Online Casinos Not on GamStop and the costs that arrive after you win

An online casino not on GamStop is a site with no British Gambling Commission licence, so it is unlicensed in Great Britain and GamStop cannot block it. Registration numbers are checked only by operators the Commission licenses. The trade-off is not freedom but exposure: no UK protection, no UK dispute route, and terms written to cost you later.

The phrase "not on GamStop" sounds like a feature. It is a description of a legal position, and it is worth reading as one. Sites in this market hold licences from Curaçao, Anjouan or Kahnawà:ke, or in some cases nothing worth the paper it is printed on, and they are free to accept British players precisely because nobody in Great Britain is supervising them. GamStop Online — the scheme is often typed "gamestop", which explains a good deal of the search traffic — is a register of people who have asked to be blocked online, and it only binds operators holding a Commission licence. A site without one never checks it.

That single fact shapes everything else. The market is small in player terms but not trivial: the Commission's analysis published 5 November 2026 estimated that among respondents who had gambled online in the previous four weeks, 2.5% had engaged with an illegal gambling website, a further 1.5% within the past year, while 94.4% of the whole population showed no indication of using one at all. Meanwhile the offshore side of the market is loud. H2 Gambling Capital put stakes with illegal operators in the UK at £16.6 billion in 2025, and the Frontier Economics study for the Betting and Gaming Council — industry-commissioned, so treat the number with the scepticism it deserves — estimated £2.7 billion staked online annually on the black market.

Where money moves, terms move too. What follows is about the costs a player does not see at first: not the absence of a licence in the abstract, but the specific, material ways an unlicensed site recovers from a winner what it could not earn from a loser. If gambling has stopped being entertainment, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day.

What an online casino not on GamStop actually is

A British licence is the dividing line, and it is a clean one. The Gambling Commission states plainly that it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a licence from the Commission, including where the operator holds a licence in another jurisdiction. Section 33 of the Gambling Act 2005 makes providing facilities for gambling an offence; on summary conviction it carries up to 51 weeks' imprisonment, a fine at level 5, or both. Section 330 covers knowingly advertising unlawful gambling. None of that catches the adult punter — the Act's offences attach to those who provide the facilities — but none of it protects him either.

The comparison that matters is not "regulated versus fun". It is two different rulebooks.

A British-licensed operator must participate in GamStop under LCCP social responsibility code provision 3.5.5, and since April 2020 must check its entire customer base against the register at least every 24 hours. It faces the £5 maximum stake per game cycle on online slots brought in on 9 April 2025, and £2 for adults aged 18 to 24 from 21 May 2025. It cannot offer a bonus whose wagering requirement exceeds ten times. It cannot let you cancel a withdrawal request — reverse withdrawals were banned outright on 31 October 2021 under RTS requirement 14B. Since 31 October 2025 it must prompt you to set a financial limit before your first deposit.

An offshore operator has none of that. When the Commission ran a test purchase in January 2025 and made its first referral to Visa, and when its Illegal Markets team reported issuing 3,140 cease and desist and disruption notices since April 2024, it was describing this market: sites that reappear under new domains, that geo-block only when a registrar forces the issue, and whose engagement fell by an average of 32% across 160 illegal websites after disruption. Registrar blocks produced the largest average fall in engagement at 91%, GEO IP blocking 60%, Google removal only 30% — which tells you something about how elastic this trade is.

Online casinos not on GamStop 2026 licence questions

Online casinos not on GamStop 2026 are really defined by which licence sits on the site's footer. That is the critical question, because in this market the licence is not decoration — it is the only thing standing between a withdrawal and a dispute nobody can adjudicate.

Curaçao has been rebuilt. The National Ordinance on Games of Chance took effect on 24 December 2024, and the Curaçao Gaming Authority became the direct licensing and supervisory authority. The old master-licence and sub-licence model is gone, and the legacy orange sub-licence certificates of operation ended on 15 October 2025. Licensing activities ceased for the four former master licensors between 18 August 2024 and 31 January 2025. A historic /JAZ number is no longer proof of anything, and the CGA says a seal must redirect to cert.cga.cw; if the certificate shows a different domain from the one being accessed, the site is displaying somebody else's paperwork. A B2C licence costs a one-time EUR 4,592 application fee and EUR 47,450 a year. Supplier registration becomes mandatory from 24 December 2026.

