Gambling Not on GamStop and the Sites Where the British Rulebook Stops

Gambling not on GamStop means playing at sites that hold no Gambling Commission licence, so the UK's self-exclusion scheme cannot reach them. The scheme covers only British-licensed operators and is set by the licence holder, not by the player's resolve. Offshore sites are legal where they are licensed and illegal to offer to British consumers.

GamStop is the sort of word people mistype. It is often typed "gamestop", because the word "game" suggests itself, and the search engines dutifully follow the error. The scheme is GamStop Online, run by The National Online Self Exclusion Scheme Limited, a company with a Harrogate registered office, and it has been the national online self-exclusion register since April 2018.

Here is the awkward arithmetic of it. At the end of 2025 GamStop held 561,983 active exclusions. By 16 July 2026 that figure was 614,738 people currently on the register, and more than one in two of them had chosen the maximum five-year term. Registrations in the first half of 2026 ran 16 per cent above the same period a year earlier, with May 2026 producing a monthly record of 12,236 sign-ups.

That is a lot of people deliberately removing themselves from the largest, most heavily policed gambling market in Europe. The question this article tries to answer is what sits on the other side of that fence, how the British rulebook compares with the offshore one, and why the difference matters more than the headline of a welcome offer.

One thing before anything else. Sites with no Gambling Commission licence are not licensed in Great Britain. The protections that apply to British-licensed gambling — the deposit limits, the withdrawal rules, the statutory levy funding treatment, the ability to complain to an adjudicator — do not follow you offshore. A GamStop exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it. Nothing about an offshore site changes that. If gambling is causing harm, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day.

What "not on GamStop" Actually Means

The scheme's reach is set by a licence condition, and the condition is British. Since 31 March 2020 every online operator has had to be part of GAMSTOP as a condition of its Gambling Commission licence; the requirement sits in social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, which says in as many words that licensees must participate in the national multi-operator self-exclusion scheme. In April 2020 the Commission added a requirement that operators check their entire customer base against the register at least every 24 hours, which also stopped registered people receiving direct marketing.

Offshore sites sitting outside that arrangement are not connected to GamStop and are not covered by it, since the scheme's obligations bind UKGC-licensed operators only. That last point is stated by trade and press sources rather than on a primary regulator page, though it follows directly from GamStop's own terms of use, so treat it as reported rather than proclaimed.

It is worth spelling out what the register does and does not do, because the two get blurred. GamStop blocks a person from signing up for or using online accounts with companies licensed in Great Britain. It cannot prevent access to gambling run by organisations that do not participate, and it does not touch land-based gambling, which runs on its own schemes: SENSE for licensed casinos, a scheme run by the Bingo Association for bingo clubs, one run by BACTA for arcades, and GamStop Betting Shops, the renamed MOSES, for bookmakers' shops.

The Commission itself has been blunt about the traffic. In an industry warning notice on 20 January 2025 it said casino games from licensed operators were appearing on unlicensed websites available to British consumers, and noted that such sites often target customers who have self-excluded through GAMSTOP and may have inadequate social responsibility and anti-money-laundering controls. That is the regulator describing the market this keyword points at.

Gambling Sites Not on GamStop and the Three Licence Families

Offshore is not one thing. The jurisdictions that supply licences to sites taking British players fall into three rough families, and the gap between them is wider than the gap between any of them and Malta.

Curaçao has spent two years rebuilding itself. The National Ordinance on Games of Chance took effect on 24 December 2024 and made the Curaçao Gaming Authority the direct licensing and supervisory authority, ending the old master-licence and sub-licence model — the private master licensors can no longer grant new licences, and licensing activity ceased for the four of them between 18 August 2024 and 31 January 2025. The legacy "orange" certificates of operation ended on 15 October 2025, so a historic /JAZ number or an old seal is no longer independent proof of anything. Operators holding a valid licence when the law changed got a six-month provisional licence by operation of law, extended once, to 24 December 2025. Supplier licensing becomes fully mandatory on 24 December 2026.

Anjouan is the cheaper door and the more contested one. Licences are issued under legislation adopted in 2005, the published fee schedule is EUR 17,828 for B2C issuance and the same again annually, with EUR 500 per additional domain. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 per licence per year, and that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally; the same investigation reported a former attorney-general of the Comoros calling the licensing entity "an illegal entity" and said the AOFA lost its status as a recognised regulator under Comorian banking laws passed in 2013 and 2015. Anjouan Gaming, for its part, stated on 10 June 2026 that an Anjouan licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". Its licensees point to an independent legal opinion of 19 September 2024, reconfirmed in February 2026 by a firm regulated in England and Wales and Quebec, confirming the authority's standing. That opinion comes from the licensee side, so it is reported rather than settled.

