Slots Without GamStop and the Sites the Regulator Keeps Chasing

Slots without GamStop means playing slot games at an operator that holds no Gambling Commission licence, so it sits outside the national self-exclusion scheme. Such sites are not licensed in Great Britain, no UK consumer protection applies to them, and the Commission treats them as illegal operators rather than as an alternative market.

There is a particular sentence that turns up in almost every article written about slots without GamStop, and it is usually true: the scheme cannot stop anyone playing at a company that never joined it. What the sentence leaves out is the half that matters. Somebody is chasing those companies. Since April 2024 the Gambling Commission's Illegal Markets team has issued 3,140 cease and desist notices and disruption notices, referred 447,778 Bing and Google URLs and secured 287,961 removals. That is not a tidy filing cabinet; it is a running fight conducted largely through registrars, hosts and search engines, and it is the reason the offshore market looks like a game of musical chairs rather than a stable shopping street.

I have watched the offshore sector long enough to be sceptical of both sides of the argument. The trade bodies produce black-market figures that grow every year and always flatter their members. The Commission produces enforcement totals that grow every year and always flatter the Commission. Neither tells you what happens on the screen when a withdrawal is pending, which is the only moment a player really learns what kind of firm he is dealing with.

This article covers the ground properly: the licence question, the seal question, the terms that quietly build in delay, and the five checks that separate a disciplined operator from a rented template. Where support is needed, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day. Where money has already gone wrong, the Commission is a regulator and not an ombudsman — it cannot get anyone's funds back.

One factual note before the mechanics: the scheme is often typed "gamestop", a slip the word "game" invites, and GamStop is the correct spelling of the name.

What "Without GamStop" Actually Describes

Slot sites without GamStop fall into two groups, and only one of them is illegal.

The first group holds a Gambling Commission operating licence and is required to participate in the national multi-operator self-exclusion scheme by Social Responsibility Code provision 3.5.5 of the Licence Conditions and Codes of Practice. Operators were told in January 2020 to integrate by 31 March 2020, and the Commission enforced it: in April 2020 it suspended the licences of two online operators for missing that deadline under section 118(2) of the Gambling Act 2005. A licensed operator cannot opt out of the scheme, and its customer database is checked against the register at least every 24 hours.

The second group holds no Commission licence at all. It may hold something else — a Curaçao licence, an Anjouan licence, a Kahnawake Client Provider Authorization — or it may hold nothing worth the paper. Providing facilities for gambling in Great Britain without an operating licence is an offence under section 33 of the Gambling Act 2005, and the section applies even when the person providing the facilities is abroad, provided the equipment or the knowledge of British use is there. The Commission has said plainly that operating in Great Britain on the strength of a foreign licence is not a defence.

The practical difference is less about honesty than about leverage. A British licence can be taken away, and that is the only reason some firms behave. An offshore licence can be replaced in a fortnight, and every enforcement statistic in this article is a record of exactly that being done.

Online Slots Without GamStop and the Regulator's Arithmetic

The Commission's own quarterly numbers are the best available measure of how the offshore slot market actually moves. The table below sets out the disruption activity by quarter, using the Commission's published figures.

*The October to December 2024 figure of 83 is recorded in the Commission's ceaseless-notices series; the count of websites referred to search engines for that quarter is not separately published.

Four points stand out. Referrals to search engines roughly trebled between the end of 2024 and the spring of 2025. Cease and desist notices rose from 83 to 145 over the same span. The rise is not only enforcement appetite — it is the growth of the offshore slot market itself, and the Commission's dashboard put 586 illegal gambling websites accessible to British consumers in September 2026, 4 per cent more than a year earlier.

And the disruption that works best is not the disruption that gets the headlines. Registrar blocks and website suspensions produced an average 91 per cent fall in engagement; GEO IP blocking produced 60 per cent; removing a site from Google produced 30 per cent; removing it from Facebook produced 8 per cent. The Commission says so itself. A search-engine removal makes a site harder to find and does not stop direct access, which is the reason the same domains reappear under fresh seals.

The prosecution record is the part rarely quoted. Across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced — a total of one, in the quarter October to December 2025.

Where Slots Without GamStop UK Sites Are Licensed

An operator serving British players without a Commission licence is normally sitting under one of a handful of regimes. They are not equivalent, and the differences are the sort that matter when a dispute arises.

