Casino Sites Not on GamStop and What the Regulator Does

Casino sites not on GamStop are operators holding no Gambling Commission licence, so they sit outside the self-exclusion scheme entirely and are not covered by UK protections such as the credit card ban, the 10× bonus wagering cap or access to an approved ADR provider. Using one is not a breach of the Gambling Act by the player; providing it is.

The phrase "not on GamStop" sounds like a feature. Read it again: it means not connected to the one register that a few hundred thousand people have asked to be on. It is often typed "gamestop", which is a fact about the name rather than the scheme.

I have spent years reading the Gambling Commission's enforcement pages, and the striking thing about this corner of the market is not that offshore sites exist — they always have — but how much effort a supposedly under-resourced regulator now puts into the chase. Since April 2024 its Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Bing and Google URLs and secured 287,961 removals. That is not a tidy-up. It is a campaign.

The other striking thing is the arithmetic of what the campaign is chasing. Across 160 illegal gambling websites for which traffic data existed, disruption produced an average 32 per cent fall in engagement. By method, registrar blocks and website suspensions delivered a 91 per cent average fall each; Google removal managed 30 per cent. Follow that logic and you see why the Commission now argues that blocking is worth more than de-listing: a site that is hard to find is not the same as a site that is hard to reach.

So this page looks at casino sites not on GamStop from the side most coverage avoids — what the regulator actually does, what a licence is worth on paper, and where the protections a UK licence buys you simply stop. Every number below comes from a published regulator or regulator-adjacent source, cited by period. My view is set out plainly where I hold one.

A word on the odds before the detail. The Commission's November 2026 analysis, covering April 2025 to April 2026, estimates that among adults who had gambled online in the past four weeks, 2.5 per cent had engaged with an illegal gambling website, with a further 1.5 per cent in the past twelve months. Among the whole adult population, 0.6 per cent had in the past four weeks and 94.4 per cent showed no indication of using one. A small minority, then — but not a rounding error, and concentrated precisely among people who have asked to be left alone.

Before anything else: as of 12.11.2026, no offshore operator holds a Gambling Commission licence, which means no offshore operator is obligated to honour a GamStop exclusion. Self-exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it — a five-year registration does not lapse quietly after five years, and an operator outside the scheme can never be described as a way round one. Help is free and always available: the National Gambling Helpline, operated by GamCare, on 0808 8020 133, 24 hours a day, every day of the year, with live chat and WhatsApp on the same number; callers in Wales can use 0808 2819 265. GamCare, BeGambleAware, Citizens Advice, Gamblers Anonymous and NHS gambling clinics all take self-referrals, and none of them requires a UK-licensed operator to have been involved.

What the Licensing Benchmark Looks Like From Britain

Every comparison on this page runs through one standard: a Gambling Commission licence. It is the only licence that carries the GamStop obligation, and it is the thing offshore operators under this keyword do not have.

The licence condition itself is short. Social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice states that licensees must participate in the national multi-operator self-exclusion scheme. The obligation has applied since 31 March 2020, and operators were told in January 2020 that the deadline was coming. In April 2020 the Commission added a requirement to check the entire customer base against GamStop at least every 24 hours — which also stopped registered people receiving direct marketing.

Two operators found out what enforcement looks like. On 3 April 2020 the Commission suspended the licences of two operators for failing to integrate GamStop by the 31 March deadline, using powers under section 118(2) of the Gambling Act 2005.

The benchmark licence also carries things that are easy to take for granted until they are absent:

• A ban on credit cards for gambling, effective 14 April 2020 under licence condition 6.1.2, including the requirement that money arriving from an e-wallet was not loaded from a credit card.
• A wagering cap of ten times on bonus funds, in force since 19 January 2026, alongside a ban on mixed-product promotions requiring more than one type of gambling.
• A financial-limit prompt before the first deposit, mandatory since 31 October 2025, and financial vulnerability checks from August 2024, tightened to a £150 net-deposit trigger on 28 February 2025.
• Online slots stake limits: £5 per game cycle for all adults since 9 April 2025, £2 for 18- to 24-year-olds since 21 May 2025.
• The reverse withdrawal ban under RTS 14B since 31 October 2021 — the option to cancel a withdrawal request simply does not exist on a UK-licensed site.

