Online Gambling UK What Protects Your Balance and What Only Looks Like It

Online gambling in the UK means betting or playing casino games on a site holding a Gambling Commission licence. That licence brings real protections: segregation of customer funds, withdrawal rules, the GamStop scheme and access to free dispute resolution. Offshore sites licensed elsewhere are not licensed in Great Britain, so none of it applies.

The British market is large, legal and heavily papered. Total gross gambling yield across Great Britain reached £17.5 billion in the year to March 2026, up 4.4 per cent on the previous year, and remote casino, betting and bingo alone accounted for £8.3 billion of it, up 6.9 per cent. Those are the Gambling Commission's own industry figures, published on 17 September 2026. The online-only picture for January to March 2026 was £1.55 billion, with 26.8 billion bets and spins and 13.4 million average monthly active accounts. Numbers like that explain why the market attracts operators who would rather not trouble the regulator.

They also explain the page you are reading. Most coverage of this sector is a shop window: a list of sites, a table of bonuses, a promise of speed. The interesting question is not which site is best — it is what actually stands between a player and their money when something goes wrong. That question has a documented answer, and the answer differs sharply depending on where the site's licence was issued. A Gambling Commission licence is not a guarantee of good behaviour; it is a set of enforceable obligations with a regulator behind them. An Anjouan or Curaçao licence, as we will see, is largely a fee receipt.

The Licence Is the Whole Argument

Anyone offering commercial gambling to consumers in Great Britain needs an operating licence from the Gambling Commission. The Commission has said so plainly: it is illegal to offer those services without a Commission licence, including where the operator holds a licence in another jurisdiction. That is the legal baseline, and it is worth holding on to, because the rest of this page is a series of consequences flowing from it.

The offence sits in section 33 of the Gambling Act 2005. Providing facilities for gambling without an authorising operating licence exposes the provider to up to 51 weeks' imprisonment on summary conviction, a fine up to level 5 on the standard scale, or both. For remote gambling, the section bites if at least one piece of remote gambling equipment used is in Great Britain, or if the operator knows or ought to know that the facilities are being used, or are likely to be used, here.

Two things follow. First, the offence is the operator's, not the customer's. Sections 47 and 49 of the Act make it an offence to invite, cause or permit a child or young person to gamble; section 42 covers cheating. Ordinary adult consumers placing a bet are not the target of the Act's gambling offences. Second, a licence from somewhere else changes nothing. The Commission's own summary of offences lists providing gambling facilities in Great Britain without a relevant licence, permit, notice or exemption as a section 33 offence by the operator.

Enforcement is real but lopsided. Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices — 2,032 C&Ds, 774 registrar referrals, 402 host referrals and 3 payment provider referrals — and referred 447,778 Bing and Google URLs, securing 287,961 removals. Across 160 illegal gambling websites with traffic data, engagement fell by an average of 32 per cent after disruption. By method, registrar blocks and website suspensions produced the largest average fall, 91 per cent each, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. The Commission itself concedes that search-engine removal makes a site harder to find without fully blocking it.

But prosecutions are rare. Across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced — a total of one, in October to December 2025. Disruption, not the criminal courts, is the working tool. That is a policy choice, and it means the practical protection for a player is not the threat of a prosecution; it is the licence condition attached to the site they are using.

The Benchmark for Automatic Withdrawals

One checkable number frames the whole question of whether a site pays. Gambling Commission data covering June to September 2024, cited in a speech delivered on 6 November 2025, records 44.2 million withdrawals by customers of large online operators in that period. Of those, 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours, and 0.1 per cent took up to 48 hours.

That is the standard a British-licensed site is measured against: essentially automatic payment, with the tail measured in hours rather than weeks. Earlier Commission data from some of the largest gambling companies showed those firms approving, processing and fulfilling around 99 per cent of withdrawal requests within 24 to 48 hours of the request.

Now the complaints side, which is where the benchmark gets uncomfortable. Problems with withdrawals from accounts have been the number one topic raised by consumers with the Commission's Contact Centre, and by July 2024 the Commission still said it received around 2,000 complaints a year about withdrawal delays. Its Annual Report and Accounts 2024-25 states that, despite work with some operators, withdrawal issues continue to cause most of the complaints it receives. Complaints coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025 — a decline, but not a small number.

The Commission's position on delay is unusually blunt. It is not acceptable for operators to introduce friction when a customer tries to withdraw rather than when they deposit, or to place commercial interests above the customer's. Where there are no regulatory concerns about a customer, there is no valid reason to delay a payout, and the operator should explain a delay or refusal — subject to the statutory prohibition on tipping off in money-laundering cases.

One structural point in the player's favour: reverse withdrawals are gone. Requirement 14B of the remote technical standards, in force since 31 October 2021, states that consumers must not be given the option to cancel a withdrawal request. Once a withdrawal is requested, the funds must not be offered back for deposit. The Commission's reason was evidence that the reverse button tempts engaged and vulnerable gamblers to keep playing.

What Customer Money Actually Gets

Here is the section that decides whether a balance is genuinely protected, and much of the trade press skips it.

