Games not on GamStop are offered by operators that hold no Gambling Commission licence, so the national self-exclusion scheme cannot reach them. That is not a loophole: it is a legal gap. British-licensed sites must join GamStop, and offshore ones simply sit outside it.
GamStop, often typed "gamestop", is the scheme that blocks a person from every online gambling company licensed in Great Britain. The Gambling Commission built it into the licence itself: since 31 March 2020, every online operator has had to participate under social responsibility code provision 3.5.5. That single sentence does more work than any advertising claim on the internet, because it means a British licence and a GamStop connection arrive together or not at all. The scheme had 561,983 active exclusions at the end of 2025 and 614,738 consumers on the register as of July 2026, more than one in two of whom had chosen the maximum five-year term. Every one of those people is blocked at the licensed sites and unblocked at the rest. The trade press has spent years arguing about how many gamblers drift to the unlicensed market; the honest answer is that nobody has measured it cleanly, and the estimates run from £2.7 billion staked a year to £16.6 billion depending on who is paying for the study.
The site angle here is comparison: how British rules stack up against offshore ones, licence for licence, term for term. That is the only way to judge this market, because the difference between a well-run offshore site and a bad one is not a matter of taste. It is a matter of paperwork, and paperwork is checkable.
Table of Contents10
- Offshore Sites Are Not Licensed in Great Britain
- How the Licences Compare, Term by Term
- How a GamStop Block Works, First Time and Later
- Five Signs an Offshore Operator Can Be Trusted
- How to Check Any Operator Before Depositing
- Does an Offshore Site Get Round a GamStop Exclusion?
- Do the Cluster Terms Change Anything?
- What the Regulator's Own Numbers Say
- Frequently Asked Questions
- The Gap Between a Licence and a Logo
Offshore Sites Are Not Licensed in Great Britain
An offshore operator serving British players without a Commission licence is breaking section 33 of the Gambling Act 2005. That is the operator's offence, not the player's, and it carries on summary conviction up to 51 weeks in prison, a fine at level 5, or both. The Act applies whether the facilities are provided inside or outside the United Kingdom, provided at least one piece of remote gambling equipment sits in Great Britain — and the Commission has said plainly that holding a licence somewhere else changes nothing.
Which means the protections British players assume are absent, not weakened. There is no GamStop check. There is no requirement to take part in a multi-operator scheme. There is no LCCP condition 17 requiring identity verification before gambling, no wagering cap, no ban on reverse withdrawals, no financial vulnerability check at £150 of net deposits over 30 days, and no approved ADR provider at the end of a dispute. The Commission is a regulator, not an ombudsman, and it cannot get anyone's money back even when the site is licensed; on an unlicensed site it has no jurisdiction at all.
The Commission issued an industry warning notice on 20 January 2025 about casino games supplied by licensed operators turning up on unlicensed websites available to GB consumers. Its own words: such sites often target people who have self-excluded through GamStop. That is the uncomfortable core of this topic. An exclusion set through GamStop holds for its full term, and stays in place afterwards until the person contacts GamStop to remove it — a five-year term with auto-renewal runs up to four further five-year periods. None of that binds a company that never signed up to the scheme.
Further Support
If gambling is causing harm, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day of the year. In Wales the number is 0808 2819 265. GamCare runs both, and BeGambleAware points to the same line. There is also support for families through GamFam, and NHS gambling treatment clinics now operate across England.