That is what "licensed in Great Britain" buys, and it is the yardstick. Offshore operators under this keyword hold something else, or nothing, and the difference shows up in the terms rather than the marketing.

Offshore Licences, Judged Against That Benchmark

Not every offshore licence is the same, and pretending otherwise would be lazy. A Curaçao B2C licence involves a real fee schedule: a one-time non-refundable application fee of EUR 4,592, with EUR 150 per ultimate beneficial owner and EUR 150 per qualified interest holder, and a total annual cost of EUR 47,450 split between a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee. The Curaçao Gaming Authority also publishes verification rules: clicking a Certificate of Operation Seal must redirect to cert.cga.cw, and if the certificate behind that seal shows a different domain from the one being visited, the site is displaying another operator's certificate and should be treated as unauthorised.

Anjouan is cheaper still — EUR 17,828 for B2C licence issuance and the same for annual renewal, with EUR 500 per additional domain. The regulator there says licence certificates carry a unique number and a QR code linking to a public register, and that a certificate which cannot be verified through the register should not be relied on. It also says, in a June 2026 statement, that its licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". Which is the honest version of the argument, and it is also the argument for a UK licence if you live in Britain.

Kahnawake is the oldest of the offshore regimes, regulating interactive gaming since 1999, and it is unusual in publishing player-facing rules: licencees must let a player set limits including zero, and its voluntary self-exclusion is permanent and irrevocable. A player who breaches a self-exclusion prohibition forfeits funds deposited or won to a charity chosen by the Commission.

Costa Rica is the one to be blunt about. It operates no comprehensive gambling licensing regime at all, and the "data processing licence" sometimes cited in this industry is not a licence in the strict legal sense. A bill that would have introduced mandatory licensing, No. 25,057, was rejected in early 2026. A site claiming a Costa Rican licence is claiming a document that does not exist in the sense a UK player would assume.

One number in that table deserves a second look. A Curaçao annual fee of EUR 47,450 and an Anjouan renewal of EUR 17,828 are meaningful sums to a small operator — but they are the entire cost of supervision. The Gambling Commission's own levy takes 1.1 per cent of previous-year Gross Gambling Yield from every online operator and every software licence, and raised just under £120 million in its first year, ringfenced for research, prevention and treatment. Supervision, on these figures, is not free anywhere. It is just thinner in some places than others.

Why Regulators Are Catching Up on the Unlicensed Market

Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 C&Ds, 774 registrar referrals, 402 host referrals and 3 payment provider referrals — and secured 287,961 URL removals from 447,778 referrals covering 339,757 Google and 108,031 Bing URLs.

The quarterly rhythm shows the escalation. Websites referred to search engines rose from 124 in July to September 2024 to 366 in April to June 2026, then to 1,835 websites and 7,677,211 URLs in July to September 2026. Cease and desist notices went 113, 83, 129 and 145 across the four quarters to June 2025, then 546 in the quarter to September 2026.

Effectiveness, though, is uneven, and the Commission says so itself. By disruption method the average fall in engagement was 91 per cent for registrar blocks and website suspensions, 60 per cent for GEO IP blocking, 52 per cent for Bing removal, 30 per cent for Google removal and 8 per cent for Facebook removal. The Commission's conclusion — that GEO IP blocking and registrar blocks beat search-engine removals, because de-listing makes a site harder to find without fully blocking access — is the most useful sentence in its published work on this.

Scale is contested, and anyone quoting a single figure for the black market is selling something. H2 Gambling Capital estimated £16.6 billion staked with illegal operators in the UK in 2025, up from about £5 billion in 2019, with the legal share falling from 97 per cent to 92 per cent. A Frontier Economics study for the Betting and Gaming Council put it at £2.7 billion online a year, about 2.1 per cent of regulated remote stakes. Yield Sec, for the Campaign for Fairer Gambling, put the whole GB online market at £8.8 billion gross gaming revenue in 2025 and the unregulated share at 9 per cent. The Commission's own method assumes £0.32 of gross gaming yield per minute of online slots play and explicitly cannot see activity hidden behind a VPN. I read the spread as a sign of how hard the measurement is, not as three competing truths.

