Gambling not on GamStop describes sites that hold no Gambling Commission licence, so the scheme never reaches them. They are legal to operate abroad, illegal to offer to British customers, and outside UK protections. The Commission's Illegal Markets team disrupts them constantly, mostly by getting them delisted, blocked or frozen out of payments.
The word is often typed "gamestop". The scheme itself is always GamStop, and the confusion is worth clearing up at the start, because it is the difference between a site that must check the register every day and one that has never heard of it.
Here is the thing I keep coming back to. Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Google and Bing URLs, and secured 287,961 removals. That is a great deal of paperwork aimed at a market the Commission's own survey work now puts at a small fraction of online players. The activity is real; the scale of the prize is smaller than the trade bodies' louder numbers suggest. What that tells anyone watching this market is that offshore operators are not so much tolerated as harried — and that the harrying works unevenly, which is the honest reason some of them keep reappearing under new names.
As of 12.11.2026, this is the market as it stands: a national self-exclusion scheme with 614,738 people on its register, a licence condition that forces every British operator into it, and a parallel world of Curaçao, Anjouan, Kahnawake and Costa Rica licences that the scheme cannot touch. The interesting question is not whether those sites exist — they plainly do, and the Commission counts around 586 of them accessible to British consumers — but what the regulator does about them, and what that means for anyone deciding where to play.
Table of Contents7
What Makes a Gambling Site Not on GamStop
The legal baseline is not complicated. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and it applies to remote gambling if at least one piece of remote gambling equipment is in Great Britain — or, since the 2014 amendment, if the provider knows or should know the facilities are likely to be used in Britain. The Commission's position is blunt: it is illegal to offer commercial gambling services to British consumers without a Commission licence, including where the operator holds a licence somewhere else. The offence carries up to 51 weeks' imprisonment and a level 5 fine, but it attaches to the operator, not to the player.
Self-exclusion sits on the other side of that line. A GamStop registration blocks a person from every online gambling company licensed in Great Britain, for six months, one year, five years or five years with auto-renewal. It takes a few minutes to set up and up to 24 hours to take effect. Once registered, the registration cannot be cancelled during the term — and, importantly, it does not lapse quietly at the end. The exclusion stays in place until the person contacts GamStop to remove it, and if they do not, the scheme holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded. Signing up takes a few minutes; the block can take up to 24 hours to become effective.
The scheme's reach stops at the licence. Since 31 March 2020 every online operator must be part of GamStop as a condition of its licence, under social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, and since April 2020 operators must check their entire customer base against the register at least every 24 hours. An offshore operator holds no such licence, so it has no such duty. The Commission's own terms are careful about this: the scheme excludes from participating operators only, and cannot prevent access to services run by organisations that do not participate.
The offshore licences that turn up behind these sites are worth knowing by shape rather than by name. Curaçao's LOK reform took effect on 24 December 2024, replacing the old master-licence and sub-licence system with direct licensing by the Curaçao Gaming Authority; the legacy orange certificates ended on 15 October 2025, and the authority has warned that a historic /JAZ number or old seal is not proof of a current licence. Anjouan issues B2C internet gaming licences from a territory of the Comoros, at EUR 17,828 for issuance and the same again annually. Kahnawake has regulated interactive gaming since 1999, with operators hosted at a single Mohawk Territory data centre. Costa Rica has no comprehensive gambling licensing regime at all — a fact that surprises people who see a Costa Rican registration quoted as a licence. [unconfirmed] Trade and press sources also state that offshore sites are simply not connected to GamStop, which is consistent with the scheme's own terms of use.
Types of Gambling Sites Not on GamStop UK
Three broad types, and they behave differently.
The first is the ex-licensed operator that has left the British market. When a business walks away from its Commission licence, its sites become unlicensed overnight while continuing to look familiar. The Commission made this point publicly in May 2025 about TGP Europe's exit, warning that sites it had operated were now unlicensed and might not provide protections against criminality or gambling-related harm.
The second is the pure offshore casino, licensed in Curaçao, Anjouan or Kahnawake and never intending to hold a British licence. These are the ones with the 25× to 50× wagering terms, maximum cashout clauses, and withdrawal menus built around crypto.
