Gambling Sites Not on GamStop and the Regulator

Gambling sites not on GamStop are online casinos and betting services that hold no Gambling Commission licence, so the self-exclusion scheme cannot reach them. There were 586 illegal sites accessible to British consumers in September 2026. Nothing about them is licensed in Great Britain, and none of the protections that come with a British licence applies.

GamStop is the shorthand everyone uses; it is often typed "gamestop", which is wrong but forgivable. The scheme's proper name since November 2025 is Gamstop Online, and it holds a register of people who have asked British-licensed operators to stop taking their money. Roughly 614,738 people were on that register as of July 2026, and more than one in two of them had chosen the full five-year term. The scheme works because the law makes it work: since 31 March 2020, participation has been a condition of a Gambling Commission licence, and in April 2020 operators were told to check their entire customer base every 24 hours.

Which is exactly the point. The obligation is a licence condition. Strip the licence away and the obligation goes with it, so an offshore site with a Curaçao or Anjouan certificate can accept a British customer whose name sits on the register and nothing in British law compels it to look. London knows this. The Commission's own illegal markets team has spent two and a half years churning through cease and desist notices, registrar referrals and search-engine removals, and in the quarter to September 2026 alone it referred 1,835 websites and issued 546 cease and desist notices. That is not a tidy problem being solved; that is a problem being managed.

What Are the Gambling Sites Not on GamStop, and How Do They Work?

They are ordinary casino and sportsbook sites with a foreign licence and a domain that resolves fine in Manchester. The legal position is simple enough. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and it applies to remote gambling where at least one piece of remote gambling equipment is in Great Britain — or, since the 2014 amendment, where the operator knows or ought to know the facilities are likely to be used here. The Commission's own line is blunter: it is illegal to offer commercial gambling to consumers in Great Britain without a Commission licence, and holding a licence somewhere else makes no difference.

So the operator commits the offence, not the punter. That distinction matters, because it explains what the regulator actually does. The Commission does not chase players; it chases access. In the financial year 2024–25, the industry's gross gambling yield was £17.5 billion, of which £8.3 billion came from remote casino, betting and bingo — a large, taxable, licensed business that the Commission is anxious to keep on the right side of the line. Enforcement against the unlicensed fringe runs on distraction rather than prosecution. Across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced.

What that means in practice is a diet of disruption notices, registrar and host referrals, and URL removals — 3,140 of the first and 287,961 of the last since April 2024. The Commission's own research, published in October 2025, found an average 32 per cent fall in engagement across 160 disrupted websites. It also published the breakdown by method, and that breakdown is the most interesting thing in the whole file: registrar blocks and website suspensions produced average falls of 91 per cent each, geo IP blocking 60 per cent, Google removal 30 per cent, Facebook removal 8 per cent. The Commission itself concedes that removing a site from search results makes it harder to find but does not block it.

Understanding Where Traffic Comes From

The Commission's analysis estimated that, among adults who had gambled online in the past four weeks, 2.5 per cent had engaged with an illegal gambling website, with a further 1.5 per cent having done so in the past 12 months. Across the whole adult population including non-gamblers, the figure is 0.6 per cent in four weeks. Small numbers, large market. Estimates of black-market stakes vary wildly depending on who commissioned them: £16.6 billion staked in 2025 from one market-intelligence firm, £2.7 billion online from a study commissioned by the betting industry's trade body, and a regulated share put between 91 and 93 per cent by a different analyst. I treat all three with the same scepticism. The one figure I trust is the Commission's own: just over 1,000 unique illegal gambling websites accessed by consumers here over May 2024 to July 2025.

UK Gambling Sites Not on GamStop and the Search Problem

There is a quieter supply chain. The Commission's affiliate-page method — following the pages that list and rank illegal sites — saw the number of identified sites rise from 364 in May 2024 to 535 in July 2025, with crypto-casino terms added to the methodology in December 2024. Affiliate pages and review portals are how a great many people find these sites in the first place, and they are also the hardest part to dislodge, because the affiliate is often not the operator and may sit in a third country. The Commission refers illegal content to Meta, TikTok, X and YouTube; in April to June 2025 it had 84 illegal lottery URLs removed from social platforms. That is a rounding error against 1,835 website referrals in a single quarter.

