Online Gambling UK Regulator, the Unlicensed Sites and the Paper Trail

Online gambling in the UK is legal only through operators holding a Gambling Commission licence. Offshore sites without one are not licensed in Great Britain, are not covered by GamStop, and offer none of the UK's consumer protections. The Commission disrupts them mainly by taking them out of search results.

The premise of this page is that, in 2026, the most useful question about online gambling in the UK is not which site pays fastest. It is who is chasing the ones that should not be there, and how well the chasing works. As of 7 Nov 2026, the answer is: energetically, unevenly, and with a scoreboard the regulator publishes itself.

I have covered this trade long enough to be tired of two arguments. The first says offshore sites are simply cheaper and quicker, as though a licence were a form of overhead. The second says the black market barely exists. Both are wrong in the same way: they treat the licence as paperwork rather than as the thing that makes a complaint resolvable.

What follows is what is actually documented. The Gambling Commission's own market data for the year to March 2026 puts Great Britain's gambling yield at £17.5 billion, with remote casino, betting and bingo at £8.3 billion. The offshore share of that is contested, and I will say plainly which estimates I trust and which I do not. The enforcement figures are not contested. They come with dates, quarters and percentages, and they say something quite specific about how a UK player ends up on a site that has no business taking their money.

The other half of the page is the practical half. A licence is a checkable thing. It takes about two minutes to check it, and the checks are free. GamStop holds registrations for their full term whatever else changes, and no offshore site is a way round that. If gambling is causing harm, the National Gambling Helpline is on 0808 8020 133, free and open every hour of the year.

The Best Online Gambling Sites UK Players Can Actually Verify

The best online gambling sites in the UK are the ones whose licence you can confirm on the Gambling Commission's public register, whose terms survive the Consumer Rights Act 2015, and whose disputes can reach an approved adjudicator. Everything else is a preference. The register is not.

That last point is the one worth labouring. The Commission advises consumers to check that a business holds a British licence and to click through to the public register to see whether the site's activities and domain names match. Not whether the brand is familiar. Whether the domain on your screen is on the list. Operators have been known to run several domains off one licence, and the mismatch is exactly where the trouble sits.

There is no published figure for how many online gambling sites there are in the UK, and anyone who quotes one is guessing at the edges: licensed domains are countable, offshore ones multiply by the week. The Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, 4% more than a year earlier. That is a floor, not a census. Its October 2024 methodology notes it does not capture activity hidden by VPNs.

Online UK Gambling and What the Regulator Actually Does

The regulator's answer to unlicensed sites is disruption rather than prosecution, and it is worth being honest about that. Across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced — one in total, in the quarter to December 2025. Meanwhile, since April 2024, the Illegal Markets team issued 3,140 cease and desist and disruption notices, comprising 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and 3 payment provider referrals, and referred 447,778 Bing and Google URLs, securing 287,961 removals.

By disruption method, registrar blocks and website suspensions produced the largest average fall in engagement — 91 per cent each — ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. The Commission says outright that GEO IP blocking and registrar blocks work better than search-engine removals, because removing a result makes a site harder to find without fully blocking access.

The tempo has risen. Websites referred to search engines went from 124 in July to September 2024 to 321 in April to June 2025, then 366 in April to June 2026 and 1,835 in July to September 2026. Cease and desist notices followed: 113, 83, 129 and 145 across the four quarters to June 2025, then 98 in the quarter to March 2026 and 546 in the quarter to September 2026.

Scale, and the estimates I distrust. The Commission's analysis published 5 November 2026 estimates that among respondents who had gambled online in the past four weeks, 2.5% had engaged with illegal gambling websites, with a further 1.5% in the past 12 months; across the whole population including non-gamblers, 0.6% in four weeks and 94.4% showing no indication of using one. H2 Gambling Capital puts stakes with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019. A Frontier Economics study for the Betting and Gaming Council offered £2.7 billion staked annually online. The spread between those two is roughly sixfold, and that difference is methodology and sponsorship, not measurement. Treat all three as directional.

Gamble Online UK and Where the Legal Line Sits

Gambling online in the UK is legal only where the operator holds a licence from the Gambling Commission, and the Commission states plainly that it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without one — including where the operator holds a licence in another jurisdiction. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence; on summary conviction it carries up to 51 weeks' imprisonment, a fine up to level 5 on the standard scale, or both. In Scotland the custodial term is six months.