Kahnawà:ke is the oldest of the three, regulating interactive gaming since 1999, and the most structurally peculiar: every operator licensed there must be hosted at Mohawk Internet Technologies, a data centre in the Mohawk Territory managed by Continent 8 Technologies, and the Interactive Gaming Licence itself is held by only one entity at a time.

Costa Rica is the fourth answer, and it is not really a licence family at all. Costa Rica has no comprehensive gambling licensing regime and no formal framework for issuing gambling licences; the "data processing license" that gets waved about in the industry is not a licence in the strict legal sense, and the Legislative Assembly rejected Bill No. 25,057 in early 2026, which would have introduced a mandatory regime.

Comparing Offshore Licence Regimes With the British One

The Gambling Commission's licence is not cheap and it is not decorative. What it buys the player is a set of enforceable obligations: identity checks before gambling, a mandatory self-exclusion register, no reverse withdrawals, a ten-times cap on wagering requirements, no maximum withdrawal limit, an eight-week complaints clock and access to an approved adjudicator. Every one of those comes from a licence condition, and the offshore regulators mostly publish standards rather than enforce outcomes.

Reading across that table, the pattern is not "strict versus lax". It is "outcome versus paperwork". A British licence produces a named regulator that will suspend a licence, fine a firm and publish the reasons. An offshore licence produces a certificate, a fee receipt and, in the best cases, a genuinely professional compliance culture underneath — a handful of the Curaçao licensees are run by people who could hold a British licence tomorrow if they wanted one, and a long tail of them are a domain name and a payment processor.

The Commission's own enforcement figures show what happens when offshore operators drift into the British market. Its Illegal Markets team has issued 3,140 cease and desist and disruption notices since April 2024 — 2,032 cease and desists, 774 registrar referrals, 402 host referrals and 3 payment provider referrals — referred 447,778 Bing and Google URLs, and secured 287,961 URL removals. Across 160 illegal websites with traffic data, engagement fell by an average of 32 per cent after disruption.

The interesting number is inside that. Registrar blocks and website suspensions produced the largest average fall in engagement, 91 per cent each, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. Search-engine removal makes a site harder to find; it does not stop anyone who already has the address. That is the Commission's own conclusion, and it is worth remembering every time a list of "not on GamStop" sites is presented as if the search results were the market.

The Licence Is the Whole Argument

If a page about offshore gambling had to keep one idea and throw the rest away, this is the one I would keep: the licence determines the terms, and the terms determine what happens when something goes wrong. Everything else — the welcome offer, the game catalogue, the loading speed — is downstream of a document nobody reads.

How it works in Britain is straightforward. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and the prohibition is indifferent to where the operator sits: it applies to remote gambling if at least one piece of remote gambling equipment used is situated in Great Britain, and, under the post-2014 wording, if the person providing the facilities knows or should know that the facilities are being used, or are likely to be used, in Great Britain. It is immaterial whether the facilities are provided wholly or partly by remote communication, and whether inside or outside the UK. On summary conviction, the offence carries imprisonment for a term not exceeding 51 weeks, a fine not exceeding level 5 on the standard scale, or both — six months in Scotland. The Commission states plainly that it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence in another jurisdiction.

Note who the Act aims at. The offences attach to the person providing the facilities, not to the adult consumer who plays on them. Sections 47 and 49 make it an offence to invite, cause or permit a child or young person to gamble; section 330 covers knowingly advertising unlawful gambling; section 331 covers advertising foreign gambling facilities. The player is not the defendant. That is a real distinction and worth stating precisely, because a great deal of public argument quietly assumes the opposite.

Now the part that decides most disputes. Offshore terms are drafted by the operator, for the operator, and enforced in a forum the operator chose. A maximum cashout clause is the clearest example: BlueChip Casino reserves the right to limit the amount withdrawable from winnings generated with bonus funds, including free spins and cashback, to 300 per cent of the credited bonus amount, with the excess voided. In Britain, the Commission's fair-terms guidance says operators must not impose any maximum limit on the amount a consumer may withdraw from their deposit balance, and its published example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". Same clause, opposite outcomes, decided entirely by which regulator is in the room.

