Gambling Not on GamStop and Offshore Sites

Gambling not on GamStop means betting with an operator that holds no Gambling Commission licence, so the exclusion does not reach it and British consumer protections do not apply either. Such sites are legal to use in most cases but unregulated here, and the differences that matter are limits, verification and where a complaint can go.

I have spent a decade reading licence conditions for a living, and the phrase "not on GamStop" is the single most misread label in British gambling. It reads like a feature. It is actually an admission about jurisdiction. A site that is not on GamStop is, almost by definition, not licensed in Great Britain, because participation in the national self-exclusion scheme has been a condition of a Gambling Commission licence since 31 March 2020 — the requirement sits in social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, and operators were told about the deadline in January 2020. Two of them, Dynamic and Sportito, had their licences suspended on 3 April 2020 for missing it.

That is the first thing to grasp. The second is that this whole market runs on limits. Offshore sites sell themselves on looser thresholds: bigger stakes on the slots, fewer questions on the deposit, a withdrawal that a British operator might pause and they will wave through. Sometimes that is genuine and sometimes it is the mechanism of harm. What follows is my attempt to separate the two, using the regulator's own numbers and the licensing paperwork that offshore operators file and hope nobody reads.

One last thing before the detail. Anyone looking for a way round a GamStop exclusion will not find one here, and not because I disapprove — because the scheme does not work that way. A GamStop registration holds for its full term and then stays in place until the person contacts GamStop to remove it. That is a fact about the scheme, not a moral position. [GamStop is often typed "gamestop"; the scheme itself is GamStop, and it is free to register with.] If gambling has become a problem, the help is at the National Gambling Helpline on 0808 8020 133, free and open 24 hours a day, every day of the year.

What the offshore market looks like from Britain

The scale is bigger than most people assume and smaller than the trade bodies claim, which is a useful lesson in reading this sector. The Gambling Commission's analysis published on 5 November 2026 estimates that among people who had gambled online in the previous four weeks, 2.5% had engaged with an illegal gambling website, with a further 1.5% doing so in the past year. Across the whole adult population, including non-gamblers, 0.6% had used one in four weeks. That is a small fraction of a very large market, and it is the number I trust most, because the Commission is not selling anything.

The trade figures are louder. H2 Gambling Capital puts the amount staked with illegal operators in the UK at £16.6 billion in 2025, up from about £5 billion in 2019. A Frontier Economics study for the Betting and Gaming Council — industry-commissioned, so treat it as advocacy with arithmetic — conservatively estimated £2.7 billion staked annually online on the black market, involving 1.5 million Brits. The truth sits somewhere in between, and the Commission's own methodology note admits it does not capture activity hidden behind VPNs. Anyone who quotes you a single figure for this market is quoting a guess.

Enforcement, meanwhile, is mostly a game of whack-a-mole played with paperwork. Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Bing and Google URLs and secured 287,961 removals. Across 160 illegal sites with traffic data, engagement fell by an average of 32% after disruption — but where a registrar block was used the average fall was 91%, against 30% for Google removal alone. The regulator's own conclusion is that taking a domain down beats hiding it, which tells you how much the search results really protect anyone.

A checkable benchmark of 44.2 million withdrawals

Here is the number I would put against every offshore marketing claim, and it comes from the regulator rather than from me. Gambling Commission data covering June to September 2024 records 44.2 million withdrawals by customers of large online operators in that period. Of those, 96.3% cleared automatically, 3.5% within 24 hours, and 0.1% took up to 48 hours.

That is the standard. Read it again, because the industry does not want it read carefully: at scale, on licensed British sites, essentially every withdrawal processes itself. There is no queue, no manual review, no five-day banking cycle dressed up as security. When a site tells you that its slower payouts are simply how banking works, it is describing a problem that a properly run operator in this market solved years ago.