How the Licences Compare, Term by Term
The comparison below is by licence and jurisdiction, never by brand, and it is the honest way to read the market. None of these licences makes a site legal in Great Britain. What they do is determine what happens when something goes wrong.
| Licensing regime | Annual cost to the operator | Player protection built in | Self-exclusion scheme | Redress route |
|---|---|---|---|---|
| Great Britain (Gambling Commission) | 1.1% of previous-year gross gambling yield under the statutory levy, plus licence fees | Licence condition 17 identity checks, 10× wagering cap, reverse withdrawals banned since 31 October 2021 | GamStop, mandatory since 31 March 2020 | Approved ADR provider, free to the consumer |
| Malta (MGA) | €25,000 fixed annual licence fee plus 5% gaming tax | Share capital of €100,000 for Type 1 and 2 licences | Operator-level arrangements | MGA complaints form, in English or Maltese |
| Curaçao (LOK regime) | €47,450 total: €24,490 licence fee plus €22,960 supervisory fee | Fund segregation and certified random number generators required | None mandated for British players | Operator-designated ADR provider |
| Anjouan | €17,828 annual renewal | Fund segregation, AML controls and age verification required | None mandated for British players | One of four approved ADR providers, complaints within 30 days |
| Kahnawà:ke | USD 20,000 annual CPA fee | Limits a player can set, including zero | Its own scheme, permanent and irrevocable | A full-time Dispute Resolution Officer |
Two numbers in that table deserve a second look. Curaçao's annual B2C fee of €47,450 is not trivial, and it is the reason the old sub-licence trade has collapsed: the LOK took effect on 24 December 2024, the legacy "orange" certificates of operation ended on 15 October 2025, and a historic /JAZ number is no longer proof of anything. Anjouan's €17,828 is roughly a third of the Curaçao price, and its regulator states that no licensing authority can exempt an operator from local law where local authorisation is required — a position that leaves the British player holding the bag.
How a GamStop Block Works, First Time and Later
The single thing this topic turns on is that GamStop is a closed list, and a closed list only excludes what is on it. Registration takes a few minutes and blocks the person from every GB-licensed online operator for 6 months, 1 year, 5 years, or 5 years with auto-renewal. It can take up to 24 hours for the block to bite. Once registered, the term cannot be cancelled or shortened; when it ends, it remains in place until the person contacts GamStop to remove it. If they never do, GamStop holds the data through a further automatic seven-year period during which operators are told the person was previously excluded. The Group's 2025 annual report devotes a section to its refusal to remove registrations early, which tells you how often it is asked.
The first time an exclusion matters, it works exactly as advertised at licensed sites. Operators must check their entire customer base against the register at least every 24 hours, a requirement the Commission introduced in April 2020, and that check also stops registered people receiving direct marketing. The mechanism is unglamorous and it holds.
Later, the seams show. A person can register under a middle name rather than a forename, and the Commission warned in August 2026 that this creates mismatches with records held elsewhere — including GamStop's own — which undermines the exclusion's effectiveness. Operators using third-party verification providers with loose fuzzy matching onboard people on partial or equivocal checks, and the Commission has said it is concerned about it. Then there is the plain gap: GamStop blocks only participating operators and cannot prevent access to services run by organisations that do not participate.
The warning signs of a hollow arrangement are worth naming. A site that asks for documents only at withdrawal, having waved the person through the deposit, is running a friction model, not a compliance one. A site whose terms claim sole discretion to void winnings — "we reserve the right" — is relying on a term the Commission regards as unfair under the Consumer Rights Act 2015. A site that offers to "skip" a self-exclusion is telling the truth about itself.
Five Signs an Offshore Operator Can Be Trusted
Trust is not a vibe. It is a document you can look at, and here is how to look at it.
A Licence You Can Verify at Source
Check the register, not the badge. Curaçao issues a Certificate of Operation Seal that must redirect to cert.cga.cw, and if the certificate behind it shows a different domain name from the site being visited, it belongs to another operator. Anjouan certificates carry a licence number and a QR code that resolves to a public register; anything that will not resolve should not be relied on. Malta publishes a list of unauthorised URLs that falsely reference an MGA licence, and it was still adding to that list in October 2026.
Terms That Do Not Keep a Trapdoor
Wagering requirements should be on the bonus only, capped and clearly stated. Kahnawà:ke requires its licensees' terms to be free of unfair or unreasonable clauses; BlueChip Casino caps bonus winnings at 300% of the credited bonus amount and caps bets at €5 while wagering; Ignition publishes a contribution chart where roulette counts 5% and live dealer games count nothing. A clear, harsh rule is a better sign than a vague, generous one.
