New Gambling Sites UK What the Regulator Really Does

New gambling sites UK players meet are either licensed by the Gambling Commission, and so bound by the rules on stakes, bonuses and identity checks, or offshore and outside all of it. Only about 2.5 per cent of online gamblers had touched an illegal site in a recent four-week window. 13.11.2026, the enforcement is real but partial.

A new site opens and the trade press announces it. A new domain appears in search results with a welcome offer nobody licensed in Great Britain could legally advertise. The two events look alike from a browser and are nothing alike in law, and separating them is most of what this page is for.

The regulator's own numbers are worth having in mind, because they set the tone. Since April 2024 the Gambling Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and three payment provider referrals — and referred 447,778 search engine URLs, securing 287,961 removals. Across 160 illegal sites for which traffic data existed, engagement fell by an average of 32 per cent after disruption. Registrar blocks did better still: 91 per cent. Google removals, at 30 per cent, did considerably less.

That is a regulator disrupting a market rather than closing it. A site removed from Google is harder to find and no less reachable to anyone who kept the bookmark. This is a column about the paperwork, so let us start with the paperwork.

One point of language before anything else. The self-exclusion scheme is always written GamStop, though it is very often typed "gamestop" — the word "game" suggests itself, and the search engines do not care.

Offshore Sites Are Not Licensed Here, and Nothing Here Protects You

Let us be plain at the start, because the rest of the page depends on it. A site that holds no Gambling Commission licence is not licensed in Great Britain, whatever else it holds. The Commission says it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, and that this includes an operator holding a licence in another jurisdiction. Under section 33 of the Gambling Act 2005 the offence is committed by the person providing the facilities, not by the person who logs in — the Act's gambling offences attach to operators, not to adult consumers. That is a distinction worth knowing precisely, and it is not a reassurance about anything else.

What follows from it is the part that matters to a player. Every protection built into the British licence — the €2,000 identity threshold, the ten-times cap on wagering requirements, the ban on reverse withdrawals, the customer-funds declaration, access to an approved Alternative Dispute Resolution provider — belongs to licensed operators only. None of it travels with a domain.

Help, if gambling is causing harm: the National Gambling Helpline is run by GamCare on 0808 8020 133, free, 24 hours a day, every day of the year, with live chat and WhatsApp on the same number. Callers in Wales can use 0808 2819 265. Gamblers Anonymous England, Wales & Ulster is on 0330 094 0322, and Citizens Advice Scotland's gambling support line runs on 0800 328 1131, Monday to Friday, 10am to 3pm.

And on self-exclusion, stated once and clearly, because it is too often presented as a door rather than a wall: registering with Gamstop Online blocks you for six months, one year, five years or five years with auto-renewal; it takes up to 24 hours to bite; you cannot cancel it during the term; and when the term ends it stays in place until you contact GamStop to remove it. If you do nothing, Gamstop holds your data through a further automatic seven-year self-exclusion period during which operators are told you were previously excluded. An offshore site is not a way round that. It is a way of gambling unlicensed.

Which Offshore Licences Sites Actually Hold

The trade has a shortlist, and the shortlist is instructive. Compare what each regulator requires and what it sets as an annual bill:

The pattern is not subtle. A Curaçao B2C licence costs EUR 47,450 a year all in; a Great Britain licence costs 1.1 per cent of gross gambling yield, which for any operator of scale is an entirely different order of money. An Anjouan licence renews for EUR 17,828. That gap is the economics of the whole offshore market, and no amount of seal design changes it.

Curaçao's reform deserves a paragraph because it is the one thing in this market that genuinely changed. The National Ordinance on Games of Chance took effect on 24 December 2024, making the Curaçao Gaming Authority the direct licensing and supervisory authority. The master-licence model is gone: the four former master licensors ceased licensing activities between 18 August 2024 and 31 January 2025, and the legacy "orange" sub-licence certificates of operation ended on 15 October 2025. A site still waving a /JAZ number is showing you a relic. From 24 December 2026 supplier licensing and registration become fully mandatory, and the authority has said its previous online portal will not return to service, with an alternative way of verifying licensed domains still in progress.