A remote operator holding customer funds must keep them in a separate client bank account, distinct from its business accounts. "Customer funds" is defined in the licence conditions as cleared funds deposited for future gambling, winnings or prizes left on deposit or not yet accounted for, and crystallised but unpaid loyalty or other bonuses. Operators must pick one of three protection ratings — "not protected", "medium protection" or "high protection" — state which applies in their terms and conditions, and, if they are rated "not protected", remind the customer every six months that their funds are unprotected on insolvency, stating the value held.

The detail that matters: a separate client account does not mean customers get their money back if the operator becomes insolvent, and gambling businesses are permitted to hold customer money in overseas bank accounts. Segregation is a bookkeeping discipline, not insurance. Money staked within an open bet is not customer funds at all and falls outside any protection arrangement.

There is worse news for anyone who has taken a bonus. Under the Commission's guidance, wagering requirements must not apply to play with a deposit balance, deposit and bonus balances must be displayed separately, and a player must be able to withdraw their deposit balance at any time, including while a bonus is pending or active. Operators may not impose a maximum limit on what a consumer can withdraw from their deposit balance — the Commission's own example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week" — and un-staked deposits remain the customer's.

That is a strong set of rules. It is also the point at which the offshore comparison becomes stark, because none of it binds an operator without a Commission licence.

Best Online Gambling Sites UK Tests That Actually Sort Them

There is no honest list of the best online gambling sites UK players can use, because "best" depends on tests nobody publishes in a top-ten table. What can be compared is the machinery. Four tests sort operators more effectively than any star rating.

Licence and register

The Gambling Commission advises consumers to check that the business holds a British licence and to click through to the public register to see whether the site's activities and domain names match. The Commission can only regulate websites that trade or advertise to customers in Great Britain, and those must hold a Commission licence. The register is the primary source; anything else, including a badge on the page, is a claim.

Segregation and protection rating

Find the sentence in the terms that names the customer-funds protection rating — "not protected", "medium protection" or "high protection" — and the method used to achieve it. It must be given in writing and acknowledged before funds are used for gambling, on the first deposit and after any change to the terms. An operator rated "not protected" must remind the customer of that every six months with the value stated. If that sentence is absent, the site is telling you something by omission.

Withdrawal terms

Look for maximum withdrawal limits, per-transaction or per-day. A cap on withdrawing from a deposit balance is prohibited for British-licensed operators; a cost-reflective processing fee is not. Operators may reasonably limit the size or number of separate withdrawals, but only under a fair and transparent term made clear before the deposit, and the charge must not exceed the direct cost of processing. Compare that with terms that ringfence a withdrawal behind a manual review of every fifth or tenth request.

Dispute route

A licensed operator must let a customer refer an unresolved dispute to an approved alternative dispute resolution provider, free of charge, if the complaint is not settled within eight weeks. The approved list includes IBAS, eCOGRA, CEDR, ADR Group, Pegasus ADR Service, Blexr, ProMediate and Tattersalls Committee. The consumer must have used the operator's own complaints process first, and the operator may issue a deadlock letter. ADR providers will not take customer-service complaints, or complaints about a refusal to accept a bet.

ADR is not a soft option, and its numbers are sobering. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, of which "Deposits & Withdrawals" accounted for 150 valid disputes; the average time to resolve domestic disputes was 31 days, and 17.8 per cent of completed disputes were ruled in favour of the consumer against 82.2 per cent for the operator. Of 499 invalid disputes, 361 — 72.3 per cent — had not gone through the operator's internal complaint procedure first. IBAS's 2024-25 report records 3,721 domestic disputes, of which 217 were categorised as banking or financial disputes, with an average completion time of 20 days and 100 per cent operator compliance with decisions in the consumer's favour.

What does that tell a careful player? The operator wins most disputes, but the route costs the player nothing, and a well-documented complaint is worth lodging. It also tells you that most complainants lose their case on procedure rather than substance.

Payment method and payout mechanics

Different methods settle on different clocks, and the site's licence does not change that — it only decides whether the site is allowed to sit on the money. The table below sets out what is mechanically true of each route.

Read the crypto rows carefully, because they are where promises get thin. A casino advertising "instant" Bitcoin payouts is describing the network, not its own queue, and the network itself is probabilistic: a 10-minute block time does not mean a block in 10 minutes. On TRON, a USDT transfer to a fresh wallet costs roughly double a transfer to a wallet that already holds USDT, because it consumes about 130,000 Energy against 65,000. Somebody pays that, and the fee schedule tells you who.

Offshore Sites and the Two Faces of Their Licences

Offshore sites that hold no Gambling Commission licence are not connected to GamStop, and are not covered by the scheme, whose obligations apply only to operators licensed in Great Britain. That much is stated by trade and press sources rather than a single regulator page, though it is consistent with GamStop's own terms of use. It is also the least interesting thing about them.

The more useful question is what their licences actually do.

Curaçao Reform and British Licensing

Curaçao is not the laxity it was. The National Ordinance on Games of Chance took effect on 24 December 2024 and made the Curaçao Gaming Authority the direct licensing and supervisory authority, replacing the old master-licence and sub-licence model. The legacy "orange" sub-licence certificates ended on 15 October 2025, and the CGA says a historic /JAZ number or legacy seal must not be treated as proof of a current licence. Licensing activities ceased for the four former master licensors on dates running from 18 August 2024 to 31 January 2025.

