Online Casinos Not on GamStop: What British Rules Protect and Offshore Ones Do Not

Updated November 2026

Licensed

Available in GB

Fast payouts

18+ Only

Online casinos not on GamStop are operators holding licences outside Great Britain, usually from Curaçao, Anjouan, Malta or Kahnawà:ke, that accept British players without appearing on the national self-exclusion register. They are not licensed here, so no British gambling protection applies. Self-exclusion holds for its full term regardless.

A fortnight ago the Gambling Commission published its settlement with a British-licensed operator that had delayed customer withdrawals, and the details read like a syllabus: a term permitting one withdrawal at a time, manual review of every fifth or tenth payout, extra documents demanded at exactly the moment a player asked for money. That is what regulation looks like from the inside — slow, procedural, and eventually expensive for the firm. Which is why the phrase you typed matters more than it looks. An online casino not on GamStop is not simply a site that skips a register. It sits outside the entire apparatus that produced that settlement: the withdrawal rules, the wagering cap, the identity-check sequencing, the complaints route with a statutory backstop.

This article compares British rules with offshore ones, rule by rule and number by number. It does not recommend a site, and it does not pretend the two kinds of operator are the same thing wearing different badges. Where the evidence is thin I say so. Where one side’s claim is hollow, I say that too.

What “Not on GamStop” Actually Means

The scheme is often typed “gamestop”, which tells you something about how the name lives in search boxes; the register itself is GamStop, and it blocks accounts with companies licensed in Great Britain.

GamStop is the national online self-exclusion scheme, run by The National Online Self Exclusion Scheme Limited. It has been live since 27 April 2018 — free to use, funded by the operators it blocks. Registration blocks a person from online gambling companies licensed in Great Britain for 6 months, 1 year, 5 years or 5 years with auto-renewal. Signing up takes minutes; the block can take up to 24 hours to bite.

The obligation sits on the operator, not the player. Since 31 March 2020, participation has been a licence condition under social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, which states that “Licensees must participate in the national multi-operator self-exclusion scheme”. Since April 2020 operators must also check their whole customer base against the register at least every 24 hours. In April 2020 the Commission suspended the licences of two operators that missed the deadline. Offshore sites holding no Commission licence are not connected to the scheme [unconfirmed — stated by trade and press sources rather than a regulator page, though consistent with GamStop’s own terms of use].

That is the whole mechanism. Nothing in it reaches a company that has never applied for a British licence, and nothing in it can be worked around: once a term is chosen, the exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it. GamStop’s 2025 annual report devotes a section to its refusal to remove registrations early. An offshore site is not a way round it.

The Numbers Behind the Register

GamStop recorded 117,756 new registrations during 2025 and held 561,983 active exclusions at 31 December 2025. Of the final six months of that year, 58,675 registrations came in — 319 a day. Then the pace rose: a 16% year-on-year increase in the first half of 2026, with May 2026 setting a monthly record of 12,236 sign-ups.

As of July 2026, GamStop reported 614,738 people on the register, more than one in two of them on the maximum five-year term. Only one in four had chosen six months. Under-25s made up nearly one in three of all exclusions in the first half of 2026, a 26% year-on-year rise — a figure worth holding next to the fact that the £2 slots stake limit for 18- to 24-year-olds only arrived on 21 May 2025.

The gender split in the 2025 annual report: 94.3% male, 5.7% female. And a note of bureaucratic honesty from the same report — the Group says it can no longer state a lifetime registration total, because the seven-year retention period running from the 2018 launch has begun to expire.

The Licence Is the Whole Argument

Everything that separates a British site from an offshore one hangs on one document, and the comparison is not between good and bad intentions. It is between two rulebooks.

