Online casinos not on GamStop are gambling sites that hold no Gambling Commission licence, so they sit outside the national self-exclusion scheme. That means no UK licence conditions, no access to the Commission's complaints route, and no obligation to check the register — the scheme is often typed "gamestop", but its real name is GamStop.
There is a temptation, when writing about online casinos not on GamStop, to treat the phrase as a category. It is not a category. It is a description of a gap — the widening space between what a British licence obliges an operator to do and what an offshore one can simply decline to do. The gap itself is small in traffic terms and large in consequence. The Commission's own analysis, published on 5 November 2026, puts it this way: among people who had gambled online in the past four weeks, an estimated 2.5% had engaged with an illegal gambling website, with another 1.5% doing so in the past twelve months. Among the whole adult population, including people who never gamble, the figure was 0.6% in the past four weeks. Those are not rounding-error numbers. In a market with 13.4 million average monthly active online accounts, small percentages are a great many people.
My interest here is narrow and, I think, the only honest one for a page like this. An unlicensed site is not a hidden devil; it is a legal and regulatory position, stated on its own paperwork. What matters is whether the licence it does hold means anything, whether the terms it imposes lean on delay, and whether the British regulator has any leverage over it at all. That last question is the one the Commission spends real money answering, and its scorecard is worth reading before any of the rest.
Table of Contents8
- What the Regulator Does About Unlicensed Sites
- Which Licence Sits Behind the Site
- Comparing Offshore Licences by What They Cost and Enforce
- The First Time and Every Time After
- Five Signs a Site Can Be Trusted With Money
- How to Judge One of These Sites Before Depositing
- Answering the Search
- What the Gap Between Two Regimes Costs
What the Regulator Does About Unlicensed Sites
The Commission does not pretend to be able to switch these sites off. It disrupts them, and it publishes what disruption achieves.
Since April 2024 its Illegal Markets team has issued 3,140 cease and desist notices and disruption notices — 2,032 cease and desist orders, 774 registrar referrals, 402 host referrals and 3 payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs and secured 287,961 removals. Across 160 illegal gambling websites for which traffic data existed, engagement fell by an average of 32 per cent after action was taken.
The interesting part is which methods work. By disruption method, registrar blocks and website suspensions produced the largest average fall in engagement — 91 per cent each — ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. The Commission says plainly that search-engine removal makes a site harder to find without fully blocking access. A de-indexed casino is an inconvenienced casino, not a closed one.
The pace has not slackened. In the quarter April to June 2026 the Commission referred 366 websites to search engines, covering 147,721 URLs. In July to September 2026 it referred 1,835 websites and 7,677,211 URLs, and issued 546 cease and desist notices. Against that, prosecutions are a rounding error: across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced, a single case in October to December 2025. The enforcement story is administrative churn, not courtroom drama.
Signs of Delay Build Into the Terms
Offshore terms rarely say "your money is at risk". They say something else entirely, in a clause about review.
A term stating that a customer may request only one withdrawal at a time, and may not request another until the first is authorised, was found unfair under the Consumer Rights Act 2015 in the Commission's October 2026 settlement with one operator, which paid £900,000 and whose failures included unnecessarily delaying consumer withdrawals. A related failure: manually reviewing every fifth or tenth withdrawal for some customers, so extra information was demanded before processing.
That is the shape of it. Delay arrives as process. Under the UK regime a customer's withdrawal request must not trigger a demand for information the operator could reasonably have asked for earlier — licence condition 17.1.1 — and reverse withdrawals were banned outright from 31 October 2021, with requirement 14B stating that consumers must not be given the option to cancel their withdrawal request. Remove a licence and you remove those rules entirely. An unlicensed operator can design friction into the cashier, call it security, and do so lawfully as far as its own jurisdiction is concerned.
Which Licence Sits Behind the Site
Almost every site in this market will name a regulator on its footer. The useful question is whether that regulator has staff, rules and a register.
