New Casinos Not on GamStop 2026 and What the Regulator Actually Does

A new casino not on GamStop is a site with no Gambling Commission licence, so it sits outside the scheme that blocks self-excluded players from British-licensed gambling for the whole of the chosen term. British protections, deposit limits and the 10x wagering cap do not apply there. The regulator can disrupt such sites but cannot licence or police them.

There is a phrase in this trade that does a lot of quiet work: "not on GamStop". Said by an operator, it sounds like a feature. Said by a regulator, it means a website trading without a licence in Great Britain, which is a criminal offence under section 33 of the Gambling Act 2005 — carrying, on summary conviction, up to 51 weeks inside and a fine, in Scotland six months. Same words, two entirely different businesses.

I have followed the Commission's Illegal Markets team for years, and the interesting thing about its figures is how much they say about the shape of the problem and how little about its size. The team cannot close a casino in Curaçao. It can make one harder to find, harder to pay and eventually unprofitable, and the numbers suggest that works at the margins. It does not work fast, and it does not work completely. The scheme itself is often typed "gamestop", which goes some way to explaining why the searches and the sites multiply.

So this column does two things at once. It explains how a new casino not on GamStop works — the licence, the check, the bonus arithmetic — and it explains what the regulator does about unlicensed sites, which is the honest subject the affiliate pages skip entirely. The schemes' rules, the licence rules and the payout rules are all in the fact sheet below, applied to the offshore market as it stands in 2026.

What the Regulator Does About Unlicensed Sites

Cease-and-desist notices, registrar referrals and search removals

Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease-and-desist and disruption notices: 2,032 C&Ds, 774 registrar referrals, 402 host referrals and 3 payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs and secured 287,961 removals. Those are the machinery of disruption, published 21 October 2025.

What interests me is the choice of tool. The Commission says registrar blocks and website suspensions produced the largest average fall in engagement — 91 per cent each — ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. Removing a site from search makes it harder to stumble across; it does not stop anyone who knows the domain. Registration is the chokepoint, and chokepoints are where regulators win.

The totals have climbed sharply. In January to March 2026 the team referred 226 websites to search engines and issued 98 cease-and-desist notices. In April to June 2026 that became 366 websites and 147,721 URLs. In July to September 2026 it referred 1,835 websites and 7,677,211 URLs, and issued 546 notices. Referrals of domain names have become referrals of individual pages by the million — a shift from chasing the shop to chasing the posters.

Why Prosecutions Do Not Work

Across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced, with a single prosecution in October to December 2025. That is the honest limit of the whole system. A £17,828 annual Anjouan licence against a criminal prosecution in a British court is not a fair contest in the operator's mind, and the Commission knows it. Enforcement here is economic disruption, not criminal justice.

How much of the market this is

The Commission's own analysis, published 5 November 2026, estimates that among respondents who had gambled online in the past four weeks, 2.5 per cent had engaged with illegal gambling websites, with another 1.5 per cent in the past year. Across the whole population, including non-gamblers, 0.6 per cent had done so in four weeks and a further 0.4 per cent in twelve months; 94.4 per cent showed no indication of using one. Its dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, 4 per cent above September 2025.

Compare the trade numbers and the fog thickens. H2 Gambling Capital put stakes with illegal operators in the UK at £16.6 billion in 2025, up from about £5 billion in 2019, with the legal share falling from 97 per cent to 92 per cent. Frontier Economics, for the Betting and Gaming Council, conservatively estimated £2.7 billion staked annually online on the black market — 2.1 per cent of the £128 billion staked with regulated remote operators. Yield Sec, for the Campaign for Fairer Gambling, put unregulated online gross gambling revenue at 9 per cent in 2025 against 7 per cent in 2024. Three firms, three incompatible numbers, each funded by someone with an interest. I would treat all of them as directional and none as precise.

The Licences Behind a New Casino Not on GamStop

Curaçao Direct Licensing and Verified Seals

The National Ordinance on Games of Chance took effect on 24 December 2024, making the Curaçao Gaming Authority the direct licensing and supervisory authority. The old master-licence and sub-licence model is gone: a historic /JAZ number or legacy seal is no longer proof of anything, and the legacy orange sub-licence certificates ended on 15 October 2025. Operators holding a valid licence when the LOK commenced received a provisional licence that ran to 24 June 2025, extended to 24 December 2025.