The fees are published, which is refreshing. A B2C application costs a one-time non-refundable EUR 4,592, plus EUR 150 per ultimate beneficial owner and EUR 150 per qualified interest holder; the total annual B2C fee is EUR 47,450, split between a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee to the CGA, payable in full by 15 January. A B2B supplier licence carries a single EUR 24,490 annual supervisory fee. By comparison, Anjouan's published schedule is EUR 17,828 for B2C issuance, one-time, and the same for annual renewal, with EUR 500 per additional domain or URL. Malta's B2C regime charges a EUR 5,000 application fee, a EUR 25,000 annual licence fee and 5 per cent gaming tax on revenue, with minimum paid-up capital of EUR 100,000 for Type 1 and Type 2 licences.

Verification is where the CGA has been candid about its own weakness. Its Certification Policy says a Certificate of Operation Seal is issued only to B2C operators and only for an approved, registered player-facing domain; clicking it must redirect to cert.cga.cw, and a seal differing in design, colour or format means the site is not authorised. If the certificate behind the seal names a different domain from the one being browsed, the site is displaying another operator's certificate and should be treated as unauthorised or fraudulent. On 7 October 2026 the CGA announced that its previous online gaming portal would not return to service and that it was working on an alternative mechanism for verifying licensed domains. A third-party tracker reading the public register reported 704 Curaçao licences held by 698 operators, 552 of them active, at 03:30 UTC on 6 November 2026 — not a CGA publication, and worth treating as an estimate.

Anjouan Licence Public Relations

Anjouan is a constituent territory of the Union of the Comoros, and its framework rests on legislation adopted in 2005, including the Anjouan Computer Gaming Licensing Act. The Anjouan Gaming Authority names the Anjouan Offshore Financial Authority as the competent regulator and Anjouan Licensing Services Inc. as the sole authorised licence administrator. Its licences come in B2C and B2B categories covering casino, sports betting, poker and bingo, and it states there are no territorial restrictions under Anjouan law — while adding that licence holders must comply with all applicable laws where they operate.

That caveat has become the whole story. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally, and that a former attorney-general of the Comoros called Anjouan Licensing Services "an illegal entity". The same investigation reported that the AOFA was stripped of its status as a recognised regulator by Comorian banking laws passed in 2013 and 2015. Anjouan Gaming's own statement of 10 June 2026 conceded the principle: "An Anjouan Internet Gaming Licence is not, and has never been presented as, a universal authorisation to operate in every country in the world."

Anjouan's certificate framework does at least provide a check. Certificates carry a unique licence number and a QR verification code linking to the public register, and the regulator says certificates that cannot be verified there should not be relied upon as evidence of licensing status. Its standards require segregated player funds, certified random number generators, AML controls and age verification. Standards are not enforcement, but they are a starting point for a question.

Kahnawà:ke Contractual and Punitive Self Exclusion

The Kahnawà:ke Gaming Commission was established in 1996 and enacted its interactive gaming regulations on 8 July 1999, and it describes itself as having regulated interactive gaming longer than almost any other jurisdiction. Licensed operators must be hosted at Mohawk Internet Technologies in the Mohawk Territory, and the Commission's Logo Certificate Program, effective 15 January 2010, lets a player click the Commission's logo to generate a Certificate of Good Standing confirming whether a site holds a valid permit.

Its rulebook has teeth in an unexpected place. Kahnawake requires a licensee's relationship with players to be contractual and free of unfair or unreasonable terms, requires sites to let a player set limits including zero, and states that its voluntary self-exclusion is permanent and irrevocable. A player who breaches a self-exclusion prohibition forfeits any funds deposited or won to a third-party charity selected by the Commission, and the Commission employs a full-time Dispute Resolution Officer. That is a harsher regime than the British one in one respect and a thinner one in another: no statutory protections, but a regulator that will confiscate to a charity rather than let a self-excluded player collect.

Malta, and the ones with nothing at all

Malta's Gaming Authority is the most substantial of the offshore options. A B2C licence is required where a Maltese or EU/EEA entity offers a gaming service from Malta, to a Maltese person, or through a Maltese legal entity. The MGA publishes a list of Unauthorised URLs, declaring no connection with those domains and that any reference to the MGA or a Maltese licence on them is false and misleading, with the most recent entries carrying notice dates of 30 October 2026. It also asks players to lodge complaints through a form it reviews in English or Maltese. Malta is not Great Britain, and an MGA licence does not bring GamStop, the British ADR list or the LCCP — but it is at least a regulator with a website, a complaints form and a blacklist.

Then there is Costa Rica, where the industry's favourite phrase — "data processing license" — describes something that is not a licence in the strict legal sense at all. Costa Rica operates no comprehensive gambling licensing regime, its Legislative Assembly rejected Bill No. 25,057 in early 2026 (a bill that would have created a mandatory licensing regime), and games of chance are generally prohibited under Costa Rican law, with only land-based casinos integrated into qualifying hotels authorised. A "licensed in Costa Rica" badge means, in substance, that nobody is supervising.