British-licensed operators carry the Commission’s conditions and the Consumer Rights Act 2015 behind them. Reverse withdrawals were banned outright by RTS 14B from 31 October 2021. Wagering requirements on bonus funds are capped at ten times by social responsibility code 5.1.1, in force since 19 January 2026. A withdrawal request must not trigger a demand for information the licensee could reasonably have asked for earlier (licence condition 17.1.1). There is no fixed maximum number of days for a payout — the regime relies on the fair-and-open condition 7.1.1 and the prohibition on unfair terms, which is a weaker guarantee than a deadline and worth admitting.

The Commission’s own figures suggest the system works most of the time. Data covering June to September 2024, cited in a speech delivered 6 November 2025, records 44.2 million withdrawals by customers of large online operators: 96.3% cleared automatically, 3.5% within 24 hours, 0.1% took up to 48 hours. Yet complaints coded “Withdrawals and/or financial transactions” ran at 2,416 in the year to December 2022 and were still 1,791 in the year to December 2025. Withdrawal problems were the number one topic raised by consumers to the Commission’s Contact Centre.

Under section 33 of the Gambling Act 2005 it is an offence to provide facilities for gambling without an operating licence, and it is immaterial whether the facilities are provided inside or outside the UK. The Commission states plainly that it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence in another jurisdiction. That is the legal baseline, whatever a site’s footer says.

Self-Exclusion Holds, Whatever the Site Says

A British-licensed operator receiving a self-exclusion must close the customer’s account and return the funds in it. The LCCP states it is not sufficient merely to prevent the customer from withdrawing funds while still accepting wagers. That is the standard.

Offshore regulators handle the same subject with a lighter touch and often a harder edge. Kahnawà:ke requires its licensees to let a player set limits including zero, and states that its voluntary self-exclusion is permanent and irrevocable; a player who breaches it forfeits funds deposited or won to a third-party charity chosen by the Commission. Anjouan requires licensees to name an approved Alternative Dispute Resolution provider in player-facing terms and expects complaints resolved within 30 days before escalation. Neither arrangement is GamStop, and neither plugs into it.

There is one further wrinkle the Commission flagged in an industry warning notice on 20 January 2025: casino games supplied by licensed operators were appearing on unlicensed websites available to GB consumers, and those sites often target people who have self-excluded through GamStop. A registration check that fails because a middle name was entered instead of a forename can create exactly the mismatch that lets a block slip. The register is robust; data entry is not.

The land-based side of self-exclusion is a different system altogether, which surprises people. SENSE covers licensed land-based casinos under LCCP code 3.5.6, with a minimum of six months extendable to twelve and a six-month “Thinking” period afterwards. Gamstop Betting Shops, formerly MOSES, is telephone-based on 0800 294 2060 and excludes a customer from named bookmakers’ shops for a fixed 12 months. Arcades use a scheme run by BACTA and Boomerang Digital; bingo clubs use one run by the Bingo Association. None of them touch an offshore website either.

Withdrawal Speed by Wallet Type and Where the Minutes Go

Withdrawal delays are the complaint that never quite goes away, so it is worth knowing which part of the chain is actually slow. The site’s own authorisation step is usually the bottleneck; the payment rail is often faster than people assume.

Read that table as a set of arithmetic, not a promise. Bitcoin’s ten-minute target is an average interval, and the classic six-confirmation default assumes an attacker with less than 10% of network hashrate accepting under a 0.1% residual double-spend risk. Litecoin’s 2.5 minutes is a cadence, not a guarantee. A TRON transfer can fail outright if the account has neither Energy nor enough TRX. Some of these figures are secondary compilations rather than protocol documents [unconfirmed on Solana, where a 400-millisecond slot time and a 13-second confirmation reference come from a tool table, not Solana’s own documentation].

Where British rules bite on all of this is narrow and practical. Licence condition 5.1.2, effective 31 January 2024, requires licensees to accept payments from GB customers only through a provider that is a payment service provider under the Payment Services Regulations 2017. Operators must ensure that money arriving from an e-wallet was not loaded from a credit card, banned for gambling since 14 April 2020. And they may charge a withdrawal fee only if it is cost-reflective, disclosed before deposit, and does not exceed the direct cost of processing.

