Online Gambling Sites UK and The Regulator's Ledger

Online gambling sites in the UK are split in two. Sites holding a Gambling Commission licence are bound by British rules on identity checks, bonus terms and payouts; offshore sites with no British licence are not, and using them means losing those protections. Help is free on 0808 8020 133, day or night.

I have spent years reading the Gambling Commission's enforcement notes, and the honest starting point for anyone asking about the best online gambling sites UK players can actually use is that "best" is the wrong word for most of it. The Commission does not rank sites. It withdraws licences, issues cease and desist notices, refers domains to registrars and hosts, and writes letters to Google and Bing. What it publishes is a ledger of disruption, not a leaderboard, and that ledger is the only sober guide to what happens to an operator that trades without permission.

The market itself is large enough to explain why the trade press never stops talking about it. Total Great Britain gross gambling yield reached £17.5 billion in the year to March 2026, up 4.4 per cent, with remote casino, betting and bingo contributing £8.3 billion of that. Online slots alone took £773 million in the first quarter of 2026. Set against that, the Commission's April 2025 to April 2026 survey work puts engagement with illegal gambling websites at 0.6 per cent of the whole adult population in the previous four weeks, and 2.5 per cent among people who had gambled online in that period.

Confirmation of licence status takes about a minute. The Commission publishes a public register, and its advice is to click through and check that the site's activities and its domain names both appear there. That single habit separates a serious decision from a hopeful one. Below I set out what the enforcement data actually shows, how a British licence compares with the offshore alternatives, and what the numbers behind them cost.

What The Commission Does About Unlicensed Sites

Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist notices and disruption notices: 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and three referrals to a payment provider. Over the same period it referred 447,778 Google and Bing URLs and secured 287,961 removals.

Then the numbers accelerate. In July to September 2026 it referred 1,835 websites carrying 7,677,211 URLs, and issued 546 cease and desist notices. In the quarter before that, April to June 2026, the figures were 366 websites and 147,721 URLs, with criminal investigations at zero. Across the whole of April 2025 to March 2026, one prosecution was commenced.

That asymmetry is the story. Disruption is cheap and fast; prosecution is neither. The Commission says so itself: GEO IP blocking and registrar blocks work better than search-engine removals, because removing a site from search makes it harder to find but does not block access to it. The measured effect bears this out. Across 160 illegal websites with traffic data, engagement fell by an average of 32 per cent after disruption. Registrar blocks produced an average fall of 91 per cent, website suspensions 91 per cent, GEO IP blocking 60 per cent, Bing removal 52 per cent, Google removal 30 per cent and Facebook removal 8 per cent.

The pattern explains why the illegal gambling dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, 4 per cent more than a year earlier, and why 311 sites faced disruption action in the second quarter of 2026-27, 38 per cent more than the previous quarter. You can knock a site down; you cannot easily stop the domain appearing somewhere else.

What the Commission cannot do is help an individual get money back. It is a regulator, not an ombudsman, and it cannot resolve personal complaints. For disputes there is a separate route through approved alternative dispute resolution providers, which I come to below.

What The Name GamStop Covers, And What It Does Not

Worth saying at the outset, because it is a factual point about the name itself: the scheme is often typed "gamestop", and the spelling that appears everywhere official is GamStop.

GamStop Online is the national online self-exclusion scheme, run by The National Online Self Exclusion Scheme Limited, and free to use. Registrations block a person from gambling with all online gambling companies licensed in Great Britain, for six months, one year, five years or five years with auto-renewal. Signing up takes minutes; the block can take up to 24 hours to take effect. It cannot be cancelled during the exclusion period, and it stays in place after the chosen term ends until the person contacts GamStop to remove it. That is not a technicality — the Group's 2025 annual report devotes a section to its refusal to lift registrations early. Registration figures give the scheme its scale: 117,756 new registrations during 2025, 561,983 active exclusions at the end of that year, 614,738 people on the register as of July 2026, and a 16 per cent year-on-year rise in registrations in the first half of 2026, with May 2026 setting a monthly record of 12,236 sign-ups.

