Gambling Sites Not on GamStop the Regulator Is Chasing

Gambling sites not on GamStop are offshore operators with no Great Britain licence, so the scheme cannot reach them. They are not a loophole in UK self-exclusion: they sit outside it. British protections, dispute routes and helpline funding do not follow a player there — and the Gambling Commission is actively disrupting these sites.

It is often typed "gamestop", but the scheme's name is GamStop, and it is worth being precise about what the name covers, because the whole topic turns on that boundary. GamStop Online is the UK's national online self-exclusion scheme, run by The National Online Self Exclusion Scheme Limited. Since 31 March 2020, every operator holding a Gambling Commission licence must be part of it — the requirement sits in the Commission's social responsibility code provision 3.5.5, which says licensees must participate in the national multi-operator self-exclusion scheme. Sign up and all of them must block you. An offshore site that holds no British licence is not one of them, and the scheme's obligations do not reach it.

That is the entire difference between a licensed site and the rest. This page looks at that gap from one side only: what the regulator actually does about the unlicensed operators filling it, what those sites' terms typically contain, and what a careful player can check. As of 13.11.2026, the enforcement numbers are unusually well documented, which is a change from the days when the black market was mostly guesswork.

What the regulator does about unlicensed sites

The Gambling Commission's Illegal Markets team has been busy, and the figures are specific enough to be checked. Since April 2024 it has issued 3,140 cease and desist and disruption notices — 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and 3 payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs and secured 287,961 removals.

The commission's own reading of that data is the interesting part. Across 160 illegal gambling websites where traffic data existed, engagement fell by an average of 32 per cent after disruption. Break it down by method and the ranking is decisive: registrar blocks and website suspensions each produced an average fall of 91 per cent, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. The Commission says so itself — search-engine removal makes a site harder to find, it does not fully block it. The quiet, unglamorous work of cutting a domain off at the registrar is what actually works.

The pace has not slackened. In January to March 2026 the team referred 226 websites to search engines and issued 98 cease and desist notices. In April to June 2026 it referred 366 websites, covering 147,721 URLs. In July to September 2026 the figures jumped to 1,835 websites and 7,677,211 URLs, with 546 cease and desist notices issued.

Now the sting. Across April 2025 to March 2026, every quarter recorded zero or one prosecutions commenced — a total of one, in October to December 2025. Disruption is a volume business; criminal prosecution is not. A site suspended at the registrar turns up under another domain, and the cycle restarts.

How many people are actually there

Estimates of the unlicensed market vary wildly depending on who is paying for the study, and it is worth saying so plainly. H2 Gambling Capital put stakes with illegal operators in the UK at £16.6 billion in 2025, up from about £5 billion in 2019. A study by Frontier Economics for the Betting and Gaming Council estimated £2.7 billion staked annually online on the black market — 2.1 per cent of the £128 billion staked with GB-regulated remote casino, betting and bingo operators, involving 1.5 million Brits. Yield Sec/Gaming Compliance International, working for the Campaign for Fairer Gambling, put 9 per cent of the £8.8 billion GB online market unregulated in 2025. Each of those is an industry-commissioned number with an interest behind it.

The Gambling Commission's own survey work is the sober counterweight, and it is much smaller. Its analysis published 5 November 2026 estimates that, among respondents who had gambled online in the past 4 weeks, 2.5 per cent had engaged with illegal gambling websites, with a further 1.5 per cent having done so in the past 12 months. Across the whole population, including non-gamblers, 0.6 per cent had engaged with an illegal site in the past 4 weeks and 94.4 per cent showed no indication of using one at all. Among online gamblers, then, roughly one in forty — materially different from a market-share story about one in eleven.

Its dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, 4 per cent less than the previous three-month average but 4 per cent more than September 2025. Of 311 sites disrupted in the second quarter of 2026/27, 77 per cent saw a reduction in estimated traffic. The regulator's own October 2024 methodology combines web-traffic data with a licensed-play assumption of £0.32 GGY per minute for online slots, and notes explicitly that it does not capture activity hidden by VPNs. Bear that in mind before trusting any of these numbers absolutely.