Slow Payouts Built Into the Terms

An unusually honest piece of Commission guidance says it is not acceptable for operators to introduce friction when a customer withdraws rather than when they deposit, or to place commercial interests above customers’. It adds that where there are no regulatory concerns, there is no valid reason to delay a payout. That is the principle. The enforcement that gave it teeth arrived on 21 October 2026, when a company operating seven websites agreed to pay £900,000 in a regulatory settlement including unnecessarily delayed withdrawals — a one-withdrawal-at-a-time term found unfair under the Consumer Rights Act 2015, and manual review of every fifth or tenth withdrawal for some customers. In July 2025 another firm was fined £170,000 for failures including a term letting it close accounts or forfeit winnings at its own discretion.

Now the offshore version, drawn from published terms rather than speculation. One operator states that deposit bonuses carry a 25× wagering requirement, expressed against either the bonus or the bonus plus deposit, with a time limit. Another calculates wagering on the bonus alone and caps withdrawable winnings from bonus funds at 300% of the credited bonus, voiding the excess. Both cap the maximum bet while wagering — one at €5 for regular players and €10 for VIPs, the other at 20% of the deposited amount — and one warns that breaching the max-bet rule may mean account closure plus forfeiture of the bonus and winnings generated during wagering. There is no ten-times cap here; that is a British rule, and it binds nobody in Curaçao.

The quiet delay is in the sequence. A site can accept a deposit in seconds and only then decide that a document is required, which under British condition 17.1.1 is precisely the thing an operator is told not to do. Offshore there is no 17.1.1 and no ADR backstop through a regulator-approved scheme. Anjouan’s operators must name an ADR provider, and Kahnawà:ke employs a full-time Dispute Resolution Officer, but these are the operators’ chosen forums, not a statutory route.

Five Signs an Offshore Operator Is Doing It Properly

Judgement here is not about gut feeling. Each of these leaves a paper trail.

A licence that verifies in one click

A Curaçao Certificate of Operation seal must redirect to cert.cga.cw, and if the certificate behind it shows a different domain from the site being accessed, the site is displaying another operator’s certificate and should be treated as unauthorised. Legacy /JAZ numbers and orange certificates are not proof: the CGA replaced the master-licence model when the LOK took effect on 24 December 2024, and the orange certificates ended on 15 October 2025. Anjouan certificates carry a licence number and QR code linking to a public register; Anjouan Gaming’s own verification framework says unverifiable certificates should not be relied on. Check the domain on the certificate against the address bar.

A complaints route with a named third party

A trustworthy offshore operator names its ADR provider and its contact details in the terms. Anjouan’s approved list currently contains EGIS ADR, Axion ADR, iGaming ADR and one licensee. For contrast, British licensees must offer ADR free of charge if a complaint is unresolved within eight weeks, and the consumer must first exhaust the operator’s own procedure. Absence of any named forum is the sign.

Terms that admit what a bonus does

Look for the exact multiplier, what it applies to, the maximum bet during wagering and the maximum cashout. One operator’s published chart weights slots at 100%, table games at 20%, video poker and blackjack at 10%, roulette and baccarat at 5%, and craps, live dealer and jackpot games at 0%. Vagueness is the warning sign, and so is a clause reserving “sole discretion” to void winnings — a term the Commission treats as unfair, and which cost a British licensee £170,000 in July 2025.

Customer funds disclosed, not implied

British licensees must select one of three protection ratings — “not protected”, “medium protection” or “high protection” — and an operator rated “not protected” must remind the customer every six months that funds are not protected in the event of insolvency. Keeping customer money in a separate client account does not guarantee its return, and businesses are legally allowed to hold it in overseas bank accounts. If an offshore site says nothing about segregation or insolvency, assume the weakest answer applies.