Then the delay terms — the quiet ones. Ignition states it does not allow the mixing of no-deposit bonuses and deposits: if a deposit is made while a no-deposit bonus is active, the wagering requirements and maximum allowed cash-out of the no-deposit bonus still apply. That is not a bonus term so much as a queue, and it can hold a balance for weeks while the player settles in. In Britain, licence condition 17.1.1 says a customer's request to withdraw must not result in a requirement for additional information that the licensee could reasonably have requested earlier, and the Commission states that where an operator has no regulatory concerns about a customer there is no valid reason to delay the payout of a withdrawal.

The warning signs are consistent, whatever the jurisdiction. A licence seal that does not resolve to the regulator's own verification domain. A maximum withdrawal limit buried in a bonus annexe. A bonus whose wagering requirement is expressed as a multiple of bonus plus deposit rather than bonus alone, which is how a 30x offer becomes a 60x one by arithmetic alone. A term giving the operator sole discretion to void winnings. A complaints page with no named adjudicator. A domain that has changed registrant twice in a year. And a support address that answers questions about deposits quickly and questions about withdrawals slowly, if at all.

Five Signs an Offshore Operator Can Be Trusted

None of these is a guarantee. Each is checkable in a few minutes, and the point of a check is that it costs the operator nothing to pass and costs a bad one something to fake.

The Licence Can Be Verified in One Click

Curaçao issues two distinct seals: a Certificate of Operation Seal, issued only to B2C operators and only for an approved and registered player-facing domain, and a License Certificate Seal, available to B2B and B2C entities and not domain-specific. Clicking a Certificate of Operation Seal must redirect to cert.cga.cw, and if the seal differs in design, colour or format the website is not authorised by the CGA. If the certificate behind the seal shows a different domain from the one being viewed, the site is displaying someone else's certificate and should be treated as unauthorised or fraudulent.

The quick check: click the seal, and read the domain on the certificate that appears against the address bar. They should match, and the redirect should end on the regulator's own site. Anjouan's certificates, similarly, carry a unique licence number and a QR verification code linking to a public register, and Anjouan's own framework says a certificate that cannot be verified through the register should not be relied on as evidence of licensing status. Kahnawà:ke's Logo Certificate Program has generated a Certificate of Good Standing from a click on its logo since January 2010.

The Register Shows the Operator Is Still Live

A licence that expired is not a licence. The CGA has announced that its previous online gaming portal will not return to service, that this does not affect the validity of existing licences or operator obligations, and that it is working on an alternative mechanism for verifying CGA-licensed domains because the previous digital licence seal may be affected by the transition. That is exactly the sort of gap a copycat site exploits.

The quick check: look up the operator on the regulator's public register and cross-check the entity name against the terms and conditions. In Malta, which many offshore operators also hold, the MGA publishes a list of Unauthorised URLs, declaring it has no connection with those domains and that any reference to the MGA or a Maltese licence on them is false and misleading; the most recent entries on that list carry notice dates of 30 October 2026. Regulators name the fakes. Reading the list is free.

Player Funds Are Segregated — and the Terms Say So

Anjouan's published standards require operators to segregate player funds from operational funds, use random number generators certified by an approved independent testing facility, and run anti-money-laundering and age-verification controls. Those are the right words. Whether anyone audits them is the part that varies.

The quick check: find the clause about player funds and read what it promises in the event of insolvency. Britain is unusually explicit here — remote operators must hold customer funds in a separate client bank account, must select one of three protection ratings ("not protected", "medium protection", "high protection"), must state which applies in their terms, and an operator rated "not protected" must remind the customer every six months, with the value of funds held. Keeping funds in a client account still does not mean customers get their money back if the operator fails, and British businesses are legally allowed to hold customers' money in overseas bank accounts. If a site is vague about insolvency, believe the vagueness.

There Is a Named Adjudicator With a Published Track Record

Anjouan requires licensees to designate an authority-approved ADR provider and list its name and contact details in the player-facing terms, with operators expected to resolve complaints within 30 days before a player may escalate. The providers currently approved are EGIS ADR, Axion ADR, iGaming ADR and one other approved provider. Kahnawà:ke employs a full-time Dispute Resolution Officer, and its rules provide that a player who breaches a self-exclusion prohibition forfeits any funds deposited or won to a third-party charity selected by the Commission — a harsh rule, and evidence the scheme is actually enforced.

The quick check: search the named adjudicator's site for published decisions or an annual report. Britain's own adjudicators publish numbers, and they are not flattering to anyone. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, 150 valid "Deposits & Withdrawals" disputes, an average 31 days to resolve domestic disputes, and 17.8 per cent of completed disputes ruled in favour of the consumer. IBAS recorded 3,721 domestic disputes in 2024-25, 217 of them banking or financial, with an average completion time of 20 days, and reports 100 per cent operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. A named adjudicator with no published output is a letterhead.