The licence question, and why it decides everything

The legal position is blunt. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and it is immaterial whether the facilities are provided wholly or partly by remote communication, or whether the provider is inside or outside the UK. On summary conviction the offence carries imprisonment for up to 51 weeks, a fine up to level 5 on the standard scale, or both — six months in Scotland. For remote gambling, section 33 catches the provider if at least one piece of remote gambling equipment used is in Great Britain, or if the provider knows or should know the facilities are being used, or are likely to be used, in Great Britain.

The Commission's line is equally clear: it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence somewhere else. Its remit covers only sites that trade or advertise to customers in Great Britain, and those must hold a Commission licence.

So the licence on a site's footer is not decoration. It tells you whether the operator is inside the system that returns your funds on self-exclusion, that forbids reverse withdrawals, that caps bonus wagering, that funds the treatment system through the levy — or outside all of it.

The offshore licences you will actually see

If a site is not on GamStop, look at what, if anything, it holds. Three jurisdictions cover most of what turns up, and each has just changed.

Curaçao after the LOK reform

The National Ordinance on Games of Chance took effect on 24 December 2024, replacing the old master-licence and sub-licence model with direct licensing by the Curaçao Gaming Authority. The legacy "orange" sub-licence certificates of operation ended on 15 October 2025 and should no longer be treated as proof of a current licence. Licensing ceased for the four former master licensors on staggered dates: Gaming Curaçao (365/JAZ) on 18 August 2024, Curaçao eGaming (1668/JAZ) on 1 October 2024, one former master licensor (8048/JAZ) on 1 November 2024 and Curaçao Interactive Licensing (5536/JAZ) on 31 January 2025. A historic /JAZ number or legacy seal proves nothing about today.

The costs tell you what kind of operation is being bought. A B2C application fee is a one-time, non-refundable EUR 4,592, with EUR 150 per ultimate beneficial owner. The total annual B2C fee is EUR 47,450, split into a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee to the Authority, payable in full by 15 January. That is a real financial commitment, and a plausible reason why a site would rather display an expired seal than buy a current one.

Verification is checkable. The authority issues two different seals: a Certificate of Operation Seal, only to B2C operators and only for an approved, registered player-facing domain, and a License Certificate Seal, available to B2B and B2C entities and not domain-specific. Clicking a Certificate of Operation Seal must redirect to cert.cga.cw. If the seal's design, colour or format differs, the site is not authorised; if the certificate behind the seal shows a different domain from the one you are on, it belongs to another operator. The Authority also warned on 7 October 2026 that its previous online portal would not return to service and that it is building an alternative way to verify licensed domains. Supplier licensing becomes fully mandatory in Curaçao from 24 December 2026, at the end of a two-year transitional period.

Anjouan, where the paperwork is contested

Anjouan is a constituent territory of the Union of the Comoros, with a framework founded on legislation adopted in 2005. It names the Anjouan Offshore Financial Authority as the competent regulator, with Anjouan Licensing Services Inc. as sole authorised licence administrator, and it publishes fees of EUR 17,828 one-time for a B2C licence and the same for annual renewal, with EUR 500 per additional domain or URL.

Its own claim to legitimacy is contested in public. An independent legal opinion dated 19 September 2024 and reconfirmed in February 2026 by a law firm regulated in England and Wales and Quebec is said by the regulator to confirm the AOFA is the lawful authority — that is the licensee's own statement, not a finding. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, and that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally; a former attorney-general of the Comoros called the licensing seller "an illegal entity". The same investigation reported that the AOFA was stripped of its status as a recognised regulator by Comorian banking laws passed in 2013 and 2015. Anjouan's own statement of 10 June 2026 concedes the useful part: an Anjouan licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world".