The caveat is honest and important. Withdrawals remain the number one subject of consumer complaints to the Commission's Contact Centre, with around 2,000 a year by July 2024, and the Commission's Annual Report for 2024-25 says withdrawal issues continue to cause most of the complaints it receives. Over a quarter of the complaints reaching the Contact Centre now concern identity verification — the pattern being a customer asked for documents only at the moment they try to cash out. So the benchmark is a median, not a guarantee. But the direction is unambiguous: the friction players complain about is created deliberately, and the Commission has said so in terms, calling it unacceptable for operators to introduce friction at withdrawal rather than at deposit.

What a British licence actually buys

Offshore sites should be judged against the British baseline, because that baseline is not marketing. It is a set of enforceable obligations. A Gambling Commission licence means the site must accept payment only through a provider that is a payment service provider under the Payment Services Regulations 2017. It means credit cards are banned for gambling — licence condition 6.1.2, effective 14 April 2020, with operators also obliged to check that e-wallet deposits were not loaded from a credit card. It means wagering requirements are capped at ten times bonus funds from 19 January 2026, mixed-product promotions are banned, and customers must be prompted to set a financial limit before their first deposit under rules effective 31 October 2025.

The parts that bear hardest on the offshore comparison are the limits and the terms. Under licence condition 7.1.1 the terms of a gambling offer must not be unfair within the meaning of the Consumer Rights Act 2015. Operators may not impose a maximum limit on what a customer can withdraw from their deposit balance — the Commission's own example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". Reverse withdrawals were banned outright under RTS 14B on 31 October 2021, so nobody in Britain is offered the chance to cancel a cash-out and put it back on the table. Un-staked deposits remain the customer's and cannot be confiscated for failing identity or age verification. Not one of those protections follows a player to a Curaçao or Anjouan site, because the licence that creates them does not reach there.

The enforcement record shows what happens when terms drift. On 21 October 2026 the Commission announced that an operator, which runs seven websites, would pay £900,000 in a regulatory settlement for failures including unnecessarily delaying consumer withdrawals — specifically, a term allowing only one withdrawal at a time, found unfair under the Consumer Rights Act 2015, and manual reviews of every fifth or tenth withdrawal that generated extra document requests. An operator, trading as Fafabet, was fined £170,000 in July 2025 over a bonus term reserving the operator's discretion to close accounts or forfeit winnings. That is the British system working, slowly and expensively.

Licensing regimes and what they deliver

This is the comparison that matters on this topic, and it is deliberately not a list of brands. What separates one regime from another is not the flag on the certificate; it is the dispute route, the fee structure and whether anybody enforces the self-exclusion promise. Fees and thresholds below are the regulators' own published figures, which is a decent proxy for how much supervision an operator is buying.

Note the first column before you read the rest. An Anjouan licence costs EUR 17,828 a year. The British online gambling sector paid a statutory levy of 1.1% of previous-year Gross Gambling Yield, which raised just under £120 million in its first year across the whole industry. One of those numbers buys supervision and the other buys a certificate. The Curaçao annual fee of EUR 47,450 looks substantial until you set it against the cost of compliance in a regulated market — financial vulnerability checks, affordability assessments, self-exclusion integration, disputes through a free ADR service. Offshore licensing is cheap because the obligations are thin, and that is the entire commercial proposition.

One further wrinkle, because it catches people out. Curaçao reformed its regime under the National Ordinance on Games of Chance, which took effect on 24 December 2024, replacing the old master-licence and sub-licence model. The legacy orange sub-licence certificates ended on 15 October 2025 and the four former master licensors ceased licensing activity between 18 August 2024 and 31 January 2025. A historic /JAZ number is not proof of a current licence. And in October 2026 the CGA said its online licensing portal would not return to service, which means verifying a Curaçao licence is harder now than it was a year ago.

Where the limits sit and who sets them

The site angle here is limits, so let us be precise about which ones an offshore move actually changes. British operators face a £5 maximum stake per game cycle on online slots since 9 April 2025, and £2 for adults aged 18 to 24 since 21 May 2025, attached by regulation to every remote casino operating licence. Offshore, no such cap exists — which sounds like freedom and functions as exposure. A slot machine's spin rate is fixed at a minimum of 2.5 seconds from the start of one game cycle to the start of the next under technical standard RTS 14D, and the loss rate is a product of stake, speed and house edge. Raise the stake with no ceiling and you have raised the loss rate by that multiple, nothing else.