A B2C licence costs a one-time non-refundable EUR 4,592 to apply, with EUR 150 per ultimate beneficial owner and per qualified interest holder, and an annual EUR 47,450 — a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee to the authority, payable in full by 15 January. Cheap, by the standards of a regulated market.

The verification detail is what a careful player uses. The authority issues two separate seals: a Certificate of Operation Seal, for B2C operators only and only for an approved, registered player-facing domain, and a License Certificate Seal, which is not domain-specific. Clicking a Certificate of Operation Seal must redirect to the official registry. If the design, colour or format differs, the site is not authorised. If the certificate behind the seal shows a different domain from the one you are on, the site is displaying another operator's paperwork. On 7 October 2026 the authority said its previous portal would not return to service and that the old digital seal may be affected, and that it is building an alternative way to verify licensed domains. In the meantime, a licence certificate is not a certificate of operation, and treating the two as interchangeable is precisely the trick.

Anjouan Licensing and Regulatory Disputes

Anjouan regulates under the laws of the Autonomous Island of Anjouan, part of the Union of the Comoros, founded on 2005 legislation. Its B2C licence is EUR 17,828 to issue, one-time, and EUR 17,828 to renew annually, with EUR 500 per additional domain. The authority states that its licences contain no territorial restrictions under Anjouan law, adding that holders must comply with the laws of the jurisdictions where they operate. Those two sentences, read together, are the whole offshore proposition: we will license anything, and what happens in Britain is your problem.

An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, and that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally; a former attorney-general of the Comoros called the licensing entity "an illegal entity", and the AOFA was reportedly stripped of recognised-regulator status by Comorian banking laws in 2013 and 2015. Anjouan Gaming maintains, in a licensee's legal opinion confirmed in February 2026, that the authority is lawful, and said on 10 June 2026 that a licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". That last statement is unusually candid and entirely correct. Its certificates carry a licence number and a QR code linking to a public register, and unverifiable certificates should not be relied upon.

Malta, Kahnawake and nowhere at all

Malta's authority charges EUR 5,000 to apply, a EUR 25,000 annual licence fee and 5 per cent gaming tax on revenue from the service, with minimum paid-up share capital of EUR 100,000 for Type 1 and Type 2 B2C licences. It publishes a list of Unauthorised URLs, with entries carrying notice dates of 30 October 2026, and states that any reference to a Maltese licence on those domains is false. Kahnawà:ke is the oldest of the offshore regulators, has regulated interactive gaming since 1999, requires licensees to be hosted in its own territory, and runs a Logo Certificate Program that generates a Certificate of Good Standing. Its Client Provider Authorization fees rise on 1 January 2027: the application fee from USD 35,000 to USD 40,000, the five-year renewal from USD 5,000 plus the annual fee to USD 40,000 including it, while the annual USD 20,000 CPA fee and USD 1,000 Key Person fee stay put. It suspended the CPA held by Polar Ventures SDRL on 29 September 2026. And Costa Rica, where a good many of these sites are actually administered, has no gambling licensing regime at all: its Legislative Assembly rejected Bill No. 25,057 in early 2026, and the "data processing licence" often cited is not a licence in any legal sense.

What a New Casino Not on GamStop Takes Out of the Ground

No 10x cap, and the arithmetic that follows

The single most consequential difference is not the licence. It is the bonus term. From 19 January 2026, British licensees may not apply wagering requirements above ten times, under LCCP Social Responsibility Code 5.1.1, and may not mix two or more product types in one incentive. The Commission said expressly that the cap "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements".

Offshore, no such ceiling exists. Typical welcome-bonus multipliers are reported at 35x to 50x, with no-deposit bonuses at 40x to 60x and a €50 to €100 cashout cap. Take a €100 bonus at 40x on bonus only: €4,000 of play. On bonus plus deposit at 40x with a €100 deposit: €8,000. Then read the contribution table, because that is where the real multiple hides. Slots and specialty games count 100 per cent, table games 20 per cent, video poker and blackjack 10 per cent, roulette and baccarat 5 per cent, and craps, jackpot games and live dealer 0 per cent. A player grinding roulette at 5 per cent has to stake €80,000 to clear the first example.