Meanwhile the Commission counted just over 1,000 unique illegal gambling websites accessed by consumers in Great Britain between May 2024 and July 2025, and its dashboard recorded 586 accessible in September 2026. In April to June 2026 it began 0 criminal investigations; across April 2025 to March 2026 there was one prosecution commenced. Disruption, in other words, is mostly administrative, and it is aimed at the plumbing — registrars, hosts, search engines and, since 2025, payment providers through the Visa Operator Scheme.

What the Checks Turn On

If there is one thing this topic turns on, it is identity verification — who is allowed to open an account in the first place, and what happens the first time versus later.

A UK-licensed operator's position is set by licence condition 17. Since 7 May 2019 it has had to obtain and verify information establishing a customer's identity before that customer is permitted to gamble, covering at least name, address and date of birth. From August 2024, checking began to reach further: financial vulnerability checks on remote operators, initially at £500 net deposits over a rolling 30 days, lowered to £150 from 28 February 2025. The Commission published the results in a May 2026 blog: in the three months after the requirement, operators ran financial vulnerability checks on 7 per cent of active customer accounts on average, 78 per cent of checks returned within 10 minutes and a further 10 per cent within two hours.

The first time is where it works best. A UK operator can verify electronically — the Commission says a business may match an account against credit reference agencies and the electoral roll and need no documents at all — and the identity gate sits before the first deposit rather than at the first withdrawal. The Commission's August 2026 blog is blunt that onboarding on incomplete or inaccurate information is not sufficient: initials instead of full names, nicknames, commercial addresses instead of residential ones. It also makes a point that matters here more than anywhere: onboarding someone under a middle name rather than a forename creates mismatches with records held elsewhere, including GamStop, which undermines the effectiveness of self-exclusion without anyone intending it.

Later is where it frays. Licence condition 17.1.1 says a withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested it earlier — with the caveat that anti-money-laundering law may force a request at that moment. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and the Commission has flagged concern about operators using "fuzzy matching" through third-party providers to onboard customers on partial or equivocal verification. Offshore, there is no equivalent rule to pull against and no free ADR route if a site simply keeps the money.

Warning signs, in order of how much they should worry anyone:

• Documents demanded for the first time at withdrawal, having been waved through at deposit.
• A site that will not say which regulator licenses it, or shows a certificate that fails its own verification route.
• A maximum cashout clause sitting in the bonus terms — BlueChip Casino's terms reserve the right to limit winnings generated with bonus funds to 300 per cent of the credited bonus, with the excess voided.
• Wagering figures quoted as a multiple of bonus plus deposit rather than bonus alone, which quietly raises the number.
• Terms giving the operator sole discretion to void winnings. In the UK, the Commission treats "may" and "reserve the right" clauses as unfair under the Consumer Rights Act 2015; an operator was fined £170,000 in July 2025 for failures including a term claiming discretion to close accounts or forfeit winnings.

Five Signs an Operator Can Be Trusted

It Names Its Regulator and the Certificate Checks Out

A trustworthy site states which authority licenses it and gives a route to verify that claim independently. A GB licence is checked on the Commission's public register, where the licence's activities and domain names should match what the site is doing. Curaçao's seal must redirect to cert.cga.cw and show the domain being visited; Anjouan's certificate carries a QR code to a public register. The quick check: click the seal. If it does not resolve to the regulator's own domain, or shows another site's name, close the tab.

Its Bonus Terms Are Readable in One Click

Under social responsibility code 5.1.9, significant conditions on a marketing incentive must be given transparently and prominently, and online, in full, no further than one click away. The quick check: look for the wagering figure before you look at the headline offer. On a UK licence it cannot exceed ten times on bonus funds; offshore, welcome offers commonly run 25× to 50× and no-deposit offers 40× to 60× with a cashout cap, and the multiplier is sometimes applied to bonus plus deposit. If you cannot find it in one click, that is the answer.

