Online Gambling UK in 2026 and the Differences Between British and Offshore Rules

Updated November 2026

Licensed

Available in GB

Fast payouts

18+ Only

Online gambling in the UK is legal only through operators holding a Gambling Commission licence; more than a thousand unlicensed sites have been reached by British consumers anyway, and the Commission can neither police their terms nor return a player’s money. The licence, not the website’s design, is the line that matters.

It is often typed “gamestop”, which is a slip: the scheme is GamStop, and it sits at the centre of how Britain handles online gambling. Register once and it blocks an account with every operator licensed in Great Britain, checked at least every 24 hours, for the term chosen — 6 months, 1 year, 5 years, or 5 years with auto-renewal. Registration cannot be cancelled or deactivated during that term, and the exclusion then stays in place after the chosen period ends until the person contacts GamStop to remove it. Signing up takes a few minutes; the block can take up to 24 hours to bite.

That is the British settlement in miniature. Regulated properly, it is a thorough machine: identity checks before a bet, a ten-times cap on bonus wagering since 19 January 2026, a statutory levy that raised just under £120 million in its first year, a helpline on 0808 8020 133. Offshore, all of that falls away. A site licensed in Curaçao, Anjouan or Kahnawà:ke is not licensed in Great Britain, is not connected to GamStop, and its players have none of the protections above. This page sets the two side by side — the money, the rules, the refund routes — and explains how to tell which one you are looking at.

The Market the Numbers Describe

Total Great Britain gambling gross gambling yield was £17.5 billion in the year April 2025 to March 2026, up 4.4%, of which remote casino, betting and bingo produced £8.3 billion, up 6.9%. The remote casino sector alone generated £5.0 billion in April 2024 to March 2025, £4.2 billion of it from slots — a single game type carrying most of an industry’s revenue.

The traffic figure that matters more for this subject is the other one. The Commission estimates that among respondents who had gambled online in the past four weeks, 2.5% had engaged with illegal gambling websites, with a further 1.5% in the past 12 months, against 94.4% of the whole population showing no indication of using one. Market-intelligence firm H2 Gambling Capital puts stakes with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019, and the legal share of gambling falling from 97% to 92% over that span. Industry-commissioned work by Frontier Economics for the Betting and Gaming Council reached £2.7 billion a year, 2.1% of stakes. The gap between 2.5% and £16.6 billion is not a contradiction; it is the difference between counting people and counting money, and it is the reason both sides argue so loudly about the black market.

The Gambling Commission recorded 586 illegal gambling websites accessible to British consumers in September 2026, 4% more than a year earlier, and took disruption action against 311 in the second quarter of 2026-27.

One Benchmark From the Regulator

For a single figure to carry around, the Commission’s own data for June to September 2024 records 44.2 million withdrawals by customers of large online operators, of which 96.3% cleared automatically and 3.5% cleared within 24 hours.

Read that twice, because it is the most useful number in the whole debate. Automatic clearing is what the regulated machine looks like when it works: no form, no queue, no argument. It also explains why withdrawal problems remain the Commission’s number one complaint subject. Its Annual Report and Accounts 2024-25 says issues relating to withdrawals continue to cause most of the complaints it receives. Complaints coded “Withdrawals and/or financial transactions” fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025 — improving, but still the top of the list. Over a quarter of complaints reaching the Contact Centre concern identity verification, a complaint customers raise when documents are requested only at the point of withdrawal.

Why the Licence on the Door Decides Everything

The licence is not a badge. Under section 33 of the Gambling Act 2005 it is an offence to provide facilities for gambling without an operating licence, and the Commission has said plainly that this includes an operator holding a licence in another jurisdiction. On summary conviction that carries up to 51 weeks’ imprisonment, a fine up to level 5 on the standard scale, or both. The Act reaches remote gambling where at least one piece of remote gambling equipment is situated in Great Britain, or where the provider knows or should know the facilities are likely to be used here.

Here is what a British licence buys, concretely. Licence condition 17.1.1 requires identity to be established before a customer is permitted to gamble, and forbids demanding extra information at withdrawal that could reasonably have been requested earlier. Condition 7.1.1 requires terms not to be unfair within the meaning of the Consumer Rights Act 2015. Since 31 October 2025 operators must prompt customers to set a financial limit before a first deposit. Since 19 January 2026 wagering on bonus funds is capped at ten times, and mixed-product promotions are banned. Credit cards have been banned for gambling since 14 April 2020. Offshore, none of it applies — not the cap, not the limit, not the ban.