Kahnawà:ke, the longest-running option

The Kahnawà:ke Gaming Commission was established in 1996 and enacted its interactive gaming regulations on 8 July 1999. Licensed operators must be hosted at Mohawk Internet Technologies, a data centre in the Mohawk Territory managed by Continent 8 Technologies. The Commission's structure is unusual: it issues one Interactive Gaming Licence, held by only one entity at a time and held by Mohawk Internet Technologies since 1999, plus Client Provider Authorizations. It places no limit on the number of CPAs it may issue.

Its player-facing protections are stricter than the offshore norm. A licensee's relationship with players must be contractual and free of unfair terms, sites must let a player set limits including zero, and the Commission states its own voluntary self-exclusion is permanent and irrevocable — a player who breaches a self-exclusion prohibition forfeits deposited or won funds to a third-party charity chosen by the Commission. A full-time Dispute Resolution Officer handles disputes. Its Logo Certificate Program, effective 15 January 2010, lets a player click the Commission's logo to generate a Certificate of Good Standing.

Malta, for context

Malta's authority states that a B2C licence is required whenever a Maltese or EU/EEA entity wants to offer a gaming service from Malta, to a Maltese person, or through a Maltese entity. Its fees are a one-time EUR 5,000 application fee, a non-refundable fixed annual licence fee of EUR 25,000, and gaming tax of 5 per cent of revenue generated. Paid-up capital minimums are EUR 100,000 for Type 1 and Type 2 licences and EUR 40,000 for Type 3 and Type 4. Malta publishes a list of unauthorised URLs, with the most recent entries carrying notice dates of 30 October 2026, and states that any reference to the MGA or a Maltese licence on those domains is false and misleading.

Costa Rica, which is not a licence at all

Worth saying once because so many sites lean on it: Costa Rica operates no comprehensive gambling licensing regime and has no formal framework for issuing gambling licences. The "data processing license" sometimes referenced in the industry is not a licence in the strict legal sense. Its Legislative Assembly rejected Bill No. 25,057 in early 2026; the bill would have introduced mandatory licensing. Under Costa Rican law, games of chance where the outcome depends primarily on luck rather than skill are generally prohibited, so gambling services should not be offered to or actively marketed toward Costa Rican residents, and only land-based casinos integrated into qualifying hotels are authorised.

The two systems side by side

The comparison that matters is not brand against brand. It is the terms a player is agreeing to, jurisdiction by jurisdiction. Where a term appears below, treat it as typical rather than universal.

The bottom row is the one people skip. Under the UK regime, customer funds must be held in a separate client account, and businesses must pick one of three ratings — "not protected", "medium protection" or "high protection" — say which applies in their terms, and, if "not protected", remind the customer every six months that their funds are not protected in the event of insolvency. Keeping money in a client account still does not guarantee it comes back, and operators are legally allowed to hold it in overseas bank accounts. But at least a British player is told. Offshore, that disclosure duty simply does not exist.

The wagering cap, and what replaced the old trick

This is the thing the topic turns on, because bonus terms are where offshore sites make their money back — and the British rule changed in a way most players have not caught up with.

From 19 January 2026, licensees must not apply wagering requirements requiring a customer to play through bonus funds more than ten times. The Commission consulted on an outright ban or a cap at 1, 5 or 10 times and chose 10, judging that licensees would otherwise be highly likely to introduce terms preventing customers cashing out bonuses. Its own words: the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". The same code bans mixed-product promotions that include more than one type of gambling product within an incentive, including where terms are linked and shared. "Bet £5 and get £10 free bet" is compliant. "Bet £5 to get 20 free spins" is not. An offer whose prize is itself mixed — a free bet plus free spins — is not.

Offshore, none of that applies, and the gap is not subtle. BlueChip Casino's terms state that for deposit bonuses the required bet amount equals the bonus multiplied by the wager, with the deposit itself excluded from the calculation, and that it reserves the right to limit winnings generated with bonus funds to 300 per cent of the credited bonus amount, with any excess voided. It caps the maximum bet while wagering at €5 for regular players and €10 for VIP players and rejects anything above. Ignition states casino bonus amounts carry a 25× playthrough requirement, gives slots and specialty games 100 per cent contribution, table games 20 per cent, video poker and blackjack 10 per cent, roulette and baccarat 5 per cent, and craps, Hot Drop Jackpots and live dealer games 0 per cent unless stated otherwise, and notes that failing its max bet rule — 20 per cent of the deposited amount per wager — "may result in account closure, forfeit of the Bonus, and any winnings generated during the wagering of the Bonus".