Three details matter more than the headline. First, it is immaterial whether the facilities are provided wholly or partly by remote communication, and whether they are provided inside or outside the UK. Second, for remote gambling the section applies if at least one piece of remote gambling equipment used is situated in Great Britain, or under the post-2014 wording if the provider knows or should know the facilities are being used, or are likely to be used, in Great Britain. Third, the offence attaches to the operator, not the adult player. Sections 47 and 49 confirm the pattern: the Act's general gambling offences attach to those who provide facilities.

The related offences fill in the outline. Section 330 covers knowingly advertising unlawful gambling without reasonable belief otherwise, and section 331 advertising foreign gambling facilities other than lotteries. Cheating, attempting to cheat or helping another to cheat is an offence under section 42 — the only offence under the Act that is not a summary offence. That is the shape of it: the law aims at the supply side, and the player's protection comes from consumer law and the licensing regime rather than the criminal law.

The Licence Is the Whole Argument

This is the single thing the topic turns on. On a licensed site, the licence condition sits behind every term you agree to. Off it, the terms are whatever a contract in another jurisdiction says they are, and your route to complaint ends at a customer service queue.

The first time. Since 7 May 2019, licence condition 17 has required licensees to obtain and verify information establishing a customer's identity before that customer is permitted to gamble. Name, address and date of birth are the minimum. In practice most checks run against credit reference agencies and the electoral roll and are instant, which is why a well-run sign-up takes seconds and asks for nothing. Under the anti-money-laundering regulations, a remote casino must identify and verify when a customer deposits or withdraws €2,000 or more, and the threshold covers transactions that appear to be linked — through the same game, in one session, or within a single logged-on period. The hybrid approach lets a remote casino verify age at registration and defer full verification to that threshold.

Later. From 31 October 2025, all gambling businesses must prompt customers to set a financial limit before their first deposit, make it easy to review and alter, and remind customers every six months to review their account and transaction information. Under RTS 12E the prompt must present setting a limit as the default, and the customer must take an action to decline. Financial vulnerability checks became a licensing requirement for remote businesses in August 2024 at £500 net deposits over a rolling 30 days, lowered to £150 from 28 February 2025. Financial risk assessments were announced on 7 July 2026 to come in stages, starting with the largest operators at £5,000 net deposits in a rolling 24 hours for customers aged 25 and over and £2,500 for under-25s; at the final stage, £1,000 in 24 hours or £3,000 over 90 days for adults, and £750 or £2,000 for under-25s.

Warning signs. A document request that lands only when you try to withdraw is the classic one. Licence condition 17.1.1 says a withdrawal request must not trigger a requirement for information the licensee could reasonably have requested earlier — unless another legal obligation, typically anti-money-laundering, requires it at that moment. The Commission reports that over a quarter of complaints to its Contact Centre concern identity verification, and it has raised concerns about "fuzzy matching" by third-party verification providers and about onboarding customers on partial verification. Onboarding with a middle name instead of a forename can create mismatches with records held elsewhere, including GamStop, which quietly undermines an exclusion. Other signs: a term capping what you can withdraw; a house term reserving "sole discretion" to void winnings, which the Commission treats as unfair under the Consumer Rights Act 2015; and a complaints route that never produces a deadlock letter.

Playing Offshore and the Terms That Build In Delay

Offshore operators are not one category. Some hold real licences from jurisdictions with published standards; some hold nothing worth the name. Comparing them to the British baseline is the only way to see the difference, and the tell is rarely the bonus figure. It is the machinery that slows money on the way out.

What a British licence obliges an operator to do

A licensed operator must be part of GamStop as a condition of its licence — required since 31 March 2020 under social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, and reinforced in April 2020 by a requirement to check the entire customer base for GamStop registration at least every 24 hours, which also stops registered people receiving direct marketing. Reverse withdrawals have been banned since 31 October 2021 under RTS 14B: a customer must not be given the option to cancel a withdrawal request. Customer funds must sit in a separate client bank account, and the operator must declare one of three protection ratings — "not protected", "medium protection" or "high protection" — in its terms. That is the package an offshore site is not carrying.

