Casino uk real money the sites the regulator chases and the ones it licenses

A real money casino for UK players means a site holding a Gambling Commission licence, which carries the national self-exclusion scheme, identity checks before you gamble, a ten-times cap on bonus wagering and access to free dispute resolution. Offshore sites hold none of that. It is illegal for anyone to offer commercial gambling to consumers in Great Britain without a Commission licence.

The machinery is real, and it is patchy. The Commission's Illegal Markets team issued 3,140 cease and desist and disruption notices between April 2024 and October 2025 — 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and three payment provider referrals — and referred 447,778 Google and Bing URLs, securing 287,961 removals. That is one way of measuring an unlicensed market: by how much paperwork it generates. Across 160 illegal gambling websites with usable traffic data, engagement fell by an average of 32 per cent after disruption. Not closed. Reduced. Registrar blocks and suspensions knocked engagement down by 91 per cent each, geo-blocking by 60 per cent, and a Google removal by 30 per cent — which tells you where the leverage sits.

Yet a licence is a set of obligations, not a guarantee of good behaviour. Licensed firms delay withdrawals, misplace identity documents and write bonus terms that a regulator later calls unfair. As of 12.11.2026, the honest read is that the British licence sets the standard, the offshore sector is judged against it and usually loses, and the gap between a licence and decent conduct is narrower than either side admits.

What the UK Licence Buys Anyone Who Plays

The obvious thing a licence buys is a phone number to ring when it goes wrong. The subtler thing is that the operator's entire commercial life depends on keeping it.

Since 31 March 2020, every online operator must be part of GamStop as a condition of its Commission licence. The requirement sits in social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, which states that licensees must participate in the national multi-operator self-exclusion scheme. In April 2020 the Commission added a requirement to check the entire customer base against the register at least every 24 hours, which also stops registered people receiving direct marketing. Two operators, one licensee and Sportito, had their licences suspended on 3 April 2020 for missing the integration deadline.

The scheme is now called Gamstop Online, renamed in November 2025, and the scheme's name is often typed "gamestop". It blocks online accounts with British-licensed companies for six months, one year, five years or five years with auto-renewal. A few facts about it get misreported constantly, so plainly: signing up takes minutes but the block can take up to 24 hours to bite; the registration cannot be cancelled during the term; and the exclusion stays in place after the chosen period ends until the person contacts GamStop to remove it. Under the terms of use, auto-renewal can only be switched off during the last six months of a five-year term, and auto-renewal continues for up to four further five-year periods. If nobody deactivates it, the data is held through a further automatic seven-year period during which operators are told the person was previously excluded. The group's 2025 annual report devotes a section to its refusal to remove registrations early.

The numbers say people choose the long option. At the end of 2025 Gamstop had 561,983 active exclusions, and 117,756 registrations were recorded during the year. Transaction data for the final six months of 2025 — 58,675 registrations — works out at 319 a day. Registrations rose 16 per cent year on year in the first half of 2026, with May 2026 setting a monthly record of 12,236. By July 2026 the register carried 614,738 people, of whom more than one in two had taken the maximum five years; across all age groups only one in four had chosen six months. Of the periods selected during 2025, 29 per cent chose six months, 24 per cent a year, 25 per cent five years and 22 per cent auto-renewal. Under-25s accounted for nearly one in three of all exclusions in the first half of 2026, a 26 per cent year-on-year rise. The 2025 annual report recorded the gender split as 94.3 per cent male and 5.7 per cent female.

Those figures describe a country making a deliberate, long-dated decision to stop. Which is precisely the population an unlicensed site has an incentive to serve.

Rules That Apply After Sign-Up

Signing up is the easy part. The rules that shape a real money account are the ones applied mid-relationship, usually at the moment someone wants their money back.

Stake limits arrived in 2025. The £5 maximum stake per game cycle for online slots for all adults went live on 9 April 2025, and the £2 limit for 18- to 24-year-olds on 21 May 2025, via the Gambling Act 2005 (Operating Licence Conditions) (Amendment) Regulations 2025, which attached a new condition to every remote casino operating licence. Slots only — roulette and blackjack are untouched. A minimum of 2.5 seconds must elapse between game cycles under RTS 14D.