Money Goes Out Through the Front Door

A UK licence banned reverse withdrawals outright under RTS 14B, and the Commission's July 2023 and July 2024 blogs say operators must not introduce friction at withdrawal that was absent at deposit. Context for how well that works even here: of 44.2 million withdrawals by customers of large online operators between June and September 2024, 96.3 per cent cleared automatically and 3.5 per cent within 24 hours. The quick check: ask how a withdrawal is made, whether any fee is charged, and whether the site allows more than one request at a time — L & L Europe paid £900,000 in a regulatory settlement in October 2026 for, among other things, a term allowing only one withdrawal at a time and manual review of every fifth or tenth withdrawal.

The Terms Do Not Let It Keep Your Money

Customer funds must sit in a separate client account, and the operator must publish one of three insolvency ratings — not protected, medium or high — in writing, with acknowledgement required before funds are used for gambling. Deposits not yet staked remain the customer's, and inactivity cannot be used to confiscate a balance. The quick check: find the customer-funds section of the terms. "Not protected" is not a scam; it is a disclosure, and it is the one to read before deciding how much sits on the site.

There Is a Free Dispute Route to Somewhere Real

UK licensees must offer referral to an approved ADR provider free of charge if a complaint is not resolved within eight weeks, and the providers on the Commission's list include IBAS, eCOGRA and CEDR. The numbers show the route gets used: IBAS handled 3,721 domestic disputes in 2024-25, of which 217 were banking and financial disputes, completing domestic cases in an average of 20 days and reporting 100 per cent operator compliance with decisions in the consumer's favour; eCOGRA recorded 911 disputes between 1 October 2024 and 30 September 2025, 150 of them valid "deposits and withdrawals" cases, resolved in an average of 31 days. The quick check: name the ADR provider. If the site cannot, there is no free route, because no offshore regulator's complaint system reaches a GB player.

How to Judge a Site Before You Register

1. Check the licence on the regulator's own register, not on the site's about page. Match the licensed domain to the domain you are on — the Commission's guidance is explicit that the register shows which activities and domain names a licence covers, and a mismatch is the single most common sign of a certificate borrowed from someone else.
2. Read the bonus terms before the welcome offer. Find the wagering multiple, the game-weighting table and any maximum cashout clause in one click. A 25× requirement weighted at 100 per cent on slots and 5 per cent on roulette is a different proposition from the headline number, and Ignition's published chart — slots 100 per cent, table games 20 per cent, video poker and blackjack 10 per cent, roulette and baccarat 5 per cent, live dealer 0 per cent — is a useful reminder that the multiplier is only half the sum.
3. Establish the withdrawal route and its cost before depositing. Skrill and Neteller both charge 2.80 per cent of the amount withdrawn to a bank account with a minimum of about EUR or USD 3.50, PayPal charges nothing to a UK bank account where no conversion is involved, and Faster Payments transactions complete in under two seconds for over 90 per cent of payments. A cost-reflective processing fee is legitimate in the UK if it is disclosed before deposit and does not exceed the direct cost of processing.
4. Set a financial limit when prompted, which is now mandatory before a first deposit on a UK licence under RTS 12E. It is the cheapest intervention available and it takes a minute: a limit entered at the start is harder to argue with later than one entered after a bad week.
5. Turn on a bank gambling block and a blocking tool. Eleven banks — including Barclays, HSBC, Lloyds, Monzo, NatWest, Santander and Starling — offer blocks keyed to gambling Merchant Category Codes, applied at card level so each card needs its own, with a 48- or 72-hour cooling-off before gambling payments resume; they do not affect a credit score. For a second layer, BetBlocker blocks over 1,368,000 gambling websites and 3,100 apps and is free worldwide; Gamban is free in Wales but costs £4.99 a month or £29.99 a year in England and Scotland after the TalkBanStop funding ended on 31 March 2026.
6. If a dispute goes wrong on a UK-licensed site, escalate in the right order, because the order is enforced. Use the operator's own complaints process first — 361 of 499 invalid eCOGRA disputes had not done so — give it up to eight weeks, then take a deadlock letter to an approved ADR provider. The Commission is a regulator, not an ombudsman: it records complaints and refers disputes on, but it cannot get money back. Offshore, none of these steps exist.