The delay clauses to look for

The Commission's guidance is unusually blunt on this. Where an operator has no regulatory concerns about a customer, it says there is no valid reason to delay a payout; operators should not introduce friction when a customer tries to withdraw rather than when they deposit; and it is not fair, transparent or necessary to delay withdrawals purely for customer-interaction purposes. It also says operators must explain a delay or refusal, subject to the statutory prohibition on tipping off in money-laundering cases.

The closed-window clause is the most common. On 21 October 2026 the Commission announced that a licensee would pay £900,000 in a regulatory settlement for failures including unnecessarily delaying consumer withdrawals — a term allowing only one withdrawal request at a time, with no second request until the first was authorised, found unfair under the Consumer Rights Act 2015, and manual review of every fifth or tenth withdrawal for some customers that led to extra information being demanded before processing.

What the numbers say about speed

The Commission's data covering June to September 2024 records 44.2 million withdrawals by customers of large online operators in that period: 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent within up to 48 hours. Earlier data from some of the largest firms showed around 99 per cent of withdrawal requests approved, processed and fulfilled within 24 to 48 hours. The complaint flow has eased — complaints coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025 — but the Commission's Annual Report and Accounts 2024-25 still records withdrawals as the cause of most complaints it receives. Consumer research published 23 July 2026 found 49 per cent of people who had gambled in the past 12 months agreed that it is quick and easy to withdraw and collect winnings, 33 per cent were neutral and 18 per cent disagreed.

Dispute routes, onshore and off

Where the Commission is a regulator and not an ombudsman, it cannot resolve individual complaints or get anyone's money back; it records them and refers disputes to an independent third party. A licensed operator must let a customer refer an unresolved dispute to an approved adjudicator free of charge if it is not settled within eight weeks. The approved list is ADR group, Pegasus ADR Service, an adjudicator, CEDR, eCOGRA, IBAS, ProMediate and Tattersalls Committee.

The recorded outcomes are instructive. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes, of which 150 valid ones concerned deposits and withdrawals; average domestic resolution took 31 days, and 17.8 per cent of completed disputes went the consumer's way. IBAS's 2024-25 report records 3,721 domestic disputes, 217 of them banking or financial, an average completion time of 20 days, and 100 per cent operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. That last figure is the value of a licence in one number. A decision you can enforce is worth more than a refund you cannot.

The Licences Offshore Sites Actually Hold

Four labels turn up most often, and they are not equivalent.

Curaçao and the LOK reform

The National Ordinance on Games of Chance took effect on 24 December 2024, making the Curaçao Gaming Authority the direct licensing and supervisory authority and ending the old master-licence and sub-licence model. The legacy "orange" sub-licence certificates of operation ended on 15 October 2025, and a historic /JAZ number or legacy seal must not be treated as independent proof that an operator currently holds a valid licence. The four former master licensors ceased licensing on staggered dates: 18 August 2024, 1 October 2024, 1 November 2024 and 31 January 2025. The practical check is a Certificate of Operation Seal: clicking it must redirect to cert.cga.cw, and if the certificate shows a different domain from the site you are on, you are looking at another operator's paperwork.

Anjouan

Anjouan regulates internet gaming under legislation adopted in 2005, with the Anjouan Offshore Financial Authority named as the competent authority and Anjouan Licensing Services Inc. as sole authorised licence administrator. Published fees are EUR 17,828 for B2C licence issuance and the same for annual renewal, plus EUR 500 per additional domain. Certificates carry a unique licence number and a QR code linking to a public register, and the authority's own framework says certificates that cannot be verified through that register should not be relied upon. Note the caveat the authority itself issued on 10 June 2026: an Anjouan licence is not and never was a universal authorisation to operate everywhere.

Kahnawà:ke

The Kahnawà:ke Gaming Commission has regulated interactive gaming since its regulations of 8 July 1999. Operators must be hosted at Mohawk Internet Technologies, and the Interactive Gaming Licence is held by one entity at a time, with operators holding Client Provider Authorizations. Its Logo Certificate Program, effective 15 January 2010, lets a player click the Commission's logo to generate a Certificate of Good Standing. Permit fees rise on 1 January 2027: the CPA application fee from USD 35,000 to USD 40,000. Kahnawà:ke also states that a breach of a self-exclusion prohibition forfeits funds deposited or won to a third-party charity.