The GamStop Detail Nobody Explains Properly

If one mechanism decides what protection is available to a player, it is identity verification — the checks that decide whether the site knows who it is dealing with, and whether a self-exclusion is going to hold.

The scheme's name is written GamStop. It is often typed "gamestop", because the word "game" suggests itself; the name is stated as GamStop in the register either way. GamStop Online is the UK's national online self-exclusion scheme, run by The National Online Self Exclusion Scheme Limited, company number 10504973, at 3 Greengate, Cardale Park, Harrogate, HG3 1GY. It is free to users. It was established in June 2017 by the Remote Gambling Association at the request of DCMS and the Gambling Commission, and went live on 27 April 2018. In November 2025 it was renamed "Gamstop Online" after a website update, and the betting-shop scheme formerly known as MOSES became "Gamstop Betting Shops".

Registration blocks a person from gambling with all online gambling companies licensed in Great Britain for six months, one year, five years, or five years with auto-renewal. Signing up takes a few minutes; the block can take up to 24 hours to take effect. Once registered, the exclusion cannot be cancelled during the period, and it stays in place after the chosen period ends unless the person contacts GamStop to remove it. Under the terms of use, auto-renewal may only be switched off during the last six months of a five-year minimum exclusion period, and auto-renewal continues for up to four further five-year periods. If the registration is not deactivated after the chosen period, GamStop holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded. GamStop does not remove registrations early, and its 2025 annual report devotes a section to refusing to do so.

The scale of this is not small. GamStop recorded 117,756 new registrations during 2025 and had 561,983 active exclusions at the end of the year, with 58,675 registrations in the final six months — an average of 319 a day. Registrations rose 16 per cent year on year in the first half of 2026, with May 2026 setting a monthly record of 12,236 sign-ups. As of July 2026 the register stood at 614,738 people currently excluded, of whom more than one in two had opted for the maximum five-year term; across all age groups only one in four had chosen six months. Of the periods selected in 2025, 29 per cent chose six months, 24 per cent a year, 25 per cent five years and 22 per cent auto-renewal. Under-25s accounted for nearly one in three of all self-exclusions in the first half of 2026, a 26 per cent year-on-year increase. The 2025 annual report recorded the gender split as 94.3 per cent male and 5.7 per cent female.

Now the part that concerns this page. Participation is a licence condition, not a courtesy: since 31 March 2020 all online gambling operators must belong to GAMSTOP as a condition of their Gambling Commission licence, under social responsibility code provision 3.5.5, which states that licensees must participate in the national multi-operator self-exclusion scheme. In April 2020 the Commission required operators to check their entire customer base for GamStop registration at least every 24 hours, which also stopped registered people receiving direct marketing. On 3 April 2020 the Commission suspended the licences of two online operators for failing to integrate by the deadline. A breach of a social responsibility code is a breach of licence condition by virtue of section 82(1) of the Gambling Act 2005.

All of that applies to Great Britain. What it does not reach is the point the Commission itself flagged in an industry warning notice on 20 January 2025 about casino games from licensed operators appearing on unlicensed websites available to GB consumers: those sites often target customers who have self-excluded via GAMSTOP, and may have inadequate social responsibility and anti-money-laundering controls. There is no honest way to soften that. An offshore site is not a round the block, and nobody should be sold it as one.

The same logic runs through the ordinary identity checks, which is where most of the friction actually lives. Licence Condition 17 requires a licensee to obtain and verify information establishing a customer's identity before that customer is permitted to gamble, covering at least name, address and date of birth, and must tell customers before they deposit what documents or information they may need to provide. Companies can often verify electronically by matching an account against credit reference agency and electoral roll data, in which case no documents are needed; where documents are required, the Commission will not give a timescale because it varies, and a selfie may be requested where fraudulent activity — such as an account opened in someone else's name — is suspected.

Two rules then bite in the player's favour. Licence condition 17.1.1 states that a withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier, though this does not prevent it seeking information it must obtain at that point under another legal obligation, such as an anti-money-laundering requirement. And operators cannot confiscate customer funds on the basis that identity has not been provided. The Commission has said that where a business delays a withdrawal because of insufficient ID it may be in breach of Licence Condition 17 and may face regulatory action.

The warning signs, in practice:

• Documents requested for the first time at withdrawal. The Commission says over a quarter of complaints reaching its Contact Centre concern identity verification, and that this is a concern customers raise when asked for documents only on attempting to withdraw. It has also expressed concern about operators using "fuzzy matching" through third-party providers and onboarding customers on partial verification.
• A name mismatch nobody flagged at sign-up. Onboarding a customer using a middle name instead of a forename can create mismatches with records held elsewhere, including GAMSTOP — which the Commission notes undermines the effectiveness of self-exclusion itself.
• A threshold that appears only when you try to leave. Anti-money-laundering rules do require identification and verification at €2,000 or more in a remote casino, counting a single transaction and linked transactions — including activity within a single logged-on period. A threshold applied at deposit is the rule working; the same threshold appearing at withdrawal, on money already staked and won, is the rule being used as a gate.
• A term reserving sole discretion. Terms letting an operator "reserve the right" or act at its "sole discretion" to void or withhold winnings are unfair within the meaning of the Consumer Rights Act 2015, and the Commission says such terms undermine a fair and open relationship.
• A refusal to explain. Where a payout is delayed or refused, the Commission expects the operator to say why, subject to the tipping-off prohibition. Silence is a signal in itself.

