2019, with the proportion of gambling happening legally falling from 97 to 92 per cent. The Frontier Economics study for the Betting and Gaming Council conservatively estimated £2.7 billion staked annually online on the black market. Yield Sec's analysis for the Campaign for Fairer Gambling put the British online market at £8.8 billion gross gaming revenue in 2025, split 91 per cent regulated and 9 per cent unregulated. The Commission's own survey work, from November 2026, suggests 2.5 per cent of people who had gambled online in the past four weeks had engaged with an illegal gambling website.

Those numbers cannot all be right. When estimates of the same market differ by a factor of six, the methodology is doing more work than the measurement — which is a reason to be sceptical of any operator quoting "the black market is growing" as a sales argument.

Who to Contact, and Where the Money Went

The help bodies are the part of this page that should be short and unambiguous.

The National Gambling Helpline is operated by GamCare on 0808 8020 133, free, 24 hours a day, every day of the year, and reachable through live chat and WhatsApp from the same number. Callers in Wales are given 0808 2819 265. It is not a crisis line. BeGambleAware is the public-facing brand of the charity GambleAware and directs people to the same helpline. GamFam, a registered charity set up by people affected by the gambling of family members and friends, runs a structured five-stage peer-support programme for affected families and for people in recovery. Gamblers Anonymous England, Wales and Ulster can be reached on 0330 094 0322 and runs around 250 meeting locations with no appointment needed. Gam-Anon UK & Ireland supports the family and friends of compulsive gamblers, whether or not the gambler attends GA. Citizens Advice Scotland runs a gambling support advice line on 0800 328 1131, open Monday to Friday, 10am to 3pm.

Treatment in England is now commissioned by NHS England, funded by the statutory levy worth approximately £100 million a year and split 50 per cent to treatment, 20 per cent to research and 30 per cent to prevention. The levy itself, introduced by the Gambling Levy Regulations 2025 and commenced on 6 April 2025, raised just under £120 million in its first year, ringfenced solely for research, prevention and treatment of gambling-related harm. The headline rate is 1.1 per cent of previous-year Gross Gambling Yield for all online operators.

And the Commission, for all the enforcement machinery above, is a regulator and not an ombudsman. It cannot resolve an individual complaint or get anyone's money back. It records complaints and refers disputes to a third party. On an unlicensed site there is no third party to be referred to.

Questions About Casino Sites Not on GamStop

Are casino sites not on GamStop legal?

The site is operating unlawfully, not the player. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and the Commission states plainly that it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence elsewhere. The Act's general offences attach to those providing facilities, not to adult consumers.

Why can't GamStop block them?

Because the scheme's obligations attach to the licence. GamStop can only exclude a person from participating operators, and all operators holding a Gambling Commission licence must participate under social responsibility code 3.5.5. A site with no British licence has no obligation to join, so there is nothing to enforce. GamStop's own terms say it cannot prevent access to services run by organisations that do not participate.

Do these sites pay out faster than licensed ones?

Some claim to, and the claim is unfalsifiable because there is no reporting requirement and no regulator collecting the data. In the licensed market, Commission data covering June to September 2024 recorded 44.2 million withdrawals by customers of large online operators, of which 96.3 per cent cleared automatically. Offshore, the speed is a business decision that can be reversed the moment it suits the operator.

What happens if an offshore site refuses to pay?

Almost always, nothing. There is no licence condition requiring a withdrawal without avoidable delay, no maximum withdrawal limit ban, and no statutory route to an approved ADR provider. If the operator has designated one — Anjouan requires this — the provider may consider the dispute, but there is no regulator behind its decision. The Commission cannot help: it is a regulator, not an ombudsman.

Does a Curaçao licence mean anything now?

It means more than it did. The LOK took effect on 24 December 2024, replacing the master-licence model with direct licensing by the Curaçao Gaming Authority, and legacy orange sub-licences ended on 15 October 2025. But a historic /JAZ number proves nothing, and the CGA said on 7 October 2026 that its old portal would not return to service, so domain verification is being rebuilt.

Is an offshore site a way round a self-exclusion?

No. Self-exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it. Nothing about an unlicensed site changes that, and the Commission's January 2025 warning notice states that unlicensed websites often target customers who have self-excluded via GAMSTOP. Treating a gap in the register's coverage as permission would be a misreading of what was agreed.

Why are there so few prosecutions?

Because disruption is faster and, on the Commission's own measure, effective. Registrar blocks and website suspensions produced an average 91 per cent fall in engagement, ahead of GEO IP blocking at 60 per cent and Google removal at 30 per cent. Across April 2025 to March 2026 every quarter recorded zero or one prosecution commenced — one in total. A criminal case takes years; a registrar referral takes weeks.

Understanding the Unlicensed Market

Casino sites not on GamStop are not a hidden tier of the market with better odds; they are the part of it that chose not to buy the licence, and the price of that choice is paid by the player, not the operator. The British standard is specific and checkable — a GamStop block that holds for its full term, a ten-times wagering cap, statutory ADR, a named customer-funds rating, a 24-hour customer-base check — and every offshore licence on the comparison table above buys none of it for a fraction of the cost.

If any of this is close to home, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day of the year.

One number to finish on. The statutory levy raised just under £120 million in its first year, ringfenced solely for research, prevention and treatment of gambling-related harm — and the operators that never joined the licensed market contributed nothing to it.