Casinos Without GamStop and the Gap Where the Guardrails Stop

Casinos without GamStop are offshore operators holding no Gambling Commission licence, so they sit outside the scheme by definition rather than by evasion. Nothing in British law stops an adult playing on them, but no British protection follows the money: no GamStop block, no eight-week complaints deadline, no guarantee of the balance.

GamStop is the sort of idea that looks obvious once it exists. One registration, and a person is shut out of every online gambling company licensed in Great Britain — 6 months, a year, five years, or five years with auto-renewal. It is free, it is run by The National Online Self Exclusion Scheme Limited, and since 31 March 2020 every licensed operator has had to join it as a condition of its licence, under social responsibility code provision 3.5.5. The Commission introduced a requirement in April 2020 that operators check their entire customer base at least every 24 hours. In April 2020 it also suspended the licences of two operators, Dynamic (trading as Prophet) and Sportito, for missing the integration deadline. That is what enforcement looks like when a rule has teeth.

The trouble is the shape of the fence. It encloses the licensed market and nothing else. Offshore casinos without GamStop sit on the other side, and the Commission has no remit over a website it does not license. The regulator's own Illegal Markets team has spent the period since April 2024 issuing 3,140 cease and desist and disruption notices, referring 447,778 search URLs and securing 287,961 removals — and it still records that GEO IP blocking and registrar blocks work better than search-engine removal, because making a site hard to find is not the same as blocking it. Where money ends up, and what stands behind it, is the whole subject of what follows.

What "Without GamStop" Actually Means

The phrase is a description, not a category anyone administers. A casino without GamStop is simply one that holds no Gambling Commission licence and therefore has no obligation under LCCP 3.5.5 to query the register. Trade and press sources state flatly that offshore sites holding no Commission licence are not connected to the scheme. I would not treat that as a subtlety of law — it follows from the scheme's own terms of use, which describe obligations on participating operators. It is also worth noting that the scheme is very often typed "gamestop", which tells you how commonly the name is heard before it is written down.

The practical consequence runs further than a missing block. Self-exclusion with GamStop holds for its full term; at the end of the chosen term it stays in place until the person contacts GamStop to remove it. Under the terms last updated 20 May 2026, an unremoved registration is followed by a further automatic seven-year data period during which operators are told the person was previously excluded. Auto-renewal can only be switched off in the final six months of a five-year term, and it runs for up to four further five-year periods. None of this reaches a site that never queries the register. A casino without GamStop is therefore not a way round an exclusion, and presenting it as one gets the mechanism backwards: it is simply a place where the exclusion is invisible.

The scale is real but narrow. The Commission's November 2026 analysis estimates that 0.6 per cent of the whole adult population engaged with an illegal gambling website in the previous four weeks, and that among people who had gambled online in that period, 2.5 per cent had done so. Those are not enormous numbers, and they are also not zero — a few hundred thousand people, depending on how the margin is drawn.

The Numbers Behind the Scheme

Two sets of figures matter, and they pull in opposite directions.

The first is GamStop's own. There were 117,756 new registrations during 2025 and 561,983 active exclusions at the end of it, with 58,675 registrations in the final six months — an average of 319 a day. The first half of 2026 ran 16 per cent ahead year on year, and May 2026 set a monthly record at 12,236. As of the July 2026 publication, 614,738 people were on the register; more than one in two had taken the maximum five-year term, and only one in four had chosen six months. Under-25s were nearly one in three of the first-half 2026 exclusions, up 26 per cent. The 2025 annual report recorded the gender split as 94.3 per cent male and 5.7 per cent female.

The second is the regulator's. The Commission's Illegal Markets work already cited is the blunt instrument; the numbers on the other side of the ledger are the per-operator ones. The Commission's data for June to September 2024, cited in a speech on 6 November 2025, records 44.2 million withdrawals by customers of large online operators: 96.3 per cent cleared automatically, 3.5 per cent within 24 hours, and 0.1 per cent took up to 48 hours. Yet the Commission's Annual Report and Accounts 2024-25 states that, despite work with operators, withdrawal issues continue to cause most of the complaints it receives. Both things are true, and the gap between them is where players lose money.