The Operator Publishes Withdrawal Terms Before You Deposit

The Gambling Commission's Contact Centre receives over 6,000 calls a year from consumers and prospective licensees, and problems with withdrawals from accounts have been the number one topic raised. By July 2024 the Commission said it continued to receive around 2,000 complaints a year about withdrawal delays, still the leading subject. A 2026 Commission blog reported that over a quarter of complaints reaching the Contact Centre concern identity verification, a concern customers raise when they are asked for documents only on attempting to withdraw.

The quick check: find the withdrawal page, not the withdrawal section of the terms. Look for a stated processing time, a named payment method list, any fee as a percentage, and whether identity documents are mentioned as a step before the first deposit or only at cash-out. If documents are mentioned only at cash-out, the operator has built a delay into the process on purpose. In Britain that practice is being squeezed: on 21 October 2026 the Commission announced that an operator running seven websites would pay £900,000 in a regulatory settlement for failures including unnecessarily delaying consumer withdrawals, with the withdrawal-specific failures including a term stating customers could request only one withdrawal at a time and manual review of every fifth or tenth withdrawal that led to extra information being required.

How to Judge an Operator Before Depositing

Six steps, in this order. Each one exists because the check that follows it is worthless without it.

1. Establish which regulator issued the licence, and when. Not the flag on the footer — the register entry. Reason: the jurisdiction determines the term set, and the issue date tells you whether you are looking at a licence granted under the current regime or a legacy certificate that ended. In Curaçao, anything resting on an orange sub-licence or a /JAZ number has to be treated as unverified since 15 October 2025.
2. Read the bonus terms and convert the wagering requirement into a real number. If the multiple is expressed against bonus plus deposit, multiply it out and add the time limit. Reason: a 30x requirement against a £100 bonus plus a £100 deposit is £6,000 of play, not £3,000, and the cap on how much of the resulting win can be paid out turns the whole offer into arithmetic theatre.
3. Find the maximum cashout and maximum bet clauses. Reason: these are the two terms that most often decide a dispute, and they are almost never on the promotion page. A maximum bet while wagering set at 20 per cent of the deposited amount will be breached by an ordinary spin at the wrong moment, and the sanction is forfeiture.
4. Locate the complaints route and the named adjudicator. Reason: the point at which a decision is taken out of the operator's hands is the point at which a player has leverage. Britain's clock is eight weeks before an ADR referral becomes available, and the ADR entity is free to the consumer; offshore, that clock and that cost are whatever the terms say.
5. Check the payment method and the currency you will be paid in. Reason: a fee schedule is a tax on patience. Skrill charges 2.80 per cent of an amount withdrawn with a minimum of EUR 3.50 for a transfer to a bank account, and a 4.49 per cent foreign-exchange fee where conversion is needed; Neteller charges the same 2.80 per cent with a USD 3.50 minimum, 12.75 USD for a member wire, and 4.49 per cent on conversion. A withdrawal of a few hundred pounds can lose a meaningful slice of itself crossing a currency and a wallet.
6. Decide, before the first deposit, what the highest balance is that you would leave sitting in the account overnight. Reason: every hard case in this market starts the same way, with a large unresolved balance and a term nobody read. Deposit and loyalty balances are visible to the operator and, in a dispute, to nobody else.

None of that is exotic. It is the same work a British-licensed site does for you behind the scenes, done manually, once, before the money moves. The Commission's fair-and-open condition, its ban on reverse withdrawals under RTS 14B since 31 October 2021, its prohibition on maximum withdrawal limits, its requirement that a customer be able to withdraw at any time including while a bonus is pending — all of these are shortcuts. Take the shortcut away and the work is yours.

The Numbers Behind the Fence

The Gambling Commission's analysis published on 5 November 2026 estimates that, across the whole population including non-gamblers, 0.6 per cent of respondents engaged with illegal gambling websites in the previous four weeks and a further 0.4 per cent in the past 12 months, while 94.4 per cent showed no indication of using one. Among respondents who had gambled online in the past four weeks, the estimate rises to 2.5 per cent, with an additional 1.5 per cent in the past year.