Five Signs a UK Online Gambling Site Can Be Trusted

Each of these can be checked before a penny is deposited, and each takes about two minutes.

A Commission licence you can find on the public register

Check the Commission's public register and confirm the domain names and activities listed match the site you are on. The Commission's own advice is exactly this: check that the business holds a British licence, then click through to the register and compare. A licence number in the footer proves nothing on its own — a number that does not resolve to this domain, offering these products, is a decoration.

A stated customer-funds protection rating

Search the terms and conditions for "customer funds" and the phrase "not protected", "medium protection" or "high protection". Licence condition 4.2.1 requires the operator to state which rating applies, in writing, and to obtain the customer's acknowledgement before funds are used for gambling — on the first deposit and after any change to the terms. An operator rated "not protected" must remind the customer of that every six months with the value of funds held. If you cannot find the sentence, the site has failed a written obligation.

Withdrawal terms with no cap on your own money

Look for a maximum withdrawal limit on the deposit balance. The Commission's guidance gives "You may withdraw up to £50 per day and up to £500 per week" as its example of a prohibited term. A transparent, cost-reflective processing fee is allowed, and so is a reasonable limit on the size or number of separate withdrawals — but only if it is clear before the deposit and does not exceed the direct processing cost.

A named ADR provider on the approved list

Find the alternative dispute resolution provider named in the complaints section, and check it against the Commission's approved list: ADR Group, Pegasus ADR Service, Blexr, CEDR, eCOGRA, IBAS, ProMediate and Tattersalls Committee. Licensed operators may use only approved providers, and the service must be free to the consumer. No name, no route.

Terms that are readable, and an operator that has been held to them

Check whether significant conditions of any offer are given transparently and prominently, and — online — in full no more than one click away. Then look at the enforcement record. In July 2025 a firm was fined £170,000 for failures including a bonus term stating it had "the right at their own discretion to close accounts or forfeit winnings". In October 2026 another operator agreed a £900,000 payment in lieu of a penalty for failures including unnecessarily delaying consumer withdrawals — a term limiting customers to one withdrawal request at a time, found unfair under the Consumer Rights Act 2015, and manual review of every fifth or tenth withdrawal for some customers.

How to Judgement-Check an Online Gambling Site UK Players Might Use

Six steps, in order, each with the reason it earns its place.

1. Confirm the licence on the Commission's public register, including the domain. The register is the primary source, and the Commission can only regulate sites trading or advertising in Great Britain. A licence that does not name the domain you are on tells you nothing about the site you are on.
2. Read the customer-funds clause and note the protection rating. Segregation into a client account does not mean the money survives an insolvency, and operators may hold customer funds in overseas accounts. The rating — and the six-monthly reminder if it is "not protected" — is the only honest signal of what happens if the business folds.
3. Read the withdrawal section for caps, fees and review triggers. A cap on withdrawing a deposit balance is prohibited under British licence conditions, and a fee must not exceed the direct processing cost. A stated policy of manual review on every fifth or tenth withdrawal is the friction the Commission has specifically criticised.
4. Read the bonus terms for the wagering figure and the maximum cashout. Since 19 January 2026 wagering requirements on bonus funds are capped at ten times for British-licensed operators, mixed-product promotions are banned, and stakes on deposit balances must not count towards wagering. This is why the multiplier on an offer is a licence question, not a generosity question — see the section below.
5. Check the identity and verification policy before depositing. Licence Condition 17 requires verification before gambling and requires the site to tell customers in advance what documents may be needed. A site that says nothing until withdrawal has breached a written obligation.
6. Set a financial limit at the point the site prompts for one. Since 31 October 2025 operators must prompt customers to set a financial limit before the first deposit, present it as the default option, remind them every six months to review account information, and offer limits via a free-text box at account level. Declining is an action the customer must take and confirm, not a passive default.

Where Bonus Terms Are Really Licence Terms

The question of online gambling offers UK players should judge is not how big the offer looks, but which obligations the offer sits under.

The British rules changed on 19 January 2026, having been moved from 19 December 2025. Social responsibility code 5.1.1 now states that licensees must not apply wagering requirements requiring a customer to play through bonus funds more than ten times, and must not include more than one type of gambling product — betting, casino, bingo and lottery — within an incentive. The Commission chose a cap over an outright ban, judging that licensees would otherwise be highly likely to introduce terms preventing customers cashing out bonuses, and noted the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". The mixed-product ban bites on linked and shared terms: "Bet £5 and get £10 free bet" is compliant; "Bet £5 to get 20 free spins" is not; and so is a prize that is itself mixed.

