Gambling Sites UK And The Limits Of Regulatory Reach

Gambling sites UK players can use lawfully are those holding a Gambling Commission licence; offshore operators taking British customers without one act illegally under section 33 of the Gambling Act 2005. The regulator disrupts them through cease and desist notices, registrar and host referrals, search-engine removals and payment referrals — not prosecutions.

Britain has two gambling markets and only one of them answers to anybody. The licensed market turned over £17.5 billion in gross gambling yield in the year to March 2026, up 4.4 per cent, and every operator inside it carries a Gambling Commission licence, a levy invoice and a compliance file. The other market is the subject of this column. Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Google and Bing URLs and secured 287,961 removals. I have read enough enforcement reports to find that impressive and insufficient at the same time. Cease and desist notices are letters. Some of the letters arrive at an address that stopped existing years ago.

What follows is how the licensed market sets the standard, where offshore operators sit against it, what the Commission genuinely achieves, and how anyone judging a site — licensed or not — can tell a real operation from a rented certificate.

What A British Licence Actually Buys

An operator here needs either a Commission licence or a good lawyer. Section 33 of the Gambling Act 2005 makes it an offence to provide gambling facilities without an operating licence, punishable on summary conviction by up to 51 weeks' imprisonment, a fine at level 5, or both; it applies whether the facilities are remote or not, and whether they are provided inside or outside Great Britain. The Commission's position, stated plainly in October 2024, is that holding a licence in another jurisdiction makes no difference.

The licence conditions are where the standard lives. Licence condition 17 requires identity verification before a customer is allowed to gamble, not when they try to leave with money. Safety net rules cap wagering requirements on bonus funds at ten times and ban promotions mixing product types — the deadline was moved from 19 December 2025 to 19 January 2026, and offshore terms of 25× to 50× are perfectly lawful outside it. Reverse withdrawals, the button that let a player cancel a payout and stake it again, were banned for all remote operators under RTS requirement 14B, in force since 31 October 2021.

Self-exclusion is the clearest dividing line. Since 31 March 2020 all online operators must be part of GAMSTOP as a licence condition, sitting in social responsibility code provision 3.5.5. The scheme's name is often typed "gamestop", which is a slip and not a different scheme. A GAMSTOP exclusion holds for its full term — six months, one year, five years or five years with auto-renewal — and then remains in place until the person contacts GamStop to remove it. An offshore site is not a way round it. Two operators lost their licences in April 2020 for missing the integration deadline, which tells you how seriously the Commission treats the scheme and how rarely it uses that particular hammer.

Where The Regulator's Reach Stops

Here is the sentence the trade pages bury. Offshore sites that hold no Commission licence are not connected to GamStop, and UK protections do not apply: no UK complaints route, no statutory levy, no ten-times wagering cap, no requirement to keep customer funds separate, and no Financial Risk Assessment regime. This is stated by trade and press sources rather than a Commission page, but it is consistent with the scheme's own terms of use [unconfirmed].

In early plain language: if such an operator refuses to pay, the Gambling Commission is a regulator, not an ombudsman. It cannot resolve individual complaints and cannot recover anyone's money. The Alternative Dispute Resolution providers it approves — IBAS, eCOGRA, CEDR, ADR Group, ProMediate and others — take disputes about licensed operators. There is no equivalent queue to join when the operator's licence came from a Caribbean regulator with four staff.

Where to get help is not a footnote. The National Gambling Helpline, run by GamCare, is free on 0808 8020 133, twenty-four hours, every day of the year; callers in Wales are given 0808 2819 265. Citizens Advice offers free, confidential help with debt anywhere in England, and Citizens Advice Scotland runs a gambling support line on 0800 328 1131 on weekdays between 10am and 3pm.

What The Numbers Say About Disruption

The Commission publishes its own scorecard, and it is more honest than most regulators'. Across 160 illegal gambling websites where traffic data existed, engagement fell by an average of 32 per cent after disruption activity. That average hides the useful part: registrar blocks and website suspensions produced an average fall of 91 per cent each, GEO IP blocking 60 per cent, Bing removal 52 per cent, Google removal 30 per cent and Facebook removal 8 per cent. A search-engine removal makes a site harder to find; it does not stop anyone who already has the address.

The pace has increased sharply. In the quarter to March 2026 the team referred 226 websites to search engines and issued 98 cease and desist notices. In July to September 2026 it referred 1,835 websites — 7,677,211 URLs — and issued 546 cease and desist notices. Over April 2025 to March 2026 it commenced one prosecution.