That is the honest figure: small, and larger than zero. The commercial estimates run hotter and should be read as commercial. Market-intelligence firm H2 Gambling Capital estimates the amount staked with illegal gambling operators in the UK reached £16.6 billion in 2025, up from about £5 billion in 2019, with the proportion of gambling happening legally falling from 97 per cent in 2019 to 92 per cent in 2025. A Frontier Economics study for the Betting and Gaming Council conservatively estimated £2.7 billion staked annually online on the black market, equal to 2.1 per cent of the £128 billion staked with British regulated remote casino, betting and bingo operators, involving 1.5 million Brits; the same study suggested a further £1.6 billion could be staked in person at illegal venues. Yield Sec/Gaming Compliance International analysis for the Campaign for Fairer Gambling put the British online market at £8.8 billion gross gaming revenue in 2025, split 91 per cent regulated and 9 per cent unregulated.

Choose your denominator and you can produce almost any percentage. The Commission's own methodology for estimating the unlicensed market combines web-traffic data with a licensed-play assumption of £0.32 gross gaming yield per minute for online slots, and explicitly notes that it does not capture activity hidden by VPNs. H2's figure and the Commission's figure are not measuring the same thing, and neither is measuring the other.

What is not in dispute is the direction of enforcement. The number of illegal gambling websites identified through the Commission's affiliate-page method rose from 364 in May 2024 to 535 in July 2025, with crypto-casino search terms added to the methodology in December 2024. The dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, 4 per cent less than the previous three-month average but 4 per cent more than September 2025, and 311 sites had disruption action taken against them in the second quarter of 2026-27, 38 per cent more than the previous quarter, with 77 per cent of disrupted websites seeing a reduction in estimated traffic.

Against that, the Commission reports that across April 2025 to March 2026 every quarter recorded 0 or 1 prosecutions commenced — one in total, in October to December 2025. In April to June 2026 it began 0 criminal investigations. Disruption, in other words, is administrative: a letter, a registrar, a host, a search engine. Meanwhile in July to September 2026 it referred 1,835 websites to search engines, covering 7,677,211 URLs, and issued 546 cease and desist notices.

What Self-Exclusion Does and Does Not Cover

Gambling websites not on GamStop cannot enforce an exclusion made through GamStop, and no offshore operator can be required to honour it. An offshore site is not a route around self-exclusion; it is simply outside the arrangement, which is a different thing with a worse consequence, because the barrier a person set for themselves is absent precisely where the protections are also absent.

The mechanics matter here. A GamStop exclusion can be set for 6 months, 1 year, 5 years or 5 years with auto-renewal, and takes effect within 24 hours of signing up, which takes only a few minutes. Once registered, it cannot be cancelled or deactivated during the period, and it stays in place after the end of the chosen period unless the person contacts GamStop to remove it. The terms of use, last updated 20 May 2026, allow the auto-renewal option to be turned off only during the last six months of a five-year Minimum Exclusion Period, and auto-renewal continues for up to four new five-year periods. If the person does not deactivate after the chosen period, GamStop holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded. Registrations cannot be removed early, and the Group's 2025 annual report devotes a section to its refusal to do so.

Those terms are strict on purpose, and they explain the shape of the register. Of the exclusion periods selected by registrants in 2025, 29 per cent chose six months, 24 per cent chose a year, 25 per cent chose five years and 22 per cent chose auto-renewal. Among those on the register as of July 2026, more than one in two had opted for the maximum five-year term, while across all age groups only one in four had self-excluded for six months. Under-25s accounted for nearly one in three of all self-exclusions in the first half of 2026, a 26 per cent year-on-year increase. The 2025 annual report recorded the gender split as 94.3 per cent male and 5.7 per cent female. The Group also states it is no longer able to report a total lifetime registration figure because the seven-year data retention period from the scheme's 2018 launch has begun to expire — a small administrative fact with a large implication for anyone who assumed the register only grows.

The land-based side is a different regime with different terms, which is why "not on GamStop" is a phrase that trips people on the high street as well as online. SENSE, which covers licensed land-based casinos, has a minimum exclusion of six months extendable to twelve from the enrolment date; removal can only be requested in person at a casino by speaking to a manager during the six-month "Thinking" period that follows the minimum period, after which a 24-hour cooling-off period applies, and if the exclusion is neither renewed nor removed it is automatically removed at the end of that period. Under LCCP ordinary code 3.5.2 the minimum land-based period must be not less than 6 nor more than 12 months, may be extended by further periods of at least 6 months each, carries a one-day cooling-off period, and remains in place for a further 6 months at the end of the chosen period unless the customer takes positive action to gamble again. GamStop Betting Shops, the renamed MOSES scheme, is telephone-based on 0800 294 2060, excludes a customer from bookmakers' shops in the areas they name for a fixed 12-month term that cannot be ended early, applies a 24-hour cooling-off period on return, works with over 60 operators and covers approximately 6,000 shops.