Anjouan is cheaper and shakier. Its published fee schedule is EUR 17,828 for B2C licence issuance and the same again annually — around EUR 17,000 a year per licence, according to an ABC News investigation of 31 December 2025 which reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences, and which quoted Comoros financial intelligence officials describing Anjouan Corporate Services as operating illegally and a former attorney-general calling the licensing operation "an illegal entity". Anjouan Gaming has said its licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". That is a regulator conceding the point.

Kahnawà:ke is older and, by offshore standards, more substantial: the Commission has regulated interactive gaming since 1999, and its Client Provider Authorization holders must be hosted at a data centre in the Mohawk Territory. Its logo certificate program generates a Certificate of Good Standing — but the KGC suspended one CPA holder effective 29 September 2026, and from 1 January 2027 the CPA application fee rises from USD 35,000 to USD 40,000.

Malta is the awkward case. An MGA licence is not a British licence, and a site holding one still cannot lawfully serve Great Britain without Commission authorisation. But the MGA keeps an Unauthorised URLs list — entries carrying notice dates as recent as 30 October 2026 — and says any reference to a Maltese licence on those domains is false and misleading. Costa Rica is simpler still: no comprehensive licensing regime, no framework for issuing gambling licences, and the "data processing license" the industry sometimes cites is not a licence in the strict legal sense. Bill No. 25,057, which would have introduced one, was rejected in early 2026.

### Comparing the licences behind the sites

The table below compares the regimes by what they charge and what they verify, not by any brand. A fee is a useful proxy: it is the minimum an operator must sink into a jurisdiction before it can take a deposit.

Note what the table does not say. A fee does not buy supervision of payouts. The British column is deliberately blank of figures because the licence costs differ by activity; the point is the register, and the fact that the Commission's remit only reaches websites that trade with or advertise to customers in Great Britain while holding a Commission licence. Everything to the right of that column is a jurisdiction that cannot tell a British player what to do about a withheld withdrawal.

### Anjouan cheap licences and contested authority

Anjouan deserves its own heading because it is where the arithmetic of this market is most visible. The regulatory framework rests on legislation adopted in 2005, including the Anjouan Computer Gaming Licensing Act, and the Anjouan Gaming Authority names the Anjouan Offshore Financial Authority as the competent regulator with Anjouan Licensing Services Inc. as sole authorised licence administrator. Two categories of licence are issued, B2C and B2B, at EUR 500 per additional domain or URL.

The authority states that its licences contain no territorial restrictions under Anjouan law but that holders must comply with the laws of the jurisdictions in which they operate — a sentence that quietly transfers the entire compliance burden to the operator and, by extension, to the player's chances of redress. Anjouan Gaming requires licensees to designate an approved ADR provider, currently EGIS ADR, Axion ADR, iGaming ADR and a designated dispute resolution firm, and expects complaints resolved within 30 days before escalation.

Anjouan also publishes a statement from a licence holder that an independent legal opinion of 19 September 2024, reconfirmed in February 2026 by a law firm regulated in England and Wales and Quebec, confirms the AOFA is the lawful regulatory authority. That claim is unconfirmed and rests on a licensee's own account. Set it beside the same investigation's report that Comorian banking laws passed in 2013 and 2015 stripped the AOFA of recognised regulator status, and a player has no way to settle the question. Regulators that need a press release to establish their own validity are not regulators you can appeal to.

How identity checks work, and why the first withdrawal is where it bites

This is the mechanism on which the whole offshore proposition turns, so it is worth understanding properly rather than resenting.

At a British-licensed site, the direction of travel has been towards checking early. Licence Condition 17, introduced on 7 May 2019, requires a licensee to obtain and verify information establishing identity — name, address and date of birth at minimum — before the customer is permitted to gamble. The Commission's blog of 12 August 2026 made the expectation explicit: identity and age checks brought forward to before a deposit or a stake, with onboarding on initials, nicknames or commercial addresses not sufficient. Companies can often match an account against credit reference agencies and the electoral roll without asking for a document at all. Under the anti-money-laundering rules, the €2,000 threshold — deposits or withdrawals reaching €2,000 or more, single or linked — triggers identification and verification at a remote casino, and licence condition 17.1.1 adds a crucial brake: a withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested it earlier. The Commission receives over 6,000 calls a year at its Contact Centre, and by July 2024 around 2,000 complaints a year concerned withdrawal delays, still the number one subject. Over a quarter of complaints now concern identity verification.