Curaçao

Curaçao rebuilt its system under the National Ordinance on Games of Chance (LOK), in force from 24 December 2024. Direct licensing and supervision passed to the Curaçao Gaming Authority, the old private master licensors lost the right to issue new licences, and the legacy "orange" sub-licence certificates ended on 15 October 2025. A historic /JAZ number must not be treated as proof of a current licence.

The numbers are modest by British standards. A B2C application costs a one-time non-refundable EUR 4,592, and the total annual B2C fee is EUR 47,450, payable in full by 15 January. An independent reading of the CGA's public register recorded 704 Curaçao licences held by 698 operators, of which 552 were active, in November 2026 — a third-party read of a public register rather than a CGA publication, so treat it as an indication rather than an audit.

The regulator's own verification tools are in flux. The CGA announced on 7 October 2026 that its previous online portal would not return to service, while stressing that existing licences and operator obligations were unaffected. A Certificate of Operation Seal must redirect to cert.cga.cw, and if the certificate behind the seal names a different domain from the site being viewed, the seal belongs to somebody else.

Anjouan

Anjouan, part of the Union of the Comoros, licenses through the Anjouan Gaming Authority with the Anjouan Offshore Financial Authority named as the competent regulator. The published fee schedule is EUR 17,828 for B2C issuance and the same for annual renewal, with EUR 500 per additional domain. The authority states there are no territorial restrictions under Anjouan law but that licensees must comply with the law of every jurisdiction they serve, and it said in June 2026 that its licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world".

That last remark is worth holding up against the claims made on some operator sites. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, and that Comorian financial intelligence officials described Anjouan Corporate Services as operating illegally. The Commission itself has never accepted an Anjouan licence as authorisation for British-facing gambling.

Malta

The Malta Gaming Authority is the most substantial of the offshore regulators, which is precisely why it is not really an offshore haven in the usual sense. A B2C licence costs a one-time EUR 5,000 application fee plus a fixed annual licence fee of EUR 25,000, and carries a 5 per cent gaming tax on revenue. Minimum paid-up share capital is EUR 100,000 for Type 1 and Type 2 B2C licences.

An MGA licence is not a British licence. It does not connect an operator to GamStop, it does not put the Commission's fair-terms conditions into the contract, and it does not give a British player access to a British dispute route. The MGA does maintain its own list of Unauthorised URLs, with entries carrying notice dates of 30 October 2026, and it declares that any reference to a Maltese licence on those domains is false and misleading. That is a useful reminder that the fake version of a licence always arrives before the real one.

Costa Rica

Costa Rica operates no comprehensive gambling licensing regime. The "data processing licence" that circulates in the industry is not a licence in the strict legal sense, the Legislative Assembly rejected Bill No. 25,057 in early 2026, and games of chance are generally prohibited under Costa Rican law. A site displaying Costa Rican paperwork is displaying nothing.

Kahnawà:ke

The Kahnawà:ke Gaming Commission has regulated interactive gaming since 1999 and issues an Interactive Gaming Licence held by one entity at a time, plus Client Provider Authorizations. Its Logo Certificate Program, effective 15 January 2010, lets a visitor click the Commission's logo to generate a Certificate of Good Standing. Fees rise on 1 January 2027: the CPA application fee from USD 35,000 to USD 40,000, and the five-year renewal from USD 5,000 plus the annual fee to USD 40,000 including it. The annual CPA fee stays at USD 20,000.

The same operator, two seals

The pattern worth noticing is not which regulator is best. It is that a single operator often moves between regimes without changing its game library or its bonus text. When the seal changes and the terms do not, the terms were never the point.

The Identity Checks That Turn Everything On

The single mechanism that decides whether a slot withdrawal arrives this week or next is identity verification, and offshore sites run it differently enough that the difference is the whole story.

Under Commission rules the position is controlled. Licence Condition 17 requires a licensee to obtain and verify information establishing a customer's identity before that customer is permitted to gamble, and the information must include name, address and date of birth. For anti-money-laundering purposes, remote casinos must identify and verify when a customer deposits or withdraws €2,000 or more, whether in a single transaction or in linked transactions forming part of one logged-on session. Many British operators verify electronically against credit reference agencies and the electoral roll at registration, in which case no document is ever requested.

