Casino Sites Not on GamStop 2026 The Licence the Rules and the Reality

Sites that sit outside GamStop are operators holding no Gambling Commission licence, so the self-exclusion scheme cannot reach them and UK protections do not apply. They are illegal to offer to British customers, and the Commission disrupts them through cease and desist notices, registrar and host referrals, search removals and payment referrals. This page shows how it works.

The phrase "not on GamStop" sounds like a feature. Read it again and it is a description of an absence, and the absence is a licence. GamStop — often typed "gamestop", which does not change what it is — is the national online self-exclusion scheme, free to use, and since 31 March 2020 every operator holding a Gambling Commission licence has had to be part of it as a condition of that licence, written into the Licence Conditions and Codes of Practice at social responsibility code 3.5.5. Registration blocks a person from gambling with all online operators licensed in Great Britain for six months, one year, five years or five years with auto-renewal. Signing up takes minutes; the block can take up to 24 hours to bite. Once registered, it cannot be cancelled during its term, and it stays in place after the term ends until the person contacts GamStop to remove it.

That is the standard against which everything else on this page is measured. Which is where the interesting part begins, because the British regulator's own numbers suggest the offshore market is not the vast shadowland its advocates claim nor the rounding error its critics prefer. The Commission's analysis published 5 November 2026 estimates that 2.5% of people who had gambled online in the past four weeks had engaged with an illegal gambling website. Across the whole adult population, including non-gamblers, 0.6% had done so. Meanwhile the market-intelligence firm H2 Gambling Capital puts stakes with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019, with the legal share of gambling falling from 97% to 92%. Two honest readings of one market, and I am not going to pretend the gap between them is a mystery I alone can solve. What I can do is show what the regulator actually does about these sites, because that record is concrete, dated and checkable. As of 13.11.2026, the disruption figures look like this.

What the Gambling Commission Has Actually Disrupted

The Commission's Illegal Markets team has been publishing its totals since April 2024, and the most recent quarterly numbers are the ones worth holding in your head. In July to September 2026 alone it referred 1,835 websites to search engines — covering 7,677,211 individual URLs — and issued 546 cease and desist notices to illegal operators. Compare that with the quarter January to March 2026, when the same team referred 226 websites and issued 98 notices. That is a step change, not a drift.

Across the whole period since April 2024, the running totals are 3,140 cease and desist and disruption notices, and 447,778 Bing and Google URLs referred, producing 287,961 removals. Measured across 160 illegal gambling websites for which traffic data existed, engagement fell by an average of 32% following disruption action.

Here is the sentence in that report I keep coming back to. The Commission says registrar blocks and website suspensions produced the largest average fall in engagement — 91% each — ahead of GEO IP blocking at 60%, Bing removal at 52%, Google removal at 30% and Facebook removal at 8%. In other words, the method most visible to a British player searching for a casino, the search-engine removal, is among the least effective. The site disappears from page one and stays reachable to anyone holding a link or a VPN. The Commission says as much itself: search removal makes a site harder to find, not impossible to reach.

And the enforcement tail is thin. Across April 2025 to March 2026, every quarter recorded zero or one prosecutions commenced — one prosecution in the whole year, in October to December 2025. A licensing offence under section 33 of the Gambling Act 2005 carries on summary conviction up to 51 weeks' imprisonment, a fine at level 5, or both. On paper that is a serious offence. In practice, disruption is the strategy, and disruption is a game of attrition played against a market that reconstitutes itself under new domains.

Which Licence a Site Actually Holds

Ask an offshore operator where it is licensed and you will usually get a jurisdiction, not an answer. The jurisdiction matters enormously, because it determines what stands behind the site if something goes wrong. There is no whitelist and no shortcut: the only way to know what protects a player is to read the licence and check it at source.

Two reform stories dominate right now. In Curaçao, the National Ordinance on Games of Chance took effect on 24 December 2024, replacing the old master-licence and sub-licence model with direct licensing by the Curaçao Gaming Authority. The legacy "orange" sub-licence certificates ended on 15 October 2025, and the CGA states plainly that an historic /JAZ number or legacy seal must not be treated as proof that an operator currently holds a valid licence. The CGA then announced on 7 October 2026 that its previous online portal would not return to service and that it is working on an alternative way of verifying licensed domains. So the seal a player might have learned to trust is, for now, in flux. A third-party tracker reading the CGA's register counted 704 licences held by 698 operators, of which 552 were active, as of 6 November 2026 — though that is not a CGA publication, so treat it as an indication rather than a figure.