Deposit limits work in the opposite direction. From 31 October 2025 British operators must present a financial limit as the default option before a customer's first deposit, with declining it requiring a positive action and a confirmation under RTS 12E, and must remind customers every six months to review their account and transaction information. Separately, financial vulnerability checks — using only publicly available information such as a bankruptcy order, County Court Judgment or Individual Voluntary Arrangement, per the Commission's May 2026 guidance — were required from August 2024 at £500 net deposits over 30 days, lowered to £150 from 28 February 2025. Financial Risk Assessments are coming in stages from the Commission's 7 July 2026 announcement: £5,000 net deposits in a rolling 24 hours for the over-25s at the first stage, falling eventually to £1,000 in 24 hours or £3,000 over 90 days.

An offshore operator runs none of that. No vulnerability check at £150. No prompt to set a limit. No £5,000 threshold, no £1,000 threshold. The account is opened, the card is charged, and the first thing that interrupts the process is a withdrawal request. Which is precisely the friction-at-withdrawal pattern the Commission has spent years telling licensed operators to stop.

Withdrawal limits are the third piece, and they are the one offshore sites advertise hardest. A British operator may not put a ceiling on withdrawals from a deposit balance, though it may charge a cost-reflective processing fee or reasonably limit the number of separate withdrawals if the term is fair and disclosed before deposit. Several offshore regimes offer no equivalent prohibition, and the terms show it: maximum cashout clauses, one-withdrawal-at-a-time rules, manual review triggers. Those are limits on getting your money out, which is a different and much grimmer thing from a limit on getting it in.

The identity verification term

If one thing decides how a relationship with an offshore operator ends, it is verification. In Britain the rules are now reasonably clear and they were tightened because of the exact trick players complain about. Licence condition 17.1.1 requires licensees to obtain and verify information establishing identity before the customer is permitted to gamble, covering name, address and date of birth. Under the anti-money-laundering regulations, remote casinos must identify and verify when a customer deposits or withdraws €2,000 or more, and the threshold applies to linked transactions too — same customer, same session, part of one logged-on period.

The first time, verification is usually invisible. Most operators match the account against credit reference agency and electoral roll data, which is why a British sign-up often clears in seconds. Documents come out only when the automatic match fails or the threshold is crossed.

Later is where it turns. After the €2,000 mark — and in practice far below it, because operators bring checks forward under Commission pressure — a customer may be asked for a passport, a driving licence, a household bill, a bank statement to establish source of funds, or a selfie where fraud is suspected. The Commission's 12 August 2026 blog gives the pattern of complaint: a customer sails through months of deposits and then meets a document request at the moment of withdrawal. Licence condition 17.1.1 forbids exactly that — a withdrawal request must not trigger a requirement for information the licensee could reasonably have requested earlier — unless a separate legal obligation such as an AML duty requires the information at that point. The prohibition is real but the carve-out is wide, which is why the Commission still receives the complaints.

The warning signs are consistent enough to list. Fuzzy matching, in which a customer is onboarded on partial or equivocal verification through a third-party provider, is a practice the Commission has flagged explicitly. Onboarding a customer with a middle name where the record elsewhere holds a forename creates mismatches with databases including GamStop's, which the Commission says undermines the effectiveness of self-exclusion. The regulator's 2026 risk assessment for the remote casino sector rates it high risk for money laundering, unchanged, and reports an increase in false documents, deepfake videos and AI-generated face swaps.

Offshore, the drill is different in kind rather than degree. Some regimes publish decent standards: Anjouan requires operators to segregate player funds, use independently certified random number generators and run AML, CTF and age verification. Others are thinner. But the enforcement machinery is the gap that no published standard fills. Malta's regulator publishes a list of Unauthorised URLs and declares any reference to a Maltese licence on them to be false. Kahnawà:ke suspended a Client Provider Authorization held by Polar Ventures SDRL with effect from 29 September 2026 following a show cause notice. Those are real actions by real regulators — they are simply not directed at the British consumer, and none of them will recover a disputed £3,000 from an operator in another jurisdiction on your behalf.