Anjouan is a different story and a worse one. Its regulator says the framework rests on legislation adopted in 2005 and that licences carry no territorial restriction under Anjouan law — while also stating, in a June 2026 statement, that a licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". An independent legal opinion reconfirming the authority's standing is the licensee's own statement rather than a court's. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, and that a former attorney-general of the Comoros described the entity selling those licences as illegal. The regulator's own verification framework, meanwhile, is sensible enough on its face: certificates carry a unique licence number and a QR code, and certificates that cannot be verified through the public register should not be relied on.

What the British Licence Actually Buys

A site licensed here is not a nicer version of an offshore one. It is a differently constrained business, and the constraints are the product.

Start with the slots. The £5 maximum stake per game cycle for online slots went live on 9 April 2025 and the £2 limit for 18- to 24-year-olds on 21 May 2025, attached as a condition to every remote casino operating licence. The limits apply to slots only — not to roulette, not to blackjack. A minimum of 2.5 seconds must elapse from the start of a game until the next cycle can begin. Whatever you think of £5, it is a rule that exists in one jurisdiction.

Then the bonuses, which since 19 January 2026 have had a ceiling. Social Responsibility Code 5.1.1 now caps wagering requirements at ten times, and bans promotions that mix two or more types of gambling product. The Commission's own reasoning is the interesting part: it said the cap "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". A 60-times requirement in a market where ten is now the limit tells you what the limit was for. Alongside it, from 31 October 2025, every operator must prompt a customer to set a financial limit before a first deposit and offer financial limits through a free-text box at account level.

And the money itself. Reverse withdrawals were banned outright for remote operators by RTS requirement 14B, in force from 31 October 2021: "Consumers must not be given the option to cancel their withdrawal request". Credit cards have been barred from gambling since 14 April 2020, and operators must check that money arriving from an e-wallet was not loaded from one. Customer funds sit in a separate client account, and the operator must declare one of three insolvency ratings — "not protected", "medium protection" or "high protection" — in writing, with an acknowledgement, before the money is used for gambling.

Roughly 700 Curaçao licences have been reported outstanding to 698 operators, a little over 550 of them active, according to an aggregator that reads the Curaçao register; that is a third-party count, not a regulator's publication, and the authority has been rebuilding how its domains are verified. Read alongside the British figures — around 13.4 million average monthly active online accounts, and online gross gambling yield of £1.55 billion in the first quarter of 2026 alone — it is fair to ask how many of those licences belong to operators with a meaningful British customer base. Most, I suspect, do not.

The Four Ways a Licence Claims to Protect and Often Does Not

Self-Exclusion

The single thing most people misunderstand about the register is when it applies and how it ends. Gamstop Online blocks a person from opening or using online accounts with gambling companies licensed in Great Britain. It is free, registration takes minutes, and it can take up to 24 hours for the block to become effective. The terms of use allow you to switch off auto-renewal only during the final six months of a five-year period, and auto-renewal can run for up to four further five-year periods. The Group's 2025 annual report devotes a whole section to its refusal to remove registrations early.

First time, then: you register, choose a term, and wait a day for the wall to go up. Later, it is more rigid, not less. Registration cannot be cancelled within the term, and at the end of the term the exclusion simply continues unless you contact GamStop to remove it; if you never do, operators are told for a further seven years that you were previously excluded. There is no grace period and no lapse.

The warning signs when a site addresses this at all are easy to spot. Any operator that describes its own self-exclusion as "flexible", that offers to lift a limit after a cooling-off period you did not ask for, or that markets itself to people looking for alternatives to the register is telling you which side of the line it operates on. Note the Commission's industry warning notice of 20 January 2025: unlicensed sites often target customers who have self-excluded via GAMSTOP, and may have inadequate social responsibility and anti-money-laundering controls. That is the regulator describing the audience, not guessing at it.