The mechanism that matters most is the weighting chart. A 25× requirement on slots that becomes 250× on blackjack is not a 25× requirement — it is a 250× requirement with a flattering headline, and offshore terms routinely carry these tables while British-licensed operators cannot use them to raise the effective multiple on bonus funds. The same goes for maximum bet rules: one published offshore set rejects any bet above roughly €5 during wagering and may close the account and forfeit winnings for a breach, which converts a single misjudged spin into a total loss.

Sticky bonuses — where the bonus amount can be wagered but never withdrawn, and is removed at cashout — are now essentially absent from the British market, because the guidance requires deposit and bonus balances to be displayed separately and play with the deposit balance to sit outside wagering. In the offshore market the same product survives in the maximum cashout clause by another name. And remember the direction of travel: British operators may not impose a maximum limit on withdrawing from a deposit balance at all, while offshore terms can cap bonus-derived winnings at a multiple of the bonus.

There is one more asymmetry worth naming. The UK rules apply to an operator's whole licence, which is why enforcement lands. A 2026 enforcement case turned on a term limiting customers to one withdrawal request at a time — found unfair under the Consumer Rights Act 2015 — while another penalty in July 2025 concerned a term reserving discretion to close accounts or forfeit winnings. Those terms are not exotic. They are ordinary in unregulated markets, and they are precisely what the licence condition forbids.

What Online Gambling Refunds and Complaints Look Like in Practice

The phrase online gambling refund UK turns up often enough to deserve a straight answer, and the straight answer is that there are three different routes, with three different standards of proof.

The first is the operator's own complaints process. Licence holders should allow customers to raise complaints for at least six months from the date of the incident, acknowledge a complaint within 24 hours where they offer 24-hour gambling facilities, and complete the entire process including internal escalation within eight weeks of first receipt. The eight-week clock can be paused if the customer does not respond to a reasonable information request within seven days.

The second is alternative dispute resolution, free to the consumer. Social responsibility code 6.1.1 requires licensees to have arrangements for referring a dispute to an ADR entity at no cost if it is not resolved to the customer's satisfaction within eight weeks, and the consumer must have gone through the operator's procedure first. ADR providers must receive information from licence holders in full and within ten working days. They will consider disputes about account management and the ability to access funds, including compensation for expenses, inconvenience or difficulty — but not customer-service complaints or a refusal to accept a bet. Timing limits matter: eCOGRA may refuse a dispute where the site is not on its approved list, where at least two weeks have not passed since the problem began, or where it arose more than a year ago; approved providers generally may require submission within not less than 12 months of the operator's notice that it could not resolve the complaint.

The third is the regulator — and here the expectations need calibrating. The Commission is a regulator, not an ombudsman. It cannot resolve individual complaints or help consumers get their money back, though it records all complaints and typically refers disputes to an independent third party. A consumer who writes to the Commission expecting a refund has misread the architecture; a consumer who writes to it with evidence that a licensed operator is breaching a condition is doing something genuinely useful.

On self-exclusion the rules are stronger than most players realise. The LCCP requires licensees to close any customer account of an individual who has entered a self-exclusion agreement and return any funds held in that account, and states that merely preventing the individual from withdrawing funds while still accepting wagers is not sufficient. That is a detail worth knowing: an exclusion is not supposed to leave money stranded on the books.

And on bank-side blocks, which are the cheapest protection available: the Commission's list of banks offering a gambling block (last updated 16 October 2026) names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. These decline payments to merchants categorised under gambling merchant category codes, cover online casinos, betting websites, gaming apps and physical venues, and are applied at card level, so each card needs activating separately. Most banks use a 48-hour or 72-hour cooling-off period before gambling transactions are allowed again after a block is switched off, and blocks do not affect a credit score.

Do the Numbers Say Offshore Sites Are Winning?

The honest answer is that nobody knows precisely, and the estimates disagree in an instructive way, because the people producing them are arguing a case.

The Gambling Commission's own analysis, published on 5 November 2026 and covering April 2025 to April 2026, estimates that across the whole population including non-gamblers, 0.6 per cent of respondents engaged with illegal gambling websites in the past four weeks and a further 0.4 per cent in the past 12 months, while 94.4 per cent showed no indication of using one. Among respondents who had gambled online in the past four weeks, the estimate rises to 2.5 per cent, with an additional 1.5 per cent in the past 12 months. The Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to GB consumers identified in September 2026 — 4 per cent less than the previous three-month average but 4 per cent more than September 2025 — and 311 sites had disruption action taken against them in the second quarter of 2026-27, with 77 per cent of disrupted websites showing reduced estimated traffic.

Then the estimates with an interest. Market-intelligence firm H2 Gambling Capital puts the amount staked with illegal operators in the UK at £16.6 billion in 2025, up from about £5 billion in 2019, with the proportion of gambling happening legally falling from 97 per cent in 2019 to 92 per cent in 2025. A study by Frontier Economics for the Betting and Gaming Council conservatively estimated £2.7 billion staked annually online on the black market, 2.1 per cent of the £128 billion staked with GB-regulated remote operators, involving 1.5 million Brits, with a further £1.6 billion possibly staked in person. Yield Sec analysis for the Campaign for Fairer Gambling puts the GB online market at £8.8 billion gross gaming revenue in 2025, split 91 per cent regulated and 9 per cent unregulated, against 93 per cent and 7 per cent in 2024. PwC work for the same trade body once found the unlicensed share of online stakes rising from 1.2 per cent in 2018-19 to 2.3 per cent in 2020.