Anjouan is the other story, and a less comfortable one. Anjouan Gaming says its licence certificates carry a unique number and a QR code linking to a public register, and that certificates which cannot be verified there should not be relied on. But an ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around €17,000 each per year, and that financial intelligence officials in the Comoros described Anjouan Corporate Services as operating illegally, while a former attorney-general of the Comoros called Anjouan Licensing Services "an illegal entity". Anjouan Gaming responded on 10 June 2026 that its licence is not, and has never been presented as, a universal authorisation to operate in every country. That statement is, in its own careful way, an admission that a licence from Anjouan does not make a British-facing site lawful in Britain. It never did.

How the Licences Compare

A number in that table and a number in this paragraph are the same number: the Curaçao annual B2C fee of €47,450, the MGA's annual €25,000 and the Kahnawà:ke annual CPA fee of USD 20,000 are the operators' own published costs, and the differences tell you what kind of scrutiny each regime can afford to fund.

Best Casino Sites Not on GamStop and How to Rank Them

The phrase "best casino sites not on GamStop" is doing a lot of unearned work. Best at what? Since I cannot name operators and would not vouch for one anyway, the honest version ranks the criteria a careful observer would use — and shows how UK-licensed sites score against offshore ones, good and bad alike.

Verified licence and payable dispute route

A site's licence should be checkable at the regulator's own register, by the domain actually being used, not just by the brand. After the Gambling Commission, the Malta Gaming Authority publishes a list of Unauthorised URLs, declaring it has no connection with those domains and that any reference to the MGA or a Maltese licence on them is false and misleading. Anjouan says its licensees must designate an Authority-approved ADR provider and list its name in player-facing terms, with complaints expected to be resolved within 30 days before escalation.

Withdrawal terms without built-in delay

This is where offshore terms are most inventive, and where the Commission's own data is most useful. Its figures covering June to September 2024 record 44.2 million withdrawals by customers of large online operators, of which 96.3% cleared automatically and 3.5% within 24 hours. Consumer research published 23 July 2026 found 49% of people who had gambled in the past 12 months agreed that it is quick and easy to withdraw and collect winnings — with 18% disagreeing. Reverse withdrawals have been banned for all remote operators in Britain since 31 October 2021 under RTS 14B, which states that consumers must not be given the option to cancel a withdrawal request. A term stating that only one withdrawal may be requested at a time is the same manoeuvre under a different name, and the Commission found exactly that term unfair under the Consumer Rights Act 2015 in a £900,000 regulatory settlement announced on 21 October 2026.

Bonus maths that survives the small print

The UK position changed on 19 January 2026. Social Responsibility Code 5.1.1 now caps wagering requirements at ten times and bans mixed-product promotions that require two or more types of gambling. When the Commission consulted it said the cap "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". Offshore sites are not bound by that cap, and their welcome offers commonly sit in the 25x to 40x range, with no-deposit bonuses higher still. A maximum cashout clause is the quiet partner of a high multiplier: one offshore operator reserves the right to limit withdrawable winnings from bonus funds to 300% of the credited bonus amount, voiding the excess.

Payment methods that leave a trail

Unlicensed operators serving British players will often push crypto and e-wallets, and there is a regulatory reason: licence condition 5.1.2, effective 31 January 2024, requires UK licensees to accept payment from Great Britain customers only by a method whose provider is a payment service provider within the Payment Services Regulations 2017. Pay by phone casino sites and PayPal casino sites in the UK operate within that perimeter, which is why they are absent from the offshore market almost entirely — the banking rails do not reach there.

Something behind the money if the site fails

British licensees must publish a customer-funds protection rating — "not protected", "medium protection" or "high protection" — and an operator rated "not protected" must remind customers every six months that their funds are not protected in the event of insolvency. Keeping money in a separate client account does not guarantee its return, and operators may hold customer funds in overseas bank accounts. Offshore, the question is harder to answer: Kahnawà:ke requires licensees' terms with players to be contractual and free of unfair or unreasonable terms, and Anjouan's published standards require segregated player funds — but a standard on a regulator's website and a client account at a named bank are different kinds of reassurance.

New Casino Sites Not on GamStop and the Brand-New Licence Problem

A new casino site, by definition, has no withdrawal history. So the question a new unlicensed casino raises cannot be answered by the market yet: whether this particular operator pays, and how fast. Newness also correlates with thin licensing. The Curaçao reform offers the clearest illustration of why a date matters. Operators holding a valid licence when the LOK came into force on 24 December 2024 received a six-month provisional licence by operation of law, due to expire on 24 June 2025; the CGA extended those provisional licences a further six months, to 24 December 2025, and said operators had to be fully compliant with the LOK by then to be eligible for a full licence. So a site launched in 2025 may have been running on a provisional status whose validity depended on compliance it could not demonstrate. Supplier licensing and supplier registration become fully mandatory in Curaçao only on 24 December 2026. A new site's age is not a virtue or a defect by itself — but a new site plus a provisional or legacy licence is two unknowns stacked on top of each other, and that is the combination worth avoiding.