The Wagering Requirement then proceeds in stages. First visit: you deposit, the bonus lands as a separate balance, and the requirement looks small because the number is expressed as a multiple of the bonus. Later, when you try to withdraw: the contribution chart applies, and hours spent on roulette counted at 5 per cent. Then the maximum cashout clause arrives, and the amount above 300 per cent of the bonus evaporates. Then the abuse clause, which typically describes low-margin or equal-risk bets, moving from a low-weighted game to a high-weighted one after a large win, and delaying free spins or bonus features until after wagering is met.

Three warning signs are worth memorising. A wagering figure that does not say whether it multiplies the bonus or the bonus plus the deposit. A contribution chart that gives live dealer games zero. A cashout cap that appears in the bonus terms rather than the headline offer. UK rules ended the practice behind the stickiest version of this: guidance requires that wagering requirements must not apply to play with a consumer's deposit balance, that deposit and bonus balances are always displayed separately, and that players may withdraw their deposit balance at any time, including while a bonus is pending or active. Offshore, a sticky bonus — one that can be wagered with but never withdrawn, and is removed on cashout — is entirely legal, and the operator's own terms decide.

Identity checks, and why they arrive at the worst moment

Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and it is among the most common dispute types referred to ADR providers. The Commission's blog of 12 August 2026 attributes much of it to a specific failure: operators asking for documents only when a player attempts to withdraw.

The rules on this are precise in Britain. Licence condition 17.1.1 requires a customer's withdrawal request not to result in a requirement for additional information if the licensee could reasonably have requested that information earlier — though that does not stop a licensee seeking information it must obtain at that moment under another legal obligation, such as an anti-money-laundering rule. Before permitting a deposit, licensees should tell customers what types of identity documents or information they may need, in what circumstances and in what form. The Commission expects identity and age checks to be brought forward to before a customer deposits or stakes, and says onboarding on incomplete or inaccurate information — initials instead of full names, nicknames, commercial addresses instead of residential — is not sufficient.

That last point has a consequence most people miss. Onboarding a customer using a middle name instead of a forename can create mismatches with records held elsewhere, including GamStop, and that undermines the effectiveness of self-exclusion itself. Sloppy verification is not a customer-service irritation; it is a hole in the scheme.

The first time on a well-run British site, verification usually happens by database match — credit reference agencies, the electoral roll — and is instant. The Commission says documents can include passports, driving licences and household bills, and that it cannot provide a timescale because the process varies. Where does the money sit meanwhile? Licensees cannot confiscate funds on the basis that ID has not been provided, and the CMA's view is that consumers are legally entitled to deposited money and to winnings from money deposited and gambled.

The warning signs are the mirror image. Documents requested for the first time at withdrawal, when the operator could plainly have asked earlier. A term allowing the operator to confiscate a deposit balance for failed verification. A verification provider doing fuzzy matching on partial data — the Commission has expressed concern about exactly that. And any site that will not tell you, before you deposit, what it will ask for and when.

Five signs an offshore operator can be trusted

None of these makes an unlicensed site equivalent to a licensed one, because nothing does. But they separate the operators that run an actual business from the ones that run a template and a deadline.

The licence survives a click

Check the seal, not the footer text. A Curaçao Certificate of Operation Seal must redirect to cert.cga.cw; if it does not, or if the certificate behind it names a different domain from the one you are on, the site is unauthorised. A historic /JAZ number, or any seal in the old orange design, means nothing since the legacy certificates ended on 15 October 2025. Anjouan certificates should carry a unique licence number and a QR code linking to the public register — the regulator's own policy says a certificate that cannot be verified there should not be relied on as evidence of licensing. Kahnawà:ke offers a Certificate of Good Standing generated by clicking the Commission's logo.