Bonus terms changed on 19 January 2026. Licensees are banned from offering mixed-product promotions requiring two or more types of gambling, and wagering requirements on bonus funds are capped at ten times — a limit the Commission said would "take out extreme levels as some licensees currently apply up to 60 times wagering requirements". The implementation date moved from 19 December 2025 to 19 January 2026; the cap is delivered by amending Social Responsibility Code 5.1.1 on rewards and bonuses.

Financial checks are the live argument. Financial vulnerability checks became a licensing requirement for remote gambling businesses in August 2024, initially at £500 net deposits over a rolling 30-day period, then lowered to £150 from 28 February 2025. Those checks may only use publicly available risk flags: a bankruptcy order, a County Court Judgment, an Individual Voluntary Arrangement, a High Court Judgment, an Administrative Order or a Debt Relief Order. They are not the same as Financial Risk Assessments, which the Commission announced on 7 July 2026 would be introduced in stages — starting with the largest operators at £5,000 net deposits in a rolling 24-hour period for customers aged 25 and over, and £2,500 for under-25s, a spend pattern fewer than 0.5 per cent of customers exceed. At the final stage the thresholds fall to £1,000 in 24 hours or £3,000 over 90 days, and for under-25s to £750 or £2,000. The pilot found 97 per cent of customers spending above the thresholds could be assessed frictionlessly, against the 80 per cent estimated in the 2023 white paper. Until the checks actually arrive, the Commission has said no enforcement action will follow a failure to act on a Financial Risk Assessment.

Credit cards have been banned for gambling since 14 April 2020, under licence condition 6.1.2. Since 31 October 2025, every gambling business must prompt for a financial limit before the first deposit, present that as the default with a positive act required to decline it, remind customers every six months to review their account information, and offer limits via a free-text box. None of it applies offshore.

Why the Licence Is Not a Character Reference

I have no time for the line that a British licence makes a firm decent. It makes it answerable.

The Commission's fair-terms guidance prohibits any maximum limit on what a consumer may withdraw from their deposit balance, with "you may withdraw up to £50 per day and up to £500 per week" given as its example of a banned term. Licensees may not confiscate un-staked deposits, or deduct from a balance because a customer failed identity or age verification. Inactivity cannot be used to confiscate a balance. Terms giving an operator sole discretion to void or withhold winnings are treated as unfair under the Consumer Rights Act 2015.

In October 2026 the Commission announced that one licensee, which runs seven websites, would pay £900,000 in a regulatory settlement for failures including unnecessarily delaying consumer withdrawals. The specific failures: a term stating customers could request only one withdrawal at a time and could not request another until the original was authorised, found unfair under the Consumer Rights Act 2015, and manual review of every fifth or tenth withdrawal for some customers, which led to extra information being demanded before payouts were processed. Elsewhere, an operator was fined £170,000 in July 2025 for failures including a bonus term stating the firm had the right at its own discretion to close accounts or forfeit winnings.

The pattern is that the licence does not prevent the behaviour; it prices it. An offshore operator pays no such price, because no one is holding the invoice.

What the Evidence Says About Fast Withdrawals

Anyone comparing a fast withdrawal casino in the UK should start with the regulator's own dataset rather than a marketing page. Commission data covering June to September 2024 records 44.2 million withdrawals by customers of large online operators. Of those, 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours and 0.1 per cent took up to 48 hours. Earlier data from some of the largest companies showed around 99 per cent of withdrawal requests approved, processed and fulfilled within 24 to 48 hours.

Then the complaints. The Commission's Contact Centre receives over 6,000 calls annually, and withdrawal problems have been the number one topic raised by consumers; by July 2024 it said it still received around 2,000 complaints a year about withdrawal delays. Complaints coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025. Its Annual Report and Accounts 2024-25 states that, despite work with some operators, withdrawal issues continue to cause most of the complaints it receives.

The Commission's position is blunt: it is not acceptable to introduce friction when a customer withdraws rather than when they deposit, it does not consider it fair, transparent or necessary to delay withdrawals purely for customer-interaction purposes, and where there are no regulatory concerns there is no valid reason to delay a payout.

Reverse withdrawals have been banned outright since 31 October 2021 under RTS requirement 14B: "Consumers must not be given the option to cancel their withdrawal request." Before that ban, cancelling a pending withdrawal and re-staking it was the single easiest way for a player to lose money they had already won.