Five signs an operator can be trusted

Trust in this market is not a feeling. It is a short list of things that can be checked in a few minutes, and I would apply all five before depositing anything, licensed or not.

The licence is verifiable on the regulator's own register

A licence claim is worth nothing until you have followed it to the source. The Gambling Commission's register lets you check that a business holds a British licence and whether the site's activities and domain names match what is recorded. For Curaçao, clicking a Certificate of Operation Seal must redirect to the authority's certification site, and if the certificate shown behind the seal names a different domain, the site is displaying somebody else's certificate. If the seal looks different in design, colour or format from the standard, the site is not authorised. Anjouan certificates carry a unique licence number and a QR code linking to its public register; certificates that cannot be verified there should not be relied on at all. Two minutes of clicking is the whole test.

The terms on withdrawals fit on one screen

Open the withdrawal section of the terms and count the conditions. A trustworthy operator states the processing time, whether any fee applies and how it is calculated, and then stops. Warning signs are a maximum amount withdrawable from a deposit balance, a one-request-at-a-time rule, a clause reserving the operator's sole discretion to void winnings, or a requirement to play through a deposit before withdrawing it. British guidance holds that a term letting an operator "reserve the right" to void or withhold winnings is unfair under the Consumer Rights Act 2015 — a principle worth applying to any site in any jurisdiction, because it describes a term nobody honest needs.

Customer funds are disclosed with a rating

An operator must say what happens to your money if it goes bust, and regulated regimes require a rating. In Britain the ratings are "not protected", "medium protection" or "high protection", stated in the terms, with a "not protected" operator obliged to remind the customer once every six months, stating the value of funds held. It is worth knowing that even a separate client bank account does not guarantee a return of funds on insolvency, and that operators may lawfully hold customer money in overseas accounts. A site that does not tell you which bucket your balance sits in has told you something.

There is a named dispute route with a real track record

Any operator can point at a complaints email. What matters is where a dispute goes next, and whether that body publishes figures. Britain's approved ADR providers include IBAS and eCOGRA, both free to the consumer. IBAS's 2024-25 report records 3,721 domestic disputes, an average completion time of 20 days and 100% operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. eCOGRA's report for October 2024 to September 2025 records 911 disputes received, 150 valid "Deposits & Withdrawals" disputes, and 17.8% of completed disputes ruled for the consumer. Those percentages are low because most disputes fail on the paperwork — 72.3% of eCOGRA's invalid disputes had never been through the operator's own complaints procedure. Note also that ADR providers will not take complaints about customer service, or about a refusal to accept a bet. Offshore, Anjouan's approved providers are EGIS ADR, Axion ADR, iGaming ADR and another entity; check that the operator names one in its terms, in writing.

Self-exclusion is described honestly, not dodged

Compare what a site says about exclusion with what its regulator requires. Kahnawà:ke rules require a licensee's relationship with players to be free of unfair terms, require sites to let a player set limits including zero, and describe their own voluntary self-exclusion as permanent and irrevocable — with funds forfeited to a charity if a player breaches it. That is a firm line. The test for any operator is whether it tells a self-excluded person plainly that it cannot take them, or whether it leaves a door ajar. The Commission issued an industry warning notice on 20 January 2025 about licensed operators' casino games appearing on unlicensed sites available to British consumers, noting that such sites often target people who have self-excluded through GamStop. A site that markets that way has answered the question for you.

How to vet an offshore operator in six steps

None of this is exotic. It is the same work a regulated operator does before it signs a supplier contract, scaled down to a private individual with twenty minutes and a debit card.