Participation is not optional for British licensees. Since 31 March 2020 every online gambling operator must be part of the scheme as a condition of its Commission licence, under social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, which states plainly that "Licensees must participate in the national multi-operator self-exclusion scheme". In April 2020 the Commission added a requirement to check the entire customer base at least every 24 hours, which also stopped registered people receiving direct marketing. Two operators that missed the integration deadline had their licences suspended on 3 April 2020 under section 118(2) of the Gambling Act 2005.

Offshore sites that hold no Commission licence are not connected to GamStop and are not covered by it, since the scheme's obligations run to British licensees. An offshore site is never a way round a self-exclusion. GamStop's own terms are clear that it can only exclude people from participating operators, and the Commission's warning notice of 20 January 2025 was explicit that unlicensed sites often target customers who have self-excluded through the scheme.

British Licence Against Offshore Licence

The table is a cost and obligation comparison, not a recommendation. The point of putting the numbers side by side is that the British regime is not the cheapest place to hold a licence, and the difference is not spent on decoration. It is spent on the conditions that follow: capped wagering requirements, banned mixed-product promotions, financial vulnerability checks, mandatory financial limits, and a self-exclusion scheme that every licensee must join.

The Curaçao figures need one caution. Since the National Ordinance on Games of Chance took effect on 24 December 2024 the Curaçao Gaming Authority licenses directly, the old private master licensors can no longer grant new licences, the legacy "orange" sub-licence certificates of operation ended on 15 October 2025, and a historic /JAZ number must not be treated as proof of a current licence. Operators were given two provisional six-month extensions, to 24 December 2025, and had to be fully compliant with the LOK by then to qualify for a full licence. The Curaçao Gaming Authority also announced on 7 October 2026 that its previous online portal would not return to service while it builds an alternative way to verify licensed domains — so anyone checking a Curaçao seal today is checking against a system in transition.

Where The Money Should Be, And How It Goes Missing

The single thing this topic turns on is the link between payments and supervision, because it is where an offshore site's lack of a British licence stops being theoretical.

The core prohibition is section 33 of the Gambling Act 2005, in force since 1 September 2007: a person commits an offence by providing facilities for gambling without an operating licence, and it is immaterial whether facilities are provided wholly or partly by remote communication, and whether inside or outside the UK. On summary conviction the penalty is up to 51 weeks' imprisonment, a fine up to level 5 on the standard scale, or both — six months in Scotland. For remote gambling the offence applies if at least one piece of remote gambling equipment is situated in Great Britain, or if the provider knows or should know the facilities are likely to be used in Great Britain. The Commission states outright that it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence elsewhere.

British licensees also face payment rules that offshore operators simply do not. Credit cards have been banned for remote gambling since 14 April 2020, and operators must ensure that money arriving from an e-wallet was not loaded from a credit card. Since 31 October 2025 customers must be prompted to set a financial limit before their first deposit, with setting a limit presented as the default option. Financial vulnerability checks became a licensing requirement in August 2024 at £500 net deposits over a rolling 30-day period, lowered to £150 from 28 February 2025.

The financial picture should worry anyone who thinks an offshore licence is interchangeable. H2 Gambling Capital estimated that £16.6 billion was staked with illegal operators in the UK in 2025, up from around £5 billion in 2019, with the legal share of gambling falling from 97 per cent to 92 per cent. That is an estimate, and estimates in this field vary widely; a Frontier Economics study for the Betting and Gaming Council put black-market online stakes at £2.7 billion a year, while Yield Sec work for the Campaign for Fairer Gambling split 2025 gross gambling revenue 91 per cent regulated and 9 per cent unregulated. What the Commission will say for certain is narrower and more useful: it identified just over 1,000 unique illegal gambling websites accessed by British consumers between May 2024 and July 2025, and its own methodology admits it cannot capture activity hidden behind VPNs.