What no one will tell you is that there is no fixed statutory payout deadline. The LCCP sets none. The regime relies on fair-and-open condition 7.1.1, identity-verification condition 17.1.1 and the prohibition on unfair terms. An operator can be slow and lawful at the same time.

How Payment Methods Compare on Cost

Speed is the easy claim; cost and friction are harder. The table below compares payment routes by mechanism, using published figures — the same numbers as in the text around it.

Two things stand out. First, the e-wallet fees above are charged by the wallet, not the casino, and they are the same percentage whether the site holds a British licence or not — an offshore site's "no fees" claim only ever covered the casino's side of the transaction. Second, volatility of timing is inherent in the rails, not the operator: Bitcoin's target is an average, not an appointment.

Identity Verification and Withdrawals

This is the section that matters, because identity verification is where most real money disputes are actually settled.

Under licence condition 17, introduced on 7 May 2019, licensees must obtain and verify information establishing a customer's identity before that customer is permitted to gamble. The information must include the customer's name, address and date of birth, though it is not restricted to those. Before permitting a deposit, licensees should tell customers what documents or information they may need, in what circumstances and in what form. They must also take reasonable steps to keep that identity information accurate.

How it works the first time: a company can often verify someone by matching the account against databases such as credit reference agencies and the electoral roll, in which case no documents are needed at all. The Commission says it cannot give a timescale for ID checks because the process varies — electronic verification may be instant, documents take longer. Passports, driving licences and household bills are the documents a business can ask for; a selfie may be requested where fraud is suspected, such as identity theft; bank statements may be obtained to check that a source of funds is legitimate. Under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, remote casinos must identify and verify when a customer deposits, withdraws or wins €2,000 or more, singly or in linked transactions — and a remote casino may use the Commission's "hybrid approach", verifying age at registration but deferring full verification to that threshold.

How it works later, and this is the point people miss: condition 17.1.1 requires that a withdrawal request must not trigger a demand for additional information if the licensee could reasonably have asked for it earlier. That prohibition does not stop an operator seeking information it must obtain at that moment under another legal obligation, such as anti-money-laundering rules. Where a business delays a withdrawal because of insufficient ID, it may be in breach of condition 17 and may face regulatory action. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and it is one of the most common dispute types referred to ADR providers.

The warning signs are specific. Being asked for documents for the first time at the withdrawal stage, having deposited happily for months. A middle name used where a forename belongs — the Commission has warned that onboarding on initials, nicknames or a middle name instead of a forename creates mismatches with records held elsewhere, including GamStop, which undermines self-exclusion itself. And "fuzzy matching" through third-party verification providers, on which the Commission has expressed concern, where customers are onboarded on partial or equivocal verification and the consequences land later.

A no-account casino, or one advertising no ID checks at all, has not removed the requirement. It has removed the protection. British operators cannot confiscate funds because ID was not provided; the Commission's 2026 risk assessment rates the remote casino sector as high risk for money laundering, unchanged, and notes an increase in false documents, deepfake videos and AI face swaps used to bypass checks. That is why the checks exist, and why the sites that skip them are not doing anyone a favour.

Distinguishing Offshore Certificates from Licences

It is illegal under section 33 of the Gambling Act 2005 to provide facilities for gambling without an operating licence. On summary conviction that carries imprisonment for up to 51 weeks, a fine not exceeding level 5 on the standard scale, or both — six months in Scotland. It is immaterial whether the facilities are provided wholly or partly by remote communication, and whether they are provided inside or outside the UK; for remote gambling the section bites if at least one piece of remote gambling equipment is in Great Britain, or if the provider knows or should know the facilities are likely to be used here. The Commission states plainly that offering commercial gambling to consumers in Great Britain without a Commission licence is illegal, including where the operator holds a licence elsewhere. The offence attaches to the operator. The adult customer commits no equivalent offence, which is exactly why the enforcement burden sits where it does.

What the offshore certificates are worth varies enormously.

