Bingo Sites Not on GamStop and Regulatory Oversight

Bingo sites not on GamStop are offshore operators with no Gambling Commission licence. I am 18 months into tracking the Commission's own enforcement figures, and one number tells the story: its disruption unit referred 1,835 websites to search engines in July to September 2026, up from 366 the quarter before. Offshore sites are not licensed in Great Britain.

GamStop, the national online self-exclusion scheme, blocks a person from every gambling company licensed in Great Britain — and only those. It is often typed "gamestop", which is a slip about the name and nothing more. The scheme's terms are blunt about the limit of its reach: it can exclude you from participating operators and cannot prevent access to services run by organisations that do not participate.

The phrase in the search box, "bingo sites not on GamStop", reads like a shortcut to a game with one fewer door closed. The published figures describe something less tidy. Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and three payment provider referrals — and secured 287,961 URL removals. What used to be a game of whack-a-mole is now a game with the mallet wired to the payment rail.

I have watched this market for years, and the honest version is this: a person can reach these rooms, and the regulator is spending real money trying to make sure they cannot. Below is how the mechanism works, what the numbers say about who is winning, and how to read the paperwork before trusting any of it.

Why the Regulator Cannot Simply Shut Them Down

The Commission's stated position is unambiguous: it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a licence from the Commission, including where the operator holds a licence in another jurisdiction. Section 33 of the Gambling Act 2005 makes providing gambling facilities without a licence an offence, and it is immaterial whether the facilities are provided wholly or partly by remote communication, or inside or outside the UK.

The teeth, though, sit on the operator, not the player. On summary conviction the offence carries up to 51 weeks' imprisonment, a fine not exceeding level 5 on the standard scale, or both — six months in Scotland. The Act's general gambling offences attach to those who provide facilities, which is why the Commission's enforcement work looks like infrastructure sabotage rather than raids: it is cheaper to remove a domain from a search index than to extradite a director.

The figures show where the leverage is. Across 160 illegal gambling websites for which traffic data existed, disruption produced an average 32 per cent fall in engagement. Broken down by method, registrar blocks and website suspensions produced the largest average fall at 91 per cent each, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. The Commission says so itself: GEO IP blocking and registrar blocks are more effective than search-engine removals, because a search-engine removal makes a site harder to find but does not fully block access.

Scale, for context. Over May 2024 to July 2025, just over 1,000 unique illegal gambling websites were accessed by consumers in Great Britain. The Commission's dashboard recorded 586 accessible to GB consumers in September 2026 — 4 per cent less than the previous three-month average, and 4 per cent more than September 2025. In the quarter April to June 2026, not one criminal investigation was begun.

That last figure is the sting. The Commission can take a site out of the index, but the person who typed the address is the one holding the browser history.

What the Numbers Say About Who Uses These Rooms

The Commission's analysis published 5 November 2026 puts the whole-population figure at 0.6 per cent of respondents engaging with an illegal gambling website in the past four weeks, with a further 0.4 per cent in the past 12 months and 94.4 per cent showing no indication of using one. Among people who had gambled online in the past four weeks, 2.5 per cent had engaged with an illegal website, with a further 1.5 per cent in the past 12 months.

Two readings of that are available, and I know which I prefer. The first is that 94.4 per cent is a reassuring number. The second is that 2.5 per cent of active online gamblers is what a small but persistent market looks like when the enforcement lever is administrative rather than criminal.

The market estimates disagree with each other, which is itself worth knowing. H2 Gambling Capital estimates the amount staked with illegal gambling operators in the UK reached £16.6 billion in 2025, up from about £5 billion in 2019, with the proportion of gambling happening legally falling from 97 per cent to 92 per cent. Frontier Economics, working for the Betting and Gaming Council, conservatively estimated £2.7 billion staked annually online on the black market — 2.1 per cent of the £128 billion staked with GB regulated remote casino, betting and bingo operators — involving 1.5 million Brits. Yield Sec, analysing for the Campaign for Fairer Gambling, put the GB online market at £8.8 billion GGR in 2025, split 91 per cent regulated and 9 per cent unregulated.