Maximum cashouts, maximum bets and clauses that bite after the win

Then the caps on the other end. One offshore licence terms set a limit of 300 per cent of the credited bonus as withdrawable from bonus-generated winnings, with the excess voided. Another caps the maximum bet while wagering at €5 for regular players and €10 for VIPs and rejects anything above it; another sets the max bet at 20 per cent of the deposited amount and warns that breaching it "may result in account closure, forfeit of the Bonus, and any winnings generated". A sticky bonus can be wagered but never withdrawn — the sort of thing British rules ended by requiring deposit and bonus balances to be displayed separately and deposits to be withdrawable at any time, even when a bonus is pending.

Read the prohibited-play list before playing, not after. Low-margin, equal or zero-risk bets, moving from a low-weighted game to a high-weighted one after a big win, and holding free spins or bonus features until wagering is complete all appear in published terms as bonus abuse, sanctionable by confiscation. In Britain, terms of that kind must specify all prohibited patterns rather than reserve sole discretion to the operator. Offshore, the discretion is the point — and enforcement of it has a price tag. One British-licensed firm paid £170,000 in July 2025 for, among other things, a bonus term letting it "close accounts or forfeit winnings" at its own discretion; another agreed £900,000 in October 2026, including a fair-terms breach. Those are the penalties that do not follow a site to Curaçao.

Terms That Build In Delay

A withdrawal term is where an offshore operator buys itself time, and the clauses are usually legal under its own licence. The commonest three:

• The one-withdrawal-at-a-time rule. A term stating customers may request only one withdrawal at a time and cannot request another until the first is authorised was found unfair under the Consumer Rights Act 2015 in a £900,000 settlement announced 21 October 2026. Offshore, it is standard and unchallengeable.
• Manual review at an arbitrary interval. The same case involved reviewing every fifth or tenth withdrawal manually, generating fresh document requests. A pattern that looks random is the hardest to argue about.
• Threshold-triggered verification moved to the exit. A site may verify age and identity at registration and defer full verification until a threshold is crossed. Done at the door, that is efficient. Done at the till, it costs the player the use of their own money for as long as the documents take.

Against all of this, the British benchmark is worth quoting. Commission data covering June to September 2024 records 44.2 million withdrawals at large online operators: 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent took up to 48 hours. Reverse withdrawals have been banned outright since 31 October 2021 under RTS 14B — "Consumers must not be given the option to cancel their withdrawal request" — and the Commission states it is not acceptable to introduce friction at withdrawal rather than at deposit. It is not a perfect market: withdrawal problems remain the largest single subject of complaints to its Contact Centre, and a 2026 blog found over a quarter of complaints concerned identity verification. But the direction of travel in Britain is one-way, and offshore it is not travelling anywhere.

Five Signs an Offshore Operator Is Worth Trusting

The licence is live on the regulator's own register

Not the seal image — the register. A Curaçao Certificate of Operation Seal must click through to the official registry, and the certificate must show the domain you are actually on. An Anjouan certificate carries a licence number and a QR code leading to the public register, and the authority says unverifiable certificates should not be relied upon. A historic /JAZ number proves nothing at all. Check the seal in ten seconds by clicking it and comparing the domain.

The licence matches the market it is selling to

Anjouan's authority says its licences carry no territorial restriction and that holders must obey local law. British law requires a Commission licence to offer commercial gambling services to consumers in Great Britain, including where the operator holds a licence elsewhere. A site selling in pounds to British customers with only an offshore licence is telling you, in its own terms, that it accepts the risk. Whether you want to share it is the question.

Deposits and identity checks happen before the money moves, not after

The Commission expects checks before a customer deposits or stakes, and calls onboarding on nicknames, initials or commercial addresses insufficient. Where a site lets an unverified account deposit but blocks the withdrawal, that is the model, not a glitch. A quick test: does the site state what documents it may need and when, before the first deposit? If that page does not exist, the delay is built in.