At an offshore site the sequence is usually reversed. Registration is frictionless, deposits are frictionless, and the document request arrives when a withdrawal is requested — the exact pattern British rules exist to prevent. Nothing in an offshore licence stops this, because the load-bearing conditions are British ones. The practical consequence is a queue: the operator holds the money while "reviewing" documents that were never needed to take the deposit in the first place.

The warning signs are specific. A site that asks for nothing before deposit but wants a passport, a utility bill, a selfie and a bank statement at the point of cashing out. A site that demands source-of-funds documents only after a large win, and applies a time limit to submitting them. A site whose terms give it sole discretion — "we reserve the right to void winnings" — because such terms are unfair within the meaning of the Consumer Rights Act 2015 and the Commission says operators should not use them. And a site whose verification flow would be unlawful in Britain: the Commission has warned that onboarding on a middle name instead of a forename can create mismatches with records held elsewhere, including GamStop, which undermines self-exclusion itself.

Five signs an offshore operator can be trusted

Trust is not a feeling about the design; it is a set of things that can be checked in ten minutes.

The licence is verifiable from the regulator's own site

A claim in a footer means nothing. The CGA's Certificate of Operation seal must redirect to cert.cga.cw, and a certificate showing a different domain from the one being accessed belongs to another operator entirely. Anjouan certificates carry a unique licence number and a QR code to a public register, and the authority says certificates that cannot be verified there should not be relied upon. Kahnawà:ke's logo generates a Certificate of Good Standing on click. If a seal does nothing when clicked, that is the answer.

Withdrawal terms carry no asymmetry

The clearest tell is whether the money leaves as easily as it arrived. British rules prohibit any maximum limit on what a consumer may withdraw from their deposit balance; the Commission's own example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". Licence condition 7.1.1 requires terms to be fair, transparent and not misleading. An offshore site may lawfully impose such a cap, which is exactly why the clause deserves to be read before the deposit rather than after.

Payout speed is stated in a document, not implied by a logo

Statements fine, 24 hours, "instant" — these are marketing words. The Commission's data for June to September 2024, covering 44.2 million withdrawals by customers of large online operators, found 96.3% cleared automatically, 3.5% within 24 hours and 0.1% up to 48 hours. Separately, 49% of people who had gambled in the past 12 months agreed it was quick and easy to withdraw, 33% were neutral and 18% disagreed. If an offshore site will not put a number on its own payout window in its terms, assume the window belongs to the operator.

Self-exclusion is honoured, not simply allowed to lapse

Kahnawà:ke rules require a site to let a player set limits including zero, and treat a voluntary self-exclusion as permanent and irrevocable — with a grim sanction: a player who breaches a self-exclusion prohibition forfeits deposited or won funds to a third-party charity. That is a genuinely strong term. The weak version is a site that offers no self-exclusion facility at all, and relies on the fact that it is invisible to GamStop.

There is a named dispute route with an adjudicator behind it

Anjouan requires a designated ADR provider named in player-facing terms — EGIS ADR, Axion ADR, iGaming ADR and a designated dispute resolution firm Kahnawà:ke employs a full-time Dispute Resolution Officer. In Britain the equivalent machinery is backed by licence conditions: LCCP social responsibility code 6.1.1 requires operators to allow referral to an approved ADR entity free of charge if a complaint is unresolved within eight weeks, and the approved list runs from the Centre for Effective Dispute Resolution to IBAS. The test to apply offshore is blunt: who decides, and can they make the operator pay?

Essential checks before you play at an unlicensed site

Anyone asking about a casino online not on GamStop is usually comparing it to a UK site they already use. The following steps are the ordinary checks — nothing clever, and nothing unlawful.