The first time on a well-run British site, verification happens at sign-up or before the first deposit. Licence Condition 17.1.1 forbids a licensee from making a withdrawal the trigger for information it could reasonably have asked for earlier, and the Commission treats a withdrawal-stage document request as a potential breach. Later, verification becomes maintenance: details are refreshed when circumstances change, and the licensee must take reasonable steps to keep what it holds accurate.

Offshore, the sequence is often inverted. The account opens with an email address, deposits run for weeks without friction, and the document request arrives the moment a withdrawal is submitted. That is not an accident of staffing. A firm that cannot be sanctioned by the Commission has no reason to bear the cost of early verification, and holding a balance while documents are "reviewed" is free working capital.

The warning signs are consistent. A request for documents that arrives only after a win. A request for a document type no reasonable check requires — the Commission says a business may ask for a selfie where it suspects fraudulent activity, not as a standard gate. A verification process with no stated timescale; the Commission itself says it cannot give one, because the process varies. And, most tellingly, a term permitting the operator to confiscate a deposit balance because verification was not completed. Commission guidance states that un-staked deposits remain the customer's and that a licensee may not confiscate or deduct any part of a deposit balance on that basis, and the Competition and Markets Authority's undertakings — obtained from six operators when its investigation closed on 29 April 2019 — included a commitment not to remove a player's money for failure to meet identity requirements.

Over a quarter of the complaints reaching the Commission's Contact Centre concern identity verification, and the Commission has warned that "fuzzy matching" through third-party verification providers and onboarding on partial data undermines everything downstream, including self-exclusion matching. Its August 2026 blog gave the example of a customer onboarded with a middle name rather than a forename, creating a mismatch with records held elsewhere.

There is a support point that belongs here rather than in a footnote. GamStop registration holds for the full chosen term — 6 months, 1 year, 5 years, or 5 years with auto-renewal — cannot be cancelled during that term, and stays in place after it ends until the person contacts GamStop to remove it. An offshore site is not a way round that arrangement, and any operator marketing itself as one is advertising a breach of the exclusion rather than a service. The Commission issued an industry warning notice on 20 January 2025 about precisely this, noting that unlicensed sites often target self-excluded customers and may have inadequate social responsibility and anti-money-laundering controls.

Five Signs an Offshore Slot Operator Can Be Trusted

Trust, offshore, is not a feeling. It is a set of documents that either exist or do not.

The licence is verifiable on the regulator's own register

A real regulator publishes a register and a way to check a seal against it. The CGA requires a Certificate of Operation Seal to redirect to cert.cga.cw, and says a seal that differs in design, colour or format means the website is not authorised. Anjouan's certificates carry a unique licence number and a QR code linking to a public register, and its own framework states that certificates which cannot be verified there should not be relied upon. Kahnawà:ke's logo program generates a Certificate of Good Standing on the click.

The quick check: find the licence number on the site, then find the same number on the regulator's register, and confirm the domain on the certificate matches the domain in the address bar. If the seal is an image that does nothing when clicked, stop there. A mismatched domain on a valid certificate means the site is displaying another operator's licence.

The terms state who holds customer money and how it is protected

Commission-licensed operators must choose one of three customer-funds protection ratings — "not protected", "medium protection" or "high protection" — disclose which applies, and remind customers every six months if funds are not protected. The Commission also warns that keeping customer funds in a separate client account does not mean customers get their money back if the operator becomes insolvent, and that businesses may legally hold that money in overseas bank accounts. Money staked in an open bet falls outside customer-funds protection altogether.

The quick check: read the banking or security section of the terms and look for the protection rating. If the section names the regulator but not the rating, or if the sentence is written so vaguely that no rating could be read out of it, the money is unrated in practice.

Withdrawal limits and fees are stated, not discovered

Commission guidance prohibits any term imposing a maximum limit on the amount a consumer may withdraw from their deposit balance, and gives "You may withdraw up to £50 per day and up to £500 per week" as its example of a prohibited term. Cost-reflective processing fees and reasonable limits on the size or number of separate withdrawals are permitted, but must be clear before a deposit is made. In October 2026 the Commission announced a £900,000 regulatory settlement with one operator, which runs seven websites, for failures including a term allowing customers to request only one withdrawal at a time and manual review of every fifth or tenth withdrawal that led to extra information being required.

The quick check: search the terms for "per day", "per week", "maximum withdrawal" and "processing fee", and count how many you find. Each one narrows the gap between the balance on screen and money in a bank account.