I find that gap the most telling statistic in the whole file. A system that clears 96.3 per cent of payouts automatically is not a system with a payout problem. It is a system where the tail is long, expensive and concentrated on exactly the customers least able to absorb it.

Benchmarks Worth Checking

Not all offshore licences are alike, and treating them as one lump is lazy. The checkable benchmark here is Curaçao's, because it has just been rebuilt and the rebuild is public.

The National Ordinance on Games of Chance took effect on 24 December 2024, making the Curaçao Gaming Authority the direct licensing and supervisory authority and replacing the old master-licence model. The legacy "orange" sub-licence certificates ended on 15 October 2025 and, per the CGA, a historic /JAZ number must not be treated as proof of a current licence. Licensing ceased for Gaming Curaçao (18 August 2024), Curaçao eGaming (1 October 2024), Antillephone (1 November 2024) and Curaçao Interactive Licensing (31 January 2025). A valid licence at the LOK's commencement converted to a six-month provisional licence, extended to 24 December 2025. Supplier registration becomes enforceable from 24 December 2026.

A Curaçao B2C application costs a one-time non-refundable EUR 4,592, and the annual total is EUR 47,450 — a publication of 15 October 2025. Anjouan's published schedule is EUR 17,828 for B2C issuance and the same for annual renewal, with EUR 500 per additional domain. Malta's B2C regime asks EUR 5,000 to apply, a fixed annual EUR 25,000, and 5 per cent gaming tax on revenue, with minimum share capital of EUR 100,000 for Type 1 and 2 licences.

I would not read those figures as a quality ranking. I would read them as a price list, and note that the cheapest jurisdiction per annum is also the one an ABC News investigation of 31 December 2025 reported was described by a former attorney-general of the Comoros as "an illegal entity". Anjouan Gaming's own response, on 10 June 2026, was notably careful: a licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". That is a regulator telling you it cannot protect you in Britain.

Where the Money Sits and Protection by Licence Type

The one thing the site-angle question turns on is what stands behind the balance. On the British side the answer is documented, imperfect and enforceable. Offshore it is a mix of published standards, contractual wording and hope.

The British column is the reason I keep coming back to licence conditions rather than marketing. Keeping customer funds in a separate client account does not mean players get their money back if the operator becomes insolvent — the Commission says so plainly, and operators are legally allowed to hold that money in overseas bank accounts. Money staked in an open bet is not customer funds at all. What the British system gives is disclosure: the rating has to be in the terms, the customer has to acknowledge it, and an operator rated "not protected" must remind them once every six months, stating the value of funds held. An offshore site can say anything it likes in the same paragraph and nobody audits the sentence.

Why the First Payout Takes Longer Than the Rest

Identity verification is the hinge on which everything else turns, and the offshore version of it is where balances go missing. Under the money laundering regulations, an online casino must identify and verify a customer when they deposit, withdraw or win €2,000 or more — counting a single transaction and transactions that "appear to be linked". Licence Condition 17, in force since 7 May 2019, goes further for British licensees: the information establishing identity must be obtained and verified before the customer is permitted to gamble at all, and the Commission expects those checks brought forward to before a deposit or stake. British operators may use the "hybrid approach" of identifying at registration and fully verifying at the €2,000 threshold.

The first time is therefore a documented process. Documents typically requested are passports, driving licences and household bills; the Commission notes that companies can often verify by matching against credit reference agencies and the electoral roll, with no documents needed at all. Electronic verification can be instant; if documents are asked for, it takes longer, and the Commission declines to give a timescale because the length varies. Later withdrawals are usually frictionless because the identity is already established.