The third is the crypto-native site, sometimes with no meaningful licence at all. The Commission added crypto-casino search terms to its own detection methodology in December 2024, which tells you where the growth was.
The Available Data on Offshore Sites
Two sets of numbers matter, and they disagree.
The industry's loud version comes from market-intelligence firm H2 Gambling Capital, which estimates £16.6 billion was staked with illegal operators in the UK in 2025, up from about £5 billion in 2019, with the legal share of gambling falling from 97 per cent to 92 per cent. Yield Sec, working for the Campaign for Fairer Gambling, put the whole GB online market at £8.8 billion gross gambling revenue in 2025, split 91 per cent regulated to 9 per cent unregulated.
The Commission's own survey work published on 5 November 2026 tells a much smaller story. Across the whole population, including non-gamblers, 0.6 per cent of respondents had engaged with illegal gambling websites in the past four weeks, a further 0.4 per cent in the past 12 months, and 94.4 per cent showed no indication of using one at all. Among people who had gambled online in the past four weeks, 2.5 per cent had engaged with an illegal site, with a further 1.5 per cent in the past year. Its dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026.
I know which numbers I trust more, and it is not the ones commissioned by interested parties. Self-reported survey data has its own flaws, but an estimate built by an advocacy group to argue a policy case is not evidence.
Checking if a Site Is Licensed
How the Licence Check Works
One check, and everything else follows from it. The Commission maintains a public register of licensed businesses, and its guidance is to click through and check whether the site's activities and domain names actually match the entry. A licence for a different domain, or for bingo when you are being offered slots, is a mismatch.
A British-licensed site must tell you what you need to know before you deposit — what identity documents may be requested, in what circumstances, and in what form — under licence condition 17.1.1. Its terms must also state whether customer funds are protected if it becomes insolvent, using one of three Commission ratings: not protected, medium protection or high protection, and an operator rated "not protected" must remind you every six months.
Then there are the rules that only exist because of the British licence. Credit cards have been banned for gambling since 14 April 2020. Reverse withdrawals — the option to cancel a withdrawal and put the money back into play — have been banned outright since 31 October 2021 under RTS 14B. Wagering requirements on bonus funds are capped at ten times from 19 January 2026, and mixed-product promotions requiring two or more types of gambling are banned entirely. Online slots carry a £5 maximum stake per game cycle for adults, and £2 for those aged 18 to 24.
An offshore site has none of that. It has no licence condition 7.1.1 obligation to keep terms fair under the Consumer Rights Act 2015, no cap on wagering, no ban on the reverse-withdrawal button, no stake limit, and no obligation to participate in the national self-exclusion scheme. Its own regulator may impose some of these things — Anjouan, for instance, requires segregated player funds, certified random number generators and AML controls — but those obligations answer to Anjouan, not to Birmingham.
Five Signs a Site Can Be Trusted
Each of these is checkable in a few minutes, and none of them requires trusting anything the site says about itself.
The Regulator Check
A trustworthy site can be traced to a real regulator, and that regulator can be traced to the site. On the British register, match the domain. On a Curaçao licence, the Certificate of Operation Seal should redirect to cert.cga.cw, and the certificate behind it should display the same domain you are looking at; if it shows a different one, you are looking at another operator's paperwork. Kahnawake's Logo Certificate Program generates a Certificate of Good Standing when you click its logo, and Anjouan's certificates carry a licence number and QR code linking to a public register. A site with none of this has nothing to check.
The Terms on Withdrawals
Find the sentence about how long a withdrawal takes and whether any limit applies. On a British-licensed site, terms that cap withdrawals or confiscate un-staked deposits are unfair and void. Offshore, a maximum cashout clause is ordinary — one operator's terms cap winnings from bonus funds at 300 per cent of the bonus amount and void the excess. A withdrawal menu that offers only crypto, or a single withdrawal permitted at a time, is a design choice about friction, and friction is the point.