The Commission's May 2026 FOI response put active self-excluded customers at 12,445 for SENSE between 1 April 2025 and 1 April 2026, with a further 8,695 enrolled under previous terms subject to auto-removal, and 9,075 for M.O.S.E.S over the same period. Compare those numbers with 561,983 active online exclusions at the end of 2025 and the structural fact is obvious: self-exclusion in Britain is overwhelmingly an online phenomenon, which is exactly why the offshore question keeps being asked.

There is also a layer that does not depend on any licence at all. Bank gambling blocks decline payments to merchants categorised under gambling Merchant Category Codes, cover online casinos, betting websites, gaming apps and physical gambling venues, and are applied at card level, so they must be activated on each card. Most banks use a cooling-off period of either 48 or 72 hours before gambling transactions are allowed again after a block is switched off, and the blocks do not affect a credit score. The Commission's list of banks offering the service, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. GamStop also signposts blocking software: BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, requires no registration and is free worldwide, while Gamban blocks licensed and unlicensed sites and is designed to be as difficult to remove as possible. TalkBanStop, the free UK licence scheme for Gamban, ended on 31 March 2026; Gamban is free for residents of Wales but in England and Scotland now costs £4.99 a month or £29.99 a year after a 7-day free trial.

Bank blocks and blocking software are worth more attention than they usually get, because they are the only measures in this market that do not care which licence an operator holds. A card block applies to the card. A blocking app applies to the device. Neither asks a regulator's permission.

Identity Checks As The Gate Everyone Walks Into Late

Identity verification is the single thing this topic turns on, and it is the one place where the offshore experience and the British one diverge most sharply — not in whether checks happen, but in when.

In Britain the rule is a licence condition, not a courtesy. Licence Condition 17 came in on 7 May 2019 and requires licensees to obtain and verify information establishing a customer's identity before that customer is permitted to gamble, and the information must include the name, address and date of birth. Before permitting a deposit, licensees should tell customers what types of identity documents or information they may need to provide, in what circumstances and in what form. The Commission expects checks brought forward to before a deposit or stake, and says onboarding on initials instead of full names, nicknames, or commercial addresses instead of residential ones is not sufficient. Under the anti-money-laundering regulations, a remote casino may identify customers and verify age at registration but defer full verification until the €2,000 threshold is triggered — the "hybrid approach" — where identification and verification are required when a customer deposits funds, or withdraws such funds or winnings, amounting to €2,000 or more. The threshold applies to a single transaction and to transactions that appear to be linked, including transactions carried out in a single logged-on period, and the Commission's 2026 risk assessment lists "smurfing" — numerous low-level transactions to evade the threshold — as a medium-likelihood, high-impact customer risk.

The first time is therefore a database match in most cases. Companies can often verify identity by matching the account against credit reference agencies and the electoral roll, in which case no documents are needed at all. When a document is required, the usual requests are a passport, a driving licence or a household bill; a selfie may be asked for where fraudulent activity is suspected, such as identity theft where an account was opened using someone else's details, and bank statements may be requested to check that a source of funds is legitimate. The Commission does not specify which types of information businesses should ask for, and says it cannot provide a timescale because the process varies — instant where electronic verification works, longer where documents are requested.

Later, the checks come back. Customer due diligence is ongoing and may need updating when circumstances or personal details change, and for higher-risk accounts and relationships an operator will also need to establish source of wealth. That is the point at which the British system and the offshore one stop resembling each other, because the British one has a rule about it. Licence condition 17.1.1 states that a customer's withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier — although that does not prevent a licensee seeking information it must obtain at that time under another legal obligation, such as an anti-money-laundering requirement. Where a business delays a withdrawal because of insufficient ID it may be in breach of Licence Condition 17 and may face regulatory action.

Offshore, the same sequence plays out without the rule. A site can accept deposits for months, ask for nothing, and then require a full document set at the moment a withdrawal is requested — which would be a breach of condition 17.1.1 on a British licence and is simply a term elsewhere. The complaint volume tells you how well that works for players: the Commission's Annual Report and Accounts 2024-25 states that, despite work with some operators, issues relating to withdrawals continue to be the cause of most of the complaints it receives.