A £16.6 billion figure and a £2.7 billion figure are not measuring the same thing, and the gap between them is the argument. H2 is modelling, Frontier was commissioned by the industry, Yield Sec was commissioned by the industry's sharpest critic. The Commission's own October 2024 methodology combines web-traffic data with a licensed-play assumption of £0.32 GGY per minute for online slots and explicitly notes it does not capture activity hidden by VPNs. When a regulator publishes an estimate that admits what it cannot see, treat the bigger numbers from elsewhere with a raised eyebrow.

The Illegal Gambling Taskforce's terms of reference were published by DCMS on 13 May 2026, with three priorities: reducing payments to and from illegal operators, tackling online advertising of illegal gambling, and improving cross-agency enforcement. It runs for 12 months and meets at least twice a year. Whether it changes anything depends on the payments rail, which is where the Commission's own strategy is described as critical and still early-stage.

UK-Licensed Bingo Sets the Standard

Anything a British player recognises as ordinary protection comes from the licence, and it is worth stating exactly what is being left at the door. From 31 October 2025 every gambling business licensed in Great Britain must prompt customers to set a financial limit before their first deposit and make it easy to review and alter it, remind customers every six months to review their account and transaction information, and offer financial limits using a free-text box at account level. Under RTS 12E, setting that limit must be presented as the default option, and the customer must take an action to decline it.

Licence Condition 17 requires licensees to obtain and verify information establishing a customer's identity before that customer is permitted to gamble. The information must include, though is not restricted to, the customer's name, address and date of birth. Before permitting a customer to deposit, licensees should tell customers what types of identity documents or information they may need to provide, in what circumstances, and in what form.

On withdrawals, the difference is sharpest. Of 44.2 million withdrawals by customers of large online operators between June and September 2024, 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent took up to 48 hours. Licence condition 17.1.1 states that a customer's request to withdraw funds must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier — though that does not prevent a licensee seeking information it must obtain at that time under another legal obligation, such as an anti-money-laundering requirement.

And the strictest term of all. Once a person is registered with GamStop, the exclusion holds for the full period chosen — six months, one year, five years, or five years with auto-renewal — and cannot be cancelled or deactivated while it runs. It stays in place after the end of the chosen period unless the person contacts GamStop to remove it. An offshore operator cannot lift it, and does not offer a way round it. What it does is ignore the question.

There is one more layer worth naming. The Commission published an industry warning notice on 20 January 2025 about casino games supplied by licensed operators appearing on unlicensed websites available to GB consumers, noting that such sites often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls. The games a player sees on some of these rooms were built by studios that answer to a British licence — supplied, in the Commission's view, as a way of reaching the customers the licence was meant to protect.

Where the Sites Actually Sit, Licence by Licence

The word "not on GamStop" covers four or five entirely different legal arrangements, and lumping them together is the first mistake a player makes. Below is what each register actually does, and what a licence of that type costs to obtain.

Read the Curaçao row carefully, because it is the one most often dressed up. The National Ordinance on Games of Chance took effect on 24 December 2024, making the Curaçao Gaming Authority the direct licensing and supervisory authority, and replacing the former master-licence and sub-licence model. Licensing activities ceased for the four former master licensors on these dates: Gaming Curaçao (365/JAZ) on 18 August 2024, Curaçao eGaming (1668/JAZ) on 1 October 2024, one former master licensor (8048/JAZ) on 1 November 2024 and Curaçao Interactive Licensing (5536/JAZ) on 31 January 2025. The legacy "orange" sub-licence certificates of operation ended on 15 October 2025, and operators should no longer rely on the former orange certificate as proof of a current licence. A historic /JAZ number or legacy seal must not be treated as independent proof that an operator currently holds a valid CGA licence.