The Curaçao Regulatory Reform
Curaçao replaced its master-licence and sub-licence model with direct licensing by the Curaçao Gaming Authority under the National Ordinance on Games of Chance, which took effect on 24 December 2024. The legacy "orange" sub-licence certificates ended on 15 October 2025, and operators should no longer rely on the former orange certificate as proof of a current licence. Licensing activities ceased for the four former master licensors on these dates: Gaming Curaçao (365/JAZ) on 18 August 2024, Curaçao eGaming (1668/JAZ) on 1 October 2024, a former master licensor (8048/JAZ) on 1 November 2024, and Curaçao Interactive Licensing (5536/JAZ) on 31 January 2025. A historic /JAZ number is not proof of anything current.
The money is not trivial: the one-time non-refundable application fee for a B2C licence is EUR 4,592, and the total annual B2C fee is EUR 47,450, split between a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee to the CGA. That is a serious regulator's price list, and it is roughly twenty-two times what Anjouan charges.
The Anjouan Licensing Regime
Anjouan, a constituent territory of the Union of the Comoros, licenses internet gaming under legislation from 2005. Its fee schedule is EUR 17,828 for B2C licence issuance and EUR 17,828 for annual renewal, with EUR 500 per additional domain.
The regulator says its licences carry no territorial restrictions under Anjouan law, but that holders must comply with the laws of the jurisdictions where they operate — which is, in effect, an admission that the licence does not authorise the activity anywhere that requires a local permit. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, and that Comorian financial intelligence officials described the entity selling them as operating illegally. One detail from that reporting is worth holding onto: a former attorney-general of the Comoros called Anjouan Licensing Services "an illegal entity", and the AOFA was stripped of recognised-regulator status by Comorian banking laws passed in 2013 and 2015.
Kahnawà:ke Rules and Remedies
The Kahnawà:ke Gaming Commission was established in 1996 and enacted its interactive gaming regulations on 8 July 1999, which makes it one of the longest-standing regimes in the business. Licensees must be hosted at Mohawk Internet Technologies in the Mohawk Territory of Kahnawà:ke. A B2C operation sits under a Client Provider Authorization — the KGC places no limit on how many it issues — and fees are rising: from 1 January 2027 the CPA application fee goes from USD 35,000 to USD 40,000, the five-year renewal from USD 5,000 plus the annual fee to USD 40,000 including it, and Key Person Permit fees from USD 5,000 to USD 6,000.
The KGC's remedy for a self-exclusion breach is distinctive, and I would rather state it than argue about it: a player who breaks a self-exclusion prohibition forfeits funds deposited or won to a third-party charity selected by the Commission. That is a regulator with teeth, pointed in an unusual direction.
Malta, and the Absence of Any Licence
The Malta Gaming Authority is the closest thing to a peer of the UK regulator in this market. Its B2C fees are a one-time EUR 5,000 application fee, a non-refundable fixed annual licence fee of EUR 25,000 and gaming tax of 5 per cent of gaming revenue generated. It publishes a list of Unauthorised URLs, declaring it has no connection with those domains and that any reference to the MGA or a Maltese licence on them is false; the most recent entries carry notice dates of 30 October 2026. That is the behaviour of a regulator, not a registry.
Costa Rica, by contrast, does not operate a comprehensive gambling licensing regime and has no formal framework for issuing gambling licences — the "data processing license" sometimes referenced in the industry is not a licence in the strict legal sense. Its Legislative Assembly rejected Bill No. 25,057 in early 2026, which would have introduced mandatory licensing. A site citing Costa Rica is citing nothing.
Comparing Offshore Licences by What They Cost and Enforce
Fees are a proxy for seriousness, and in this market a serviceable one. A jurisdiction that charges EUR 47,450 a year can afford inspectors. One that charges EUR 17,828 is running a different business.