The Offshore Licence Is Real, Just Not British

It is worth being precise, because “offshore casino” gets used as a synonym for “sham” and that is not accurate. A Curaçao licence is a real licence issued by a real authority. Since 24 December 2024 the National Ordinance on Games of Chance has made the Curaçao Gaming Authority the direct licensing and supervisory authority, replacing the old master-licence and sub-licence model; legacy “orange” sub-licence certificates ended on 15 October 2025 and should no longer be treated as proof of a current licence. The application fee for a B2C licence is a one-time non-refundable €4,592, and the total annual fee is €47,450.

Anjouan issues its own licences under legislation adopted in 2005, at €17,828 for issuance and the same for annual renewal. Kahnawà:ke has regulated interactive gaming since its regulations of 8 July 1999. Malta’s authority charges a €5,000 application fee, a €25,000 annual licence fee and 5% tax on revenue. Costa Rica, by contrast, has no comprehensive gambling licensing regime at all — its Legislative Assembly rejected Bill No. 25,057 in early 2026, and the “data processing license” sometimes cited is not a licence in the strict legal sense.

The Anjouan file is the one that repays reading carefully. An ABC News investigation published on 31 December 2025 reported that the licensing administrator claims to have issued more than 1,300 gambling licences at around €17,000 each per year, and that Comoros financial intelligence officials described the entity selling them as operating illegally, with a former attorney-general of the Comoros calling it “an illegal entity”. Anjouan Gaming itself said in a statement on 10 June 2026 that an Anjouan licence “is not, and has never been presented as, a universal authorisation to operate in every country in the world”. Both statements are on the record. Neither is a licence from the Gambling Commission.

How British Rules Compare With Offshore Ones

The table below compares by rule, not by brand, and the values are the ones a player actually meets.

The £16.6 billion figure and the 2.5% figure sit in the same row of that table’s logic: a rule only changes behaviour where it is applied, and it is applied only by licensees.

The Single Thing the Whole Subject Turns On

Identity Checks, and Why They Land at Withdrawal

If one mechanism decides whether online gambling is pleasant or maddening, it is identity verification, and the reason is timing.

The first time, at a properly run British operator, checks happen early. Licence condition 17 has been in force since 7 May 2019 and requires a licensee to obtain and verify information establishing identity before permitting a customer to gamble, including name, address and date of birth. Before a customer is allowed to deposit, operators should tell them which documents or information may be needed, in what circumstances and in what form. Much of the verification is invisible: companies can verify by matching the account against databases such as credit reference agencies and the electoral roll, in which case no documents are needed and the whole thing is effectively instant. The Commission has said it cannot give a timescale for checks because the process varies.

Later, the picture changes for two legitimate reasons. Anti-money-laundering rules under the Money Laundering Regulations 2017 require identification and verification in remote casinos when a customer deposits or withdraws €2,000 or more, and the €2,000 threshold applies both to a single transaction and to transactions that appear to be linked — same customer, same session, one logged-on period. Separately, financial vulnerability checks have been a licensing requirement since August 2024, with the threshold lowered to £150 of net deposits over 30 days from 28 February 2025, drawing only on publicly available risk flags such as a bankruptcy order, a County Court Judgment or an Individual Voluntary Arrangement. Financial Risk Assessments arrive in stages from the Commission’s announcement of 7 July 2026, starting with the largest operators at £5,000 net deposits in a rolling 24 hours for customers aged 25 and over and £2,500 for under-25s, ending at £1,000 in 24 hours or £3,000 over 90 days for adults.

The warning signs are the same everywhere and easy to spot. Fragmented checks: nothing asked at deposit, a passport demanded at withdrawal. A pattern of review — the Commission’s October 2026 settlement with an operator over unnecessarily delaying withdrawals included manual review of every fifth or tenth withdrawal, requiring extra information before processing. Fuzzy matching: the Commission has expressed concern about operators onboarding customers on partial or equivocal verification, and noted that opening an account with a middle name instead of a forename can create mismatches with records held elsewhere, such as GamStop, undermining self-exclusion itself.

Offshore, the same sequence runs without a floor beneath it. There is no condition 17, no £150 vulnerability check, no eight-week complaint clock, no free ADR, and no regulator to whom a British player can complain. Anjouan’s standards do require segregated player funds, certified random number generators, AML and age verification, and a designated ADR provider from its approved list. That is a genuine framework. It is also one where, if the operator ignores it, the player’s practical remedy is a contractual dispute under foreign law.

Five Signs an Operator Can Be Trusted

None of these needs an account, a deposit or a test payment. Each takes a couple of minutes.