Curaçao's National Ordinance on Games of Chance took effect on 24 December 2024, making the Curaçao Gaming Authority the direct licensing and supervisory authority and ending the old master-licence and sub-licence model. The legacy "orange" sub-licence certificates ended on 15 October 2025, and operators should no longer rely on the former orange certificate as proof of a current licence. Licensing ceased for the four former master licensors on 18 August 2024, 1 October 2024, 1 November 2024 and 31 January 2025 respectively. A historic /JAZ number or legacy seal must not be treated as independent proof of a valid CGA licence. Provisional licences granted by operation of law were extended to 24 December 2025. The CGA announced on 7 October 2026 that its previous online gaming portal would not return to service, and that it is working on an alternative mechanism for verifying licensed domains because the previous digital seal may be affected; supplier licensing becomes fully mandatory from 24 December 2026. On fees, a B2C application is a one-time non-refundable €4,592 and the total annual B2C fee is €47,450, payable in full by 15 January. A Certificate of Operation Seal is issued only to B2C operators and only for an approved player-facing domain, and clicking it must redirect to cert.cga.cw — if the seal differs in design, colour or format, the site is not authorised, and if the certificate behind it shows a different domain name, it belongs to someone else.

Anjouan regulates internet gaming under legislation adopted in 2005. Its published fee schedule is €17,828 for B2C licence issuance and the same for annual renewal, with €500 per additional domain. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around €17,000 per licence per year, and that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally; a former attorney-general of the Comoros was reported as calling the licensing entity "an illegal entity", and the AOFA was reported as having been stripped of recognised-regulator status by Comorian banking laws passed in 2013 and 2015. Anjouan Gaming says an independent legal opinion issued on 19 September 2024 and reconfirmed in February 2026 confirms its authority, though that assurance comes from a licensee's own statement and is unconfirmed. On 10 June 2026 the regulator itself stated that an Anjouan licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world" — which is the whole argument in one sentence.

Kahnawà:ke has regulated interactive gaming since 1999, hosts licensees at a single data centre, and runs a Logo Certificate Program that generates a Certificate of Good Standing when the Commission's logo is clicked. Permit fees rise on 1 January 2027: the Client Provider Authorization application from USD 35,000 to USD 40,000, and the five-year renewal from USD 5,000 plus the annual fee to USD 40,000 including it. One CPA holder had its authorisation suspended with effect from 29 September 2026, which is a useful reminder that these registers are live documents.

Costa Rica has no comprehensive gambling licensing regime at all, and the "data processing license" sometimes cited in the industry is not a licence in the strict legal sense; a bill that would have introduced mandatory licensing was rejected in early 2026. Malta's authority publishes a list of Unauthorised URLs, and recent entries carry notice dates of 30 October 2026.

The Commission issued an industry warning notice on 20 January 2025 about casino games supplied by licensed operators appearing on unlicensed websites available to GB consumers, noting that such sites often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls. A self-exclusion is not something an offshore site can lawfully work around, and it would not lift the registration even if one accepted the custom.

Five Signs of a Trustworthy Site

No single mark settles it. But five checks, done in ten minutes, separate the serious from the shabby.

The licence matches the domain

A British licence names the domains it covers. The Commission advises checking that a business holds a Commission licence and clicking through to the public register to see whether the site's activities and domain names match. The failure mode is a genuine licence belonging to a different URL entirely. Offshore, the same test applies with the same trap: an Anjouan certificate that cannot be verified through the public register should not be relied upon as evidence of licensing, and a CGA seal that does not redirect to cert.cga.cw, or shows another domain, means the site is unauthorised.

The self-exclusion block is honoured at the door

A British-licensed operator must check its customer base against the GamStop register at least every 24 hours, and must close the account of anyone who has self-excluded and return funds held, rather than merely stopping them withdrawing. The check is simple: a site that markets itself as an alternative for people who have excluded is advertising an unlawful proposition, and the Commission's own warning notice says unlicensed sites often do exactly that.

The terms are short and say what happens to money

Under social responsibility code 5.1.9, significant conditions on marketing incentives must be provided transparently and prominently, and where displayed online, in full no further than one click away. The Competition and Markets Authority's do's and don'ts state that operators must not deny customers access to their own money or place maximum limits on withdrawals, and must not confiscate customer funds for failure to supply identity documents or after inactivity. Read the withdrawal section of the terms before depositing. If it contains the phrase "reserve the right" attached to your winnings, that term is the answer.

Payout speed is honest about its constraints

The Commission has said there is no valid reason to delay a payout where it has no regulatory concerns, and that where a withdrawal is delayed or refused the operator should explain why, subject to the statutory prohibition on tipping off in money-laundering cases. There is no fixed maximum period in the LCCP, so judge the explanation, not the promise. A site that publishes its processing times, names its payment provider limits and says plainly that Faster Payments limits apply per transaction rather than per day is telling the truth about rails it does not control.