The warning signs to watch for are specific and unglamorous. Verification requested for the first time at cash-out. A request for documents in a format the operator's own upload tool cannot accept. A requirement for a selfie or a video call with no explanation tied to suspected fraud. A request for source-of-wealth documents on an account that has never approached the €2,000 threshold. An account frozen while documents are "under review" with no stated deadline. And, most telling of all, a mismatch between the name on the account and the name the operator holds elsewhere: the Commission has warned that onboarding a customer using a middle name instead of a forename can create mismatches with records held elsewhere, such as GAMSTOP, undermining the effectiveness of self-exclusion. A sloppy identity file is not a neutral error. It is the reason a self-exclusion can fail.

One legal point sits underneath all of this and is worth stating flatly. Operators cannot confiscate a customer's funds on the basis that ID has not been provided, and the Competition and Markets Authority's position is that consumers are legally entitled to deposited money, winnings from money deposited and gambled, and bonus winnings where the conditions are met. The CMA's published do's and don'ts tell firms not to deny customers access to their own money, not to place maximum limits on withdrawals, and not to confiscate customer funds for failure to supply identity documents or after inactivity; the Commission states those principles apply to all online gambling operators and that operators must adhere to them to demonstrate compliance with licence conditions. That is a British-licensed obligation. Offshore, it is a hope.

What Happens When a Payment Goes Wrong

British-licensed withdrawal processing is, on the Commission's own data, fast. Its figures covering June to September 2024 record 44.2 million withdrawals by customers of large online operators in that period, of which 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours and 0.1 per cent took up to 48 hours. Earlier data from some of the largest companies showed those firms approved, processed and fulfilled around 99 per cent of customer withdrawal requests within 24 to 48 hours. Consumer research on trust published in July 2026 found 49 per cent of people who had gambled in the past 12 months agreed that it is quick and easy to withdraw and collect winnings, with 33 per cent neutral and 18 per cent disagreeing. Complaints to the Commission's Contact Centre coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025.

Two things about that. First, the system mostly works, and saying so is not shilling. Second, the LCCP sets no fixed maximum number of days within which an operator must complete a withdrawal, which is why the rules that do exist are about friction rather than deadlines: the fair-and-open condition 7.1.1, the identity condition 17.1.1, and the prohibition on unfair terms. The Commission states it is not acceptable for operators to introduce friction when a customer tries to withdraw rather than when they deposit, or to place the operator's commercial interests above their customers', and does not consider it fair, transparent or necessary to delay or withdraw purely for customer-interaction purposes.

For anyone weighing a crypto-funded offshore account, the plumbing is worth knowing rather than believing. Bitcoin targets an average interval of 10 minutes between blocks, but within any 10-minute window the probability of a block being found is about 63 per cent, rising to 95 per cent within 30 minutes and 99.7 per cent within 60 — so "ten minutes" is an average cadence, not a promise. Litecoin targets 2.5-minute blocks, giving roughly 2½ minutes for one confirmation and 15 minutes for six, yet only about 55.43 per cent of modelled six-confirmation spans actually complete within 15 minutes. A TRC-20 USDT transfer to a wallet that already holds USDT consumes about 65,000 Energy, and to a brand-new wallet about 130,000; without staked Energy that burns roughly 13 TRX and 26 TRX respectively, and a transfer can fail outright if the account has neither Energy nor enough TRX. Ethereum's base fee changes by a maximum of 12.5 per cent per block, and gas consumed by a transaction that then reverts is still charged — a failed transfer costs money and moves nothing.

The traditional rails are not free either. Rewards are an example: MiFinity withdrawal fees run at 1.8 per cent for cryptocurrency, €1 for VISA EEA and €2 for Mastercard Interregional, with an FX markup of up to 2.99 per cent on the wholesale rate. Jeton's UK schedule shows a local bank transfer withdrawal taking 0 to 30 minutes with no sender or receiver fee and limits of £10 to £10,000, while a separate instant bank transfer carries a 2.5 per cent sender fee. MuchBetter withdrawals may take from a few hours to up to five business days depending on the method, while its crypto withdrawals typically arrive in a few minutes to a few hours. On the bank side, Visa Direct's Fast Funds processes in real time with funds available within 30 minutes of approval, Faster Payments carries a £1 million scheme ceiling — raised from £250,000 on 10 February 2022 — though individual banks set lower per-payment limits, and CHAPS settles same-day with no scheme upper limit and a daily cut-off.

The point of all the plumbing, again, is the licence. None of it is a substitute for one.