1. The Licence Is Named and Checkable

A British operator must be licensed by the Gambling Commission, and the Commission advises checking the public register to see whether the site’s activities and domain names match. A real Curaçao licence should show a Certificate of Operation Seal that redirects to cert.cga.cw; a Certificate of Operation is issued only to B2C operators and only for an approved, registered, player-facing domain. If the certificate behind the seal names a different domain from the one in the address bar, the site is displaying someone else’s certificate.

2. The Terms Are Readable and Specific

Fair-and-open terms are a licence condition, not a courtesy. A trustworthy operator states the customer-funds protection rating — “not protected”, “medium protection” or “high protection” — in writing, and requires acknowledgement on the first deposit. It publishes terms outside the small print for promotional play restrictions, listing the prohibited types of play rather than reserving sole discretion. A term that says the operator “may” or “reserves the right” to void winnings at its own discretion is the specific wording the Commission calls unfair, and it is the wording that got one operator fined £170,000 in July 2025.

3. Withdrawals Have No Built-in Delay

Look for a term that limits how often a customer may withdraw, or that requires a first withdrawal to be authorised before a second can be requested. That exact construction was found unfair under the Consumer Rights Act 2015 in the October 2026 settlement, alongside a £900,000 payment. Maximum withdrawal limits on the deposit balance are prohibited outright. A payout-processing fee is permitted only if it is cost-reflective, transparent and disclosed before a deposit.

4. Complaints Go Somewhere Independent

An operator must let a dispute go to an approved ADR entity free of charge if it is not resolved within eight weeks. IBAS and eCOGRA handle most gambling disputes; their record is not soft on operators — IBAS reported 693 complaints not upheld against 65 upheld for 2024-25 — but they are free, they are gambling specialists, and they will consider disputes about account management and access to funds. An operator whose terms name only an offshore arbitration address, or none, has told you what the complaint is worth.

5. Help Is Signposted, Not Hidden

The Commission’s listed bank gambling blocks, blocking software such as Gamban and BetBlocker, and the National Gambling Helpline on 0808 8020 133 are all publicly documented. An operator that mentions none of them, and whose marketing pushes deposit limits and financial limits instead of stating them plainly, is a weaker proposition. Note the incentive as well: a bonus with a wagering multiple over ten times is not permitted here, so a site advertising forty times is telling you which regulator is not looking.

A Practical Reading of a Site, in Six Steps

1. Find the licence and the register entry. Go to the Gambling Commission’s public register and confirm the domain appears there. Reason: a licence claimed in a footer is marketing; a licence on the register is a fact, and an offshore licence, however genuine, gives a British player no regulator to appeal to.
2. Read the customer-funds paragraph. Establish which of the three protection ratings applies and whether the money is in a separate client bank account. Reason: keeping funds separate does not mean customers are repaid if the operator becomes insolvent, and money staked in an open bet is not customer funds at all — so the rating is the only meaningful signal.
3. Check the bonus arithmetic before claiming it. Multiply the wagering multiple by the bonus and compare it with the ten-times ceiling that applies here. Reason: a 40× multiple on a £100 bonus is £4,000 of play, and the cap exists because the Commission found licensees applying up to 60 times.
4. Read the withdrawal clause, not the deposit page. Look for withdrawal frequency limits, manual review triggers and processing fees. Reason: friction placed on the way out rather than the way in is the Commission’s own definition of the problem, and it is now the subject of enforcement.
5. Confirm the complaint route and its clock. Note whether the terms name an approved ADR provider and whether the operator allows complaints for at least six months from the incident. Reason: 72.3% of the invalid disputes one ADR provider recorded in 2024-25 failed because the internal complaints procedure had not been completed first — the order of steps is not optional.
6. Set the limits the rules require you to be offered. British operators must prompt a financial limit before the first deposit; the customer must take an action to decline and confirm that decision. Reason: the limit you set before playing is the only one made with a clear head.

Where gambling has become a problem, help is free and immediate: the National Gambling Helpline is run by GamCare on 0808 8020 133, 24 hours a day, every day of the year, with the same number reaching live chat and WhatsApp (mobile only), and 0808 2819 265 for callers in Wales. Gamblers Anonymous England, Wales & Ulster runs around 250 meeting locations on 0330 094 0322. NHS gambling services exist, and the statutory levy that raised just under £120 million in its first year is ringfenced solely for research, prevention and treatment.

The Refund Question

There is no general right to a refund because gambling went badly, and offshore there is often no practical route to one at all. The British routes that do exist are narrower and more specific than the phrase “online gambling refund uk” suggests.