There is a real route to a decision

British licensees must arrange for disputes to go to an approved ADR entity free of charge if unresolved within eight weeks. The approved list includes ADR Group, Pegasus ADR Service, Blexr, CEDR, eCOGRA, IBAS, ProMediate and Tattersalls Committee. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes, 150 of them valid "Deposits & Withdrawals" cases, with an average 31 days to resolve a domestic dispute and 17.8 per cent decided in the consumer's favour. IBAS's 2024-25 report records 3,721 domestic disputes, average completion 20 days, and 100 per cent operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. A site outside that system has no comparable endpoint.

How to Check a Real Money Casino Before Depositing

Six steps. Each one exists because the alternative is finding out later.

1. Verify the licence on the public register, not on the site's own badge. Open the Commission's register and confirm the operator and the exact domain are listed. A licence that covers a different domain is not a licence for the site being used, which is the commonest deception in this market.
2. Read the withdrawal terms before the first deposit. Look for maximum withdrawal limits on your own money, inactivity deductions and any clause reserving sole discretion to void winnings. These are the terms the Commission treats as unfair under the Consumer Rights Act 2015 and the terms the CMA has already taken undertakings on.
3. Check the customer-funds rating in the terms. Operators must publish one of three ratings — "not protected", "medium protection" or "high protection" — and an operator rated "not protected" must remind customers once every six months. Keeping funds in a separate client account does not guarantee repayment if the operator becomes insolvent, and money staked inside an open bet is not treated as customer funds at all.
4. Set a financial limit at the prompt. Since 31 October 2025 every British-licensed business must offer one before the first deposit and present it as the default. Ten minutes now removes an argument later.
5. Confirm the alternative dispute resolution route and its time limits. The operator must allow a complaint to escalate to approved ADR free of charge after eight weeks; eCOGRA may refuse a dispute more than a year old, and 361 of 499 invalid disputes in its last reported year had not been through the operator's internal procedure first. Keep the emails.
6. Install blocking software before it is needed. GamStop signposts Gamban and BetBlocker as an extra layer on phones, tablets and computers. BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, needs no registration and is free worldwide; Gamban blocks licensed and unlicensed sites and is free in Wales, but costs £4.99 a month or £29.99 a year in England and Scotland after the end of TalkBanStop funding on 31 March 2026. Bank gambling blocks are the other lever: the Commission's list, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. They act on gambling Merchant Category Codes, must be switched on card by card, and most banks impose a 48- or 72-hour cooling-off before transactions resume. They do not affect a credit score.

Understanding No Deposit Bonus Offers

The cluster of searches about the latest no deposit casino bonuses, £5 free spins and no deposit bonus casino 2026 real money all chase the same thing: money for nothing. The British rulebook has narrowed what that phrase can legally mean.

Since 19 January 2026, wagering on bonus funds is capped at ten times under social responsibility code 5.1.1. Mixed-product promotions are banned: "bet £5 to get 20 free spins" and an offer whose prize is itself mixed, such as "bet £5 and get a £5 free bet and 20 free spins", are both non-compliant, while "bet £5 and get £10 free bet" is fine because it does not mix product types. The ban does not apply where the customer freely chooses, on an unrestricted basis, which product category to use bonus money on. UK rules also require that wagering requirements must not apply to play with a deposit balance, that deposit and bonus balances are always displayed separately, and that players may withdraw their deposit balance at any time, including while a bonus is pending or active.

Offshore terms are a different species. Offshore welcome-bonus multipliers typically run at 35x to 50x, and no-deposit bonuses at 40x to 60x with a €50–€100 cashout cap, on a 2026 comparison table that is itself an unconfirmed industry compilation; trade coverage describes offshore welcome offers as typically 25x–40x. One offshore operator's published chart gives slots and specialty games 100 per cent contribution towards wagering, table games 20 per cent, video poker and blackjack 10 per cent, roulette and baccarat 5 per cent, and craps, jackpot games and live dealer games 0 per cent. That last figure is the trick: play a live dealer game with bonus money and none of it reduces the wagering requirement. Another caps the maximum bet while wagering at €5 for regular players and €10 for VIPs, and rejects any bet above the limit; a third limits winnings generated with bonus funds to 300 per cent of the credited bonus amount, with the excess voided. A maximum cashout clause of that kind would be a prohibited term on a British-licensed site, because operators may not impose any maximum limit on what a consumer may withdraw from their deposit balance.

