Casino Sites Not on GamStop and the Regulator

Casino sites not on GamStop are offshore operators with no Gambling Commission licence, so the scheme cannot reach them and UK protections do not apply. They are legal to run elsewhere, not here: offering gambling to British customers without a Commission licence is an offence under section 33 of the Gambling Act 2005.

The phrase is doing a lot of quiet work. GamStop — a scheme that is often typed "gamestop", which is not its name — is a register of people who have asked to be blocked from every online gambling company licensed in Great Britain. A site that is "not on GamStop" has not opted out of anything. It has never been on it, because it holds a licence from somewhere else: Curaçao, Anjouan, Kahnawà:ke, or nowhere at all. That distinction is the whole subject, and it is the one the marketing buries.

I have spent years reading licence registers and enforcement notices, and the pattern is fairly plain. The Gambling Commission does not license these sites, cannot compel them, and yet spends a good deal of money making them harder to find: since April 2024 its Illegal Markets team has issued 3,140 cease and desist and disruption notices. That is the regulator's answer to the category — not prohibition of the player, who commits no offence by gambling offshore, but attrition against the operator.

What "Not on GamStop" Actually Means for a Player

The scheme's obligation runs only one way. Since 31 March 2020 every operator with a Commission licence must participate in the national multi-operator self-exclusion scheme, a duty that sits in the Licence Conditions and Codes of Practice at social responsibility code 3.5.5. Offshore operators have no such duty, because the condition attaches to a British licence they do not hold.

What follows is not a loophole but a gap in coverage. A self-exclusion holds for its full term, and it then stays in place until the person contacts GamStop to remove it — there is no quiet expiry. That is a fact about the scheme, and it is worth stating plainly, because the entire appeal of a non-GamStop site rests on the idea that a block can be sidestepped. It cannot be sidestepped by a legitimate route. The register is simply not consulted by an operator that was never required to consult it.

The trade press and industry sources describe unlicensed sites as outside the scheme by definition, and GamStop's own terms of use point the same way [unconfirmed — stated by trade and press sources rather than a primary regulator page]. The practical consequence: a person who has self-excluded and then plays offshore is gambling with no backstop at all. No UK licence, no fair-terms condition, no requirement that customer funds sit in a separate account, and no route to an approved disputes body.

How Many Illegal Sites the Regulator Can See

The best single benchmark is the Commission's own disruption reporting. Over April 2024 to October 2025 it issued 2,032 cease and desist notices, made 774 registrar referrals, 402 host referrals and 3 payment provider referrals, and referred 447,778 Google and Bing URLs, securing 287,961 removals.

Those figures come from the Commission's 21 October 2025 report, measured across 160 illegal gambling websites. The lesson is uncomfortable for anyone who assumes a delisted site is a dead one: taking a page out of Google reduces engagement by under a third, while cutting the domain or the IP address does far more. Later quarters show the same treadmill — 366 website referrals in April to June 2026, then 1,835 in July to September 2026, with 546 cease and desist notices in that last quarter alone. Scale of effort is not the same as closure.

And the market keeps regenerating. The Commission's dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, up 4 per cent on the year before, while 311 sites had disruption action taken against them in the second quarter of 2026 to 2027. Its population survey, published 5 November 2026, found 2.5 per cent of people who had gambled online in the past four weeks had engaged with an illegal site, and a further 1.5 per cent in the past twelve months.

Are Offshore Sites Ever a Fair Deal? The Licence, Compared

A licence is a promise enforced by someone. What matters is who does the enforcing, whether they can reach the operator, and what the player can do when it goes wrong. Set out by jurisdiction, the differences are not decorative.

Read the third column and the ranking is obvious. British-licensed sites are not saintly, but they carry a complaints architecture with teeth: a deposit balance remains the customer's, unfair terms are voidable under the Consumer Rights Act 2015, and an operator's own complaints procedure must be capable of reaching an approved alternative dispute resolution provider at no cost to the consumer. A Kahnawà:ke operator also employs a dispute officer, which is more than most, but the self-exclusion regime there is permanent and irrevocable — an odd asymmetry, given that an offshore site is still not a way round a GamStop term.

Now the terms that build in delay. Under Curaçao rules a licence certificate is not the same document as a Certificate of Operation, and a certificate showing a domain different from the one being played on belongs to another operator. In Anjouan, the regulator itself said in June 2026 that an Internet Gaming Licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". That is a regulator explaining that a licence is not a passport. It is also the tidiest summary of this whole market.