FAQ

Are casino sites not on GamStop legal in the UK?

The operator is the one committing an offence, not the player. Section 33 of the Gambling Act 2005 makes it an offence to provide gambling facilities without an operating licence, whether the facilities are provided wholly or partly by remote communication and inside or outside the UK, with a maximum of 51 weeks' imprisonment, a level 5 fine, or both on summary conviction. The Commission states plainly that offering commercial gambling services to consumers in Great Britain without a Commission licence is illegal, including where the operator holds a licence in another jurisdiction.

Which casino sites not on GamStop are best for a British player?

None, on the measure that matters. Best usually means biggest bonus, and the bonus is precisely where the difference bites: a British licence caps bonus wagering at ten times since 19 January 2026 and bans mixed-product promotions, while offshore welcome offers commonly run 25× to 50×. Kahnawake's framework, with limits available down to zero and a permanent self-exclusion, is the most player-protective offshore regime I have read; but a player who wants the protections of a British licence needs a British licence.

Do new casino sites not on GamStop have any advantage?

They are usually newer and cheaper to run, and some launch with genuinely transparent terms. But newness is not a protection. Anjouan licences cost EUR 17,828 for issuance and the same for renewal, with EUR 500 per extra domain — a price that supports a fast launch and very little supervision. A new site is also unproven on the one thing that counts: whether it pays out, in full, on time, when the amount is large enough to test somebody's appetite.

Are there pay by phone or PayPal casino sites not on GamStop?

Usually not, and that is informative rather than reassuring. PayPal is not on the Commission's list of payment methods used for deposits, and licence condition 5.1.2, effective 31 January 2024, requires GB licensees to accept payment only through a payment service provider under the Payment Services Regulations 2017. Offshore, a genuine PayPal facility is rare because mainstream processors screen merchant codes; where "pay by phone" is offered, read the fee schedule, as deposit and withdrawal costs are rarely symmetric.

How does the Gambling Commission act against these sites?

Mostly through disruption rather than prosecution. Since April 2024 it has issued 3,140 cease and desist and disruption notices, referred 447,778 search URLs and secured 287,961 removals; it began 0 criminal investigations in April to June 2026 and commenced one prosecution across April 2025 to March 2026. Methods differ in effect: registrar blocks and suspensions cut engagement by an average of 91 per cent, GEO IP blocking by 60 per cent and Google removal by 30 per cent.

Can an offshore site get round a GamStop exclusion?

No, and it does not need to — it simply never sees the register. GamStop blocks access to sites licensed in Great Britain, so an operator outside the scheme receives no notification and applies no check. The exclusion itself does not lapse at the end of the chosen term: it stays in place until the person contacts GamStop to remove it, and the scheme's 2025 annual report devotes a section to its refusal to remove registrations early. Registering takes minutes and can take up to 24 hours to take effect.

Casino Sites Not on GamStop

The trade-off is stark and it does not flatter the offshore side: an operator outside the scheme offers nothing a British licence cannot, and gives up the ten-times wagering cap, the credit card ban, the reverse withdrawal ban, the deposit-limit prompt, the free ADR route and the whole apparatus of Commission enforcement that has issued 3,140 disruption notices since April 2024. My judgement is that the marketing has it exactly backwards — "not on GamStop" is the absence of a protection, not the existence of a feature, and the sites that shout it loudest are the ones with the least to offer once the terms are read properly.

The figures that stay with me are GamStop's own: 614,738 people on the register as of July 2026, of whom more than one in two chose the maximum five-year exclusion, and only one in four the six-month term. People do not pick five years by accident. Something was wrong at the point of registration, and a market that grows by intercepting them is not solving the problem — it is running a counter at the exit. The National Gambling Helpline on 0808 8020 133 is free, runs 24 hours a day, every day of the year, and does not care which licence the site you were using had.