1. Verify the licence at source, not on the site. Open the regulator's own register — the CGA's certificate redirect, Anjouan's QR register, the KGC's Certificate of Good Standing — and confirm the domain in front of you appears there. Reason: a footer claim costs nothing to type, and the 2013 and 2015 Comorian banking laws show that a licensing authority's own status can be contested.
2. Read the withdrawal clause and the maximum-cashout clause before depositing. Look for per-day or per-week caps, "one withdrawal at a time" rules, review thresholds such as every fifth or tenth withdrawal, and any clause limiting winnings from bonus funds. Reason: on 21 October 2026 the Commission announced a £900,000 regulatory settlement with an operator whose withdrawal failures included exactly those terms — unfair under the Consumer Rights Act 2015.
3. Work out the true wagering burden, including game weighting. Establish whether the requirement attaches to the bonus or to the bonus plus the deposit, how much time you have, and which games count. Reason: offshore requirements commonly run at 25× and higher, contribution charts can weight roulette at 5% and live dealer at 0%, and British sites are now capped at ten times by LCCP SR Code 5.1.1, in force since 19 January 2026.
4. Check what the licence says about segregating player funds and dispute resolution. Anjouan's standards require segregation of player funds, certified random number generators and AML controls; Kahnawà:ke keeps a Dispute Resolution Officer. Reason: those are the two things that matter if the operator stops paying, and even in Britain the Commission warns that a separate client account does not guarantee a return of funds on insolvency.
5. Judge the payment method on cost and reversibility. Card payouts via Visa Direct Fast Funds can be available within 30 minutes of approval, while e-wallet withdrawals carry their own tariffs — Skrill charges 2.80% of the amount withdrawn with a minimum of EUR 3.50 for transfers to a bank account from 12 January 2026, and Neteller applies the same 2.80% with a USD 3.50 minimum. Crypto is faster and not automatically cheaper: a bare USDT transfer on TRON burns roughly 13 TRX without staked Energy, and a fresh Bitcoin block arrives within 10 minutes about 63% of the time. Reason: the fee is real money, and a payment method with no practical reversal means a payment dispute has nowhere to go.
6. Set a limit outside the site's own tools as well. Most banks on the Commission's list — Bank of Scotland, Barclays, Halifax, HSBC, Lloyds, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling — run a gambling block at card level that must be activated on each card, with a cooling-off period of 48 or 72 hours before gambling transactions resume. Reason: the block sits below the site, so it applies to a site that is not on GamStop, which no self-exclusion scheme can reach.

The bonus arithmetic that pays for the marketing

British sites can no longer hide here, which makes the comparison unusually clean. LCCP Social Responsibility Code 5.1.1, in force since 19 January 2026, bars wagering requirements above ten times and bans mixed-product promotions — "bet £5 to get 20 free spins" is non-compliant; "bet £5 and get £10 free bet" is fine, and an offer whose prize is itself mixed is not. The Commission chose a cap over an outright ban because an outright ban would have pushed licensees towards terms preventing cash-out, and it said the ten-times limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements".

Offshore, 60× was never unusual and no longer has to be disclosed with any particular clarity. A site may state that a bonus amount is subject to a 25× playthrough, then express that multiple against the bonus plus the deposit, then attach a contribution chart weighting slots at 100%, table games at 20% and live dealer at 0%, then cap the maximum bet during wagering at about €5 for regular players, then reserve a maximum cashout of some multiple of the bonus with the excess voided. Each clause is individually legal somewhere. Together they describe an offer that is difficult to finish and easy to breach — and Ignition-style terms typically say that breach "may result in account closure, forfeit of the Bonus, and any winnings generated during the wagering".

Read every clause through one question: who collects? A wagering requirement that attaches only to the bonus is, in the CMA's own view, unlikely to be unfair. A maximum-cashout clause is a direct transfer of a winner's winnings back to the house. And a term giving the operator sole discretion to void winnings is precisely what earned one firm a £170,000 fine in July 2025.

Self-exclusion, and the site that never sees it

Self-exclusion is where the phrase "not on GamStop" does its real work, so let it be stated flatly: a GamStop exclusion holds for its full term, and it stays in place after the chosen period ends until the person contacts GamStop to remove it. It cannot be cancelled or deactivated during the exclusion. Under the terms last updated 20 May 2026, holders of a five-year Minimum Exclusion Period may only turn off auto-renewal during the last six months, and if nothing is done GamStop holds the data through a further automatic seven-year period during which operators are told the person was previously excluded. GamStop Online registrations cannot be removed early; the Group's 2025 annual report devotes a section to its refusal to do so.

This is not a technicality to be routed around, and an offshore site is not a way round it — it is a way of not being seen by a scheme that was designed to see you. The Commission warned in an industry notice on 20 January 2025 that casino games supplied by licensed operators were appearing on unlicensed websites available to GB consumers, and that these sites often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls. That is not a market gap. It is a market.

The scale is worth keeping in view. Of the periods chosen by registrants in 2025, 29% took six months, 24% a year, 25% five years and 22% auto-renewal — and by July 2026 GamStop Online reported 614,738 consumers currently on the register, of whom more than one in two had opted for the maximum five-year term. Half a million people chose the longest available commitment. A site defined by not checking that register is defined by not respecting that choice.