The land-based schemes are separate and worth knowing for contrast. SENSE, the national scheme for licensed casinos, has a six-month minimum extendable to twelve months, removal only in person at a casino during the six-month "Thinking" period that follows, and a 24-hour cooling-off. Gamstop Betting Shops, formerly MOSES, is telephone-based on 0800 294 2060, runs a fixed 12-month term that cannot be ended early, and applies a 24-hour cooling-off. Neither is online self-exclusion and neither substitutes for it.

Identity Checks and Why They Matter

This is the topic the Commission keeps returning to, because it is where players most often meet friction they did not expect. The British framework has enough moving parts to deserve spelling out.

The criminal framework sits in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, under which a "casino" is the holder of a casino operating licence. In remote casinos, identification and verification are required when a customer deposits to take part in remote gambling, or withdraws such funds or winnings, amounting to €2,000 or more — and the threshold catches transactions that "appear to be linked", including activity within a single logged-on period. So the €2,000 figure is less a line than a description of a pattern.

On top of that sits Licence Condition 17, introduced on 7 May 2019, which requires licensees to obtain and verify information establishing identity, including name, address and date of birth, before a customer is permitted to gamble. The Commission calls the arrangement by which a remote casino verifies identity and age at registration but defers full verification to the €2,000 threshold the "hybrid approach", and it expects checks to be brought forward rather than parked at the withdrawal button.

Which brings us to the asymmetry players actually feel. Licence condition 17.1.1 states that a withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier — but that does not stop an operator seeking information it must obtain at that moment under another legal obligation, such as anti-money-laundering rules. Verifying identity electronically can be instant; asking for documents takes longer, and the Commission declines to give a timescale because it varies.

The warning signs are specific. If documents are demanded only when you try to leave, the operator may be in breach of Licence Condition 17. If a business asks for the same document twice, or for a selfie with no stated suspicion of identity theft, or for bank statements with no explanation of what irregularity it is looking at, ask what obligation the request serves. And note the Commission's own concern about "fuzzy matching": operators onboarding customers on partial or equivocal verification, or taking a middle name in place of a forename, which creates mismatches against records held elsewhere — including against GamStop, which undermines the register's whole purpose. A mismatch is not a technicality. It is a hole.

Bonus Terms and What They Mean

Wagering requirements are the single figure that decides what a bonus is worth, and they are also the figure most often buried. A wagering requirement, in the Code's own definition, is where a customer is required to make wagers totalling a particular value for funds to become withdrawable.

In Great Britain the ceiling is ten times. That came in on 19 January 2026, having been moved from an original date of 19 December 2025. The mixing ban is at least as important: you cannot offer a promotion whose prize is itself two products, so "bet £5 and get 20 free spins" is non-compliant, and neither is "bet £5 and get a £5 free bet and 20 free spins". What is allowed is a customer freely choosing which product to use bonus money on.

Offshore, the arithmetic is simply different. A Curaçao-licensed operator publishing 25× on casino bonuses is not breaking its own rules; a comparison table published in 2026 puts offshore welcome offers typically at 35× to 50×, and no-deposit bonuses at 40× to 60× with a €50 to €100 cashout cap, though those ranges are trade compilations rather than regulator data. Watch the contribution chart: slots and specialty games at 100 per cent, table games at 20 per cent, video poker and blackjack at 10 per cent, roulette and baccarat at 5 per cent, and craps and live dealer games at zero — so a £5 blackjack hand clears a fiftieth of what a £5 spin does. Add a maximum bet while wagering, commonly €5 for regular players and €10 for VIPs, breach of which may void the lot. Add a maximum cashout clause reserving the operator's right to limit winnings from bonus funds to 300 per cent of the bonus credited, with the excess voided.

British rules attack exactly those two devices. Operators may not impose any maximum limit on the amount a consumer may withdraw from their deposit balance — the Commission's own specimen of a prohibited term is "you may withdraw up to £50 per day and up to £500 per week". And wagering requirements must not attach to play with a deposit balance at all, with deposit and bonus balances displayed separately and withdrawal of the deposit balance allowed at any time, including while a bonus is pending. That last combination is what ended the sticky bonus in this market: a bonus you could wager but never withdraw made sense only while the deposit was held hostage alongside it. If an offer today does not tell you plainly which balance you are playing and what clears it, the answer is somewhere in the terms, and it will not be in your favour.