Where an operator has broken its licence conditions, the Commission records the complaint but cannot resolve it: it is a regulator, not an ombudsman, and it cannot get an individual’s money back. The productive route is the operator’s own complaints procedure, then an approved ADR entity, free of charge, if the matter is not resolved within eight weeks. ADR providers will not take customer-service complaints, nor disputes about a refusal to accept a bet. Where money is concerned, ADR providers can consider disputes about account management and access to funds, including compensation for expenses and inconvenience.

The strongest single protection is one most players never read. Un-staked deposits remain the customer’s property; licensees may not hold terms allowing confiscation of money deposited but not yet staked, nor deduct from a deposit balance because a customer has failed identity or age verification. Inactivity cannot be used to confiscate a balance either. And where a customer has entered a self-exclusion agreement, the licensee must close the account and return the funds in it. Offshore, that whole paragraph is a matter of contract, and the contract will usually say something else.

Tax, Law and the Size of the Trade

British players pay no tax on gambling winnings; the duty is levied on operators, which is why nobody at a British-licensed site ever asks a winning customer for a tax return. That is not a loophole but the design: the industry produced £17.5 billion of gross gambling yield in 2024-25 to 2025-26, and the statutory levy took just under £120 million in its first year at a rate of 1.1% of previous-year gross gambling yield for online operators.

The legal position for a player is the mirror image of the operator’s. Providing facilities for gambling without a licence is an offence by the operator under section 33, carrying up to 51 weeks’ imprisonment or a level 5 fine; the Act’s general gambling offences attach to those who provide facilities, not to adult consumers. Cheating is the exception — section 42 makes cheating, attempting to cheat or assisting another to cheat an offence, and it is the only offence under the Act that is not a summary offence.

Enforcement leans on the supply side rather than the courts. Since April 2024 the Commission’s Illegal Markets team had issued 3,140 cease and desist and disruption notices by October 2025, comprising 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and 3 payment provider referrals, referring 447,778 search URLs and securing 287,961 removals. Across 160 illegal websites with traffic data, engagement fell an average 32%; registrar blocks produced a 91% average fall and these days the Commission says registrar blocks and GEO IP blocking are more effective than search-engine removals, which make a site harder to find without blocking access to it. In July to September 2026 it referred 1,835 websites and issued 546 cease and desist notices. It also began zero criminal investigations in April to June 2026, and across April 2025 to March 2026 every quarter recorded 0 or 1 prosecutions commenced. That is a regulator fighting a market with paperwork and plumbing, not with prosecutions.

How Many Sites, and How Many People

The Commission’s Illegal Gambling Taskforce was set up in 2026 with three priorities — reducing payments to and from illegal operators, tackling online advertising of illegal gambling, and improving cross-agency enforcement — with terms of reference published by DCMS on 13 May 2026 and a 12-month remit.

Counting British sites is harder than it sounds, because the number that is published is the number the Commission has identified, not the number that exists. Its affiliate-page method found 364 illegal gambling websites in May 2024 and 535 by July 2025, with crypto-casino search terms added to the methodology in December 2024; just over 1,000 unique illegal websites were accessed by British consumers over May 2024 to July 2025. Gambling remains a majority-of-adults activity: 47% of adults gambled in any form in the past four weeks, falling to 27% once those who only bought lottery draws are excluded, from a survey of 20,775 adults with fieldwork from January 2025 to January 2026. Problem Gambling Severity Index scores of 8 or more were recorded by 2.4% of participants, described by the Commission as stable across three years at 2.5%, 2.7% and 2.4%.

Self-exclusion is the number that has moved fastest. GamStop recorded 117,756 new registrations during 2025 and had 561,983 active exclusions at the end of that year; by July 2026 GamStop Online reported 614,738 consumers currently on the register, more than one in two of whom had opted for the maximum five-year exclusion, with only one in four across all age groups choosing six months. Registrations rose 16% year-on-year in the first half of 2026, with May 2026 setting a monthly record of 12,236 sign-ups, and under-25s accounted for nearly one in three of all exclusions, a 26% year-on-year increase.

The Delay Built Into the Offshore Model

One structural fact separates the two regimes more sharply than any bonus term: an offshore site can build delay into its own terms, and a British one largely cannot.

In the UK, reverse withdrawals have been banned since 31 October 2021, when RTS requirement 14B took effect: consumers must not be given the option to cancel a withdrawal request, and once a customer has asked to withdraw, the operator should not offer them a way to deposit those funds again. There is no statutory maximum number of days for completing a withdrawal, but the regime does not need one — it relies on fair-and-open condition 7.1.1, identity-verification condition 17.1.1 and the prohibition on unfair terms. Where an operator has no regulatory concerns about a customer, the Commission’s position is that there is no valid reason to delay the payout, and operators should explain any delay or refusal, subject to the statutory prohibition on tipping off in money-laundering cases.