Where the Money and the Identity Checks Get Stuck

The single thing this topic turns on is what happens between a deposit and a withdrawal, because that is where the licences differ most in practice. On a British-licensed site the first visit is meant to be verified before gambling: licence condition 17 requires name, address and date of birth to be established and checked, and the Commission has said onboarding on initials, nicknames or a commercial address is not good enough. Where that can be done electronically it is instant; where documents are demanded, it is not.

The first-time sequence is therefore: register, provide the details, get verified — often against credit reference and electoral roll data, in which case no paperwork at all — and only then deposit. Some remote casinos take the "hybrid approach", identifying the customer and checking age at registration but deferring full verification until deposits or withdrawals reach €2,000, a threshold that also catches transactions which look linked within one logged-on session.

Later visits are supposed to be frictionless, and the rules say so. A withdrawal request must not trigger a demand for information the operator could reasonably have asked for earlier, unless a separate legal duty — anti-money-laundering rules, typically — requires it at that moment. Reverse withdrawals have been banned outright since 31 October 2021. Credit cards have been barred since 14 April 2020, and even an e-wallet funded by a credit card is not acceptable.

The warning signs are recognisable. Identity documents requested only at the point of withdrawal; an account verified on a middle name, which then fails to match GamStop records; a term limiting withdrawals to one at a time; a "may at our sole discretion void winnings" clause. The Commission's Contact Centre takes more than 6,000 calls a year, and over a quarter of the complaints reaching it in 2026 concerned identity verification, most often raised when documents were demanded on cashing out. That is not a paperwork problem. That is a business model.

Five Signs an Offshore Operator Can Be Trusted

Trust here is not a feeling. It is a set of documents that either exist or do not.

The licence is verifiable on the regulator's own register

A licence is only worth what its register is worth. A Curaçao Certificate of Operation seal must redirect to cert.cga.cw, and a certificate behind it showing a different domain means the site is displaying someone else's paperwork. Kahnawà:ke lets a player click the Commission's logo to generate a Certificate of Good Standing. Anjouan certificates carry a unique licence number and a QR code pointing to a public register. The quick check: click the seal, and see whether the domain matches and the register loads.

The terms name an approved disputes body

Every reputable regulator requires an alternative route when the operator will not budge. Anjouan requires a named, approved ADR provider with contact details in the player-facing terms — EGIS ADR, Axion ADR, iGaming ADR and other approved bodies are the current list. Malta wants complaints lodged with it directly. The quick check: search the terms for the word "ADR" or "dispute". If there is no named body, there is no route.

Player funds are segregated and the rating is disclosed

Great Britain's licence conditions require customer funds to sit in a separate client bank account and the operator to disclose whether those funds are protected if it goes bust. Anjouan's published standards also require segregation from operational funds. The quick check: find the insolvency-protection rating in the terms — "not protected", "medium protection" or "high protection". An operator that will not say has told you something.

The bonus terms are short, numbered and boring

From 19 January 2026, wagering requirements on bonus funds at British-licensed operators are capped at ten times, and mixed-product promotions requiring two or more types of gambling are banned outright. Offshore terms routinely run at 25 times and above, with maximum cashout clauses such as 300 per cent of the bonus credited. The quick check: look for the wagering multiple, the maximum bet while wagering, and any cashout cap, in that order. A cap in the small print is the tell.

Withdrawal terms are written down and testable

A serious operator says how long a withdrawal takes and does not change the answer when money is owed. The quick check: read whether a "one withdrawal at a time" rule exists — the Commission found exactly that clause unfair under the Consumer Rights Act 2015 in October 2026 — and whether any fee exceeds the direct cost of processing. If a fee is more than a bank charge, it is not a processing fee; it is a hurdle.