Five Signs an Operator Can Be Trusted

The Licence Matches the Domain

Start on the regulator's own register, not the site. The Gambling Commission advises consumers to check that a business holds a British licence and to click through to the public register to see whether the site's activities and the domain names match. Quick check: if the register shows a company but not the domain you are on, stop. The Commission can only regulate websites that trade or advertise to customers in Great Britain, and only those holding its licence.

The Seal Leads Somewhere Real

Offshore seals are not decoration; each has a defined behaviour. For Curaçao, clicking a Certificate of Operation seal must redirect to cert.cga.cw, and a seal that differs in design, colour or format means the site is not authorised. If the certificate behind the seal shows a different domain from the one you are on, you are looking at another operator's certificate. Quick check: click the seal and read the domain on the certificate. A licence certificate is not interchangeable with a Certificate of Operation. For Kahnawà:ke, a logo click should generate a Certificate of Good Standing; for Anjouan, a certificate should carry a QR code resolving to the public register, and one that does not resolve should not be treated as evidence of anything.

The Terms Pass the Five-Minute Test

Under Licence Condition 7.1.1 licensees must ensure the terms on which gambling is offered, and any consumer notices, are not unfair within the meaning of the Consumer Rights Act 2015 — and the CMA's published position is that operators must not deny customers access to their own money, place maximum limits on withdrawals, or confiscate funds for a failure to supply identity documents or after inactivity. Quick check: search the terms for "sole discretion", "reserve the right" and "may void". The Commission's guidance says operators should not use terms giving themselves sole discretion to void or withhold winnings precisely because such terms are unfair. If those phrases cluster around the withdrawal clause, the document was written for the operator's benefit.

Someone Independent Answers Complaints

Licensed operators must let a customer take an unresolved dispute to an approved Alternative Dispute Resolution provider free of charge, provided the operator's own complaints process has been used first and the matter is not settled within eight weeks. IBAS and eCOGRA handle most gambling disputes and set no charge to the consumer. Quick check: find the ADR provider's name in the terms before you deposit, not after. The evidence from those providers is a useful corrective to optimism: eCOGRA's Great Britain report for 1 October 2024 to 30 September 2025 records 911 disputes received, 150 of them valid deposits-and-withdrawals cases, with 17.8 per cent of completed disputes ruled in the consumer's favour and an average domestic resolution time of 31 days. IBAS's figures for 2024-25 record 3,721 domestic disputes, 217 of them banking or financial, an average completion time of 20 days and 65 consumer complaints upheld by written decision. Even a good ADR route is a slow one, and the odds are not on the complainant.

The Payout Pipeline Is Boring

Boring is the highest compliment available in this department. The Commission's data covering June to September 2024 recorded 44.2 million withdrawals by customers of large online operators, of which 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent in up to 48 hours. Quick check: read the stated withdrawal times in your chosen payment method's own schedule before depositing, and check whether the operator charges a processing fee. Fees are permitted only where they are cost-reflective, made clear before you deposit, and no more than the direct cost of processing. Meanwhile the Commission's Contact Centre still receives around 2,000 complaints a year about withdrawal delays, and its Annual Report and Accounts 2024-25 states that withdrawal issues continue to cause most of the complaints it receives. On 21 October 2026 the Commission announced that an operator would pay £900,000 in a regulatory settlement for failures including unnecessarily delaying consumer withdrawals. The regulator does chase this. It does not do so quickly enough for the person waiting.