The warning signs are specific. A request for documents that arrives only when a withdrawal is attempted is the classic one — Licence Condition 17.1.1 says a withdrawal request must not trigger a demand for information the licensee could reasonably have requested earlier, and the Commission has said a delay on those grounds may be a breach. It reported in August 2026 that over a quarter of the complaints reaching its Contact Centre concern identity verification, and separately criticised "fuzzy matching" through third-party providers and onboarding on partial or equivocal verification. It also noted a detail I had not thought through: onboarding someone under a middle name rather than a forename can create mismatches against the GamStop register, which quietly undermines self-exclusion. The industry is now facing AI-generated false documents, deepfake videos and face swaps, per the Commission's July 2026 risk assessment. Offshore, none of these rules apply, and the €2,000 threshold may be the only trigger a player ever sees.

Delay Built Into the Terms

Terms that build in delay are the offshore speciality, and they are legal where they are written.

The British baseline forbids the worst of it. Reverse withdrawals were banned outright: RTS 14B, in force 31 October 2021, states that consumers must not be given the option to cancel a withdrawal request. Operators may not impose a maximum limit on the amount a consumer may withdraw from their deposit balance — the Commission's own example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". Un-staked deposits remain the customer's and cannot be confiscated for failing identity or age verification. The Competition and Markets Authority's undertakings, taken from six operators after an investigation running from October 2016 to April 2019, cover the same ground: no maximum withdrawal limits, no removal of funds from dormant accounts, no confiscation for unmet verification.

Note what those rules conspicuously do not contain: a deadline. The LCCP sets no fixed maximum number of days within which a withdrawal must be completed. The regime relies on the fair-and-open condition 7.1.1, the identity-verification condition 17.1.1 and the ban on unfair terms. That is an important admission — British protection is about the terms being fair, not the money being fast.

Offshore, the delays are written into the offer itself. Wagering multipliers of 35x to 50x on welcome bonuses and 40x to 60x on no-deposit offers, with cashout caps of something like €50 to €100, are the norm in the comparisons I have read, and a single operator's terms can cap withdrawable bonus winnings at 300 per cent of the bonus credited. The Commission capped wagering at ten times, from 19 January 2026, under SR Code 5.1.1, and said the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". An offshore site is not bound by that cap, and is under no obligation to let a player withdraw their deposit balance while a bonus is pending.

The reverse withdrawal ban deserves a moment. It exists because the option to cancel a withdrawal is, in practice, a lever for putting money back. Offshore sites that still offer it are not offering convenience.

Five Signs an Operator Can Be Trusted

Trust here is not a feeling. It is a set of things that can be looked up in under ten minutes.

The Licence Is Verifiable Through the Regulator's Own Register

A licence claim is worth nothing unless it can be checked at source. The Gambling Commission advises clicking through to the public register and checking whether the site's activities and domain names match the entry. Curaçao's Certificate of Operation Seal must redirect a click to cert.cga.cw, and if the certificate behind it shows a different domain from the one being visited, the site is displaying another operator's paperwork. Anjouan certificates carry a licence number and a QR code linking to a public register. Quick check: click the seal, read the domain on the certificate, and compare.

The Terms Are Findable Without Wading

LCCP social responsibility code 5.1.9 requires significant conditions of a marketing incentive to be provided transparently and prominently, and displayed in full no further than one click away. The Committee of Advertising Practice guidance from 11 September 2025 says the same for free bets and bonuses. Quick check: count the clicks from the offer banner to the full terms. If it is more than one, the operator has made a choice.

Withdrawals Are Not Conditional on New Information

Licence Condition 17.1.1 forbids demanding information at withdrawal that could reasonably have been requested earlier; LCCP also requires customers to be told before depositing what documents might be needed, in what circumstances and in what form. Quick check: see whether the operator's help pages state the document list before an account is opened, rather than after a win.