| Licensing jurisdiction | Application / issuance fee | Annual cost | Domain or seal check |
|---|---|---|---|
| Great Britain (Gambling Commission) | No comparable published schedule; licence conditions bind the operator | Levy of 1.1% of previous-year Gross Gambling Yield for online operators | Public register; check the domain matches the licensed activity |
| Curaçao (CGA, under the LOK) | EUR 4,592, non-refundable, plus EUR 150 per ultimate beneficial owner | EUR 47,450 (EUR 24,490 licence fee plus EUR 22,960 supervisory fee) | Certificate of Operation Seal redirects to cert.cga.cw; a mismatched domain means the certificate belongs to someone else |
| Malta (MGA) | EUR 5,000, non-refundable | EUR 25,000 fixed licence fee plus 5% gaming tax on revenue | MGA Unauthorised URLs list |
| Anjouan | EUR 17,828 | EUR 17,828 renewal, plus EUR 500 per extra domain | Licence certificate carries a unique number and a QR code linking to the public register |
| Kahnawà:ke (KGC) | USD 40,000 for a Client Provider Authorization from 1 January 2027 (was USD 35,000) | USD 20,000 annual CPA fee | Click the Commission's logo to generate a Certificate of Good Standing |
| Costa Rica | No gambling licensing regime | — | None available |
Two figures in that table deserve a second look. The first is the British levy, at 1.1 per cent of previous-year Gross Gambling Yield for all online operators, introduced by the Gambling Levy Regulations 2025 and commenced on 6 April 2025; it raised just under £120 million in the year reported, ringfenced solely for research, prevention and treatment of gambling-related harm. An offshore operator keeps that money. The second is the Curaçao supervisory fee of EUR 22,960 a year, which is the cost of being watched by somebody. Sites trading on a Costa Rica "licence" are not paying it and are not being watched by anyone.
The First Time and Every Time After
The single thing this topic turns on is the join between licensing and self-exclusion. Everything else is commentary.
A licensed British operator must participate in the national multi-operator self-exclusion scheme — the requirement sits in the Gambling Commission's licence conditions and codes of practice, social responsibility code provision 3.5.5, which states that licensees must participate in the national multi-operator self-exclusion scheme. Since 31 March 2020 that obligation has attached to every online operating licence. In April 2020 the Commission added a requirement for operators to check their entire customer base for GamStop registration at least every 24 hours, which also stopped registered people receiving direct marketing.
Now the arithmetic of a registration. Signing up takes a few minutes, but it can take up to 24 hours for the block to become effective. The chosen term is 6 months, 1 year, 5 years or 5 years with auto-renewal. Once registered, a person cannot cancel or deactivate the registration during the exclusion period, and the exclusion stays in place after the end of the chosen period unless they contact GamStop to remove it. That is the whole mechanism, and it is deliberately not a switch.
The register is not a small club. GamStop had 561,983 active exclusions at the end of 2025, and by July 2026 reported 614,738 consumers currently on the register, of whom more than one in two had opted for the maximum five-year exclusion; across all age groups only one in four had self-excluded for six months. Registrations rose 16 per cent year on year in the first half of 2026, with May 2026 setting a monthly record of 12,236 sign-ups.
Here is the fork in the road, and it is a legal fork rather than a moral one. A site licensed in Great Britain will decline the account, because the daily check will find the registration. A site with no British licence has nothing to decline with. The Commission's own statement on the scheme is that it can only exclude from participating operators and cannot prevent access to services run by organisations that do not participate. The Gambling Commission confirmed in a warning notice issued on 20 January 2025 that unlicensed sites advertising to British consumers often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls.
I will not hedge that into "might". Offshore sites are not licensed in Great Britain. GamStop holds for its full term and then stays in place until the person contacts GamStop to remove it, and no offshore site changes that fact or is a way round it. What changes is only who is checking.
Where to get help, stated plainly: the National Gambling Helpline is operated by GamCare on 0808 8020 133, free, 24 hours a day, every day of the year; in Wales the number given is 0808 2819 265. BeGambleAware is the public-facing brand of the charity GambleAware and directs people to that same helpline. Gamblers Anonymous England, Wales & Ulster can be reached on 0330 094 0322. Citizens Advice offers free confidential advice including help with debt.
Warning Signs in the Identity Checks
If the first-time experience at a licensed operator is a registration that gets checked daily, the later experience is an identity check that arrives, too often, at the worst moment.
Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and it is one of the most common dispute types referred to alternative dispute resolution providers. The pattern is familiar: an account opens, deposits clear, play proceeds, and then the withdrawal prompts a request for documents. The Commission's position is that this is not good enough. Licence condition 17.1.1 states that a customer's withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier — subject to anti-money-laundering obligations that genuinely do bite at the point of payment. The Commission expects identity and age checks to be brought forward to before a customer deposits or stakes, and has said that onboarding on incomplete or inaccurate information — initials instead of full names, nicknames, commercial addresses instead of residential — is not sufficient.
That last point is not administrative pedantry. The Commission has flagged that onboarding a customer using a middle name instead of a forename can create mismatches with records held elsewhere, such as GamStop, undermining the effectiveness of self-exclusion. A sloppy identity check is a hole in the exclusion wall.
For offshore sites the risk is the reverse. There is no licence condition 17.1.1 to breach and no ADR provider obliged to take the case. Kahnawà:ke requires a licensee's relationship with players to be contractual and free of terms that are unfair or unreasonable, requires sites to let a player set limits including zero, and employs a full-time Dispute Resolution Officer. Anjouan requires licensees to designate an Authority-approved ADR provider — EGIS ADR, Axion ADR, iGaming ADR and another entity are currently approved — and expects complaints resolved within 30 days before escalation. Those are real protections. They are simply not British ones, and they are not enforced by anyone with jurisdiction over a bank account in Manchester.
Five Signs a Site Can Be Trusted With Money
It Names a Regulator You Can Reach, Not One You Can Only Read
Check the licence on the site's footer against the regulator's own register, not the site's own description of it. Curaçao requires that clicking a Certificate of Operation Seal redirects to the official CGA certification portal, and that if the seal differs in design, colour or format the website is not authorised by the CGA. If the certificate behind the seal displays a different domain name from the one being accessed, the site is displaying a certificate belonging to another operator and should be considered unauthorised or fraudulent. That check takes under a minute.
The Withdrawal Terms Are Typewritten, Not Governed by Discretion
Read the clause that governs cashing out and the clause that governs cases the operator has not thought of. Operators should not use terms giving them sole discretion — "may" or "reserve the right" — to void or withhold winnings, because such terms are unfair within the meaning of the Consumer Rights Act 2015. An operator was fined £170,000 in July 2025 for failures including a bonus term stating that Fafabet had the right at its own discretion to close accounts or forfeit winnings. A term that hands the operator the last word is the term that will be used.
Money Is Held Under a Named Insolvency Rating
Customer funds held by a remote operator must be kept in a separate client bank account, and an operator must select one of three customer-funds protection ratings — "not protected", "medium protection" or "high protection" — and state in its terms which applies. One rated "not protected" must remind the customer once every six months that funds are not protected in the event of insolvency, stating the value held. A site with no rating at all has answered the question by refusing to.
Complaints Go Somewhere Independent, for Free
A British licensee must have arrangements for customers to refer a dispute to an ADR entity free of charge if it is not resolved within eight weeks. Among the Commission's approved providers, IBAS recorded 3,721 domestic disputes in 2024-25 — 217 of them banking or financial — with an average completion time of 20 days and 100 per cent operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, 150 valid "Deposits & Withdrawals" disputes, and an average of 31 days to resolve domestic disputes, with 17.8 per cent of completed disputes ruled in the consumer's favour. Ask where a complaint goes. "Our dedicated support team" is not a destination.
Rules Are Applied Before Deposit, Not Before Withdrawal
The tell is timing. A licensed operator should be asking for identity documents before a customer stakes, and should tell customers before they deposit what information may be needed, in what circumstances and in what form. An operator that is relaxed about identity on the way in and rigorous on the way out has revealed which direction the money flows that it cares about.
How to Judge One of These Sites Before Depositing
Six steps, and no clever ones. Each carries its reason because the reason is what makes the check worth doing.
- Open the regulator's own register and search the exact trading domain. A licence that covers a licence number but not the domain in front of you belongs to somebody else. Curaçao's own certification policy treats a domain mismatch as evidence the site is unauthorised or fraudulent, and the Commission's public register similarly lets a consumer check whether the site's activities and domain names match.
- Read the section on identity documents and note where in the journey it applies. The question is not whether documents are required but when. If verification happens at withdrawal only, the cashier has been designed as a filter rather than a door.