Why Identity Checks Arrive Late, And Why That Matters

If there is one complaint that defines the difference between a good operator and a bad one, it is identity verification. The Commission's Contact Centre receives more than 6,000 calls a year, and over a quarter of the complaints reaching it concern identity verification, raised when customers are asked for documents only on attempting to withdraw. Its Annual Report for 2024-25 said withdrawals remain the cause of most complaints received.

The rule is straightforward. Licence condition 17.1.1 requires that a customer's withdrawal request must not trigger a demand for extra information if the licensee could reasonably have requested it earlier. A separate licence condition, 17.1.1 in its fair-and-open form, exists precisely to stop operators using verification as a brake. The Commission has said it is not acceptable to introduce friction at withdrawal rather than at deposit, and that where there are no regulatory concerns there is no valid reason to delay a payout.

Underlying this is an anti-money-laundering threshold. In remote casinos, identification and verification are required when a customer deposits to take part in remote gambling, or withdraws such funds or winnings, amounting to €2,000 or more — and the threshold covers linked transactions, including activity within a single logged-on period. A remote casino may identify customers at registration and defer full verification until that threshold is triggered, an approach the Commission calls the hybrid route. It is lawful. It is also the mechanism by which a first withdrawal can suddenly require a passport, a utility bill and a bank statement.

The warning signs are consistent. A site that accepts deposits for weeks without a whisper about documents, then demands a full file the moment a withdrawal is requested. A site that asks for a selfie or source-of-wealth paperwork only after a win. And a site whose terms reserve to itself sole discretion to void winnings — the Commission's guidance says terms using "may" or "reserve the right" to void or withhold winnings are unfair within the meaning of the Consumer Rights Act 2015. Where an operator has no regulatory concerns, there is no valid reason to delay a payout.

Five Signs An Operator Can Be Trusted

The Licence Is Real And The Domain Matches It

The Commission's public register is the only check that matters, and the detail is what counts: the register must show both the operator and the specific domain being used. The Commission's own advice is to click through and confirm the activities and domain names match. A logo on a footer proves nothing. For Curaçao-licensed sites, a Certificate of Operation Seal must redirect to the Curaçao Gaming Authority's validation portal, and if the certificate behind the seal names a different domain from the one being visited, it belongs to another operator and the site should be treated as unauthorised or fraudulent. A licence certificate is not the same document as a certificate of operation, and the two are not interchangeable.

The Bonus Terms Are Written Down, And Capped

From 19 January 2026 British licensees cannot impose wagering requirements above ten times, and cannot include more than one type of gambling product in an incentive. The Commission chose that cap over an outright ban after noting that some licensees were applying requirements of up to 60 times. So the quick check is arithmetic: find the wagering multiple and read it against the number ten. Terms must be clear, transparent, fair and readily accessible, and significant conditions must be visible no further than one click away. A site that buries the multiple three pages deep in a PDF is telling you where it expects the dispute to go.

Withdrawals Are Not A Separate Regime From Deposits

The Commission permanently banned reverse withdrawals for remote operators through RTS requirement 14B, in force since 31 October 2021, which states that consumers must not be given the option to cancel a withdrawal request. Operators may still charge a cost-reflective processing fee, or reasonably limit the size or number of withdrawals, provided it is fair, transparent and made clear before a deposit. What they may not do is impose a maximum limit on withdrawals from a deposit balance — the Commission's stated example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". Nor may they confiscate un-staked deposits, or deduct from a balance on the basis that identity or age verification failed.

Customer Money Is Disclosed As Protected Or Not

British licensees holding customer funds must state in their terms whether those funds are protected in the event of insolvency, at which level, and by what method, using the Commission's rating of "not protected", "medium protection" or "high protection". An operator rated "not protected" must remind the customer every six months, stating the value of funds held. The check takes two minutes and almost nobody performs it. The uncomfortable part is that even a separate client bank account does not guarantee return of funds on insolvency, and British businesses are legally allowed to hold customer money in overseas bank accounts.