The Commission's own methodology for estimating the unlicensed market combines web-traffic data with a licensed-play assumption of £0.32 gross gaming yield per minute for online slots, and explicitly notes it does not capture activity hidden by VPNs. That caveat should travel with every number above. A range from 2.1 per cent to 9 per cent depending on who is measuring is not a range that settles anything.

What the numbers do establish is that the unlicensed market is not a rounding error, and that its growth coincides with the tightening of British rules. That is a correlation, not a proven cause, and it should be handled as such. The Illegal Gambling Taskforce's terms of reference, published by DCMS on 13 May 2026, set three priorities: reducing payments to and from illegal operators, tackling online advertising of illegal gambling, and improving cross-agency enforcement. It runs for twelve months and meets at least twice a year. Small machinery for a £16.6 billion estimate.

UK Gambling Participation and Site Numbers

Two of the most-searched questions in this cluster have answers that are less useful than they look, because both depend on definitions.

On participation: 47 per cent of adults aged 18 and over gambled in some form in the past four weeks, falling to 27 per cent when those who only took part in lottery draws are excluded. Those figures come from the third annual Gambling Survey for Great Britain, published 16 July 2026, based on 20,775 adults with fieldwork from January 2025 to January 2026. On harm, 2.4 per cent of participants scored 8 or more on the Problem Gambling Severity Index, 3.5 per cent scored 3 to 7 and 7.8 per cent scored 1 to 2, and the Commission describes the PGSI 8+ figure as stable across the survey's three years: 2.5 per cent in 2023, 2.7 per cent in 2024 and 2.4 per cent in 2025. Among those who had gambled in the past 12 months, 3.4 per cent had sought support because of their own gambling, and 2.7 per cent reported one or more severe consequence, with relationship breakdown the most reported at 1.7 per cent.

On the number of sites: there is no register count worth quoting as a consumer, because "site" and "operator" are different things — one licence can cover a dozen brands — and the Gambling Commission's operator dataset covers roughly 70 per cent of the online market, the largest operators, and is explicitly not comparable with its industry statistics, partly because it may include free bets and bonuses. The more meaningful number is the illegal one: just over 1,000 unique illegal gambling websites were accessed by consumers in Great Britain over May 2024 to July 2025, and the count identified through the Commission's affiliate-page method rose from 364 in May 2024 to 535 in July 2025, with crypto-casino search terms added to the methodology in December 2024.

For remote casino specifically, gross gambling yield was £5.0 billion in April 2024 to March 2025, of which £4.2 billion came from slot games. Online slots yield then rose 12 per cent year on year to £773 million for the January to March 2026 quarter, on 25.1 billion spins and 4.8 million average monthly active accounts, up 6 per cent. The Commission's 2026 risk assessment rates the remote casino sector as high risk for money laundering, unchanged from the previous rating, and reports an increase in the scale and sophistication of attempts to bypass checks using false documents, deepfake videos and face swaps generated by AI.

Two of the white paper's measures are worth knowing because they affect how a site behaves towards a customer before any complaint arises. The £5 maximum stake per game cycle for online slots took effect on 9 April 2025, with a £2 limit for adults aged 18 to 24 from 21 May 2025 — online slots only, not roulette or blackjack — and a minimum of 2.5 seconds must elapse between game cycles. On affordability, financial vulnerability checks became a licensing requirement in August 2024 at a £500 net-deposit threshold over a rolling 30 days, lowered to £150 net deposits over 30 days from 28 February 2025, using only publicly available risk flags such as a bankruptcy order, a County Court Judgment or an Individual Voluntary Arrangement. Financial Risk Assessments are a separate and later arrival: announced on 7 July 2026 to be introduced in stages, starting with the largest operators at £5,000 net deposits in a rolling 24-hour period for customers aged 25 and over and £2,500 for under-25s, and ending at £1,000 in 24 hours or £3,000 over 90 days for over-25s.

Online Gambling Slots and Games UK Players Actually Get

The games themselves are the least protected part of the British offer, which surprises people.

Stake limits bite on slots, and only slots. That means the game with the fastest cycle — 25.1 billion spins in a single quarter, a minimum 2.5 seconds per cycle — is the one with a statutory ceiling of £5 per cycle, or £2 for under-25s, while roulette and blackjack carry no equivalent cap. The Commission's reasoning is that speed and stake compound; the practical effect is that a player seeking a slower game is offered fewer legal guardrails, not more.

The anti-money-laundering framework is where the gaming and the money meet. Identification and verification are required in a remote casino when a customer deposits funds to take part in remote gambling, or withdraws such funds or winnings, amounting to €2,000 or more — a threshold that applies to a single transaction and to transactions that appear to be linked, including activity forming part of the customer's overall activity during a single logged-on period. A remote casino may identify customers and verify their age at registration but defer full verification until that threshold is triggered; the Commission calls this the hybrid approach. Remote casinos should also note that, absent safeguards, non-face-to-face relationships must be treated as high risk, requiring enhanced due diligence, and for higher-risk accounts the operator must establish source of wealth rather than merely source of funds. Documents a business can ask for include passports, driving licences and household bills, and it may obtain bank statements to check that funds are legitimate, or ask for an explanation of irregular income such as a pending house sale.