The disputed-terms clause is narrow and the ADR route is named

Anjouan requires licensees to name an approved alternative dispute resolution provider and its contact details in player-facing terms, with complaints expected to be resolved within 30 days before escalation; the approved providers are EGIS ADR, Axion ADR, iGaming ADR and an approved dispute resolution firm. Kahnawà:ke applies contractual fairness and employs a full-time Dispute Resolution Officer. A site with no named ADR and a clause giving it sole discretion to void winnings has told you where a dispute ends: nowhere.

The self-exclusion position is stated as a fact, not sold as a feature

GamStop Online excludes a person from operators licensed in Great Britain: terms of six months, one year, five years, or five years with auto-renewal. The scheme itself says it cannot prevent access to services run by organisations that do not participate — a fact regularly dressed up as a selling point. An offshore site is not a way round a self-exclusion; it is simply outside the arrangement, and no offshore regulator's voluntary exclusion carries the same force. A site that markets itself against the scheme is advertising the absence of the protection, which is the clearest signal on the page.

Six Checks for Judging an Offshore Casino

1. Search the public register, not the site's own badges. The Commission's guidance says to check that the business holds a British licence and to click through to the register to see whether the site's activities and domain names match. Reason: a licence badge is an image file; the register is a record. Three minutes here saves the rest of the list.
2. Click the seal and confirm the domain behind it. Curaçao's Certificate of Operation Seal must redirect to cert.cga.cw and show the domain in use; a certificate showing a different domain belongs to another operator and signals an unauthorised or fraudulent site. Reason: seal copying is trivial and the click-through is not.
3. Rewrite the bonus as a real number before depositing. Multiply the bonus by the multiplier, then divide by the contribution rate for the game you intend to play, and check whether the deposit is inside the multiple. Reason: a 40x bonus on roulette at 5 per cent contribution is 800 times the bonus in staked turnover, and no one should discover that mid-session.
4. Read the cashout cap, the max-bet rule and the abuse list together. One set of terms allows withdrawal of only 300 per cent of the credited bonus; another sets max bet at 20 per cent of deposit. Reason: those clauses decide what actually arrives, and each is enforced after a win rather than before.
5. Bank the winnings before the next deposit. The Commission's fair-terms guidance lets a British player withdraw a deposit balance at any time, bonus or no bonus, and bans reverse withdrawals outright. Reason: multiple requests in flight are one of the standard hooks for a manual review.
6. Write down who to call if it goes wrong, before it does. The National Gambling Helpline, run by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year — 0808 2819 265 for callers in Wales — with live chat and WhatsApp on the same number. Reason: a telephone number stored in advance is worth more than a support form discovered afterwards.

Where the Protections Do and Do Not Reach

New UK casinos not on GamStop are not licensed in Great Britain, and the point is not a technicality. The Commission states plainly that it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence in another jurisdiction, and that its remit covers only sites which trade or advertise to British customers. British protections therefore do not apply: no statutory deposit limits prompting at first deposit, no 10x wagering cap, no contribution to the statutory levy, which raised just under £120 million in its first year ringfenced for research, prevention and treatment, no requirement to keep customer funds in a separate client account, and no approved ADR provider compelled to take the complaint. The Commission is a regulator, not an ombudsman: it cannot resolve an individual dispute or retrieve a player's money.

And the scheme that started all this is not optional for British operators. Under LCCP social responsibility code 3.5.5, licensees must participate in the national multi-operator self-exclusion scheme, and all online operators have had to belong since 31 March 2020. In April 2020 the Commission required operators to check their entire customer base for GamStop registration at least every 24 hours, which also stopped registered people receiving direct marketing. Two operators had their licences suspended on 3 April 2020 for missing the integration deadline. A self-exclusion set for six months, a year or five years holds for its full term, cannot be cancelled during it, and stays in place after the term ends unless the person contacts GamStop to remove it — and if they do not, the data is held through a further automatic seven-year period during which operators are told the person was previously excluded. That is the standard. Offshore sites are not a way round it; they are merely outside it.