The customer funds rating is stated

Look for a sentence, in the terms, saying whether funds are protected in the event of insolvency and how. British operators must disclose one of three ratings and remind unprotected customers every six months. An offshore site with no such statement has told you something by omission: on insolvency, the money is in the queue with the other creditors, and the account may be overseas.

Payout terms contain no cap and no queue

Check the withdrawal section for two things: a maximum cashout figure, and a rule limiting how many withdrawals may be requested. BlueChip's 300 per cent cashout cap on bonus winnings is a live example of the first. A term permitting only one withdrawal at a time until the previous one is authorised is the second — the Commission found exactly that term unfair under the Consumer Rights Act 2015 when it settled with an operator for £900,000 in October 2026, alongside manual review of every fifth or tenth withdrawal that led to extra information being demanded before payouts were processed.

Complaints go somewhere, with a clock on it

Find the Alternative Dispute Resolution provider named in the terms. Anjouan requires licensees to designate an Authority-approved provider, list its name and contact details in player-facing terms, and resolve complaints within 30 days before a player may escalate; the approved providers are EGIS ADR, Axion ADR, iGaming ADR and an additional ADR provider Kahnawà:ke employs a full-time Dispute Resolution Officer. Note that the Gambling Commission is a regulator, not an ombudsman: it cannot resolve individual complaints or get money back for a consumer.

The terms are fair on their face

Read for words that hand the operator a discretion with no limit on it. A term stating the operator has the right at its own discretion to close accounts or forfeit winnings was among the failures behind a £170,000 fine in July 2025. The Commission's guidance is that operators should not use terms giving them sole discretion — "may" or "reserve the right" — to void or withhold winnings, because such terms are unfair within the meaning of the Consumer Rights Act 2015. Offshore, that guidance has no force; it is still the clearest single test of whether a set of terms was written to be honoured.

How to check an operator before depositing a penny

Six steps, all of them ordinary and all of them lawful. The reason matters as much as the step.

1. Double-check the licence on the regulator's own register. Curaçao's seal redirect and Anjouan's QR-linked register exist precisely so that a claimed licence can be tested rather than believed, and a mismatch between the certificate's domain and the site's is a decisive finding.
2. Confirm the site is outside GamStop, and understand what that means. An offshore site is never a route around a self-exclusion, and it is worth stating plainly: a GamStop registration blocks you from online operators licensed in Great Britain for 6 months, 1 year, 5 years or 5 years with auto-renewal, cannot be cancelled during the period, and the exclusion stays in place after the term ends unless you contact GamStop to remove it. The regulator has warned that unlicensed sites often target customers who have self-excluded.
3. Read the bonus terms for a wagering figure and a cashout cap. Establish whether the multiple applies to the bonus alone or the bonus plus deposit, and find the maximum cashout clause before the offer, not after the loss.
4. Test the withdrawal section against the complaint history. Withdrawal problems were the number one topic raised by consumers with the Commission, and its Annual Report 2024-25 records that withdrawal issues continued to cause most of the complaints it receives. A site whose terms put a queue in front of a payout is pricing that delay into its model.
5. Look for the funds-protection statement and the ADR provider in the terms. These are the two documents that decide what happens when things go wrong; a site that names neither is telling you it expects you never to need them.
6. Name a block that does not depend on the operator. GamStop signposts Gamban and BetBlocker for phones, tablets and computers. Bank gambling blocks are applied at card level, so they must be activated on each card, and most banks impose a 48-hour or 72-hour cooling-off period before gambling transactions are allowed again — the Commission's list names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. A block you can switch on and then cannot easily switch off is worth more than a promise in a set of terms.