Speed claims you can test in a small amount

A site’s own payout times are marketing. The checkable version: make a small withdrawal early, note the timestamp, and see whether the money arrives before any document request appears. Commission data shows 96.3% of withdrawals at large British operators cleared automatically in June to September 2024. A first withdrawal that stalls behind a fresh ID demand tells you what the second one will do.

How to Check a Site Before Depositing Anything

These are ordinary, lawful checks. None of them requires an account.

1. Verify the licence on the regulator’s own register, not the site’s footer. Click the seal and confirm the certificate names the domain in your address bar. A seal pointing elsewhere is a borrowed certificate, and the site should be treated as unauthorised.
2. Read whether the operator is on the Commission’s public register. The Commission advises consumers to check that a business holds a British licence and to click through to see whether the site’s activities and domain names match. If it is a British licence, GamStop applies; if it is not, nothing in this article’s second paragraph protects you.
3. Find the withdrawal section of the terms and read it before the bonus section. Look for a maximum cashout, a one-withdrawal-at-a-time clause, and any manual review schedule. Those three clauses cause more disputes than every other term combined.
4. Check the bonus arithmetic against the deposit. A 25× requirement on a bonus alone is a different animal from 25× on bonus plus deposit. Multiply it out on the amount you would actually deposit.
5. Write down the complaints route and the ADR provider’s name before you need them. Under British rules a complaint unresolved after eight weeks can go to ADR free of charge; offshore, the operator’s chosen provider may have its own admissibility rules, and eCOGRA for one may refuse a dispute where it has not been through internal procedure first.
6. Decide what happens if the money does not arrive. That is the honest test of an unlicensed operator, because the Commission is a regulator and not an ombudsman: it cannot resolve individual complaints or get money back, and typically refers disputes elsewhere.

Illegal Sites and the Odds of Landing on One

The Commission’s illegal gambling dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, 4% less than the previous three-month average but 4% more than September 2025. In Quarter 2 of 2026 to 2027, 311 sites had disruption action taken against them — 38% more than the prior quarter — and 77% of disrupted sites saw a reduction in estimated traffic.

Scale estimates vary wildly depending on who is paying for them, and the difference is instructive. H2 Gambling Capital, a market-intelligence firm, estimates £16.6 billion was staked with illegal operators in the UK in 2025, up from about £5 billion in 2019, with the legal share falling from 97% to 92%. A study by Frontier Economics for the Betting and Gaming Council put the online black market conservatively at £2.7 billion a year, 2.1% of the £128 billion staked with regulated remote operators. Yield Sec, working for the Campaign for Fairer Gambling, put 9% of GB online gross gambling revenue unregulated in 2025. A Commission survey published 5 November 2026 found that among respondents who had gambled online in the past four weeks, 2.5% had engaged with an illegal gambling website, with a further 1.5% in the past year.

Those numbers cannot all be right, and the Commission’s own October 2024 methodology openly concedes it does not capture activity hidden by VPNs. What is not in dispute is enforcement. Since April 2024 the Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 C&Ds, 774 registrar referrals, 402 host referrals and 3 payment provider referrals — referred 447,778 Bing and Google URLs, and secured 287,961 URL removals. The effectiveness ranking is the interesting part: registrar blocks and website suspensions each produced an average 91% fall in engagement, ahead of GEO IP blocking at 60%, Bing removal at 52%, Google removal at 30% and Facebook removal at 8%. Search-engine removal makes a site harder to find; it does not block it.

Where the Money Sits, and What Happens If It Goes Wrong

The single thing this topic turns on is what happens at the moment money moves — and identity checks and payout sequencing are where the two rulebooks diverge most sharply.

First time, on a British site: identification and verification are required when a customer deposits or withdraws €2,000 or more under the Money Laundering Regulations, but licence condition 17 requires name, address and date of birth to be verified before the customer is permitted to gamble at all. A remote casino may use the “hybrid approach” — verifying age and identity at registration, deferring full verification to the €2,000 threshold — and the Commission now expects checks brought forward to before a deposit or stake, saying onboarding on initials instead of full names or a commercial address instead of a residential one is not sufficient. Most checks are done electronically against credit reference agencies and the electoral roll and are instant; documents take longer, and the Commission declines to give a timescale.