KYC and How It Protects Players

Identity verification is what all of this turns on, because it is simultaneously the thing that protects a player and the thing that delays their money — and the two are almost impossible to separate from the outside.

The first time is mechanical. A UK-licensed operator must obtain and verify information establishing a customer's identity before that customer is permitted to gamble, under licence condition 17.1.1, introduced on 7 May 2019. The information must include name, address and date of birth. Many operators can match an account against databases such as credit reference agencies and the electoral roll, in which case no documents are needed at all. Where that fails, passports, driving licences and household bills get requested. In remote casinos the anti-money-laundering rules require identification and verification once deposits or withdrawals and winnings reach €2,000, and that threshold applies to linked transactions as well as a single one.

Later, the picture changes. Checks are ongoing and may be repeated when circumstances or personal details change, and for higher-risk accounts an operator will want to establish source of wealth, not merely source of funds. Bank statements can be requested to check that funds are legitimate, along with information explaining irregular income patterns. The Commission's 2026 risk assessment rates the remote casino sector as high risk for money laundering, and describes an increase in attempts to bypass checks using false documentation, deepfake videos and face swaps generated by AI.

The warning signs are specific. A request for documents that arrives only when a withdrawal is attempted, having been absent during months of deposits, is the classic one — the Commission's licence condition 17.1.1 forbids requiring additional information at withdrawal if the operator could reasonably have requested it earlier. More than a quarter of complaints reaching the Commission's Contact Centre concern identity verification, per a blog published 12 August 2026, and "fuzzy matching" through third-party verification providers is a live concern. So is onboarding a customer under a middle name rather than a forename, because the mismatch that creates against records held elsewhere can quietly undermine a self-exclusion. If identity checks are the gate, understand that on an unlicensed site there is no gate that anyone regulates — no condition to enforce, no regulator to complain to, and no route to an ADR provider the Commission has approved.

Five Signs an Operator or Service Can Be Trusted

The licence is verifiable at the regulator, by domain

Check the domain named on the certificate against the domain you are using. The Curaçao Gaming Authority states that clicking a Certificate of Operation Seal must redirect to its own certificate portal, and that if the certificate shows a different domain from the website being accessed, the site is displaying another operator's certificate and should be considered unauthorised or fraudulent. Kahnawà:ke's Logo Certificate Program works similarly: click the logo and it generates a Certificate of Good Standing. Five minutes of clicking beats any review site's badge.

The complaints route ends somewhere real

A trustworthy operator tells you which ADR provider handles disputes before one arises. The Commission's list of approved providers is ADR group, Pegasus ADR Service, another approved provider, CEDR, eCOGRA, IBAS, ProMediate and Tattersalls Committee. IBAS took 3,721 domestic disputes in 2024-25 and reports 100% operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. Anjouan's approved providers are EGIS ADR, Axion ADR, iGaming ADR and a designated body. If the terms name none, that is the answer.

A withdrawal request is not the moment new conditions appear

Ask, before depositing, what documentation will be needed and when. Then check whether the site uses reverse-style friction — a rule that only one withdrawal may be in progress at a time, a manual review of every fifth withdrawal, a minimum withdrawal set high enough to be a lock. Whichever way the evidence points: if withdrawing is harder than depositing, the commercial interest is visible.

The bonus terms fit on one screen

Under LCCP SR Code 5.1.9 all significant conditions applying to marketing incentives must be provided transparently and prominently, and where displayed online, in full no further than one click away. A genuine ten-times cap with a stated maximum bet while wagering and no maximum cashout clause takes a paragraph to explain. If the terms run to several screens and contain the words "reserve the right", the offer is not a gift; it is a term sheet.

Funds are held somewhere that would survive the operator

Look for a stated customer-funds protection rating in the terms, and for an acknowledgement of receipt of that disclosure — British licensees must give it in writing before a customer uses funds for gambling, on first deposit and after any change. A site that will not say how customer money is held, or that says it holds it overseas and calls that protection, has answered the question honestly and unhelpfully at the same time.

How to Check a Casino Site Before You Use It

1. Find the licence and verify it at the regulator. Search the operator's domain on the regulator's public register rather than trusting a page footer, because a footer logo costs nothing and a register entry is checked by someone else.
2. Read the withdrawal section of the terms in full, before depositing. Look specifically for per-withdrawal caps, processing fees, manual review thresholds and any rule on how many withdrawal requests may be open at once — those terms bind you later, and reading them first is the only moment you have leverage.
3. Write down the wagering requirement, the maximum bet while wagering, and the maximum cashout. Three numbers, one line. If the operator publishes only two of them, assume the third is unfavourable.
4. Check the advertised payment method matches what the terms actually process. Pay by phone and PayPal offshore casinos are advertised much more often than they are genuinely operated, and a mismatch between the landing page and the cashier is an early signal.
5. Confirm the complaints route and its deadline. Identify the ADR or dispute body named in the terms, and note that many will not accept a dispute until the operator's internal process has run — which can take up to eight weeks in the UK regime.
6. If anything about gambling is already a live concern, players should use the schemes that actually work. GamStop Online registration and blocking software such as Gamban or BetBlocker, plus a bank gambling block, which most major banks provide and which applies at card level, so it must be activated on each card.