The market itself is not shrinking. Just over 1,000 unique illegal gambling websites were accessed by consumers in Great Britain over May 2024 to July 2025, and the Commission identified 586 accessible to British consumers in September 2026. H2 Gambling Capital estimates £16.6 billion was staked with illegal operators in the UK in 2025, up from around £5 billion in 2019, with the lawful share falling from 97 per cent to 92 per cent. A September 2024 study by Frontier Economics for the Betting and Gaming Council put the online black market at £2.7 billion annually and 1.5 million Britons. Industry-commissioned figures should be read with the usual scepticism — the number suits whoever paid for it — but three independent houses pointing in one direction is worth more than any one of them alone. The Commission also warns that such sites often target people who have self-excluded through GAMSTOP, which is the ugliest fact in this column.

How Offshore Operators Differ, By Licence Type

A licence is not a badge; it is a jurisdiction's legal regime, with fees, supervisory capacity and a complaints ladder attached. The table below compares the regimes British players most often encounter, by the things that matter to a payout.

Two things are worth noticing. The first is that Curaçao's total annual cost is nearly double Malta's licence fee despite Malta also charging 5 per cent of gaming revenue — and Curaçao's supervisory budget is newer, thinner and, on the evidence of its own portal, still being rebuilt. The second is Costa Rica, where there is no comprehensive licensing regime at all. The "data processing license" sometimes mentioned in industry copy is not a licence in any legal sense, and a bill that would have created a mandatory regime was rejected by the Legislative Assembly in early 2026.

Curaçao itself has changed underfoot. The National Ordinance on Games of Chance took effect on 24 December 2024 and replaced the old master-licence and sub-licence model with direct licensing by the Curaçao Gaming Authority. The legacy orange certificates ended on 15 October 2025, and the four former master licensors stopped issuing on dates running from August 2024 to 31 January 2025. An operator still displaying a /JAZ number has a document that proves nothing about its status today.

The Certificate Check That Takes Two Minutes

For odd some reason the thing most players never do is the thing that settles the question outright. Identity checks are where offshore sites differ most in practice — that is the section that follows this one — but the licence check comes first, and it is quicker.

Click the seal. On a Curaçao-licensed site the Certificate of Operation Seal must redirect to the CGA's certificate address, and it is issued only for an approved, registered player-facing domain. If the seal differs in design, colour or format, the site is not authorised by the CGA. If the certificate behind the seal names a different domain from the one being viewed, the seal belongs to another operator and the site should be treated as unauthorised or fraudulent. A Curaçao licence certificate is not interchangeable with a certificate of operation, and the authority has said its previous portal is not returning to service, so it is building an alternative way to verify licensed domains.

For a British licence the check is different and easier: the Commission advises clicking through to its public register and confirming that both the activities and the domain names match. A licence held by a company whose registered domains do not include the site in front of you is a licence for something else.

Kahnawà:ke runs a similar arrangement — its logo certificate programme, effective 15 January 2010, generates a Certificate of Good Standing showing whether the site holds a valid permit. Anjouan certificates carry a unique licence number and a QR code linking to a public register, and the authority has stated that certificates which cannot be verified through that register should not be relied on as evidence of licensing.

How Identity Checks Actually Work

The single thing this topic turns on is verification, because it is the mechanism that decides whether money leaves. Licence condition 17 requires a British operator to obtain and verify a customer's identity — name, address, date of birth — before that customer is permitted to gamble, not at the point of withdrawal. Licence condition 17.1.1 adds the rule that has caused the most trouble in the industry: a withdrawal request must not trigger a demand for information the licensee could reasonably have asked for earlier.

That is not the same as saying documents can never be requested. Anti-money-laundering duties sit under the Money Laundering Regulations 2017, and for remote casinos identification and verification are required when deposits or withdrawals reach €2,000 — a threshold that applies to a single transaction or to linked ones, including activity within a single logged-on period. Source of funds, and for higher-risk accounts source of wealth, are separate questions again. The Commission expects identity and age checks to be brought forward to before a deposit or stake, and has said that onboarding on initials, nicknames or a commercial address is not sufficient.

First time, then later. A new customer at a competent licensed operator is usually checked in seconds, by matching the details supplied against credit reference agency and electoral roll data, with no document in sight. A new customer at a site that defers everything until payout day meets the other version: an email asking for a passport, a utility bill and a bank statement, on the morning they wanted their money. That contrast is the whole story of verification. The Commission reports that over a quarter of complaints reaching its Contact Centre concern identity verification, raised when documents are demanded only on withdrawal, and that verification and withdrawals are among the most common dispute types going to ADR providers.

Warning signs in this area are specific. Fuzzy matching against third-party databases, onboarding a customer on partial or equivocal verification, and accounts opened with a middle name where a forename belongs — a mismatch that also defeats self-exclusion, because the name may not match the one held by GAMSTOP. The Commission's 2026 risk assessment reports rising use of false documents, deepfake videos and AI face swaps to get past due diligence, and describes customers depositing around £40,000 over six months through accounts created with five different people's details. Identity checks are not there to inconvenience honest players. They are there because the queue outside includes people who are not honest players.