Anjouan is cheaper and thinner. Internet gaming there is regulated under the laws of the Autonomous Island of Anjouan, a constituent territory of the Union of the Comoros, with the framework founded on legislation adopted in 2005. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 per licence per year, and that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally. The same investigation reported that a former attorney-general of the Comoros described Anjouan Licensing Services as "an illegal entity". Anjouan Gaming said in a statement on 10 June 2026 that "An Anjouan Internet Gaming Licence is not, and has never been presented as, a universal authorisation to operate in every country in the world". That is the regulator agreeing with the Commission, in public, about the limits of its own paper.

Costa Rica is the bottom of the ladder: it does not operate a comprehensive gambling licensing regime and has no formal framework for issuing gambling licences, and the "data processing license" sometimes referenced in the industry is not a licence in the strict legal sense. Its Legislative Assembly rejected Bill No. 25,057 in early 2026, which would have introduced a mandatory regime. Under Costa Rican law games of chance where the outcome depends primarily on luck rather than skill are generally prohibited.

The Identity Check, and Why It Changes After the First Deposit

If one mechanism decides how this whole market behaves, it is the identity check — how it works the first time, how it works later, and what the warning signs are.

In Great Britain the pattern is heavily front-loaded. A remote casino may identify customers and verify their age at registration but defer full identity verification until the €2,000 threshold is triggered — the Commission calls this the "hybrid approach". The Commission expects identity and age checks to be brought forward to before a customer deposits or stakes, and says onboarding on incomplete or inaccurate information — initials instead of full names, nicknames, commercial addresses instead of residential — is not sufficient. Companies can often verify identity by matching the account against databases such as credit reference agencies and the electoral roll, in which case no documents are needed.

The nasty version, and the reason this section exists, is a check that arrives at the withdrawal screen and nowhere earlier. The Commission says that over a quarter of complaints reaching its Contact Centre concern identity verification, a concern customers raise when they are asked for documents only on attempting to withdraw. In its 2026 risk assessment it also reports an increase in the scale and sophistication of attempts to bypass customer due diligence checks using false documentation, deepfake videos and face swaps generated by AI. Licence condition 17.1.1 exists precisely to stop an operator holding back a document request it could reasonably have made at the start.

The warning signs, in order of how much they should worry anyone:

• Documents requested for the first time on the withdrawal screen, when nothing was asked at deposit.
• A maximum cashout clause tied to bonus winnings, which caps what the account can ever pay out.
• Wagering figures well above the British cap of ten times, buried behind two or three clicks.
• An account inactivity clause allowing a deduction from a balance after a set period.
• Any term giving the operator sole discretion — "we may", "we reserve the right" — to void winnings.

That last one has cost operators real money. One operator was fined £170,000 in July 2025 for regulatory failures including a bonus term stating that "the operator has the right at their own discretion to close accounts or forfeit winnings". Under the Commission's fair-terms guidance, operators should not use terms giving them sole discretion to void or withhold a customer's winnings, because such terms are unfair within the meaning of the Consumer Rights Act 2015. Note that this is a British rule applied to a British licence. An offshore operator with the same clause has nobody to answer to.

Five Signs an Offshore Room Is Worth Your Time

These are the checks I would run myself, in this order. None of them requires a deposit.

A verifiable licence number, not a picture of a seal

The Curaçao authority issues two separate seals: a Certificate of Operation Seal, issued only to B2C operators and only for an approved and registered player-facing domain, and a License Certificate Seal, available to B2B and B2C entities and not domain-specific. Clicking a Certificate of Operation Seal must redirect to the official Curaçao validation portal, and if the seal differs in design, colour or format the website is not authorised by the CGA. If the certificate shown behind a seal displays a different domain name from the website being accessed, the site is displaying a certificate belonging to another operator. Anjouan's certificates carry a unique licence number and a QR verification code linking to its public register, and certificates that cannot be verified through the public register should not be relied upon.