- Find the sentence about how customer funds are protected, or find that it is missing. A licensed operator must state its insolvency rating and make the customer acknowledge it before depositing. If the terms are silent, treat the money as unsecured and lent.
- Read the wagering requirement and whether the deposit counts towards it. From 19 January 2026, British licensees cannot apply wagering requirements over a maximum of 10 times, and cannot include more than one type of gambling product within an incentive. Offshore sites are not bound by that cap, and outside operators commonly run 25× to 50× on welcome offers. The distinction between wagering applied to bonus only and wagering applied to deposit plus bonus is the difference between a promotion and a trap.
- Look for a maximum cashout clause and a maximum-bet-while-wagering clause. These are the two clauses that convert a large win into a small one, and they are the ones set in the smallest type. Kahnawà:ke requires that such terms be fair and reasonable; plenty of jurisdictions require nothing at all.
- Check the complaints destination out loud, by asking support a question a scripted agent cannot answer. Ask which ADR provider handles disputes and how a consumer reaches them. The channel that handles your complaint has to have been named in the terms before the dispute existed.
None of this is a test of virtue. It is a test of leverage: whether, if the relationship goes wrong, somebody outside the company has the power to make it right.
Answering the Search
Which online casino is not on GamStop, and what does that actually mean?
It means the site holds no Gambling Commission licence, so it is not bound by the licence condition requiring participation in the national self-exclusion scheme. A UK online casino not on GamStop cannot decline a self-excluded customer on the basis of the register, because it does not check it. It is also outside UK licence conditions, the complaints route and the levy.
Are UK online casinos not on GamStop legal, and can they operate here?
No. It is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence elsewhere, and section 33 of the Gambling Act 2005 makes providing gambling facilities without a licence an offence carrying up to 51 weeks' imprisonment on summary conviction, a level 5 fine, or both. The offence attaches to the operator. Adult players are not the target of it.
What does the regulator do about them in practice?
It disrupts rather than closes. Since April 2024 the Illegal Markets team has issued 3,140 cease and desist and disruption notices and secured 287,961 URL removals, and in July to September 2026 alone it referred 1,835 websites and 7,677,211 URLs. Registrar blocks and suspensions cut measured engagement by 91 per cent on average, against 30 per cent for Google removal.
Which offshore licences do these sites usually hold now?
Mostly Curaçao, Malta, Anjouan or Kahnawà:ke, and sometimes a Costa Rica "data processing license", which is not a licence in the strict legal sense. Curaçao's legacy "orange" sub-licence certificates ended on 15 October 2025, so a site still displaying one is displaying a document that no longer proves current licensing.
Can a new online casino not on GamStop be trusted with a large balance?
That depends on facts you can check: whether the regulator has a working register and a fee schedule that funds supervision, whether terms avoid sole discretion, whether a funds-protection rating is stated, and whether an independent ADR provider is named. A site with a named regulator, a stated insolvency rating and an identified ADR provider is a different proposition from one answering with a chat widget.
What about free spins no deposit offers at sites outside the scheme?
Scrutinise the cashout cap, which is where such offers are decided. Outside jurisdictions rarely limit the playthrough — offshore multipliers typically run from 25× to 50× on welcome offers and higher on no-deposit ones — and a maximum cashout clause can convert a substantial win into a modest payment. In the UK the wagering requirement is capped at ten times and no maximum limit may be imposed on withdrawals from a deposit balance.
What the Gap Between Two Regimes Costs
The subject reduces to a single asymmetry. A British licence obliges an operator to check the exclusion register daily, to cap wagering at ten times, to keep customer funds in a separate account under a declared insolvency rating and to answer to an adjudicator within eight weeks. An offshore licence obliges none of that, and the Commission can do little more than de-index the site and ask a registrar to pull it — which it did 1,835 times in a single quarter of 2026, while commencing no criminal investigations at all.
Anyone weighing the two should weigh that, and then watch the regulator's scoreboard rather than the site's advertising. And if gambling has become a problem, the National Gambling Helpline is 0808 8020 133, free and open 24 hours a day.