Five Signs An Operator Can Be Trusted

Every sign below is checkable from a desk, in minutes, without depositing anything.

The licence is verifiable on the regulator's own register

Check the operator's name on the Commission's public register and confirm the domain in front of you is listed. For an offshore licence, click the seal and see where it lands; a seal that does not redirect to the authority's certificate page, or a certificate naming another domain, is a fail. A licence graphic that is simply an image file is decoration.

Identity checks happen before the first deposit

The genuine article tells a new customer what documents may be needed, in what circumstances and in what form, before they deposit. Verification that arrives only when a withdrawal is requested is the pattern the regulator is explicitly trying to stamp out, and it is worth walking away from before any money moves.

Withdrawal terms contain no ceiling and no queue

The Commission's guidance prohibits terms imposing a maximum limit on what a consumer may withdraw from their deposit balance; its published example of a forbidden term is a £50 daily and £500 weekly cap. Unfair terms in this area get enforced — the Commission announced on 21 October 2026 that one licensee would pay £900,000 in a regulatory settlement over failures including unnecessarily delaying withdrawals, one of them a term allowing only one withdrawal request at a time.

Bonus terms fit on one screen

Since 19 January 2026, licensed operators cannot set wagering requirements above ten times on bonus funds, and cannot mix product types within a single incentive. The Commission said the cap "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". If the welcome offer's small print runs to several pages, try the arithmetic instead: a 40× requirement on a £100 bonus is £4,000 of play before a penny is withdrawable.

There is a named dispute route you can actually use

A licensed operator must let a customer refer an unresolved dispute to an approved ADR provider free of charge after eight weeks. The providers publish their own numbers, which is a useful measure of whether a route works: eCOGRA received 911 disputes in the year to 30 September 2025, of which 150 valid ones concerned deposits and withdrawals, and IBAS handled 3,721 domestic disputes in 2024-25 at an average completion time of 20 days, with 100 per cent operator compliance with decisions in the consumer's favour. Compliance figures published by the body deciding the cases deserve a raised eyebrow, but the mechanism is real. With an offshore operator, the equivalent is usually an email address.

How To Assess A Site Before Depositing

1. Check the licence on the regulator's register. Find the operator's legal name and confirm the domain you are looking at is listed against it. The Commission's own advice is to click through and check that activities and domain names match; that check has caught more problems than any review ever written.
2. Read the withdrawal section of the terms before the bonus section. Look for a stated processing period, any maximum withdrawal limit on the deposit balance, a fee above the direct cost of processing, and any language about manual review of a proportion of withdrawals. The Commission's 2023 blog noted that some of the largest firms processed around 99 per cent of withdrawals within 24 to 48 hours, so a long silence is a choice rather than a technical limit.
3. Decide what the bonus actually costs. Work out the wagering requirement as a cash figure, check which games contribute and at what percentage, and look for the maximum bet allowed while wagering. Offshore charts routinely weight slots at 100 per cent while roulette contributes 5 per cent and live dealer games nothing, so a requirement that looks passable on slots becomes unreachable on the games a player actually enjoys.
4. Settle the self-exclusion question honestly. Registering with GAMSTOP Online blocks all operators licensed in Great Britain for six months, one year, five years or five years with auto-renewal, takes a few minutes to set up and up to 24 hours to take effect. It cannot be cancelled during the term, and it stays in place after the term ends unless the person contacts GamStop to remove it. Kahnawà:ke goes further, treating its voluntary self-exclusion as permanent and irrevocable — and a player who breaches it forfeits deposited and won funds to a charity chosen by the Commission.
5. Decide how payments will be funded. Credit cards have been banned for gambling since 14 April 2020, and operators must also ensure money arriving from an e-wallet was not loaded from a credit card. Where a card is used, it is a debit card, and the bank's own gambling block — offered by Bank of Scotland, Barclays, Halifax, HSBC, Lloyds, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling — declines merchant-category gambling payments at card level and must be activated on each card.
6. Set the limit at the start. Since 31 October 2025 every gambling business must prompt a customer to set a financial limit before the first deposit, present that as the default option, and remind customers every six months to review their account and transaction information. A limit set in the first five minutes is worth ten set in the last five.

The Rules That Changed Recently

Three changes matter more than the rest. Online slots carry a £5 maximum stake per game cycle for all adults, live since 9 April 2025, and £2 for adults aged 18 to 24 since 21 May 2025 — they apply to slots only and not to roulette or blackjack. Financial vulnerability checks became a licensing requirement in August 2024 at £500 of net deposits over a rolling 30 days, and the threshold fell to £150 from 28 February 2025. Financial Risk Assessments are coming in stages, starting with the largest operators at £5,000 net deposits in a rolling 24-hour period for customers aged 25 and over and £2,500 for under-25s; at the final stage they apply at £1,000 in 24 hours or £3,000 over 90 days for over-25s. The Commission has said no enforcement action will follow a failure to act on an FRA during the early stages, which is a sentence to remember when a site's terms do not match the rulebook.