The Regulator's Own Warnings Do Not Name Them

Regulators publish the negative lists, and they are more useful than the positive ones. The MGA maintains a list of Unauthorised URLs, declaring it has no connection with those domains and that any reference to the MGA or a Maltese licence on them is false and misleading; entries carried notice dates of 30 October 2026. The Commission's public register and its enforcement notices do the equivalent on the British side. Quick check: search the regulator's name beside the operator's domain.

A Named Dispute Route Exists Before It Is Needed

Anjouan requires licensees to designate an Authority-approved ADR provider and to name it, with contact details, in player-facing terms, and expects complaints resolved within 30 days before escalation. Kahnawà:ke employs a full-time Dispute Resolution Officer. In Britain, the route is free and the clock is fixed. Quick check: find the named provider in the terms. If there is no provider, the only route left is a court in a jurisdiction nobody has named.

How to Check an Offshore Casino's Protections

Six steps, each with a reason. All of them are ordinary, lawful checks anyone can do before a penny moves.

1. Read the licence claim off the site, then verify it at the regulator. Note the licence number and the domain it is issued for, then check both against the regulator's own register. Reason: a certificate issued for a different domain is not evidence of anything.
2. Find the customer-funds disclosure and write down the rating. On British-licensed sites this is required in writing, with an acknowledgement before funds can be used. Reason: the rating is the only honest answer to whether the balance survives the operator's insolvency.
3. Read the bonus terms before the bonus, not after. Look for the wagering multiple, the maximum bet while wagering, any cashout cap, and whether the bonus is removed on withdrawal. Reason: those four numbers decide whether the offer is a gift or a debt.
4. Check the withdrawal section for a stated processing time and any repeat-withdrawal limit. Look for wording that permits only one withdrawal at a time — a term the Commission found unfair under the Consumer Rights Act 2015 when it took a £900,000 settlement from an operator in October 2026. Reason: a limit on how often you can be paid is a limit on how much you can be paid.
5. Identify the ADR provider named in the terms and check it against the regulator's approved list. Reason: an ADR route that does not exist is worse than none, because it absorbs the complaint instead of escalating it.
6. Set a deposit limit and, where offered, a bank-level block. The Gambling Commission's list of banks offering a gambling blocking service, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling; most use a 48-hour or 72-hour cooling-off before gambling transactions resume, and blocks are applied at card level. Reason: it is the one control that sits outside the operator's systems entirely.

The Offshore Terms That Change the Maths

Two clauses do most of the work of separating a fair offshore site from an unfair one, and neither is hidden in fine print — they are simply unread.

Maximum Cashout Clauses

A cap on how much of a bonus win can be withdrawn converts a headline offer into a smaller one. One operator's published terms limit withdrawable bonus winnings to 300 per cent of the credited bonus amount, with the excess voided. Another states that no-deposit bonuses cannot be mixed with deposits: if a deposit is made while a no-deposit bonus is active, the original wagering requirements and cashout cap still apply. The cap is the real value of the offer, and it is usually expressed as a percentage of the bonus rather than the headline amount — which is exactly why it reads so badly.

Wagering Contribution Charts

A wagering requirement is not one number, because different games count differently. A published contribution chart from one operator gives slots and specialty games 100 per cent, table games 20 per cent, video poker and blackjack 10 per cent, roulette and baccarat 5 per cent, and craps, jackpots and live dealer games 0 per cent unless stated otherwise. At 25x wagering, a slot player's requirement is the one advertised; a live dealer player's is, on that chart, unbounded. The British cap of ten times applies to bonus funds under SR Code 5.1.1 either way, and operators found to hold terms letting them void winnings at their own discretion have been penalised for it — a £170,000 fine in July 2025 included a clause allowing the operator to "close accounts or forfeit winnings" at its own discretion.

I would put it more sharply than the guidance does. A contribution chart is a price list for the privilege of playing your own bonus, and a 0 per cent row means the game you came for was never part of the deal.