Later, the same customer gets checked again, and this is where complaint volumes come from. Over a quarter of complaints reaching the Commission’s Contact Centre concern identity verification, raised when documents are demanded only at withdrawal. Condition 17.1.1 exists precisely to stop that, though it does not prevent an operator seeking information it must obtain then under an anti-money-laundering obligation. Where an operator suspects money laundering it must file a Suspicious Activity Report and obtain a defence from the National Crime Agency before returning funds — a genuine reason for delay, and not a licence to confiscate deposits.

The warning signs have patterns. Onboarding on a middle name rather than a forename creates mismatches with other records, including GamStop, which undermines self-exclusion. Third-party “fuzzy matching” that produces partial or equivocal verification is a known concern. The Commission’s 2026 risk assessment reports rising use of false documents, deepfake videos and AI face swaps to bypass checks, lists failure to scrutinise source-of-funds documents properly as a new high-impact control risk, and describes “smurfing” — many small transactions to stay under the threshold — as a medium-likelihood, high-impact customer risk. One case study: roughly £40,000 deposited over six months across accounts opened with the details of five different people.

Funds are a separate question from checks. Customer funds must be held in a client account separate from the operator’s business accounts, and money staked within an open bet is not customer funds at all, so it sits outside any insolvency protection. A rating of “not protected” must be stated and repeated every six months. The CMA, whose 2016 to 2019 investigation ended with undertakings from six operators, is clear that firms must not deny customers access to their own money or confiscate balances for missing identity documents or after inactivity. That is British law. Offshore, you rely on the operator’s own words.

Help, and the Line to Call

Help in Great Britain is free and does not depend on which site someone has used. GamCare operates the National Gambling Helpline on 0808 8020 133, 24 hours a day, every day — the same number reaches live chat and WhatsApp. Callers in Wales also have 0808 2819 265. BeGambleAware, the public-facing brand of the charity GambleAware, directs people to that helpline and its online chat. Gamblers Anonymous England, Wales & Ulster runs around 250 meeting locations with no appointment needed on 0330 094 0322. GamFam supports families through its five-stage GRA5P programme, and Gam-Anon UK & Ireland supports the family and friends of compulsive gamblers whether or not the gambler attends GA. Citizens Advice gives free, confidential advice including on debt; Citizens Advice Scotland runs a gambling support line on 0800 328 1131, Monday to Friday, 10am to 3pm. The NHS National Gambling Clinic in London takes self-referrals, and NHS England has opened 15 specialist clinics since 2019, with integrated care boards commissioning 8 regional services receiving almost 5,000 referrals a year.

Blocking software is the other ordinary tool. GamStop signposts Gamban and BetBlocker. BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, requires no registration and is free worldwide; Gamban states it blocks licensed and unlicensed sites and is designed to be as difficult to remove as possible, though TalkBanStop funding ended on 31 March 2026 and it now costs £4.99 a month or £29.99 a year in England and Scotland, free in Wales. Bank-level blocks are worth knowing about too: the Commission’s list of banks offering a gambling block, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. They work on merchant category codes, cover online casinos, betting sites, gaming apps and physical venues, must be activated on each card, and most banks apply a 48- or 72-hour cooling-off before gambling transactions are allowed again.

Two structural notes. The statutory levy commenced on 6 April 2025 and raised just under £120 million in its first year, ringfenced for research, prevention and treatment, split 50% treatment, 30% prevention and 20% research. And funding the treatment system does not make it universal: a charity or helpline reached at 2am is still the practical answer.

The Bing Test

Search-engine removal, the Commission found, cut engagement with illegal sites by 30%. A registrar block cut it by 91%. Anyone who has watched a results page fill with fresh domains the week after a purge will recognise the arithmetic: the site that ranks is not the site that is safe, it is the site that has not yet been referred.