Why the Best Label Is Misleading

The word "best" in that phrase does a lot of dishonest work, since there is no shared standard by which an unlicensed site could be best at anything. What the phrase really asks is which jurisdictions impose something. And there the differences are large, which is why the table below is drawn by licence rather than by brand.

How Offshore Licences Compare With a British One

Read the middle column and the story tells itself. A British licence costs an operator a 1.1 per cent levy on previous-year gross gambling yield and, more painfully, the 10x wagering cap that came in on 19 January 2026. An Anjouan licence costs €17,828 a year. A reporter named the number of licences that authority says it has issued — more than 1,300 — in an investigation published on 31 December 2025, which also quoted Comoros financial intelligence officials describing one of the companies involved as operating illegally, and a former attorney-general of the Comoros calling the licensing body "an illegal entity". The regulator itself has since stated, on 10 June 2026, that an Anjouan licence is not and never has been a universal authorisation to operate anywhere in the world. That is worth rereading: the licensing authority is telling you its licence does not make the site legal in Britain.

Curaçao is tidier but mid-reform. The National Ordinance on Games of Chance took effect on 24 December 2024, replacing the old master-licence model with direct licensing by the Curaçao Gaming Authority. The legacy "orange" sub-licence certificates ended on 15 October 2025, and provisional licences ran to 24 December 2025. Supplier licensing becomes fully mandatory on 24 December 2026. In October 2026 the CGA announced that its previous online portal would not return to service and that it is working on another way to verify licensed domains, because the digital licence seal may be affected. If a site's seal cannot be checked today, that is a fact about the seal, not proof of anything sinister — but it does mean a claim of Curaçao licensing is currently harder to verify than it should be.

And at the bottom, Costa Rica, where there is no comprehensive licensing regime at all. The "data processing license" that circulates in marketing copy is not a licence in any legal sense, and a bill that would have created a proper regime was rejected in early 2026.

The Exclusion Problem Nobody Can Fix

Self-exclusion is the single thing this topic turns on. Registering with Gamstop Online blocks a person from gambling with every online gambling company licensed in Great Britain for six months, one year, five years, or five years with auto-renewal. Registration takes minutes, though the block can take up to 24 hours to bite. It cannot be cancelled or shortened during the term — the group's 2025 annual report devotes a whole section to refusing early removals — and it stays in place after the chosen period ends unless the person contacts Gamstop to remove it. Auto-renewal can only be switched off in the final six months of a five-year term, and where nothing is done, Gamstop holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded.

The first time, it works cleanly because the operator has to check. On every login attempt afterwards, the same daily sweep keeps working. Where it breaks is at the boundary of the scheme: an operator with no British licence never receives the register, so the exclusion is simply invisible to it. This is not a loophole I am describing approvingly; it is the reason the Commission issued an industry warning notice on 20 January 2025 about licensed operators' casino games turning up on unlicensed websites, noting that such sites often target people who have self-excluded and may have weak social responsibility and anti-money-laundering controls.

A person who wants the protection to travel should look outside the register: blocking software such as Gamban and BetBlocker, which Gamstop itself signposts, and bank-level gambling blocks. The Commission's list of banks offering a blocking service, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. Those blocks decline payments to gambling merchant codes, apply at card level so must be switched on for each card, and most banks impose a 48- or 72-hour cooling-off period before gambling payments go through again.

Warning signs are worth naming. A site that advertises "no GamStop" as a selling point is telling you it does not participate in the scheme, which is the same as telling you it holds no British licence. Terms that let the operator void winnings at its own discretion are unfair under the Consumer Rights Act 2015 and were part of the reason one operator was allowed to pay £900,000 in October 2026. A site whose licence seal leads to a certificate bearing a different domain is displaying someone else's paperwork, and the CGA says plainly that such a site should be considered unauthorised or fraudulent. And a site with no named alternative dispute resolution provider gives a dissatisfied customer nowhere to go.