The Identity Check Timing
Ask when documents are required. The Commission's expectation is that identity and age checks happen before a customer deposits or stakes, and since 31 March 2020 operators must also check the register daily. A site that asks for nothing until you try to withdraw is doing the opposite, and a 2026 Commission blog reported that over a quarter of complaints reaching its Contact Centre concern identity verification — almost always raised at the withdrawal stage.
The Complaints Route
A serious operator names an ADR provider in its terms and lets you take a dispute there free of charge if it is not resolved within eight weeks. In Great Britain, approved providers include IBAS, eCOGRA, CEDR, ADR Group and ProMediate, and IBAS and eCOGRA have historically handled most gambling disputes. Anjouan requires its licensees to designate an approved ADR provider, and currently lists EGIS ADR, Axion ADR, iGaming ADR and others. A site that offers no route beyond its own support inbox has told you what it thinks of disputes.
The Protection Terms in Plain English
Look for what the site promises when things go wrong. Gamban and BetBlocker both block licensed and unlicensed sites and can be installed for an extra layer. Bank gambling blocks — offered by Lloyds, Barclays, HSBC, Monzo, Starling and others, per the Commission's list updated in October 2026 — work by declining payments under gambling merchant category codes. A site whose terms mention none of this, and whose own responsible-gambling page consists of a link to a foreign regulator, is not protecting anything.
What the Regulator Does to Unlicensed Sites
This is the part the sales copy never mentions, and it is the most interesting part of the story.
The Commission cannot prosecute websites it cannot reach, so it works on distribution instead. Since April 2024 its Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 cease and desist letters, 774 registrar referrals, 402 host referrals and three payment provider referrals — while referring 447,778 Google and Bing URLs and securing 287,961 removals. Across 160 illegal gambling websites for which traffic data existed, engagement fell by an average of 32 per cent after disruption.
The method matters more than the total. By disruption type, registrar blocks and website suspensions each produced an average engagement fall of 91 per cent; GEO IP blocking produced 60 per cent; Bing removal 52 per cent; Google removal 30 per cent; Facebook removal 8 per cent. The Commission's own reading is that search-engine removal makes a site harder to find but does not fully block access, which is why registrar action outperforms it so heavily. That is a telling admission: the visible lever is the least effective one.
The pace has accelerated sharply. Websites referred to search engines rose from 124 in July to September 2024 to 321 in April to June 2025. In January to March 2026 the Commission referred 226 websites and issued 98 cease and desist notices. In April to June 2026 it referred 366 websites covering 147,721 URLs and began zero criminal investigations. In July to September 2026 it referred 1,835 websites covering 7,677,211 URLs and issued 546 cease and desist notices.
Read those last two quarters together and something obvious appears. Referrals to search engines multiplied fivefold in a single quarter, and the number of URLs behind them multiplied by more than fifty — from 147,721 to 7,677,211. The Commission is not finding new operators at that rate; it is counting the same operators' domains at industrial scale. Meanwhile, across the whole of April 2025 to March 2026, one prosecution was commenced. Every quarter recorded zero or one. Disruption, not prosecution, is the strategy, and the strategy's success is measured in search results rather than in courtrooms.
Self-exclusion is where this bites. The Commission issued an industry warning notice on 20 January 2025 about casino games from licensed operators appearing on unlicensed websites, noting that such sites often target customers who have self-excluded through GamStop and may have inadequate social responsibility and anti-money-laundering controls. That is the shape of the risk: not that an offshore site will be worse at everything, but that it will be found by precisely the people the scheme was built to hold.
What to Check Before Using Any Offshore Site
Five steps, in order, all lawful and all ordinary. Together they take about half an hour.
- Confirm what the site holds and who regulates it. Find the licence name and click the seal or certificate. Check that the certificate names the domain you are on. If there is no seal, no register entry and no regulator named, stop there — this is the single check that makes the rest meaningful.
- Read the withdrawal terms before depositing, not after. Look for a maximum cashout clause, a limit on the number of withdrawals, processing fees, and whether your payment method appears at all. A term that caps what you can take out is not a detail; it is the deal.