Six Steps for Judging a Site Carefully

1. Check whether the site holds a Commission licence at all. Open the Commission's public register and confirm the domain name is listed against the operator. If it is, the site is on GamStop and this whole question does not arise. If it is not, everything below applies.
2. Identify the actual licensing jurisdiction and verify it at source. Not the flag in the footer, not the badge image, but the regulator's own register. A jurisdiction that has replaced its licensing model — Curaçao did so in 2024, and legacy orange sub-licence certificates ended on 15 October 2025 — is a good reason to check rather than assume.
3. Read the terms on funds and disputes before depositing a penny. Look for the client-fund protection rating, the named ADR provider and the withdrawal conditions. This takes ten minutes and costs nothing, which is the cheapest diligence available.
4. Assume no UK protection exists and price that in. No fair-terms condition, no stake limit of £5 per spin on slots, no statutory complaints route, no guarantee that money held for you survives an insolvency. Those are features of a British licence, not of the internet.
5. Set limits the operator cannot override, and treat them as the real control. Deposit limits and time limits set with the site are useful; they are also administered by the party with an interest in you exceeding them. A bank-level gambling block applied at card level is administered elsewhere, and most banks impose a 48- or 72-hour cooling-off period before gambling payments are allowed again.
6. Report and record. The Commission cannot resolve individual disputes — it is a regulator, not an ombudsman — but it records complaints and uses patterns in them. Reporting a suspicious or unlicensed site is how the disruption figures on this page get made.

Where British Players Stand, and Where Help Is

GamStop's coverage ends at the British licence, and the Commission's own advice is to check the register before playing. Beyond that, the supports are not jurisdiction-dependent and they are free.

The National Gambling Helpline, run by GamCare, is 0808 8020 133, twenty-four hours a day, every day of the year. Callers in Wales have a separate number, 0808 2819 265. GamCare also runs live chat and a WhatsApp service on the same main number. It is not a crisis line, and its staff follow safeguarding procedures rather than transferring someone at immediate risk — worth knowing before relying on it as an emergency service.

Beyond the helpline: GambleAware's public brand signposts to the same service; Gamblers Anonymous England, Wales and Ulster can be reached on 0330 094 0322 with around 250 meeting locations and no appointment needed; GamFam supports families through its five-stage GRA5P programme; Gam-Anon UK and Ireland supports the relatives and friends of compulsive gamblers whether or not the gambler attends. NHS treatment has expanded considerably — fifteen specialist clinics across England since 2019, with integrated care boards commissioning eight regional services now receiving almost 5,000 referrals a year against a target of 3,000. Citizens Advice offers free, confidential debt and gambling advice, and Citizens Advice Scotland runs a gambling support line on 0800 328 1131, Monday to Friday, 10am to 3pm.

What the national picture does not support is complacency. The third Gambling Survey for Great Britain, published 16 July 2026, found 2.4 per cent of adults with a PGSI score of 8 or more, a figure the Commission describes as stable across three years, and 2.7 per cent of those who had gambled in the past year reporting a severe consequence. Offshore sites sit outside all of the machinery built to respond to that.

How the Category Ranks Itself

The phrase "best casino sites not on GamStop" is a ranking question, and rankings need a criterion. Judged by licence, the field orders itself into three tiers.

At the top, offshore operators under a functioning regulator with a live public register, fund segregation rules, a named disputes body and no territorial nonsense — the Maltese and Kahnawà:ke end of the market. In the middle, Curaçao licensees who have completed the transition to the LOK regime and can show a verifiable Certificate of Operation for the exact domain in use; an aggregator reading the public register counted 704 Curaçao licences held by 698 operators as of 6 November 2026, of which 552 were active [unconfirmed — a third-party tracker, not a Curaçao Gaming Authority publication]. At the bottom, domains with a legacy seal, a certificate naming someone else's site, or a jurisdiction that no longer issues licences at all.

That ranking is by method, not by brand, and it produces an awkward conclusion: the best operator in this category is the one whose paperwork survives the first five minutes of checking. Nothing in the tiering has anything to do with the games.

Why Date of Launch Is Not a Recommendation

"New casino sites not on GamStop" is a different question, and the answer is less flattering. Newness in this market means a recently registered domain, and a recently registered domain is not evidence of anything except a recent registration.

The genuine newness to look for is regulatory. Curaçao's LOK regime took effect on 24 December 2024 and replaced the old master-licence model: provisional licences ran to 24 December 2025, the legacy orange certificates ended on 15 October 2025, and supplier licensing becomes fully enforceable there from 24 December 2026. A site launched under the new regime has a real licence behind it. A site launched last month on an old seal does not, and the Curaçao Gaming Authority has said plainly that a historic /JAZ number must not be treated as proof of a current licence.