Five Signs an Operator or Service Can Be Trusted

The Licence Matches the Register, Not the Badge

Any operator offering gambling to British customers must hold a Commission licence, and the badge on a website proves nothing. Search the Commission's public register by the company name and check that the licensed activities and the domain names listed actually match the site being looked at. A licence belonging to another brand, or a domain that appears nowhere on the register, is the end of the conversation.

It Is Honest About Where Your Money Sits

Licensed operators must hold customer funds in a separate client account, must pick one of three insolvency ratings — not protected, medium or high — and must state in their terms which one applies, with a reminder every six months if funds are unprotected. Read that line before depositing. It is the difference between money that is merely separate and money that might come back.

The Bonus Terms Fit Inside a Postcard

Since 19 January 2026, wagering requirements are capped at ten times and mixed-product promotions are banned outright. A British-licensed site cannot ask for 40x. If the terms run to screens and ask for more, the licence is elsewhere. And a term letting the operator decide, at its discretion, whether a customer has abused a promotion is precisely the sort of clause the regulator has been fining people over.

Identity Checks Happen Before the Deposit, Not After the Win

A compliant operator is expected to bring identity and age verification forward to before a customer deposits or stakes, and to tell customers in advance what documents might be needed. Licence condition 17.1.1 says a withdrawal request must not trigger a demand for information the operator could reasonably have asked for earlier. Asking for a passport only when a withdrawal is requested is one of the most common complaints reaching the Commission and its ADR providers, and doing it deliberately is a licence breach.

There Is a Named ADR Body and a Real Complaints Route

Licensed operators must let a customer refer an unresolved dispute to an approved alternative dispute resolution provider free of charge after eight weeks, and the Commission's approved list includes IBAS, eCOGRA, CEDR and others. The numbers are worth knowing: IBAS handled 3,721 domestic disputes in 2024–25 with an average completion time of 20 days; eCOGRA resolved domestic disputes in 31 days on average in the year to 30 September 2025, ruling in the consumer's favour in 17.8 per cent of completed cases. The Commission is a regulator, not an ombudsman, and cannot get anyone's money back.

How to Check a Site That Claims to Be Outside GamStop

1. Find the licence holder's registered company name in the site's footer, then search the Commission's public register. The footer is where the truth sits, and the register lists the domains that licence actually covers. A match tells you British protections apply.
2. If the licence is foreign, open the regulator's own verification tool rather than the badge. For Curaçao, clicking a Certificate of Operation seal must redirect to cert.cga.cw, and a certificate showing another domain means the site is not that licensee. For Anjouan, certificates carry a unique licence number and a QR code linking to the public register, and a certificate that will not verify should not be treated as evidence of anything. For Kahnawà:ke, the clickable logo generates a Certificate of Good Standing.
3. Read the customer-funds clause and accept the answer before you deposit. Separate client accounts do not guarantee a return if the operator becomes insolvent, and operators are legally permitted to hold customer money in overseas accounts. If the terms are silent, that is an answer too.
4. Check the withdrawal terms for a cap, a fee or a queue. Operators cannot impose a maximum limit on what may be withdrawn from a deposit balance, cannot ask for the same information twice at withdrawal, and cannot use inactivity to confiscate a balance. A term limiting a customer to one withdrawal at a time until the first is authorised has already been found unfair under consumer law.
5. Note whether the terms name an ADR provider, and where the company is actually registered. An ADR name is the minimum price of credibility; a registered office in a jurisdiction with no gambling framework is a statement of intent.
6. Put the protection somewhere the site cannot reach. Blocking software, and a bank-level gambling block switched on for each card, hold regardless of which licence a site carries. Self-exclusion through Gamstop Online holds for its full term and then stays in place until the person contacts Gamstop to remove it — for the sites that participate, which is every site licensed here and no site licensed elsewhere.