The bonus wording survives being read twice

From 19 January 2026, Commission licensees may not apply wagering requirements above ten times, and may not mix more than one type of gambling product within an incentive. The Commission's stated reason for the cap was that its limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". Offshore, the older arithmetic is intact: welcome-bonus multipliers typically run at 35x to 50x under a 2026 casino-guide comparison, and some operators publish higher figures alongside maximum cashout clauses — one, for example, reserves the right to limit withdrawals from bonus-generated winnings to 300 per cent of the credited bonus amount and void the excess. The contribution charts are the detail that ruins the arithmetic: a chart giving roulette 5 per cent and live dealer games 0 per cent turns a 35x requirement into something far longer.

The quick check: find the contribution table and the maximum bet while wagering. A term capping bets at a low fixed amount while wagering, or a clause reserving the operator's right at its own discretion to void winnings, is the standard-issue escape hatch — the Commission fined one licensee £170,000 in July 2025 over a bonus term letting it close accounts or forfeit winnings at its own discretion.

Disputes go to a named independent adjudicator

Anjouan requires licensees to designate an approved alternative dispute resolution provider and publish its name and contact details, listing EGIS ADR, Axion ADR, iGaming ADR and an ADR provider as current choices, with complaints to be resolved within 30 days before escalation. Kahnawà:ke employs a full-time Dispute Resolution Officer. The Commission's approved British list runs to eight providers, including IBAS and eCOGRA, and its ADR guidance says a consumer should use the operator's own complaints process first and that the whole internal process should be completed within eight weeks.

The quick check: look for the ADR provider's name in the terms, then search for that provider. If the only route offered is a support email address, the dispute has no destination.

What a Careful Player Checks First

Six steps, none of which involves testing anything or spending anything. They are all reading.

1. Confirm who licenses the site and find it on that regulator's register. The relevant section of the terms will name a jurisdiction. Go to that regulator's public list and check the licence number and the domain, not just the logo. Reason: the licence is the only piece of leverage anyone outside the operator holds over it.
2. Read the withdrawal section before the bonus section. Look for maximum withdrawal amounts, per-day or per-week limits, processing fees and any clause about manual review. Reason: the withdrawal clauses are where an offshore contract states its real price, and they are usually buried one click behind the offer.
3. Read the bonus terms twice, once for the wagering multiple and once for the contribution chart. Note the multiple, the game weights, the maximum bet while wagering and any maximum cashout. Reason: game weighting decides more than the multiple does, and both are usually presented separately.
4. Check the customer-funds disclosure for a protection rating. If the terms do not say whether funds are protected on insolvency, treat the money as unprotected. Reason: an unstated rating is not a neutral one.
5. Find the named ADR provider and confirm the operator's complaints window. The terms should say how long a complaint may be raised and how long internal resolution may take. Reason: a dispute route with no clock is not a route.
6. Set account limits and financial limits in the account settings before the first deposit, and keep the exclusion tools in mind. Commission rules require a financial limit prompt before a first deposit, a limit review reminder every six months, and a free-text limit option at account level; offshore sites vary wildly here, which is itself the information. Reason: a limit set at the start is a decision; a limit set in the middle of a session is a negotiation.

If any of the six cannot be completed from the site's own published documents, the answer is the site, not the reader. There are British-licensed operators whose terms survive all six checks without a footnote.

Payouts, Delays and the Terms That Build Them In

The withdrawal question is where offshore terms earn their reputation. The Commission's fair-terms position is explicit: it is not acceptable for operators to introduce friction when a customer tries to withdraw rather than when they deposit, and where there are no regulatory concerns there is no valid reason to delay a payout. It banned reverse withdrawals outright — requirement RTS 14B, in force from 31 October 2021, states that consumers must not be given the option to cancel their withdrawal request — and it regards the practice as a risk to engaged and vulnerable gamblers.

The British record is not flawless. The Commission's own data for June to September 2024 records 44.2 million withdrawals by customers of large online operators, of which 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent up to 48 hours. Consumer research published in July 2026 found 49 per cent of people who had gambled in the past 12 months agreed that it is quick and easy to withdraw winnings, against 18 per cent who disagreed. Complaints coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025. Progress, and still the number one subject of complaints.