How to Judge a New Site in Six Steps

1. Find the licence on the regulator's register, not on the site's own badge. Search the public register for the company, then check that the domain you are on is listed among its trading names. The Commission's advice is explicit about matching activities and domains. A licence that exists but does not cover the site you are looking at is not a licence for the site you are looking at.
2. Note what the register does not say. If the operator holds only a foreign licence, read the previous sections again and price that in. The distance between a EUR 47,450 annual Curaçao fee and a 1.1 per cent levy on gross gambling yield is a business model, and it is paid for somewhere.
3. Read the bonus terms for the number, not the headline. Find the wagering requirement, the contribution percentages by game, the maximum bet while wagering, and any maximum cashout. If any of them is absent from the summary but present in the full terms, that is the answer. Under British rules a significant condition must be displayed in full no further than one click away.
4. Look for the financial limit prompt before you deposit. Since 31 October 2025 operators must prompt customers to set a financial limit before a first deposit, and setting one must be presented as the default option, with declining it requiring a deliberate action and a confirmation. An operator that makes this easy is probably making everything else easy too.
5. Check the identity process at the door rather than the exit. Look for what documents the operator says it may need, and when. A site that tells you upfront what it will ask for is behaving as the Commission expects; a site that tells you nothing and then asks for a bank statement on the way out is not, and may be in breach of Licence Condition 17.
6. Confirm where the money sits and who decides disputes. Find the insolvency rating — "not protected", "medium protection" or "high protection" — and the named ADR provider. Keep in mind what the rating does not promise: money in a separate client account is still not a guarantee of return if the operator becomes insolvent, and an operator rated "not protected" must remind you once every six months that your funds are not protected, stating the value held.

What New Online Gambling Sites UK 2026 Enforcement Actually Achieves

The numbers here are worth following quarter by quarter, because they show a strategy shifting rather than a problem shrinking. Website referrals to search engines rose from 124 in July to September 2024 to 321 in April to June 2025. Cease and desist notices by quarter ran 113, 83, 129 and 145 over the same four quarters, with removals from search engines at 123, 109, 170 and 214.

Then the tempo jumped. In January to March 2026 the Commission referred 226 websites and issued 98 cease and desist notices. In April to June 2026 it referred 366 websites, covering 147,721 URLs, and began no criminal investigations at all. In July to September 2026 it referred 1,835 websites covering 7,677,211 URLs and issued 546 cease and desist notices. Across April 2025 to March 2026, every quarter recorded either zero or one prosecution commenced — one in total, in October to December 2025.

Read that last line twice. Enforcement is running at scale in the civil and technical register — takedowns, referrals, blocks, payment routes — and at almost nothing in the criminal courts. The Commission states the position plainly enough: GEO IP blocking and registrar blocks work better than search-engine removals, because removal makes a site harder to find but does not block access. Its averages agree, at 60 per cent and 91 per cent falls in engagement respectively against 30 per cent for Google removals. The taskforce set up by DCMS with terms of reference published on 13 May 2026 has three priorities — reducing payments to and from illegal operators, tackling online advertising of illegal gambling, and improving cross-agency enforcement — and runs for twelve months. Payments disruption, by the Commission's own description, remains a critical and still early-stage part of the strategy; it made its first referral to Visa in January 2025 after a test purchase, followed by three more covering three separate unlicensed sites.

The size of what is being chased has been estimated in ways that do not agree with each other, which is itself informative. H2 Gambling Capital put stakes with illegal operators in the UK at £16.6 billion in 2025, up from about £5 billion in 2019, with the legal share of gambling falling from 97 per cent to 92 per cent. A Frontier Economics study for the Betting and Gaming Council, industry-commissioned, estimated £2.7 billion staked annually online on the black market — 2.1 per cent of the £128 billion staked with regulated remote operators. Yield Sec's analysis for the Campaign for Fairer Gambling put the market at £8.8 billion gross gaming revenue in 2025, 91 per cent regulated. The Commission's own survey estimate, published 5 November 2026, found 0.6 per cent of the whole adult population engaging with illegal gambling websites in the past four weeks, rising to 2.5 per cent among those who had gambled online in that period — and its methodology expressly notes it does not capture activity hidden by VPNs. The spread between a £16.6 billion estimate and a 2.5 per cent survey figure is not a contradiction. It is a measurement problem, and everyone selling a number has an interest.