A no minimum deposit casino or a 1 minimum deposit casino has simply removed the qualifying spend, not the wagering attached to the prize. And "top 20 online casinos", "top 50" and "top 100" lists are ranking exercises, usually affiliate-funded. The ranking tells you who pays best, not who pays out.

Choosing a Safe Real Money Casino App

A casino app for UK players carries the same licence obligations as a desktop site, so the checks are identical. The app store is not a regulator, and an app's presence in a store proves nothing about the operator behind it.

Two things worth adding. First, a shared wallet across products does not dilute the rules: where a remote operator runs one wallet across casino and other products, the customer due diligence requirements apply when the customer first enters the casino part of the site and deposits money. Second, whether a site has "no account" sign-up or skips verification at registration is irrelevant to what happens at €2,000 of deposits or withdrawals — the Regulations require identification and verification at that point whether or not the onboarding was frictionless. Deposits and withdrawals made during a single logged-on period, or in the same game or session, count as linked transactions towards that threshold.

Anyone who wants the shortest defensible test should use four: the domain on the public register, the customer-funds rating in the terms, the withdrawal clause, and the ADR provider named in the complaints section. Everything else is taste.

Where to Get Help

GamStop is free and takes minutes, and a registration holds for its full term and then stays in place until the person contacts GamStop to remove it. It is not lifted by moving to a site without a British licence, and no lawful operator will accept the custom.

The National Gambling Helpline, run by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year, and the same number reaches live chat and WhatsApp; callers in Wales are given 0808 2819 265. BeGambleAware, the public-facing brand of the charity GambleAware, directs people to the same helpline. Citizens Advice offers free, confidential advice including on debt, and Citizens Advice Scotland runs a gambling support line on 0800 328 1131, Monday to Friday, 10am to 3pm. GamFam, a registered charity, delivers peer support through its GRA5P programme for families affected by someone else's gambling. Gamblers Anonymous England, Wales & Ulster can be reached on 0330 094 0322, with around 250 meeting locations and no appointment needed, and Gam-Anon UK & Ireland supports family and friends regardless of whether the gambler attends GA. The NHS National Gambling Clinic at 69 Warwick Road, London SW5 9HB takes self-referrals and professional referrals, on 020 7381 7722. Treatment is now funded by the statutory levy on operators, introduced by the Gambling Levy Regulations 2025 and commenced on 6 April 2025, which raised just under £120 million in its first year, ringfenced solely for research, prevention and treatment of gambling-related harm.

One more time, because it is the only number that matters at three in the morning: 0808 8020 133.

The Regulator's Scoreboard, Read Honestly

The Commission's own numbers are the most useful thing on this subject and the least flattering to the enforcement story. Its quarterly referrals of websites to search engines rose from 124 in July to September 2024 to 321 in April to June 2025, then 226 in January to March 2026, then 366 in April to June 2026 — and then 1,835 in July to September 2026, covering 7,677,211 URLs, with 546 cease and desist notices issued in that quarter alone. Website removals by quarter went 123, 109, 170 and 214 across the first four quarters. Across April 2025 to March 2026, every quarter recorded no more than one prosecution commenced — a total of one, in October to December 2025. The Commission has made its first referral to Visa and three more since, and describes payment transaction data as a critical and still early-stage part of its financial disruption strategy.

Its own reading of the method is candid: geo IP blocking and registrar blocks are more effective than search-engine removals, because removing a site from search results makes it harder to find but does not fully block access. Over the monitored period of May 2024 to July 2025, just over 1,000 unique illegal gambling websites were accessed by consumers in Great Britain, and the number identified through its affiliate-page method rose from 364 in May 2024 to 535 in July 2025. For scale, the Commission's estimate of time spent on illegal gambling sites by GB consumers was 306 million minutes in January 2025, falling to 116 million in June 2025 and rising again to 152 million in July 2025 — a trend line that bends with enforcement, then bends back.