Where the protections end, and where help begins

British protections stop at the water's edge, and it is worth being precise about which ones. The Commission is a regulator, not an ombudsman: it cannot resolve individual complaints or get anyone's money back, though it records complaints and refers disputes to independent third parties. A UK site must return funds held in an account when a customer has self-excluded, and it may not simply block withdrawals while continuing to accept wagers. None of that travels. Offshore, a player's realistic routes are the operator's own complaints process, a named ADR provider if one exists, and the courts — which is a costly way to chase a few hundred pounds held by a company in a jurisdiction whose authority is itself in dispute.

So the help that exists is British help, and it is also publicly funded rather than voluntary: the statutory levy introduced by the Gambling Levy Regulations 2025 commenced on 6 April 2025 at 1.1% of previous-year Gross Gambling Yield for all online operators, and raised just under £120 million in the year reported, ringfenced for research, prevention and treatment and split 20% research, 30% prevention and 50% treatment.

The numbers to keep are these. The National Gambling Helpline, operated by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year, and also reaches the service by live chat and WhatsApp; callers in Wales have 0808 2819 265. Gamblers Anonymous England, Wales and Ulster can be reached on 0330 094 0322, with around 250 meeting locations and no appointment needed. NHS England had opened 15 specialist gambling clinics across England since 2019, and integrated care boards commission eight regional services taking almost 5,000 referrals a year. GamFam, a registered charity, supports families through its GRA5P peer-support programme, and Gam-Anon UK & Ireland exists for the friends and relatives of compulsive gamblers.

Gambling Commission FAQ

What is an online casino not on GamStop?

It is a site that does not participate in GamStop Online, which in practice means it holds no Gambling Commission licence. The Commission states it is illegal to offer commercial gambling services to consumers in Great Britain without one, including where the operator holds a licence elsewhere. Because GamStop obligations bind only licensed operators, such a site does not check the register and cannot see an exclusion.

Are online casinos not on GamStop legal in the UK?

The provider side is not. Section 33 of the Gambling Act 2005 makes providing gambling facilities without an operating licence an offence carrying up to 51 weeks' imprisonment, a fine at level 5, or both. The Act's gambling offences attach to those who provide facilities, not to adult consumers, so a player commits no offence by using such a site — but he also has no British regulatory remedy if it withholds money.

Do offshore casinos pay out faster than UK ones?

Usually faster in headline terms, because they skip the checks British rules force forward. But the Commission's data for June to September 2024 found 96.3% of 44.2 million withdrawals at large UK operators cleared automatically, so the British baseline is not slow. Speed offshore comes with a document request on the way out rather than the way in, which is where delays begin.

Can an offshore casino see a GamStop self-exclusion?

No. GamStop can only exclude a person from participating operators, and it says it is unable to prevent access to gambling services run by organisations that do not participate in the scheme. That is the whole point of the category and the whole of its risk: an exclusion holds for its full term and beyond, and a site outside the scheme is unaffected by it.

What documents will offshore sites ask for?

Typically the same bundle: passport or driving licence, a utility bill for address, sometimes a bank statement for source of funds, occasionally a selfie. The regulation is the give-away. Licence Condition 17.1.1 stops a British operator demanding on withdrawal what it could reasonably have asked earlier; offshore, there is no such brake, and source-of-funds documents may be requested only once a win is large.

Does a Curaçao or Anjouan licence protect a UK player?

It gives you somewhere to complain and nothing more. Curaçao's LOK took effect on 24 December 2024 and its Certificate of Operation seal must redirect to cert.cga.cw; Anjouan requires a named ADR provider and expects resolution within 30 days. Neither can compel a British remedy, and Anjouan's own regulator concedes its licence is not a universal authorisation to operate anywhere.

The cost of not being seen

An online casino not on GamStop is not a loophole in the self-exclusion scheme; it is a business built on the part of the market that sits outside it, which is why the price is paid not at the deposit but at the withdrawal — in documents requested late, in caps on what can leave, in bonus terms that cost more the closer you get to finishing them, and in a dispute route that ends in a foreign jurisdiction nobody will arbitrate. Of the 586 illegal gambling websites the Commission's dashboard identified as accessible to GB consumers in September 2026, 311 faced disruption action in the second quarter of 2026 to 2027 — 38% more than the previous quarter — and 77% of those disrupted saw estimated traffic fall. The sites move. The arithmetic does not.