Who Helps When It Goes Wrong

Gambling on an unlicensed site is not an offence for the punter — the Act's general gambling offences attach to those who provide facilities, and section 42 cheating aside, adult consumers are not in the frame. That is cold comfort when a balance will not move. The Commission cannot order a refund and can only record a complaint, so the practical routes are the National Gambling Helpline, run by GamCare, free on 0808 8020 133, 24 hours a day every day of the year; GamFam for families affected by someone else's gambling; Gamblers Anonymous on 0330 094 0322, with around 250 meeting locations across England, Wales and Northern Ireland; the NHS National Gambling Clinic on 020 7381 7722; and Citizens Advice, free and confidential, including on debt. In Wales the helpline number given is 0808 2819 265.

Questions About Sites Outside GamStop

What gambling sites are not on GamStop?

Any site that holds no Gambling Commission licence. Participation in the scheme is a licence condition — Social Responsibility Code Provision 3.5.5 — so a Curaçao, Anjouan, Kahnawà:ke or Costa Rica operation is outside it by definition. There is no register of such sites, because nobody licenses them here. The Commission's dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, but that measures what it has found, not what exists.

Is it legal to use an online gambling site not on GamStop?

For the player, generally yes — section 33 of the Gambling Act 2005 targets the operator providing facilities, not the customer. The Commission is explicit that offering commercial gambling to consumers in Great Britain without a licence is illegal regardless of any foreign licence held. That asymmetry is the whole story of this market: someone is breaking the law, and it is not the person placing the bet.

Do Welsh players have any extra route if a site is outside GamStop?

No, and this surprises people. Licensing is a reserved matter, so the same Gambling Commission register covers England, Scotland and Wales, and a Welsh player has the same protections and the same gaps. The one practical difference is that Gamban, the blocking software Gamstop signposts, is free for residents of Wales after the funding scheme ended on 31 March 2026, while in England and Scotland it costs £4.99 a month or £29.99 a year.

Why do offshore sites say they take UK players but not GamStop?

Because a British-licensed operator cannot. Participation in the national scheme is a condition of the licence, checked against the entire customer base at least every 24 hours since April 2020, and the sanction for failing to integrate has been immediate — two operators had their licences suspended on 3 April 2020 for missing the deadline. An offshore operator has no licence to lose and no access to the register, so its "we accept everyone" line is not generosity. It is the absence of an obligation.

How fast does the regulator actually shut these sites down?

Slower than the marketing implies, and by access rather than arrest. In April to June 2026 the Commission referred 366 websites to search engines and began zero criminal investigations; in July to September 2026 it referred 1,835 websites and issued 546 cease and desist notices. Disruption works unevenly — registrar blocks cut average engagement by 91 per cent, Google removal by 30 per cent — which is why the Commission now describes payment referrals to card schemes as a critical and still early-stage part of the strategy.

What if a site refuses to pay out after a win?

An unlicensed operator gives you no ADR route, no licence to complain about, and no realistic prospect of recovery, which is the entire argument against using one. A licensed operator must let you go to an approved ADR provider free of charge after eight weeks, and must respond to that provider's requests within ten working days. Keep records, complain in writing, and use the operator's own procedure first — 72.3 per cent of invalid eCOGRA disputes fail for exactly that reason.

The Long Game Against Sites Outside the Register

Sites not on GamStop exist because a licence is a cost and an obligation, and because enough British players find them; the Commission's answer is to make them expensive to reach rather than illegal to run, and on its own evidence that answer is half-working — 2.5 per cent of online gamblers had engaged with one in four weeks, engagement down a third where disruption landed, and 586 identified sites still accessible in September 2026. If you want the reassurance that comes with a rulebook, the public register is the only place that gives it, and it is free to check. If you want help rather than a check, the National Gambling Helpline is on 0808 8020 133, day and night, every day of the year.

Checked against the current rules as of 12.11.2026.