Complaints Have Somewhere To Go

British licensees must let customers refer an unresolved dispute to an approved alternative dispute resolution provider, free of charge, if it is not settled within eight weeks. The Commission's approved list includes IBAS, eCOGRA, CEDR, ADR Group, Pegasus ADR Service, Blexr, ProMediate and the Tattersalls Committee. The published outcomes are not flattering to complainants and are worth knowing: eCOGRA's report for October 2024 to September 2025 recorded 911 disputes, of which 150 valid ones concerned deposits and withdrawals, an average domestic resolution time of 31 days, and 17.8 per cent of completed disputes decided in the consumer's favour. IBAS recorded 3,721 domestic disputes in 2024-25, with 65 upheld by written decision against 693 not upheld. Those numbers do not mean the system is broken — they mean a dispute needs documentation before it is worth raising. Note also that ADR providers will not accept complaints about customer service, or about a refusal to accept a bet.

Practical Checks Before Using Any Site

1. Open the Commission's public register and confirm both the operator and the domain. Reason: a licence held by a group is not a licence held by the domain in front of you, and the register lists domains for exactly this purpose. If the site is not there, nothing else on the page applies to it.
2. Find the customer funds statement in the terms and note the protection rating. Reason: it tells you what happens to your balance if the operator fails. An operator rated "not protected" must repeat that reminder every six months, so the words should be somewhere obvious.
3. Read the withdrawal terms rather than the deposit terms. Reason: the deposit journey is designed to be frictionless; the withdrawal journey is where maximum limits, processing fees and single-withdrawal-at-a-time conditions hide. Any maximum cap on withdrawing a deposit balance is a prohibited term.
4. Note the wagering multiple and the game weights on any bonus you accept. Reason: a multiple of ten on slots can mean far more on table games, and the ten-times cap is the ceiling on the bonus requirement itself. If you cannot find the multiple in one click, treat the offer as unquantified.
5. Set a financial limit at the point the site prompts for one. Reason: since 31 October 2025 British licensees must present limit-setting as the default before a first deposit, and the setting is easier to adjust deliberately than under pressure later. The Commission also requires reminders every six months to review account and transaction information.
6. Check whether the site appears on any regulator's unauthorised list. Reason: the Malta Gaming Authority publishes a list of unauthorised URLs carrying notice dates as recent as 30 October 2026, stating that references to the MGA or a Maltese licence on those domains are false and misleading. A short check against a regulator's own list is faster than any review site.

FAQ

How Many Online Gambling Sites Are There In The UK?

There is no single tally, and any figure quoted as definitive is being sold to you. What can be counted is the licensed population and the illegal one separately. A third-party reading of the Curaçao Gaming Authority's public register found 704 licences held by 698 operators, of which 552 were active, as of 6 November 2026 — that is a reading of an external tracker, not a Curaçao publication, and should be treated as approximate. On the illegal side, the Commission's dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, and its monitoring identified just over 1,000 unique illegal websites accessed between May 2024 and July 2025. The useful number is not the total; it is whether the site you are looking at appears on the British register.

Do New Sites Face The Same Rules?

Yes, and that is the point of licensing. The obligations attach to the licence, not to the site's age, so a domain launched last month faces the same 10-times wagering cap, the same financial vulnerability thresholds, the same ban on reverse withdrawals and the same duty to participate in the self-exclusion scheme as a name that has traded for twenty years. Where new sites differ is in seasoning: an operator with a short history has a short regulatory history, and there is no long record of how it handles a disputed withdrawal. The Commission's decision to remove TGP Europe from the British market in May 2025, after which the sites it operated became unlicensed, showed how quickly a familiar-looking brand can lose the protections that came with a licence. Age of domain is not a safeguard; a current entry on the register is.

Which Sites Are Safest, And How Would Anyone Know?