A Named Dispute Route With a Real Deadline
Anjouan requires its licensees to name an approved ADR provider in player-facing terms and expects complaints resolved within 30 days before escalation. Kahnawà:ke employs a full-time Dispute Resolution Officer. Malta takes complaints in English or Maltese. A site that names no adjudicator, or names one that cannot be reached, has told you what a dispute there looks like.
Payment Terms That Do Not Penalise the Withdrawal
The Commission's position is that introducing friction at withdrawal rather than at deposit is unacceptable, and it fined a licensed operator £900,000 in October 2026 for exactly that, among other failures. The offshore equivalent is the maximum cashout clause. Read it before depositing, not after winning.
Fund Segregation You Can Actually Read About
Anjouan's published standards require operators to segregate player funds from operational funds; Curaçao's LOK regime does the same. Even so, a separate client account is not insurance: British guidance is explicit that holding customer funds separately does not guarantee their return if the operator becomes insolvent, and overseas accounts are permitted. On a GB licence the operator must at least declare a rating of "not protected", "medium" or "high" and remind customers every six months when the answer is the first.
How to Check Any Operator Before Depositing
Six steps, each with a reason, and all of them ordinary lawful checks anyone can run from a laptop.
- Find the licence number on the site and verify it at the regulator's own register. A licence is only as good as the register entry behind it, and the two are meant to match on domain name, not just on company.
- Read the withdrawal terms before the bonus terms. The withdrawal clause tells you how the operator behaves when it owes money; the bonus clause tells you how it behaves when it wants money. The first is the one that matters.
- Check whether the site appears on Malta's unauthorised URL list or on any register of ceased licences. The Curaçao transitional period ended on 15 October 2025 for legacy certificates, so anything still waving an orange sub-licence is advertising history.
- Look for a named ADR provider and its published time limits. Redress is the only protection that survives a dispute, and a named provider with a 30-day expectation beats a promise of fairness.
- Set a financial limit at account level before the first deposit, and confirm it in writing. British sites must prompt for this under the rules in force since 31 October 2025 and present it as the default; offshore sites rarely do, and the prompt is the difference between a decision made calmly and one made at 2am.
- Check the bank block and the blocking software independently of the operator. Eleven UK banks offer gambling blocks, applied at card level, so each card must be set individually, and most impose a 48- or 72-hour cooling-off before gambling payments resume. Gamban blocks licensed and unlicensed sites and costs £4.99 a month or £29.99 a year in England and Scotland, and is free in Wales; BetBlocker blocks over 1,368,000 gambling websites and needs no registration.
Does an Offshore Site Get Round a GamStop Exclusion?
No. It does not lift the exclusion, and it is not a route round it. A GamStop registration blocks a person from gambling with every online operator licensed in Great Britain, and it holds for its full term and then stays in place until the person contacts GamStop to remove it. An offshore site simply sits outside the scheme's reach, which is a fact about the operator's licence, not about the exclusion. Nothing about an unlicensed site shortens, cancels or bypasses a term that has been set.
Do the Cluster Terms Change Anything?
No. Casino games not on GamStop, gambling sites not on GamStop and slot games not on GamStop are three ways of describing one legal situation: an operator without a Commission licence. A UK gambling site not on GamStop is the same thing in different words, and a Welsh gambling site not on GamStop faces the same arithmetic — Wales has no separate licensing regime, and the only Welsh-specific number on this page is the National Gambling Helpline line for callers in Wales, 0808 2819 265.
The distinction that does matter is between offshore operators, not between phrases. One carries a verifiable licence, published terms and a named adjudicator. Another carries a badge image, a maximum cashout clause and an email address that stops replying. The search phrase is identical; the two are not.