Malta and Costa Rica

Malta's B2C licence costs a one-time EUR 5,000 application fee, a fixed annual EUR 25,000 licence fee and 5% gaming tax on revenue, with minimum paid-up share capital of EUR 100,000 for Type 1 and 2 licences. The MGA publishes a list of Unauthorised URLs and declares any reference to a Maltese licence on those domains false and misleading. Costa Rica is a different matter: it operates no comprehensive gambling licensing regime, and the "data processing licence" sometimes quoted in the trade is not a licence in the strict legal sense. Bill No. 25,057, which would have introduced mandatory licensing, was rejected in early 2026.

UK Online Gambling Rules That Bite

The rules changed a great deal between 2024 and 2026, and the changes are the reason a British licence looks expensive. Slot stake limits went live on 9 April 2025 — £5 per game cycle for all adults, and £2 for 18- to 24-year-olds from 21 May 2025 — attached to every remote casino operating licence by the 2025 Regulations and applying to online slots only, not roulette or blackjack. A minimum of 2.5 seconds must elapse from the start of a game until the next cycle can begin. From 19 January 2026, licensees are banned from offering mixed-product promotions requiring two or more types of gambling, and wagering requirements on bonus funds are capped at ten times. The Commission's own words on the cap: it "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". The implementation date slipped from 19 December 2025 to 19 January 2026, which is worth remembering when a site's terms page still looks pre-Christmas.

The credit card ban has been in place since 14 April 2020 under licence condition 6.1.2, covering all remote gambling and non-remote betting, and lives on in a rule that where payment comes from an e-wallet the money must not have been loaded from a credit card. Under licence condition 5.1.2, effective 31 January 2024, licensees may accept payment from Great Britain customers only by a method whose provider is a payment service provider within the Payment Services Regulations 2017. Separately, the statutory levy commenced on 6 April 2025 at 1.1 per cent of previous-year gross gambling yield for online operators, and raised just under £120 million in its first year, ringfenced for research, prevention and treatment.

How the four options compare

The table below compares the routes a UK player realistically has, by what protects the money rather than by brand. Every figure comes from the sources above.

Five Signs an Operator or Service Can Be Trusted

The licence matches the domain

Check the public register and confirm that the activities and the domain names listed match what is on screen. A register entry for a different domain is the single most common mismatch, and it means the site in front of you is not covered.

The funds rating is stated before you deposit

Licence condition 4.2.1 requires the insolvency protection rating to be given in writing, acknowledged by the customer before funds are used for gambling, on the first deposit and after any change to the terms. Not protected is a legitimate answer. Silence is not.

Withdrawal terms contain no ceiling

Look for any term limiting how much or how often you can withdraw. The Commission's example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week", and operators may not impose any maximum limit on the amount a consumer may withdraw from their deposit balance.

Complaints reach a named adjudicator

The operator should name its ADR provider and explain that the service is free and available after eight weeks. If the terms mention only an internal disputes email, note that 361 of 499 invalid eCOGRA disputes — 72.3 per cent — had not been through the operator's own procedure first, which tells you how many players never get near a decision.

The bonus carries terms you can find in one click

Social responsibility code 5.1.9 requires all significant conditions applying to marketing incentives to be provided transparently and prominently, and where displayed online in full, no further than one click away. Wagering over ten times, a maximum cashout clause, or a "sole discretion to void winnings" term are the three to watch for.

A Practical Check Before Anyone Plays

1. Find the licence, then the domain. Open the Gambling Commission's public register and confirm the domain on your screen is listed against the licence. The reason is that a licence covers named domains, not brands, and the mismatch is where unprotected play starts.
2. Read the funds rating in the terms. Search the terms and conditions for the insolvency protection statement. The reason is that "not protected" is a real and permitted rating, and it is better discovered before a deposit than after an insolvency.
3. Read the withdrawal section, not the bonus page. Check whether there is any cap on the amount or number of withdrawals, and whether a fee applies. The reason is that a closed-window term — one request at a time — was specifically found unfair under the Consumer Rights Act 2015.
4. Find the adjudicator's name. Look for the approved ADR provider in the terms, and keep the eight-week clock in mind. The reason is that the operator's own complaints process must be exhausted first, and a deadlock letter is your ticket past it.
5. Set the financial limit during sign-up. The prompt should appear before the first deposit, with setting a limit as the default. The reason is that limits set later are set by a different person than the one who set them at the start.
6. If an exclusion is wanted, register with GamStop and add blocking software. Gamban and BetBlocker are signposted by the scheme; BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, free and with no registration. The reason is that an exclusion covers participating operators, and a block covers the rest of the browser.