The scale, meanwhile, is not small and not shrinking. GamStop recorded 117,756 new registrations during 2025 and had 561,983 active exclusions at the end of it; by July 2026 it reported 614,738 consumers on the register, with more than one in two having opted for the maximum five-year exclusion. Registrations rose 16 per cent year-on-year in the first half of 2026, with a record 12,236 sign-ups in May 2026. The Gambling Commission's warning notice of 20 January 2025 said unlicensed sites often target customers who have self-excluded through GamStop. Anyone can check whether a site holds a British licence in a few minutes. If it does not, the protections simply are not there, and the help bodies — the National Gambling Helpline on 0808 8020 133, Gamblers Anonymous on 0330 094 0322, Citizens Advice Scotland's gambling support line on 0800 328 1131 — are where the argument ends rather than begins.

Frequently Asked Questions

Is a new casino not on GamStop legal to play at?

Playing as an adult is not the offence — section 33 of the Gambling Act 2005 targets the person providing facilities for gambling without an operating licence, and British consumers are not caught by the Act's general gambling offences. The operator is committing an offence. That distinction matters legally and not at all practically: with no British licence there is no British regulator compelled to act on a complaint, and no approved ADR provider obliged to hear one.

Why do new online casinos not on GamStop appear so often?

Because launching is cheap. A Curaçao B2C licence costs EUR 4,592 to apply and EUR 47,450 a year; Anjouan charges EUR 17,828 to issue and the same to renew. Malta charges EUR 25,000 a year plus 5 per cent gaming tax and EUR 100,000 in paid-up capital. The gap between a few thousand euros and a fully capitalised European licence is the entire recruitment pitch, and affiliate marketing fills the rest of the shelf.

Are brand new casinos not on GamStop safer than older ones?

Usually the opposite. Age is not a virtue in itself, but an operator that has paid Kahnawà:ke's CPA renewal — rising to USD 40,000 including the annual fee from 1 January 2027 — and kept its permit for years has something to lose. A site in its first months has no track record on payouts, no published complaints history and, on offshore terms, no obligation to produce one. Treat an unproven site as exactly that.

What happens to a withdrawal delay at an offshore casino?

Little that is mechanical. Anjouan requires a named ADR provider and resolution within 30 days before escalation; Kahnawà:ke has a full-time Dispute Resolution Officer and treats self-exclusion breaches as forfeiting funds to charity. Neither can be compelled by a British regulator, and the ADR providers approved in Great Britain — among them IBAS, eCOGRA, CEDR and ADR Group — have no jurisdiction over an unlicensed site. Compare the British figures: 96.3 per cent of 44.2 million withdrawals cleared automatically between June and September 2024.

Do these sites take pay by phone deposits?

Some do, and the method has a specific problem. UK operators must accept payment only by a method whose provider is a payment service provider under the Payment Services Regulations 2017, and card payments go through merchant codes that banks block. Carriers and small payment intermediaries sit outside that perimeter, which is why phone deposits reappear on unlicensed sites. Convenience is not the same as recourse: if the money goes, the bank has no chargeback duty on gambling payments.

What about the 10x wagering cap on British sites?

It applies to licensees and not to offshore sites. Since 19 January 2026 LCCP Social Responsibility Code 5.1.1 caps wagering requirements at ten times and bans mixing two or more product types in one incentive; the Commission chose the cap over an outright ban partly to stop operators writing terms that blocked cashing out bonuses. Offshore there is no cap, no separation of deposit and bonus balances, and no right to withdraw a deposit while a bonus is pending. Read the contribution table before the multiplier.

The Regulator Carries a Scalpel, Not a Cell Key

A new casino not on GamStop exists because nothing in the British system requires it to stop existing, and the Commission's answer is disruption rather than prosecution — 546 cease-and-desist notices and 1,835 website referrals in a single quarter to September 2026, against one prosecution commenced in the whole of the previous financial year. That is a rational allocation of a regulator's power and a poor substitute for a licence. The practical verdict is unglamorous: an offshore site is a private arrangement with a company you cannot sue at home, and the terms do the deciding. Read the bonus multiplier, the game weighting, the cashout cap and the maximum bet before anything else, check the licence on the register rather than the badge, and keep the National Gambling Helpline's number — 0808 8020 133, free and answered every hour of the year — somewhere other than a support form you cannot find again.

Behind all of it sits a number worth remembering. GamStop had 614,738 people on its register as of July 2026, and more than one in two of them chose the maximum five-year term. Nobody picks five years by accident.