Questions About Offshore Casinos

Are online casinos not on GamStop legal in Great Britain?

No — it is illegal for anyone to provide facilities for gambling without an operating licence, and it is immaterial whether the facilities are provided inside or outside the UK. Section 33 of the Gambling Act 2005 carries up to 51 weeks’ imprisonment, a level 5 fine, or both. The offence attaches to the operator, not to an adult who plays there. That said, the Commission states clearly, including where the operator holds a licence in another jurisdiction, that offering commercial gambling services to consumers in Great Britain without a Commission licence is illegal.

What is the best online casino not on GamStop?

There is no honest answer to that, because “best” would mean best for the player, and the disqualifying defect is shared by every operator in the category: no British licence, no GamStop connection, no route to a regulator-approved ADR scheme, and no fair-terms condition enforced by the Commission. What can be compared is the paperwork. A verifiable Certificate of Operation naming the domain in your address bar, a named ADR provider, published wagering figures and a disclosed customer-funds rating are the only things worth ranking. Nothing else in the category is a quality signal.

Do offshore casinos run identity checks?

Often, and sometimes harder than British ones. Anjouan’s published standards require age verification and AML controls; the Money Laundering Regulations require identification and verification on deposits or withdrawals of €2,000 or more in remote casinos, and the EU’s Anti-Money Laundering Regulation retains that threshold. Offshore, though, there is no condition 17.1.1 stopping a demand for documents appearing at the moment of withdrawal rather than before deposit. So the check itself is not the problem. The sequencing is, and that is what most withdrawal complaints are actually about.

What happens if an offshore casino delays or refuses a withdrawal?

Your options are thinner. On a British licence, a payout delay with no regulatory concern behind it is something the Commission says there is no valid reason for, and a complaint unresolved after eight weeks can go to an approved ADR provider free of charge; a company paid £900,000 in October 2026 over exactly this. Offshore, you go to whatever forum the operator names in its terms — for Anjouan licenses, EGIS ADR, Axion ADR, iGaming ADR or one licensee — and eCOGRA, for one, may refuse a dispute that has not been through the operator’s internal procedure.

Do free spins or no-deposit bonuses change the calculation?

They make it worse, not better. One operator’s terms state that no-deposit bonuses and deposits may not be mixed: if a deposit is made while a no-deposit bonus is active, the wagering requirements and the maximum cashout of the no-deposit bonus still apply. Another voids winnings above 300% of the credited bonus. British sites cannot do this in the same way — wagering on bonus funds is capped at ten times since 19 January 2026, and a maximum cashout limit on a deposit balance is a prohibited term.

Can an offshore casino get round a GamStop exclusion?

No. GamStop blocks accounts with operators licensed in Great Britain, and an offshore site is simply not one of them — it is outside the scheme rather than exempt from it. That is a statement about the register’s scope, not a loophole. Self-exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it, and GamStop’s 2025 annual report devotes a section to its refusal to remove registrations early. The Commission’s January 2025 warning notice flagged the opposite problem: unlicensed sites targeting people who have self-excluded.

Why a Licence Is Not a Badge But a Rulebook

On paper, the difference between a British-licensed casino and an offshore one is not quality of software or generosity of offer; it is which rulebook applies when something goes wrong, and the numbers show the British book is short on guarantees too — no fixed payout deadline, 1,791 withdrawal complaints in 2025, a regulator that cannot get your money back. So the honest comparison is not safe against unsafe. It is a rulebook with visible enforcement against a rulebook chosen by the operator. And the enforcement figures do move: 586 illegal sites recorded in September 2026, 311 disrupted in a single quarter, and registrar blocks cutting engagement by 91% while search removals manage 30% — which is why those domains keep changing and why the Commission’s helpline number, 0808 8020 133, stays free at any hour.

*Prepared using facts as of 12 November 2026.*

Content created by the «GamStop Fast Payout» team