Deposit and stake limits, in contrast, were once the offshore selling point and have quietly become a British one. A licensed operator must offer limits through a free-text box at account level, must not confiscate an unstaked deposit, must not confiscate a balance because identity verification failed, and must not let account inactivity be used as a reason to deduct from it. Those are not marketing claims; they are conditions, and breaching them is a route to a regulatory settlement.

2026 In One Paragraph

The pattern of the last two years is a regulator getting faster at disruption and no better at prosecution: hundreds of cease and desist notices each quarter, thousands of URLs referred, one prosecution commenced in a year. It is worth saying plainly what that means for anyone assessing a site. Processing and withdrawal rules changed on 29 July 2026, the bonus cap and mixed-product ban took effect on 19 January 2026, the statutory levy has been running since 6 April 2025 and raised just under £120 million in its first year, ringfenced for research, prevention and treatment. None of it reaches an operator with no licence.

The Regulator's Own Numbers, And What They Miss

H2's estimate of £16.6 billion staked with illegal operators in 2025 is the number that ought to end the debate about whether this matters, and it will not, because the same report notes a problem nobody can fix with a letter. The Commission's methodology combines web-traffic data with a licensed-play assumption of £0.32 of gross gambling yield per minute for online slots, and states explicitly that it does not capture activity hidden behind VPNs. Every estimate in this area, mine included, is a floor.

Questions I Get Asked

How many licensed gambling sites are there in the UK?

The Commission does not publish a tidy count of websites, and it would be a poor measure anyway — one licence often covers several domains. The useful figure is market size: total British gross gambling yield was £17.5 billion in the year to March 2026, of which remote casino, betting and bingo accounted for £8.3 billion. If a claim about numbers starts with "hundreds of sites", it is counting domains, not licences.

Are new gambling sites safer than established ones?

Newer is neither safer nor riskier, but it is harder to check, because there is no complaints history to read. Take a new site through the same five checks as any other: register listing, identity timing, withdrawal terms, bonus arithmetic and a named ADR provider. The main difference is bonus tolerance. A new operator buying market share may accept a larger bonus or a looser wagering requirement than it will offer in two years' time.

Can credit cards be used on gambling sites?

Not on any remote gambling licensed by the Commission, since 14 April 2020, when licence condition 6.1.2 came into force. It covers online betting, casino and bingo and lotteries taking online or telephone payments, and operators must also check that money coming from an e-wallet was not loaded from a credit card. The exception is a non-remote lottery operating licence: credit cards can still buy tickets and scratchcards in a shop or by post.

What happens if an offshore site refuses to pay?

Almost nothing, in regulatory terms. The Commission cannot resolve individual complaints or recover money, because it is a regulator rather than an ombudsman, and the ADR providers it approves take disputes about licensed operators. Payment referrals to Visa are a disruption tool, and the Commission has made four of them since January 2025, but they act on the market rather than on one player's balance. The realistic routes are the operator's own complaints process and ordinary consumer law.

Does self-exclusion stop offshore sites taking bets?

It does not, and this is the part that gets misrepresented. GAMSTOP Online binds operators licensed in Great Britain, because participation is a licence condition under social responsibility code 3.5.5. An operator with no Commission licence is not part of the scheme and is not covered by it [unconfirmed]. That is why the Commission issued an industry warning notice in January 2025 noting that unlicensed sites often target customers who have self-excluded, with weak social responsibility and anti-money-laundering controls.

How quickly should a withdrawal arrive?

Mostly instantly, on the Commission's own figures: of 44.2 million withdrawals by customers of large online operators between June and September 2024, 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent within 48 hours. Consumer research published in July 2026 found 49 per cent of people who had gambled in the past year agreed that withdrawing was quick and easy, which leaves half who did not. There is no fixed maximum number of days in the LCCP.

Paying Attention To The Boring Bits

The American satirist Ambrose Bierce defined patience as a minor form of despair disguised as a virtue; reading a gambling site's withdrawal terms requires a good deal of both. The evidence runs one way. Where the Commission can act — register listings, identity timing, fair terms, ten-times wagering, the ban on reverse withdrawals that came in on 31 October 2021 — the standard has risen, and 96.3 per cent of 44.2 million withdrawals clearing automatically is what a working rulebook looks like. Where it cannot act, the market has grown: from around £5 billion staked illegally in 2019 to an estimated £16.6 billion in 2025. The traders who treat GAMSTOP and the rest as paperwork to be routed around are being honest about their priorities, which is more than can be said for their seals.

If any of this stops being an interesting market to read about, the National Gambling Helpline is on 0808 8020 133, free, twenty-four hours a day, and GamCare runs it.