Where Welsh players stand

Welsh players are in the same position as everyone else in Great Britain, with one difference worth knowing. A GamStop registration covers online gambling companies licensed in Great Britain, and that includes sites serving Wales, so the exclusion works exactly as it does in England and Scotland. The help line is not the same everywhere: the National Gambling Helpline, operated by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year, and for callers in Wales the number given is 0808 2819 265, alongside 0808 8020 133 for England and Scotland.

There is a small irony in the blocking software. Gamban is free for residents of Wales, while in England and Scotland it costs £4.99 per month or £29.99 per year after a 7-day free trial, following the end of TalkBanStop funding on 31 March 2026. BetBlocker, by contrast, requires no registration and is free worldwide; it states it blocks over 1,368,000 gambling websites and 3,100 apps.

Why an offshore site still looks like a bargain

It is worth being honest about the appeal, because pretending it is irrational does not answer anything. A site outside the British system can offer wagering multiples of 25× when the domestic cap is 10×, can impose a cashout cap that British rules forbid, can accept a deposit and then ask for documents at the withdrawal stage without breaching licence condition 17.1.1, because it holds no such condition. It pays no 1.1 per cent levy on previous-year gross gambling yield. Its lower costs are real, and some of them are passed on.

The trade is what the money buys. British-licensed sites set the standard against which the rest are measured, and the measurement is not about generosity — it is about what happens at the point of exit. On a licensed site, a self-exclusion must be honoured, the account closed and funds returned; the LCCP requires licensees to close the account of anyone who has entered a self-exclusion agreement and return any funds held, and says it is not sufficient merely to prevent the individual from withdrawing while still accepting wagers. On a licensed site, reverse withdrawals are banned outright — RTS requirement 14B, in force since 31 October 2021, states that consumers must not be given the option to cancel a withdrawal request. On a licensed site, a dispute can go to an approved ADR provider free of charge, and the operator must have arrangements for that referral if the complaint is unresolved within eight weeks.

On an offshore site, each of those is a policy the operator has chosen or not chosen, and can change. The honest conclusion is unexciting: offshore operators can be run well, and some are, but the player's protection rests on the operator's continued goodwill rather than on an obligation with a regulator behind it. That is not a small difference disguised as a moral one. It is the whole difference.

The evidence from disputes, in numbers

ADR providers publish figures, and they are instructive precisely because they are boring.

eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, of which "Deposits & Withdrawals" accounted for 150 valid disputes. Average time to resolve domestic disputes was 31 days. Of completed disputes, 17.8 per cent were ruled in favour of the consumer and 82.2 per cent for the operator. Of 499 invalid disputes, 361 — 72.3 per cent — had not been through the operator's internal complaints procedure first, which is the single most common way a player loses a complaint before it is heard.

IBAS's annual statistical report for 2024-25 records 3,721 domestic disputes, of which 217 were categorised as banking or financial disputes. Average completion time for domestic disputes was 20 days, compared to 19 days in 2023-24. Sixty-five consumer complaints were upheld by written decision, against 693 not upheld and 737 resolved by a consumer-satisfactory pre-ruling outcome. IBAS reports 100 per cent operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25.

Those last two numbers are the ones to hold on to. A tenth of disputes reaching a gambling ADR provider in that period were resolved in the consumer's favour, which means the great majority of complaints are lost on the terms the player accepted at sign-up. And the platform only works because the operator is required to comply. The Commission notes that IBAS and eCOGRA have historically handled the majority of gambling disputes; the government's 2023 review of gambling legislation recommended creating a Gambling Ombudsman with an expanded remit of ADR work, which has not yet arrived.

What a payout actually looks like

Withdrawals are better than their reputation, which is worth saying with the figures attached. Gambling Commission data covering June to September 2024 records 44.2 million withdrawals by customers of large online operators in that period. Of those, 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours and 0.1 per cent took up to 48 hours. Consumer research on trust published in July 2026 found 49 per cent of people who had gambled in the past 12 months agreed that "it is quick and easy to withdraw and collect my winnings", with 33 per cent neutral and 18 per cent disagreeing.