- Check the bonus terms against the ten-times benchmark. Wagering requirements cap at ten times on a British licence; offshore they commonly run at 25× to 40×, and no-deposit bonuses at 40× to 60× with a cashout cap. Note also the maximum bet while wagering, which offshore sites often set low — one caps it at €5 and rejects any bet above it, with forfeiture as the sanction.
- Decide whether the transaction itself is one you want to make. Offshore operators frequently run on crypto, and crypto settlements are final in a way a card payment is not. Bitcoin blocks average ten minutes but arrive irregularly, with roughly a 63 per cent chance of one within any ten-minute window; more importantly, a payment sent to the wrong address cannot be recalled.
- Set your own hard stops before you start, and use blocking tools. Financial limits, Gamban or BetBlocker, and a bank gambling block are all free or cheap and do not depend on the operator's goodwill. Bank blocks operate at card level, so they must be set on each card, and most banks apply a 48- to 72-hour cooling-off period before gambling payments resume.
Getting Help, and Where the Line Really Sits
If gambling has become a problem, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day, run by GamCare, and also reachable by live chat and WhatsApp. There are treatment routes too: NHS specialist gambling clinics, with 15 opened across England since 2019, and integrated care boards commissioning eight regional services now receiving almost 5,000 referrals a year against a target of 3,000. Citizens Advice Scotland runs a gambling support line on 0800 328 1131. GamFam supports families and friends, and Gamblers Anonymous runs around 250 meeting locations with no appointment needed.
The line that matters is the one the scheme draws for itself. A GamStop registration blocks British licensed operators for its full term and then remains in place until the person contacts GamStop to remove it. Offshore sites are outside that arrangement by definition, and anything presenting them as a way around it is describing the gap, not a solution.
What the Commission's Own Complaints Data Says
The regulator publishes the shape of its own failures, if you read the numbers properly, and they are instructive.
Complaints to the Commission's Contact Centre coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025. Withdrawals nonetheless remain the number one complaint subject, and its 2024-25 annual report says issues relating to withdrawals continue to cause most of the complaints it receives. Commission data covering June to September 2024 recorded 44.2 million withdrawals by customers of large online operators: 96.3 per cent cleared automatically, 3.5 per cent within 24 hours, and 0.1 per cent took up to 48 hours.
So British-licensed withdrawal friction is genuinely rare and getting rarer, which is the strongest argument the licensed market has. The counterweight is the tail — a 2026 Commission blog noted that over a quarter of Contact Centre complaints concern identity verification, and the CMA's investigation, closed in 2019, ended with six operators undertaking to stop imposing maximum withdrawal limits at all.
The Commission has been clear about which side of that it stands on. It says it is not acceptable to introduce friction when a customer tries to withdraw rather than when they deposit, and that where there are no regulatory concerns there is no valid reason to delay a payout. In October 2026 one operator agreed a £900,000 regulatory settlement for failures including unnecessarily delaying withdrawals and a term allowing only one withdrawal at a time. That is a small number against a market worth £17.5 billion in the year to March 2026, and it is still the number that matters most on this page.
The Question Underneath the Keyword
Gambling not on GamStop is a search about a gap, and the gap is structural rather than accidental. The scheme binds only licence holders, the licence binds only those who want British customers, and everything else operates beyond the reach of a rule that is, in the end, a condition on a document.
What the Commission does about it is disruption: 3,140 notices, 447,778 URLs, 287,961 removals, an average 32 per cent fall in engagement on the sites it measures. What it does not do is prosecute — one case in a year — which means the deterrence rests on a site's position in search results, not on a court. That is why registrar blocks, which cut a domain off entirely, are so much more effective than search-engine removals, and why the Commission's referral numbers are exploding while the market it is chasing stays stubbornly small.
The practical conclusion is dull and defensible. A British licence buys a specific bundle of protections that no offshore paperwork replaces, and checking whether a site holds one — properly, on the register, domain by domain — takes the difficulty out of everything else. The number to end on is the one that keeps the whole argument honest: £16.6 billion staked illegally in 2025, according to a market-intelligence estimate, against 0.6 per cent of the population reported to have touched an illegal site in the previous four weeks. Both figures are quoted constantly. Only one of them is the regulator's.