What I Make of It

The market for gambling sites not on GamStop exists because a licence condition draws a line, and a line always produces a market on the far side of it. That is not a scandal; it is how regulation works. What is worth saying plainly is that the far side is not uniform, and the flattering comparison — offshore offers versus British ones — conflates two completely different questions. The first is what a site will pay you and when. The second is who decides when the operator and the player disagree. Offshore operators compete ferociously on the first and answer the second in their own favour, and no welcome offer has ever compensated for that.

My own view, after enough years of reading terms and conditions and enough of the Commission's complaint data, is that the offshore market contains a small number of genuinely well-run operators and a very long tail that exists to harvest impatient searches. The licence seal is the cheapest filter available. So is the register lookup. So is reading the clause about maximum cashout before the clause about the welcome bonus. None of that takes more than twenty minutes, and all of it is worth more than the difference between a 30x and a 40x wagering requirement.

The genuinely underrated tools are the ones that ignore licensing entirely: a bank gambling block applied at card level, a blocking app on the device, and a self-exclusion that stays put. A GamStop exclusion holds for its full term and stays in place until the person contacts GamStop to remove it. That is a fact about the register, not about the market, and it is the reason the register still does the job it was built for. If any of this is closer to home than comfortable, the National Gambling Helpline is free on 0808 8020 133, day or night, every day of the year, and Citizens Advice gives free confidential advice including help with debt.

FAQ

What gambling sites are not on GamStop?

Any site holding no Gambling Commission licence. GamStop's obligations bind British-licensed operators only, so a site licensed in Curaçao, Anjouan, Kahnawà:ke or nowhere in particular is not connected to the register and cannot be required to honour an exclusion made through it. That is the whole of the answer, and it is a fact about licensing rather than about any particular operator's conduct.

Are there online gambling sites not on GamStop that are properly regulated?

Yes. Malta, Curaçao and Kahnawà:ke all have real regulators with published rules and fee schedules. Curaçao's licensing authority has direct supervisory powers under the National Ordinance on Games of Chance, which took effect on 24 December 2024. The distinction that matters is enforcement: a British licence can be suspended, and the Commission does suspend them, while offshore supervision usually runs to registration and audit.

Why do people look for UK gambling sites not on GamStop?

Usually because they want a higher welcome bonus, a bigger maximum stake on slots, or fewer affordability checks. The British market caps wagering requirements at ten times and limits online slots to a £5 maximum stake per game cycle for adults, and £2 for those aged 18 to 24, from 9 April 2025 and 21 May 2025 respectively. Those limits were introduced deliberately, and an offshore site is not a neutral alternative to them.

How many people actually use unlicensed gambling sites?

Fewer than the trade headlines suggest. The Commission's analysis published on 5 November 2026 puts it at 0.6 per cent of the whole population in the previous four weeks, rising to 2.5 per cent of those who had gambled online in that period. Among adults who had gambled in the past 12 months, 3.4 per cent had sought support because of their own gambling.

Does an offshore casino pay out faster than a British one?

Not reliably. British figures covering June to September 2024 show 96.3 per cent of 44.2 million withdrawals clearing automatically, with 0.1 per cent taking up to 48 hours. Offshore processing can be quick, but the terms often build in delay at the point of verification instead, and the Commission's rule against requesting information at withdrawal that could reasonably have been requested earlier does not travel with a player.

What happens if an offshore site refuses to pay?

The route is the operator's own complaints process, then the named adjudicator in its terms — Anjouan requires a designated ADR provider to be listed, and expects complaints resolved within 30 days first. The Commission cannot help, because it is a regulator rather than an ombudsman and cannot resolve individual disputes or recover money. A named adjudicator who publishes no decisions is not worth the referral.

The Licence Decides Everything Else

Offshore really means one thing: outside a rulebook that would otherwise have set the terms, and everything a player dislikes or admires about the far side of that line follows from it. The sites not on GamStop are not a hidden tier of the market with better odds; they are a different jurisdiction with a cheaper licence, and the price of the difference is paid at the point where the operator and the player disagree. Check the seal, check the register, read the cashout clause. Twenty minutes of work beats a welcome offer every time.

The Commission's own enforcement figures make the point better than any argument: since April 2024 it has issued 3,140 cease and desist and disruption notices and referred 447,778 search URLs, and a registrar block still cuts engagement by 91 per cent where removing a site from search results cuts it by 30 per cent. Being findable and being legal are not the same thing — 586 illegal gambling websites were accessible to British consumers in September 2026, and the search bar will happily take you to every one of them.