The quick check: click the seal yourself and read the domain on the certificate. A seal that is a static image, or a link that goes nowhere, is decoration.

A register that names the operator

Kahnawà:ke runs a Logo Certificate Program, effective 15 January 2010, which lets a player click the Commission's logo on a site to generate a "Certificate of Good Standing" confirming whether that site holds a valid KGC permit. The MGA publishes a list of Unauthorised URLs, declaring it has no connection with those domains and that any reference to the MGA or a Maltese licence on them is false and misleading, with the most recent entries carrying notice dates of 30 October 2026.

The quick check: search the operator's name and domain against the regulator's own list. Absence from a register is the finding.

Real dispute resolution, in writing

Under licence condition 6.1.1-style arrangements in Great Britain, licensees must let customers refer a dispute to an ADR entity free of charge if it is not resolved within eight weeks of receipt of the complaint, and a consumer must have gone through the operator's own complaints procedure first. Anjouan Gaming requires licensees to designate an Authority-approved ADR provider and to list its name and contact details in player-facing terms, with operators expected to resolve complaints within 30 days before a player may escalate; the approved providers are EGIS ADR, Axion ADR, iGaming ADR and one other authorised entity. Kahnawà:ke employs a full-time Dispute Resolution Officer.

The quick check: find the named ADR provider in the site's own terms, not in a support chat message.

Terms that were not rewritten last week

The Commission's fair-terms guidance requires terms setting out promotional play restrictions to specify all prohibited types or patterns of play, and not to reserve sole discretion for the operator to decide when play breaches them. Terms covering fraud, collusion, multiple accounts, software manipulation, loophole exploitation or deliberate cheating must sit in separate terms from those relating to promotional play restrictions.

The quick check: look for a version number and an update date on the bonus terms page. Terms with no date are terms that can be anything.

A payout clause that does not cap the payout

British rules bar any term imposing a maximum limit on what a consumer may withdraw from their deposit balance; the Commission's own example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". They also bar confiscation of money deposited but not yet staked, and bar deductions on the basis that the consumer has failed identity or age verification. Offshore, none of that applies. BlueChip Casino, for instance, reserves the right to limit the amount withdrawable from winnings generated with bonus funds to 300 per cent of the credited bonus amount, with any excess voided.

The quick check: read the withdrawal section once, and count the words "maximum" and "void".

The Checks Worth Making Before and After Registering

A short, lawful routine. Every step here is ordinary consumer diligence.

1. Check the licence on the regulator's own register. The Commission advises consumers to check before gambling that the business holds a British Gambling Commission licence and to click through to the public register to see whether the site's activities and domain names match. If the domain is not on that register, the operator is unlicensed in Great Britain, and everything that follows changes.
2. Read the customer-funds disclosure before depositing. Licence condition 4.2.1 requires licensees holding customer funds to state clearly whether those funds are protected in the event of insolvency, the level of protection and the method used, and the disclosure must be given in writing with the customer acknowledging receipt before they are permitted to use funds for gambling. An offshore operator rated "not protected" will rarely print that in bold.
3. Set the financial limit as soon as the account opens. Under RTS 12E, setting a financial limit must be presented as the default option and the customer must take an action to decline. The limit is the one control that survives a bad evening, and it costs nothing.
4. Keep the deposit and withdrawal history where it can be found. Where a business delays a withdrawal because of insufficient ID it may be in breach of Licence Condition 17 and may be subject to regulatory action. Screenshots of deposit dates and the terms in force at the time are what an ADR provider will ask for.
5. Use the complaints route in the right order. A consumer must have gone through the operator's own complaints procedure first, and the operator may issue a "deadlock letter" confirming the customer can go to ADR. The Commission is a regulator and not an ombudsman, so it cannot resolve individual complaints or help consumers get their money back, though it records all complaints and typically refers disputes to an independent third party. ADR providers will not accept complaints about customer service issues, or about the refusal to accept a bet or a customer's custom.
6. Install blocking software before it is needed. GamStop signposts Gamban and BetBlocker as gambling blocking software that can be installed on phones, tablets and computers for an extra layer of protection. BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, requires no registration and is free worldwide. Gamban states it blocks licensed and unlicensed sites and that its protection is designed to be as difficult to remove as possible, though its free UK licence scheme, TalkBanStop, ended on 31 March 2026 and it now costs £4.99 per month or £29.99 per year in England and Scotland after a 7-day free trial. It remains free for residents of Wales.