That last step is worth spelling out plainly, because it is the one that gets quietly inverted by marketing. Offshore sites that hold no Gambling Commission licence are not connected to GamStop and are not covered by it, since the scheme's obligations apply only to UKGC-licensed operators. That is a statement about the limits of a British scheme, not an invitation. A GamStop exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it — it is not something a different website can lift, and any operator implying otherwise is describing a licensing gap as a service.

If gambling is causing harm, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day of the year; callers in Wales can use 0808 2819 265. GamCare runs it, with live chat and WhatsApp alongside. NHS specialist gambling clinics operate across England, and Citizens Advice Scotland runs a gambling support advice line on 0800 328 1131, Monday to Friday, 10am to 3pm. GamFam supports families affected by someone else's gambling, and Gamblers Anonymous England, Wales and Ulster can be reached on 0330 094 0322.

FAQ

Are casino sites not on GamStop legal in the UK?

No. The Gambling Commission states it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence elsewhere. The offence sits with the operator under section 33 of the Gambling Act 2005, which carries up to 51 weeks' imprisonment, a level 5 fine, or both on summary conviction. Players are not the target of that provision.

Do British casino sites not on GamStop exist at all?

No — not if they hold a Commission licence. Since 31 March 2020, participation in GamStop has been a licence condition for every online operator, written into social responsibility code 3.5.5, which states that licensees must participate in the national multi-operator self-exclusion scheme. The Commission has shown it will act: on 3 April 2020 it suspended the licences of two operators that missed the integration deadline.

What happens to my money on a site with no UK licence?

Nothing automatic protects it. British licensees must disclose a customer-funds protection rating, and one rated "not protected" must remind customers every six months that their funds are not protected if the operator becomes insolvent. Keeping funds in a separate client account does not guarantee their return, and operators may hold customer money in overseas bank accounts. Offshore, the standard depends entirely on the licensing regime.

Can I use pay by phone or PayPal at casino sites not on GamStop?

Rarely, and the advertising usually outruns the reality. UK licence condition 5.1.2, effective 31 January 2024, restricts British licensees to payment methods whose provider is a payment service provider under the Payment Services Regulations 2017. Offshore sites mostly route around that perimeter through crypto and e-wallets, and the Commission's financial disruption work includes referrals of payment data to card schemes — a strategy it calls critical and still early-stage.

What does the regulator actually do about unlicensed sites?

It disrupts rather than prosecutes. Since April 2024 the Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Bing and Google URLs and secured 287,961 removals. Across April 2025 to March 2026, every quarter recorded zero or one prosecutions commenced. Registrar blocks and suspensions cut engagement by 91% on average, against 30% for Google removal — the visible action is not the effective one.

Is an offshore licence as good as a British one?

No, and the regulators themselves effectively say so. Anjouan Gaming stated on 10 June 2026 that its licence is not, and has never been presented as, a universal authorisation to operate in every country, and that no licensing authority can exempt an operator from local law where local authorisation is required. A Curaçao licence costs an operator €47,450 a year in total B2C fees; a Gambling Commission licence brings obligations that no fee schedule captures.

Casino Sites Not on GamStop and the Licensing Gap

The market for unlicensed casino sites exists because a licence condition is a real constraint, and the constraint creates an arbitrage for anyone willing to trade British player protection for it. What the evidence supports is narrower than either camp claims. The regulator has built a disruption machine — 1,835 websites referred in a single quarter, 546 cease and desist notices, an average 32% fall in engagement across 160 measured sites — and that machine works best through registrars and hosting, not through the search results a British player sees. It prosecutes almost never: one prosecution across a full financial year. So the honest conclusion is that unlicensed sites are illegal, patchily suppressed, and increasingly licensed somewhere that sounds like a regulator without functioning like one.

Judge them the way I judge everything in this trade: by what is checkable. A licence you can verify at source, a withdrawal term you read before depositing, a dispute route with a name on it. The Gambling Commission's own quarterly figures make the closing point better than I can — registrar blocks cut engagement by 91%, search removals by 30% — and if the disruption that actually works is the kind a player never notices, then the protection that actually works is the kind that never has to be found on a website in the first place. The National Gambling Helpline remains free on 0808 8020 133, 24 hours a day, every day of the year.