The complaint volume is real but falling. Complaints to the Commission's Contact Centre coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025. The Commission's position on delays is unusually direct: it is not acceptable for operators to introduce friction when a customer tries to withdraw rather than when they deposit, or to place the operator's commercial interests above their customers'; where an operator has no regulatory concerns about a customer, there is no valid reason to delay a payout, and operators should explain any delay or refusal, subject to the statutory prohibition on tipping off in money-laundering cases.

A relevant detail sits alongside that. Where an operator suspects or has knowledge of money laundering or terrorist financing, it must submit a Suspicious Activity Report and obtain a Defence Against Money Laundering from the National Crime Agency before moving or returning customer funds. The Commission accepts that this may necessitate a delay in payouts, but states it does not give operators the right to confiscate customer deposits. That is the boundary: a delay may be lawful, a confiscation is not.

The version of the promise that does not hold

The promise this keyword carries is a comparison, and comparisons cut both ways. GamStop Online reported 614,738 consumers currently on the register as of July 2026, of whom more than one in two had opted for the maximum five-year exclusion; across all age groups only one in four had self-excluded for six months. Under-25s accounted for nearly one in three of all self-exclusions in the first half of 2026, a 26 per cent year-on-year increase, on 117,756 new registrations during 2025 and 561,983 active exclusions at the end of that year.

Registering takes a few minutes and can take up to 24 hours to become effective. And the terms are unromantic: you cannot cancel or deactivate during the exclusion period, and the exclusion stays in place after the chosen period ends unless you contact GamStop to remove it. The refusal to remove registrations early is significant enough that the Group's 2025 annual report devotes a section to it. Under the terms of use you may turn off auto-renewal only during the last six months of a five-year Minimum Exclusion Period, and auto-renewal continues for up to four new five-year periods. If you do not deactivate after your chosen period, GamStop holds your data through a further automatic seven-year self-exclusion period during which operators are told you were previously excluded.

Offshore sites are not a way round that, and the regulator has said so from the other direction. Its industry warning notice of 20 January 2025 concerned casino games supplied by licensed operators appearing on unlicensed websites available to GB consumers, and noted that such sites often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls. Non-participation in the scheme is not a feature of a site; it is the gap the scheme cannot close.

What offshore terms build in, and what they cost

Here is the part the brochures leave out. Delay is not always an accident or a failure of staffing. It is often a term, and the terms are readable in advance.

Three patterns recur. The queue: a rule limiting a customer to one withdrawal at a time, with the next request unavailable until the first is authorised — a term the Commission found unfair under the Consumer Rights Act 2015 in its October 2026 settlement. The review: manual scrutiny of every fifth or tenth withdrawal for selected customers, which leads to extra information being required before the payout is processed; the same settlement covered that. The cap: a maximum on what may be withdrawn from winnings generated with bonus funds, with the excess voided, as in BlueChip's 300 per cent term.

The British regime addresses each, imperfectly but in writing. Reverse withdrawals are banned. LCCP condition 17.1.1 forbids requiring additional information at withdrawal that the operator could reasonably have requested earlier. Licence condition 7.1.1 requires terms to be fair within the meaning of the Consumer Rights Act 2015. Operators may not impose a term setting a maximum limit on what a consumer may withdraw from their deposit balance — the Commission's own example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". The regime sets no fixed maximum number of days for completing a withdrawal, and that is a legitimate criticism; it relies on fairness conditions rather than a stated deadline.

Offshore, the queue, the review and the cap are all available, and none of them breaches anything but the operator's own conscience. A payout that arrives in three weeks on a term nobody read at sign-up is not a malfunction. It is the business model working as drafted.

How the regulator's remit stops at the border

One structural point explains why this topic exists at all, and it is the site angle in a sentence: the Commission's regulatory remit allows it to regulate only gambling websites that trade or advertise to customers in Great Britain, and those must hold a Commission licence. A site that does neither is outside the remit, which is why the Commission's response is disruption rather than supervision — registrar referrals, host referrals, cease and desist notices, search-engine removals, payment referrals and, once, a criminal prosecution.