The Commission expects identity and age checks to be brought forward to before a customer deposits or stakes, and says onboarding on incomplete or inaccurate information — initials instead of full names, nicknames, commercial addresses instead of residential — is not sufficient. It lists the failure to scrutinise source-of-funds documents properly as a new operator-control risk rated medium likelihood and high impact, and "smurfing" — many low-level transactions to evade the threshold — as a medium-likelihood, high-impact customer risk. One case study in the 2026 risk assessment describes a customer depositing approximately £40,000 over six months using accounts created with the details of five different individuals. That is what the paperwork is for, and it is why a site that asks sensible questions early is not being difficult.

Online Gambling UK Frequently Asked Questions

Is online gambling legal in the UK?

Yes, when the operator holds a Gambling Commission licence. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an authorising operating licence, with up to 51 weeks' imprisonment, a level 5 fine, or both on summary conviction; the offence is the operator's, not the adult customer's. Section 33 applies to remote gambling if at least one piece of remote gambling equipment is in Great Britain, or if the operator knows the facilities are likely to be used here.

Is online gambling legal in the UK if the site is licensed abroad?

No. The Commission states it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence in another jurisdiction. An Anjouan or Curaçao licence is not a British licence, and the Commission can regulate only websites that trade or advertise to customers in Great Britain. British protections — the LCCP, GamStop, the approved ADR list — do not follow the site's own regulator's paperwork.

How many people gamble online in the UK?

The Gambling Survey for Great Britain, based on 20,775 adults with fieldwork from January 2025 to January 2026, found 47 per cent of adults had gambled in any form in the past four weeks, falling to 27 per cent when lottery-only participants are excluded. Separately, 2.4 per cent scored 8 or more on the Problem Gambling Severity Index, a figure the Commission describes as stable across the survey's three years.

How many online gambling sites are there in the UK?

No consumer-useful count exists, because one licence can cover many brands. The Gambling Commission's operator dataset covers roughly 70 per cent of the online market and is not comparable with its industry statistics. The count with real meaning is the illegal one: just over 1,000 unique illegal websites were accessed by GB consumers between May 2024 and July 2025, and 586 were identified as accessible in September 2026.

Do UK online gambling winnings get taxed?

Winnings are not taxed as income for the player; the duty falls on the operator. Since 6 April 2025 a statutory levy has applied to licensees, at 1.1 per cent of previous-year gross gambling yield for all online operators, raising just under £120 million in its first year and ringfenced solely for research, prevention and treatment of gambling-related harm. The levy is split 20 per cent research, 30 per cent prevention and 50 per cent treatment.

What happens if a withdrawal is delayed or refused?

Use the operator's complaints process, which should be completed within eight weeks of first receipt; then refer the dispute free of charge to an approved ADR provider. The Commission is a regulator, not an ombudsman, and cannot recover money for an individual. Terms letting an operator act at its "sole discretion" to void winnings are unfair under the Consumer Rights Act 2015, and delays caused by ID requested only at withdrawal may breach Licence Condition 17.

Where can someone get help with gambling?

The National Gambling Helpline is operated by GamCare on 0808 8020 133, free, 24 hours a day, every day of the year; callers in Wales have a separate number, 0808 2819 265. NHS treatment is commissioned across England, with the NHS National Gambling Clinic in London on 020 7381 7722, and GamFam supports families through its GRA5P peer-support programme. Citizens Advice gives free, confidential help with gambling-related debt, and Citizens Advice Scotland runs an advice line on 0800 328 1131.

Can an offshore site get round a GamStop self-exclusion?

No. GamStop blocks a person from gambling with all online gambling companies licensed in Great Britain, and the exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it — it cannot be cancelled during the period. Offshore sites are not connected to the scheme at all. The Commission's January 2025 warning notice specifically flagged that unlicensed sites often target customers who have self-excluded.

The Balance Is Only as Protected as the Licence Behind It

Everything on this page reduces to a single proposition: in British online gambling the protection is the licence, and the licence is a set of written obligations with a regulator willing to enforce them — 3,140 cease and desist and disruption notices since April 2024, a £900,000 settlement in October 2026 for putting obstacles in front of withdrawals, a penalty in July 2025 for a term reserving discretion to forfeit winnings. Strip the licence away and a player keeps the game and loses the paperwork, which is why the offshore version of "instant payouts" and the British version are not the same offer with different branding.

If this page is worth one action, make it this: before depositing anywhere, read the customer-funds clause and find the protection rating, then check the licence against the Commission's public register and compare the domain. Nine words of terms will tell you more than any bonus table.

And if gambling stops being a pastime and starts being a problem — for the reader or for anyone in a household — the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day of the year. GamStop, meanwhile, is holding 614,738 active exclusions as of July 2026, more than half of them for the full five years, which suggests a great many people have already reached that conclusion for themselves.