The unspoken dependency is that the Commission's remit only allows it to regulate sites that trade with or advertise to customers in Great Britain. The sites that ignore that boundary entirely are the ones it must chase with paperwork addressed to registrars, hosts and payment providers — which is why the same 586 illegal gambling websites were still identifiable in September 2026, and why the fall in engagement after a registrar block is 91 per cent rather than 100.

The market data says most people do not go near any of it. Commission analysis published on 5 November 2026 estimated that, across the whole population including non-gamblers, 0.6 per cent of respondents engaged with illegal gambling websites in the past four weeks and a further 0.4 per cent in the past 12 months, while 94.4 per cent showed no indication of doing so; among those who had gambled online in the past four weeks, 2.5 per cent had engaged with an illegal site, with a further 1.5 per cent in the past year. Advocates on both sides quote larger figures, often drawn from industry-commissioned work, and the honest position is that the estimates diverge too widely to settle the argument.

What does not diverge is the standard. A British licence brings the register, the pre-deposit identity check, the ten-times wagering cap, the ban on maximum withdrawal limits, the customer-funds disclosure and a free route to an adjudicator. An offshore certificate brings none of them, and in the case of the Curaçao and Anjouan registers, the regulators themselves now publish the sentences that say so.

FAQ

Is a casino without a UK licence legal to play at?

The offence under section 33 of the Gambling Act 2005 attaches to the operator, not the adult customer, so playing is not the thing being prosecuted. But the site is providing facilities for gambling in Great Britain without a licence, which is a criminal offence carrying up to 51 weeks' imprisonment, a level 5 fine or both. The practical consequence for anyone playing there is that no British protection applies.

Do offshore sites have to honour a GamStop self-exclusion?

No. The scheme's obligations apply to operators holding a Gambling Commission licence, and offshore sites are not connected to it. Because a registration cannot be cancelled during its term and then stays in place until the person contacts GamStop to remove it, it also cannot be undone by finding a site that ignores it. The Commission's January 2025 warning notice says unlicensed sites often target self-excluded customers deliberately.

Is there a fixed deadline for a UK casino to pay out?

There is none in the LCCP. The regime relies on fair-and-open condition 7.1.1, identity-verification condition 17.1.1 and the prohibition on unfair terms, rather than a stated number of days. The evidence suggests speed is normal: of 44.2 million withdrawals recorded between June and September 2024, 96.3 per cent cleared automatically. The disputes are about the minority, and they are the loudest complaints the Commission receives.

Can a site withhold winnings pending identity documents?

It must not, in the sense that condition 17.1.1 bars demanding extra information at withdrawal that the licensee could reasonably have requested earlier, and the CMA's position is that operators must not confiscate funds for failure to supply identity documents. The exception is information an operator must obtain at that moment under another legal obligation, such as anti-money-laundering rules, and operators cannot deduct from a deposit balance for failed verification.

What wagering requirements apply to a British bonus in 2026?

Since 19 January 2026, wagering on bonus funds is capped at ten times under social responsibility code 5.1.1, and mixed-product promotions requiring two or more types of gambling are banned. Wager-free play with a deposit balance is required to be separated from bonus play, and deposit and bonus balances must be displayed separately. The Commission chose a cap over an outright ban because it judged that licensees would otherwise write terms preventing people cashing out bonuses at all.

Do no deposit bonuses carry hidden conditions?

Nearly always. The prize is free; the withdrawal attached to it usually is not. A no-deposit bonus of £5 or ten free spins can sit behind a 40x to 60x multiplier and a €50–€100 maximum cashout, on an industry comparison that is unconfirmed but consistent. On a British-licensed site the multiplier cannot exceed ten times, but a maximum cashout clause that would be prohibited on deposit balances can still apply to bonus winnings.

What the Licence Actually Promises

The promise in the head keyword is not that a British-licensed casino will treat anyone well — the £900,000 settlement agreed by an operator in October 2026 for delaying withdrawals shows how thin that guarantee is — but that there is a register to check, an identity check before the first bet, a ten-times cap on wagering, a ban on capping what anyone may withdraw from their deposit balance, and a free adjudicator waiting after eight weeks. The offshore alternative offers a certificate that its own issuing authority has described as something other than a universal authorisation to operate.

Between April 2024 and October 2025 the Commission referred 447,778 Google and Bing URLs and secured 287,961 removals, and engagement with illegal sites fell by an average of 32 per cent. That is a decent week's paperwork and a poor substitute for a closed site.