Credit Cards, Bank Blocks and Limits

The British rulebook has removed several of the levers an offshore site still pulls.

Credit cards were banned for gambling from 14 April 2020 under licence condition 6.1.2, covering online betting, online casino and bingo and lottery payments, and operators must also check that money arriving from an e-wallet was not loaded from a credit card. Financial vulnerability checks became a licensing requirement in August 2024 at £500 net deposits over a rolling 30 days, lowered to £150 from 28 February 2025, and may only use publicly available risk flags such as a bankruptcy order, County Court Judgment, Individual Voluntary Arrangement, High Court Judgment, Administrative Order or Debt Relief Order. Financial Risk Assessments are being introduced in stages from 7 July 2026, starting with the largest operators at £5,000 net deposits in a rolling 24 hours for customers aged 25 and over and £2,500 for under-25s — a spend pattern fewer than 0.5 per cent of customers exceed. From 31 October 2025 every gambling business must prompt customers to set a financial limit before their first deposit, with setting a limit presented as the default under RTS 12E.

None of that reaches an offshore account. Where the site takes cards directly, the bank block on gambling Merchant Category Codes may still decline the payment — which is a useful accident, but not a policy. Crypto payments sit outside all of it: on Ethereum the protocol minimum is 21,000 units of gas for a value transfer, and the base fee is burned when the block is created; on TRON, a USDT transfer burns roughly 13 TRX without staked Energy, and about 26 TRX to a new wallet. Those are the mechanics, and none of them come with a vulnerability check attached.

Equity of Protection and Where the Two Markets Diverge

The remote casino sector generated £5.0 billion in gross gambling yield in April 2024 to March 2025, of which £4.2 billion came from slots, and the Commission's 2026 risk assessment rates the sector high risk for money laundering, unchanged. Total Great Britain gross gambling yield was £17.5 billion in the year to March 2026, up 4.4 per cent. The licensed market is large, taxed — the statutory levy raised just under £120 million in its first year, split 50 per cent treatment, 30 per cent prevention and 20 per cent research — and inspected.

Offshore, estimates of size vary by a factor of five depending on who is paying for the research, which is itself informative. Market-intelligence firm H2 Gambling Capital put stakes with illegal operators at £16.6 billion in 2025; a study by Frontier Economics for the Betting and Gaming Council estimated £2.7 billion staked annually online on the black market. When the same quantity produces numbers that far apart, the honest position is that nobody knows, and that both figures are being used to argue a case.

What I do accept is the direction. The Commission's own methodology combines web-traffic data with a licensed-play assumption and explicitly notes it does not capture activity hidden by VPNs. The Illegal Gambling Taskforce's terms of reference, published by DCMS on 13 May 2026, name three priorities: reducing payments to and from illegal operators, tackling online advertising of illegal gambling, and improving cross-agency enforcement. It runs for 12 months and meets at least twice a year. A taskforce meeting twice a year is not going to close a market, and pretending the estimate is precise does not make the response stronger.

The Balance Is the Whole Argument

Strip the branding and the argument reduces to a single question: if something goes wrong, what stands behind the number on the screen? On the British side there is a register, a set of licence conditions, an insolvency rating that has to be disclosed, a free ADR route with an eight-week clock, and a regulator that has shown it will suspend a licence over a missed deadline. On the offshore side there is a certificate, a jurisdiction priced at EUR 17,828 a year, and a clause about the operator's discretion.

That asymmetry is the fact worth keeping. The Gambling Commission's Illegal Markets team issued 546 cease and desist notices to illegal operators between July and September 2026 alone, and in the same quarter recorded 7,677,211 URLs referred in that quarter across 1,835 websites, against 366 websites in the preceding quarter. The fence is being repaired at speed, and the Commission's own evidence says the repair works: across 160 illegal gambling websites, average engagement fell 32 per cent after disruption, with registrar blocks producing a 91 per cent average fall. The gap is narrowing. It has not closed, and the balance sits on the far side of it until it does.