Offshore, the equivalent clauses are drafted the other way round. Consider the paperwork alone. Bitcoin targets a ten-minute block interval, with that often-cited six-confirmation default assuming an attacker with under 10% of hashrate and a residual double-spend risk below 0.1%; Litecoin averages 2.5 minutes a block and only about 55.43% of modelled six-confirmation spans complete within 15 minutes; a USDT transfer on TRON to a wallet that already holds USDT consumes about 65,000 Energy and burns roughly 13 TRX without staked Energy, and to a brand-new wallet about 130,000 Energy and 26 TRX. Then the e-wallets: Skrill and Neteller both charge 2.80% of a bank withdrawal with a minimum of about €3.50, and both deduct a monthly service fee if the account goes unused for six months. None of that is a licence term. All of it is time.

The temptation is to read the absence of rules as freedom. The more accurate reading is that the rules never disappeared; they moved to the other side of the table, where the operator writes them. A GamStop exclusion is a good illustration, because it is the one term that cannot be argued with. It runs for its full term, and after that term it remains in place until the person contacts GamStop to remove it — that is why the Commission’s January 2025 warning notice singled out unlicensed sites for often targeting customers who have self-excluded, and why the Commission treats a mismatch between an operator’s records and GamStop’s as a compliance problem worth writing to the industry about. No offshore licence is a route around it.

Questions About Online Gambling UK

Is online gambling legal in the UK?

Yes, when the operator holds a Gambling Commission licence. The Commission states it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without one, including where the operator holds a licence in another jurisdiction, and section 33 of the Gambling Act 2005 makes providing facilities for gambling without an operating licence an offence by the operator. Adult players commit no equivalent offence by using a site.

How many online gambling sites are there in the UK?

No reliable total exists. The Commission’s affiliate-page method found 364 illegal websites in May 2024 and 535 by July 2025, and just over 1,000 unique illegal websites were accessed by British consumers over May 2024 to July 2025. Its dashboard recorded 586 illegal websites accessible to British consumers in September 2026. Licensed operator numbers are published separately and run into the hundreds of domains.

How many people gamble online in the UK?

The Gambling Survey for Great Britain, published 16 July 2026 from 20,775 adults with fieldwork from January 2025 to January 2026, found 47% had gambled in any form in the past four weeks, falling to 27% when lottery-only players are excluded. Total online gross gambling yield for January to March 2026 was £1.55 billion, with average monthly active accounts of 13.4 million, down 1%.

Do UK players pay tax on gambling winnings?

No. Tax is levied on operators rather than players, through the statutory levy introduced by the Gambling Levy Regulations 2025 and commenced on 6 April 2025. Online operators and software licences pay 1.1% of previous-year gross gambling yield, with 0.1% to 0.5% for several land-based and lottery categories. The levy raised just under £120 million in its first year, ringfenced solely for research, prevention and treatment.

What are the safest online gambling sites in the UK?

The safest sites are those whose licence is on the Commission’s public register and whose terms match the licence: customer funds rated, a financial limit prompted before the first deposit, a withdrawal clause without frequency limits or manual review triggers, and an approved ADR provider named for disputes. Camouflage is a warning in itself. The Commission permits no bonus wagering above ten times, so a site advertising forty times is not licensed here.

Can offshore sites avoid a GamStop self-exclusion?

They are outside the scheme, but the exclusion still holds. GamStop blocks accounts with operators licensed in Great Britain, which are required by licence condition to participate and to check their whole customer base at least every 24 hours. An offshore site is not a way round the term; the exclusion runs for its full period and then remains in place until the person contacts GamStop to remove it.

What the Licence Actually Buys

Two numbers answer the question this page set out to ask. One is 96.3% — the share of 44.2 million withdrawals that cleared automatically for customers of large British-licensed operators between June and September 2024. The other is the £16.6 billion estimated to have been staked with illegal operators in 2025, a sum moving through sites where no Gambling Commission condition, no ten-times bonus cap and no free ADR route exists.

Between those two figures sits everything this page has described: the licence, the identity checks, the limit prompts, the dispute clock, the refund rules. A British licence is not a promise that nothing goes wrong — withdrawal complaints are still the Commission’s most common subject, which is precisely how we know the system is being measured. It is a promise about who answers when it does, and to whom. Where those conditions do not apply, the National Gambling Helpline is on 0808 8020 133, free, 24 hours a day. The last fact is the one to remember: a GamStop exclusion blocks the account the moment it is registered, and it does not end until its term does.

Content created by the «GamStop Fast Payout» team