What the Regulator's Own Numbers Say
The Commission's Illegal Markets team has been busy. Since April 2024 it has issued 3,140 cease and desist and disruption notices — 2,032 of them cease and desist — referred 447,778 Google and Bing URLs, and secured 287,961 removals. Its own analysis found that registrar blocks and website suspensions cut engagement by 91% on average, against 30% for Google removals and 8% for Facebook removals. GEO IP blocking managed 60%. The lesson the Commission itself draws is that making a site harder to find is not the same as blocking access to it.
Its survey work for April 2025 to April 2026 found that 2.5% of people who had gambled online in the past four weeks had engaged with an illegal gambling website, with a further 1.5% in the past year. Among the whole adult population, including non-gamblers, 0.6% had done so in the past four weeks and 94.4% showed no indication of using one at all. That is a small share of a large market, and it is the share this page is about.
Frequently Asked Questions
What gambling sites are not on GamStop?
Any operator without a Gambling Commission licence, because participation in GamStop is a licence condition under social responsibility code 3.5.5, mandatory for online operators since 31 March 2020. In practice that means sites holding Curaçao, Anjouan, Kahnawà:ke or Maltese licences, plus a long tail with no meaningful licence at all. A Maltese licence is a real licence, but it does not connect the operator to GamStop, and it does not authorise trading in Great Britain.
Are bingo games not on GamStop legal to play in Britain?
Playing is not the offence. Section 33 of the Gambling Act 2005 targets the person providing facilities for gambling without an operating licence, and the Act's general gambling offences attach to those who provide facilities, not to adult consumers. What the player loses is every protection that comes with a licence: the identity-verification duty, the wagering cap, the ban on reverse withdrawals, and any adjudicator who can order a payment.
Do offshore sites have to check identity at all?
Not to British standards. Under LCCP condition 17.1.1, a GB-licensed operator must obtain and verify a customer's identity before they are permitted to gamble, covering name, address and date of birth. Anjouan's published standards do require age verification and AML controls, and Kahnawà:ke requires enforceable contractual terms, so some check exists — but there is no British regulator standing behind it, and no Commission to complain to when it is done badly.
Why do withdrawals take longer at offshore sites?
Because nothing obliges them not to. Reverse withdrawals have been banned on GB-licensed remote operators since 31 October 2021 under requirement 14B, and LCCP condition 17.1.1 forbids demanding extra information at withdrawal that the operator could reasonably have requested earlier. Offshore, the standard tool is the maximum cashout clause instead: one operator caps withdrawable bonus winnings at 300% of the credited bonus and voids the excess. Read that clause first.
Is a Curaçao licence still worth anything?
Less than the badge suggests. The LOK took effect on 24 December 2024, direct CGA licensing replaced the old master-licence and sub-licence model, and legacy "orange" certificates of operation ended on 15 October 2025. A historic /JAZ number must not be treated as proof of a current licence, and the CGA's own portal went offline in October 2026 while it builds a replacement verification mechanism. A genuine Curaçao licence costs €47,450 a year.
Can blocking software cover the sites GamStop cannot?
Partly, and it is the most practical answer available. Gamban states it blocks licensed and unlicensed sites and is designed to be as hard to remove as possible, though TalkBanStop funding ended on 31 March 2026 and it now costs £4.99 a month in England and Scotland, free in Wales. BetBlocker blocks over 1,368,000 gambling websites and 3,100 apps with no registration. Bank blocks are the third layer, and they work at card level.
The Gap Between a Licence and a Logo
Offshore sites are not a clever workaround for British rules; they are a different jurisdiction, with different paperwork, different obligations and a much thinner safety net, and the only sensible way to read them is licence against licence, term against term. Check the register, read the withdrawal clause, find the adjudicator, and set the limit before the first deposit rather than after the first loss.
One last figure to keep in view. The Commission's Illegal Markets team referred 1,835 websites to search engines in July to September 2026 alone, carrying 7,677,211 URLs, and issued 546 cease and desist notices. Meanwhile the number of consumers on the GamStop register reached 614,738 as of July 2026, more than half of them on a five-year term. Both numbers are growing, and they are growing in the same market. Anyone weighing an offshore site against a licensed one is standing in the space between them.