If any of this has stopped being hypothetical, the National Gambling Helpline is operated by GamCare, free of charge, on 0808 8020 133, 24 hours a day, every day of the year; the same number reaches live chat and WhatsApp. Callers in Wales are directed to 0808 2819 265. It is not a crisis line — staff cannot transfer callers at immediate risk of harm and follow their own safeguarding procedures instead — so anything urgent belongs with the emergency services.

FAQ

What bingo sites are not on GamStop, and why does the list keep changing?

Any operator without a Gambling Commission licence is outside the scheme, because participation in GamStop is a licence condition rather than a voluntary choice. The list shifts because the Commission's Illegal Markets team is actively pruning it: across April to September 2026 it referred 366 websites to search engines in one quarter and 1,835 in the next, issuing 546 cease and desist notices in that second quarter alone.

Is there a list of bingo sites not on GamStop anywhere worth trusting?

Not one I would use. Any published list is out of date the week it is written, and the sites that curate them are usually affiliates earning on the click. The MGA publishes a list of Unauthorised URLs and the Commission maintains a public register of licensed operators. Checking a domain against a register takes a minute; trusting someone's directory takes a deposit.

Do UK bingo sites not on GamStop offer no deposit bonuses?

Some do, and the terms are where the value disappears. Offshore no-deposit bonuses typically run at 40x to 60x wagering with a €50 to €100 cashout cap, against a British cap on bonus wagering of ten times that came in on 19 January 2026. A headline "free" £10 with a £100 maximum cashout and 50x playthrough is a marketing cost, not a gift.

Are online bingo sites not on GamStop legal for a British player?

Using them is not the offence — section 33 of the Gambling Act 2005 targets the person providing facilities without a licence, and the Act's general gambling offences attach to those who provide facilities rather than to adult consumers. The practical consequence lands elsewhere: no GamStop block, no British identity-verification rights, no ADR scheme, and no regulator to complain to.

New bingo sites not on GamStop keep appearing — what should I look at first?

The licence claim, then the withdrawal clause. Curaçao's reform is the common answer, and it is checkable: the legacy "orange" sub-licence certificates ended on 15 October 2025, and a historic /JAZ number must not be treated as proof of a current licence. If a site's seal does not resolve on a click, treat the licence as unproven.

Can an offshore bingo site get round a GamStop exclusion?

No, and the framing is wrong. A GamStop exclusion holds for the full period chosen — six months, one year, five years or five years auto-renewing — and stays in place after the term ends until the person contacts GamStop to remove it. An offshore site does not lift it; it simply sits outside the scheme and ignores it. That is a gap in coverage, not an unlock.

The Register Is the Product

A bingo site that is not on GamStop is not a cleverer casino; it is one with the doors taken off. The British licence is the thing that makes a deposit limit a default rather than a favour, that makes an identity check happen before the money moves rather than after the win, and that gives a complaint somewhere to go. Strip it out and what is left is a wallet with a bingo card behind it.

The Commission knows this, which is why its enforcement is aimed at the plumbing — 3,140 disruption notices and 287,961 URL removals since April 2024, with registrar blocks cutting engagement by an average of 91 per cent. Its own analysis of the last 12 months puts engagement with illegal gambling websites at 94.4 per cent of people reporting none, and the taskforce set up in May 2026 has just 12 months to make that number hold.