Questions I Get Asked

Are casinos without GamStop legal to use in Britain?

The offence sits with the operator, not the player. Section 33 of the Gambling Act 2005 makes it an offence for a person to provide gambling facilities without an operating licence, and the Commission states it is illegal to offer commercial gambling services to consumers in Great Britain without one, including where the operator holds another jurisdiction's licence. Playing on such a site is not, in itself, an offence.

Why does an offshore site never see a GamStop registration?

Because participation is a licence condition. LCCP social responsibility code 3.5.5 requires licensees to participate in the national multi-operator self-exclusion scheme, and since 31 March 2020 every licensed operator has had to join. A site holding no Commission licence has no such condition, no register to query, and no obligation to run the 24-hour customer-base checks that the Commission required from April 2020.

Does a self-exclusion lapse when the chosen period ends?

No. A GamStop exclusion holds for its full term and stays in place until the person contacts GamStop to remove it; it cannot be cancelled during the term. Under terms last updated 20 May 2026, an unremoved registration is followed by a further automatic seven-year period in which operators are told the person was previously excluded. Auto-renewal is the default trajectory unless stopped in the final six months of a five-year term.

Are payouts really slower on offshore casinos than British ones?

Not always, but the guarantees differ. Commission data for June to September 2024 shows 96.3 per cent of 44.2 million withdrawals clearing automatically. Yet the same regulator's 2024-25 annual report says withdrawal issues still cause most of the complaints it receives, and no licence condition sets a maximum number of days. British protection is about fair terms, not speed; offshore, there may be no terms worth the name.

What documents should an operator ask for, and when?

British licensees should tell customers before they deposit what documents may be needed, in what circumstances and in what form. Passports, driving licences and household bills are the common requests; electronic matching against credit reference agencies and the electoral roll can remove the need entirely. Under Licence Condition 17.1.1 a withdrawal must not trigger a demand for information the licensee could reasonably have requested earlier.

Can blocking software replace a licensing guarantee?

No, and it is not meant to. GamStop signposts Gamban and BetBlocker as extra layers: BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, free and without registration, while Gamban states it blocks licensed and unlicensed sites and is designed to be hard to remove. Both are fences around the device, not protection of the money already deposited.

What about pay-by-phone and live dealer offers?

These are the two shapes an offshore site most often takes, and both change the risk. Phone-bill deposits route money through a phone account, which sits outside any gambling Merchant Category Code block a bank can apply. Live dealer games are frequently excluded from wagering contribution charts or weighted at 0 per cent, so a bonus may be unwinnable in the game the site advertises most loudly. In both cases the licence and the terms are the only things worth checking.

The Fence Has a Gate, and It Is Marked

The British system does not stop adults gambling offshore; it stops the protections from following them there, and it says so in its own paperwork. The register, the disclosure, the ADR clock and the pension for research, prevention and treatment all sit on one side of a licence line, and the licence is the only thing that puts them there. Anyone weighing it up should start with the address the certificate was issued for, not the offer on the banner.

Where help is needed, the National Gambling Helpline is run by GamCare on 0808 8020 133, free, 24 hours a day, every day of the year; callers in Wales use 0808 2819 265. GamCare also runs live chat and WhatsApp, GamFam supports families through its GRA5P programme, Gam-Anon UK & Ireland supports the friends and family of gamblers, Gamblers Anonymous England, Wales and Ulster can be reached on 0330 094 0322 with around 250 meeting locations, and the NHS National Gambling Clinic at 69 Warwick Road, London SW5 9HB can be called on 020 7381 7722. Citizens Advice Scotland's gambling support line, 0800 328 1131, is open Monday to Friday, 10am to 3pm.

One number to end on, because it is the one that does not move: the scheme that keeps 614,738 people on its register as of the July 2026 publication has no jurisdiction over the sites that never ask.