Safety here is a matter of enforceable obligations rather than reputation. A site licensed in Great Britain must verify identity, cap wagering at ten times, refrain from mixing products in a single promotion, participate in GamStop, disclose its customer funds rating and offer access to an approved ADR provider. Those are licence conditions, and breach is a breach of licence. The Commission's enforcement record shows it will act: licence suspensions in April 2020 for failure to integrate the self-exclusion scheme, a £170,000 penalty for an operator in July 2025 for failures including a bonus term giving the operator discretion to close accounts or forfeit winnings, and a £900,000 regulatory settlement in October 2026 from L & L Europe Limited, which runs seven websites, for failures including unnecessarily delaying consumer withdrawals and a term restricting customers to one withdrawal request at a time. Nothing comparable attaches to a site outside the register, because there is no licence to remove.

What Help Exists In Great Britain?

Help is free and it does not require anyone to stop gambling first. The National Gambling Helpline, operated by GamCare, runs on 0808 8020 133, 24 hours a day, every day of the year, and the same number reaches live chat and WhatsApp. Callers in Wales can use 0808 2819 265. BeGambleAware, the public-facing brand of the charity GambleAware, directs people to the same helpline. NHS England had opened 15 specialist gambling clinics across England since 2019, and integrated care boards commission eight regional NHS gambling services receiving almost 5,000 referrals a year. The NHS National Gambling Clinic in London accepts self-referrals, and takes young people aged 13 to 18 from anywhere in England. Citizens Advice Scotland runs a gambling support advice line on 0800 328 1131, Monday to Friday, 10am to 3pm. Treatment and prevention are paid for by the statutory levy on operators, which commenced on 6 April 2025 and raised just under £120 million in its first year, ringfenced for research, prevention and treatment.

What Happens If An Offshore Site Withholds A Payment?

Recovery is hard, and the first thing to understand is where the money went. British-licensed operators are held to the fair and open terms condition, the identity verification condition and the prohibition on unfair terms, backed by a regulator that can fine them and a disputes route through an approved ADR provider. A site licensed elsewhere is answerable to a different authority with a different appetite. Kahnawà:ke, for instance, operates a full-time Dispute Resolution Officer, and Anjouan requires licensees to name an approved ADR provider and expects complaints resolved within 30 days before escalation. Those are real mechanisms. They are simply not the mechanism that applies to a British licence, and no foreign regulator can order an operator to comply with British consumer law. The Commission is a regulator, not an ombudsman, so it cannot resolve individual complaints or help recover money from any operator, onshore or offshore.

Why The Offshore Licence Is Not A Shortcut

The claim I find hollowest is the one that treats an offshore licence as a functional equivalent. Comparison shopping on fees is fine as a spectator sport — Curaçao's annual B2C charge is EUR 47,450, Anjouan's is EUR 17,828, and Kahnawà:ke's Client Provider Authorization application fee rises from USD 35,000 to USD 40,000 on 1 January 2027 — but the fee buys supervision of a different kind and depth. The Commission's 2026 risk assessment rates the remote casino sector as high risk for money laundering, unchanged from the previous rating, and reports an increase in the scale and sophistication of attempts to bypass due diligence using false documents, deepfake videos and face swaps generated by artificial intelligence. British operators bear that risk under a British licence. An operator outside the register bears it under someone else's.

What the Commission does about unlicensed sites, in the end, is arithmetic. Since April 2024: 3,140 cease and desist and disruption notices, 447,778 URLs referred to search engines, 287,961 removals secured, and one prosecution commenced in a full year. A registrar block cuts engagement by an average of 91 per cent. It is a scraper, not a wall, and the sites keep coming back under new domains. Which is why the register, and not a review list, is where the question of the best online gambling sites UK players can safely use is actually settled — and why the number that matters most on this page is 614,738: the people on the self-exclusion register as of July 2026, each of whom an offshore site is not permitted to serve.