That is also why the enforcement numbers are so lopsided. In July to September 2026 the team referred 1,835 websites and issued 546 cease and desist notices, while the whole of April 2025 to March 2026 produced one prosecution. Disruption degrades a business; it does not convict anyone. The Commission's own data concedes the limits: GEO IP blocking and registrar blocks work better than search-engine removals, because removing a page from a search engine makes a site harder to find without fully blocking access. Referring payment transaction data to the Visa Operator Scheme is described by the Commission as a critical and still early-stage part of its financial disruption strategy. "Still early-stage" is the honest summary of the whole border.

The Illegal Gambling Taskforce's terms of reference were published by DCMS on 13 May 2026, with three priorities: reducing payments to and from illegal operators, tackling online advertising of illegal gambling, and improving cross-agency enforcement. It runs for 12 months and meets at least twice a year. Whether it moves the numbers is, as of 13.11.2026, an open question, and I would rather say so than pretend the direction is settled.

Help, and the number to keep

The bodies that help with gambling harm in Britain are free, and none of them asks whether the site in question held a licence.

The National Gambling Helpline, operated by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year, and reaches the same service via live chat and WhatsApp. It is not a crisis line — staff cannot transfer callers at immediate risk of harm and follow their own safeguarding procedures — so anyone in immediate danger needs emergency services, not the helpline. BeGambleAware, the public-facing brand of the charity GambleAware, directs people to the same number or its online chat.

Beyond the helpline: GamFam, a registered charity (No. 1191139) set up by people affected by the gambling of family and friends, runs GRA5P, a five-stage peer-support programme with meetings held remotely via Zoom and usually six to ten members per group. Gamblers Anonymous England, Wales & Ulster can be reached on 0330 094 0322, with around 250 meeting locations and no appointment needed. Gam-Anon UK & Ireland supports family and friends regardless of whether the gambler attends GA. The NHS National Gambling Clinic at 69 Warwick Road, London SW5 9HB, telephone 020 7381 7722, accepts self-referrals and professional referrals for young people aged 13 to 18 anywhere in England and for adults 18 or over in Greater London and the South East. Citizens Advice Scotland runs a gambling support advice line on 0800 328 1131, Monday to Friday, 10am to 3pm.

The money behind treatment changed in 2025 and is worth understanding, because it explains why this provision is not going anywhere. The statutory gambling levy commenced on 6 April 2025, replacing voluntary contributions, and charges 1.1 per cent of previous-year gross gambling yield from all online operators. In its first year it raised just under £120 million, ringfenced solely for research, prevention and treatment, split 50 per cent treatment, 20 per cent research and 30 per cent prevention. From 1 April 2026 NHS England took commissioning responsibility for gambling-harm treatment in England, funded by approximately £100 million a year. An operator outside the British system pays none of that. Which is a fact about funding, not a moral about players — but it is the same border running through everything on this page.

The help line, once more

It is worth repeating because it is the one number on this page that anyone may need: the National Gambling Helpline, operated by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year, with the same service reachable by live chat and WhatsApp, and 0808 2819 265 for callers in Wales.

What the board looks like after all that

Read the terms, not the slogan. The Commission has taken disruption action against 3,140 operators and domains since April 2024, referred 447,778 URLs and secured 287,961 removals, and prosecuted once in a year. That ratio is the story of this market: an offshore site can be knocked down at the registrar and be back under a new domain before the paperwork is filed, which is why the burden of judgement sits with the player rather than with a regulator who cannot reach the operator. The sites are not evil and they are not safe; they are unaccountable, and unaccountable is a word with a price attached.

If the offer is better offshore, ask what you are being paid for. Then check the seal, the funds statement, the cashout cap and the ADR provider — four things that take ten minutes and answer most of the question. And on the prevention side, one further piece of arithmetic deserves the last word: in 2019, 97 per cent of UK gambling happened legally. By 2025, on H2 Gambling Capital's estimate, that figure was 92 per cent — a five-point shift in six years, which is what happens when the border is easy to walk around.