An exclusion registered with GamStop holds for its full term — six months, one year, five years, or five years with auto-renewal — and stays in place after the end of the chosen period unless the person contacts GamStop to remove it. Under the terms of use, auto-renewal may only be turned off during the last six months of a five-year period, and it continues for up to four further five-year periods. If nothing is done, GamStop holds the data through a further automatic seven-year self-exclusion period. For the scale of it: 117,756 new registrations during 2025, 561,983 active exclusions at the end of that year, and 614,738 consumers on the register as of July 2026, of whom more than one in two chose the maximum five years. Bank blocks are a useful second layer — the Commission's list last updated 16 October 2026 names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling, applied at card level and generally lifted only after a 48- or 72-hour cooling-off period.

Is Gambling Online in the UK Safe?

Broadly, on a licensed site, yes — the protections are real and enforceable. Off it, no: the Gambling Commission states its remit only allows it to regulate sites that trade or advertise to customers in Great Britain and hold a Commission licence, so an offshore site sits outside the register, outside GamStop, outside the client-account rules and outside the free adjudication route that makes a licensed dispute worth pursuing.

Online Gambling UK Questions

Is online gambling legal in the UK?

Yes, through an operator holding a Gambling Commission licence. The Commission states it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without one, including an operator licensed elsewhere. Section 33 of the Gambling Act 2005 makes providing facilities for gambling without an operating licence an offence carrying up to 51 weeks' imprisonment, a fine up to level 5, or both. The offence attaches to the operator, not the adult player.

How many online gambling sites are there in the UK?

Nobody knows, and any single figure is a guess at the edges. Licensed domains can be counted; offshore ones multiply weekly. The Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, 4% more than a year earlier, and 311 illegal sites had disruption action taken against them in the quarter to September 2026.

How many people gamble online in the UK?

The Gambling Survey for Great Britain, published 16 July 2026 from 20,775 adults, found 47 per cent had gambled in any form in the past four weeks, falling to 27 per cent when lottery-only players are excluded. Among those who had gambled online in the past four weeks, the Commission estimates 2.5 per cent had engaged with illegal gambling websites, with a further 1.5 per cent in the past 12 months.

Is there tax on online gambling winnings in the UK?

No — winnings are not taxed in the hands of the player, and no duty is deducted from a payout. The tax sits on the operator instead. The statutory levy, which commenced on 6 April 2025, charges online operators 1.1 per cent of previous-year gross gambling yield and raised just under £120 million in its first year, ringfenced for research, prevention and treatment.

What is the difference between a UK licence and an offshore one?

A British licence carries obligations with it: membership of GamStop, a ban on reverse withdrawals since 31 October 2021, separate client accounts with a declared protection rating, and access to an approved adjudicator free of charge. An offshore licence carries none of those in Great Britain, because those duties attach to the Commission licence rather than to the company.

Can a UK player get a refund from an unlicensed site?

Rarely through any official route. The Commission is a regulator, not an ombudsman, so it cannot resolve individual complaints or get money back — it records complaints and refers disputes onward. A licensed operator can be pushed to an approved adjudicator after eight weeks; IBAS reported 100 per cent operator compliance with decisions in the consumer's favour in 2023-24 and 2024-25. No equivalent lever exists offshore.

The Paper Trail Is the Point

The page ends where the enforcement numbers begin: the regulator's leverage over unlicensed sites is disruption, not prosecution — one prosecution commenced across the whole of April 2025 to March 2026, against 546 cease and desist notices issued in the single quarter to September 2026. That ratio is the honest summary of the whole subject, and the reason a licence check on the public register remains the only check that matters. Before finishing: if gambling is causing harm, the National Gambling Helpline is 0808 8020 133, free and open 24 hours a day, every day of the year.