What is not in dispute: 586 illegal gambling websites accessible to GB consumers were identified in September 2026, 311 had disruption action taken against them in Quarter 2 of 2026 to 2027 with 77 per cent showing a fall in estimated traffic, and over the monitored period from May 2024 to July 2025 just over 1,000 unique illegal sites were accessed by consumers here.

Questions About New Gambling Sites

Is it illegal to use a gambling site that is not licensed in Great Britain?

Not for the player. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and the Act's gambling offences attach to those who provide facilities, not to adult consumers. That is a narrow point and easy to misread. The offence sits with the operator; the exposure sits with you, because no British protection, no GamStop block and no ADR route reaches a site the Commission does not license.

Why do offshore sites never appear on the GamStop register?

Because Gamstop Online can only exclude people from participating operators, and participation is a licence condition — Social Responsibility Code 3.5.5, which was required from 31 March 2020, with operators told of the deadline in January 2020. A site without a Commission licence has no such obligation. The Commission's warning notice of 20 January 2025 noted that unlicensed sites often target customers who have self-excluded, and that their social responsibility and anti-money-laundering controls are frequently inadequate.

Do new British sites have to cap their bonus wagering at ten times?

Yes, since 19 January 2026, when Social Responsibility Code 5.1.1 came into force. The cap is ten times, applying to all licences except gaming machine technical and gambling software licences. The same code bans promotions mixing two or more gambling products. Offshore operators are not bound by it, which is why their welcome offers are commonly quoted at 25× to 50×. The Commission chose a cap rather than a ban after consulting on options of 1, 5 or 10 times.

How long should a withdrawal from a licensed site take?

Usually less than a day, judged by the Commission's own data covering June to September 2024: of 44.2 million withdrawals by customers of large online operators, 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent in up to 48 hours. There is no fixed maximum in days — the regime relies on fair terms and the identity-verification condition. But the Contact Centre still takes around 2,000 withdrawal complaints a year.

What happens if I have to complain about a new site?

Use the operator's own complaints process first; if it is unresolved after eight weeks, or you hold a deadlock letter, you can refer the dispute to an approved Alternative Dispute Resolution provider free of charge. IBAS and eCOGRA handle most gambling disputes. Expect it to take weeks rather than days — eCOGRA's average for domestic disputes was 31 days, IBAS's 20 days. And expect the operator to win more often than not: 17.8 per cent of eCOGRA's completed disputes went the consumer's way.

What stops a new unlicensed site from being taken down?

Mostly registrar and payment disruption rather than prosecution. The Commission's own figures show the pattern: GEO IP blocking cut engagement by an average of 60 per cent and registrar blocks by 91 per cent, against 30 per cent for Google removals, which hide a site without blocking it. Across April 2025 to March 2026 only one prosecution was commenced. It also states 77 per cent of websites disrupted in Quarter 2 of 2026 to 2027 saw a reduction in estimated traffic.

Can a bank block stop an unlicensed site taking my money?

Partly, and only if you switch it on. The Commission's list of banks offering a gambling block, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. Blocks work by declining payments to merchants categorised under gambling Merchant Category Codes and are applied at card level, so each card needs activating. Most banks use a 48- or 72-hour cooling-off before gambling transactions are allowed again, and a block does not affect your credit score.

The Register Is the Real Product, Not the Site

A new domain is only ever the shopfront; the licence behind it is what decides which rules apply, and in Great Britain the enforcement numbers show a regulator that disrupts at scale and prosecutes almost never — one prosecution commenced across an entire financial year, against 546 cease and desist notices in a single quarter. That is not a quiet failure so much as a chosen method, and it leaves the checking where it has always been: with the person deciding which domain to trust. The help, if it is needed, stays the same — the National Gambling Helpline on 0808 8020 133, free, 24 hours a day, every day of the year, with 0808 2819 265 for callers in Wales.

Gamstop Online reported 614,738 consumers on its register as of July 2026, of whom more than one in two had chosen the maximum five-year exclusion.