The delay mechanisms offshore are structural rather than accidental. A single-withdrawal-at-a-time clause makes each request sequential, so a player waiting on one payout cannot start another. A manual review at every fifth or tenth withdrawal converts an automated process into a queue. A maximum cashout clause converts a win into a formula. A maximum bet while wagering clause — €5 or $5 for regular players under one operator's published terms — gives the firm a reason to void winnings if a stray larger bet slips through. None of these is illegal in a jurisdiction that has not banned them. All of them are visible in the terms before a deposit is made.

There is one genuine delay that deserves the benefit of the doubt, and it is narrow. Where an operator suspects or has knowledge of money laundering, it must submit a suspicious activity report and obtain a defence against money laundering from the National Crime Agency before moving or returning funds. The Commission acknowledges that obligation may necessitate a delay in payouts — and says in the same breath that it does not give operators the right to confiscate deposits.

FAQ

Are slots without GamStop legal in the UK?

The player is not the target of the law. Section 33 of the Gambling Act 2005 makes it an offence for a person to provide facilities for gambling without an operating licence, and the Act's general gambling offences attach to those who provide facilities rather than to adult consumers. The Commission states that offering commercial gambling services to consumers in Great Britain without a Commission licence is illegal, including where the operator holds a licence elsewhere. The practical risk to a player is that a disputed balance has no British remedy behind it.

Why can GamStop not block an unlicensed slot site?

Because the obligation runs through the licence. Social Responsibility Code provision 3.5.5 requires licensees to participate in the national multi-operator self-exclusion scheme, and the Commission made that a condition of every licence from 31 March 2020. A company holding no Commission licence is not a participant, cannot check the register and has no obligation to. GamStop itself states it can only exclude from participating operators and cannot prevent access to services run by organisations that do not participate.

What does the Gambling Commission do about unlicensed slot sites?

Disruption rather than prosecution. Since April 2024 the Illegal Markets team has issued 3,140 cease and desist and disruption notices and secured 287,961 URL removals, and across April 2025 to March 2026 every quarter recorded 0 or 1 prosecutions commenced — one in total. The Commission states that GEO IP blocking and registrar blocks are more effective than search-engine removals, because a removal makes a site harder to find without blocking access. Engagement across 160 illegal websites fell an average 32 per cent after disruption activity.

Does an offshore licence give any protection at all?

Sometimes, and less than the marketing suggests. Malta requires EUR 100,000 paid-up capital for Type 1 and Type 2 B2C licences and a EUR 25,000 annual fee; Anjouan requires segregated player funds and certified random number generators and names EGIS ADR, Axion ADR, iGaming ADR and an ADR provider as approved adjudicators. Those are real obligations. They are not British ones. There is no Commission enforcement behind them, no access to the Commission's approved British ADR list, and no assumption that a British player's statutory consumer rights will be honoured.

How do I check whether a Curaçao licence is real?

Click the seal and see where it goes. The Curaçao Gaming Authority says a Certificate of Operation Seal must redirect to cert.cga.cw, is issued only to B2C operators for an approved player-facing domain, and that a seal differing in design, colour or format means the site is not authorised. Check that the certificate names the same domain you are viewing; if it names another operator's, the seal has been borrowed. A legacy /JAZ number or old orange certificate is not proof of a current licence — those ended on 15 October 2025.

What happens to a self-exclusion after the term ends?

It stays in place. A GamStop exclusion runs for its chosen term — 6 months, 1 year, 5 years, or 5 years with auto-renewal — cannot be cancelled during that term, and then remains in force until the person contacts GamStop to remove it. Terms of use last updated in May 2026 also provide that, where a registration is not deactivated, GamStop holds the data through a further automatic seven-year period during which operators are told the customer was previously excluded.

What All of This Adds Up To

The offshore slot market is not a secret door out of the British system; it is a parallel market the regulator spends its days trying to make expensive to use, and the arithmetic of that effort is the honest guide to what a player is buying. The Commission's own figures show why the fight is uneven: a registrar block cuts engagement by an average of 91 per cent, a Google removal by 30 per cent, and the team commenced one prosecution in a full year. Deleting a website is easy. Deleting the demand that finds the next one is not. If the terms of a site cannot survive six straightforward checks read before the first deposit, the National Gambling Helpline on 0808 8020 133 is free, 24 hours a day, and a conversation there costs nothing at all.