The same caution applies to the British market's own churn. When TGP Europe left Great Britain in May 2025, sites it had operated became unlicensed overnight and the Commission said so publicly, warning that they might not provide protections against criminality or gambling-related harm. A domain that was safe last year is not automatically safe this year. Age is not the test; the register is.

The Contradiction in the Term British Sites

Strictly, "British casino sites not on GamStop" describes something that should not exist. A site serving British customers is required to hold a Commission licence, and a Commission licence requires participation in the scheme. There is no lawful version of a British-licensed operator that is not on GamStop.

What the phrase usually means is one of three things: an offshore site dressing itself in British imagery — Union flags, "UK players welcome", sterling balances; an operator that held a British licence and no longer does; or a domain simply not telling the truth about who regulates it. The Commission's position is unambiguous: it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, and that includes an operator licensed elsewhere. Section 33 of the Gambling Act 2005 carries, on summary conviction, up to 51 weeks' imprisonment, a level 5 fine, or both. The offence is the operator's. The player is not committing it.

That asymmetry is worth holding on to. The law does not criminalise the customer; it withdraws the machinery of protection from around them and aims the enforcement at the company. Which is a roundabout way of saying that the risk here is largely financial, contractual and practical — and that the person carrying it is the one holding the debit card.

Mobile and E-Wallet Payments

Two payment queries recur, and both have a regulatory answer. "Pay by phone casino sites not on GamStop" and "PayPal casino sites not on GamStop" are searches about rails, and rails are regulated separately from gambling.

British-licensed operators may accept payment from British customers only through a provider that qualifies as a payment service provider under the Payment Services Regulations 2017 — a condition effective since 31 January 2024. That is why the payment menu at a licensed casino is short and boring. Mobile-carrier billing, which is what "pay by phone" usually means, is heavily restricted or absent for gambling at licensed operators precisely because it is difficult to reconcile with that requirement and with anti-money-laundering expectations.

An offshore operator is not bound by that condition, which is the point and the problem. Payment methods that a British licence discourages are exactly the ones an unlicensed site will accept, and the protections that attach to a card transaction are thinner or absent. Two further rules matter regardless of jurisdiction. Credit cards have been banned for gambling since 14 April 2020, and an operator must satisfy itself that money arriving from an e-wallet was not loaded from one. Where a card is used, a bank-level gambling block declines payments categorised under gambling merchant codes — and it applies per card, so it must be switched on for each one.

The uncomfortable arithmetic: a payment method accepted offshore that a licensed operator will not touch is a reasonable definition of a warning sign, not a feature.

What the Regulator Does, and What It Cannot Do

The Commission's answer to unlicensed sites is disruption rather than prosecution. It refers thousands of URLs to search engines, blocks domains through registrars, geo-blocks IP addresses, and has begun reporting payment transaction data to the Visa Operator Scheme — a step it calls critical and still early-stage. It made its first referral to Visa in January 2025 after a test purchase on an unlicensed site, and three more since.

Yet across April 2025 to March 2026, every quarter recorded zero or one prosecutions commenced. Enforcement here is administrative attrition, not the criminal courts, and the Commission's own research says registrar blocks and site suspensions cut engagement by 91 per cent while Google removals manage 30 per cent. It also warned the industry in January 2025 that content from licensed casinos was turning up on unlicensed sites that often target people who have self-excluded. That is the sharp end: not a grey market, but a market with a business model pointed at a specific group.

Meanwhile the Illegal Markets Taskforce, whose terms of reference were published on 13 May 2026, has three priorities — cutting payments to and from illegal operators, tackling advertising of illegal gambling, and improving cross-agency enforcement — and runs for twelve months. Nothing in that list is aimed at players. All of it is aimed at supply.

Conclusions About Casino Sites Not on GamStop

So the sensible reading of casino sites not on GamStop is that they exist because the British licence is demanding and the scheme is one of its demands, that the regulator responds with domain blocks and search removals rather than arrests, and that a site's licence is worth exactly as much as the register that can confirm it.

Two figures to finish on. The Commission estimates that among people who had gambled online in the past month, 2.5 per cent had engaged with an illegal site — roughly one in forty. And its Illegal Markets team has issued 3,140 cease and desist and disruption notices since April 2024, which is a great many letters to companies that, on paper, do not exist.