1. Establish who the licence belongs to, then check the domain against it. Read the footer, note the licence number and the regulator, then find that number on the regulator's own register and confirm the domain you are using is authorised. Reason: licences are issued to companies and often to specific domains, and a certificate belonging to another operator is the single clearest sign of a cloned or abandoned site.
2. Read the withdrawal clause before the deposit clause. Find the processing time, the fee schedule and any ceiling on what can be taken out, then look for terms about manual reviews or additional requests. Reason: deposit terms are written to be read and withdrawal terms are written to be skimmed past, and the second set is where the money actually gets stuck.
3. Check the customer-funds disclosure and the insolvency rating. Look for the words "not protected", "medium protection" or "high protection", and for any statement about separate client accounts. Reason: if the operator fails, this paragraph decides whether your balance is a claim in an insolvency or a line in a statement of loss.
4. Locate the dispute route and confirm the ADR provider is real. The terms should name a specific ADR body; then check that body's published list of covered operators and its complaint window. Reason: ADR providers such as eCOGRA may refuse a dispute if the site is not on their approved list, or if the dispute arose more than a year ago, and those limits bite before you learn about them.
5. Test the bonus arithmetic against the ten-times benchmark. Multiply the wagering requirement by the bonus amount and check the game-weighting table: 100% for slots, 20% for table games, 10% for video poker, 5% for roulette and baccarat in one published example. Reason: a 40× requirement weighted at 5% on roulette is effectively 800× on that game, and the combination of multiplier and weighting is where offshore offers do their work.
6. Give one small withdrawal a full run before the balance grows. Deposit a modest sum, stake it, request the cash-out and time how long it takes, including any document request. Reason: withdrawal speed is the only claim in this market that cannot be simulated, and it is much cheaper to discover a five-day manual review with £40 at stake than with £4,000.

What the numbers say about where most sites sit

The Gambling Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, 4% more than September 2025, and 311 sites had disruption action taken against them in the quarter to September 2026 — 38% more than the previous quarter, with 77% of disrupted sites showing a reduction in estimated traffic. Read together, those figures say the population of accessible sites is roughly stable while the effort against them is rising, which is what you would expect from a market that reloads as fast as it is emptied.

For anyone searching out a site that takes British players without GamStop, this is the practical consequence: the domain you find today may be gone in six months, taking your account history and any pending withdrawal with it. That is not a scare line. It is arithmetic. The regulator referred 1,835 websites to search engines between July and September 2026 — 7,677,211 URLs — and the number of criminal prosecutions commenced across April 2025 to March 2026 was one. Disruption, in other words, is cheap and fast, while enforcement against the people behind these sites is slow and rare. The site you are looking at is the disposable part.

The prevalence picture is worth holding alongside it. The Gambling Survey for Great Britain's third annual report, published 16 July 2026 from 20,775 adults, found 47% of adults had gambled in any form in the past four weeks, falling to 27% once lottery-only participants are excluded. Among all participants, 2.4% scored 8 or more on the Problem Gambling Severity Index, stable across the survey's three years at 2.5%, 2.7% and 2.4%. And 561,983 people were actively excluded through GamStop at the end of 2025, rising to 614,738 by July 2026, of whom more than one in two chose the maximum five-year term. Somewhere in the overlap between those two sets sits the demand this market serves, and the reason the Commission keeps returning to it.

The payment question sits underneath all of it. Bank gambling blocks are now offered by eleven named institutions — Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling — and they decline payments to merchants categorised under gambling Merchant Category Codes. They are applied at card level, so each card must be switched on separately, and most banks impose a cooling-off period of 48 or 72 hours before gambling transactions are permitted again after a block is switched off. That last detail is the one that matters most in this context: on a licensed British site, the switch back on is slower than the switch off. Card-level blocks can also be sidestepped entirely by a payment method outside the banking system, which is a structural feature of the offshore market rather than an accident.

Offshore bonuses and the terms that build in delay

Bonus terms are where offshore operators quietly rebuild the delay that British rules removed. The British position since 19 January 2026 is that wagering requirements cannot exceed ten times, and mixed-product promotions are banned — "Bet £5 to get 20 free spins" is non-compliant, while a free bet on the same product is fine. The Commission chose a cap over an outright ban, noting that the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". The rest of the code requires terms that are clear, transparent, fair and readily accessible, and forbids increasing a bonus's value or amount on the basis that qualifying spend was reached faster than the full qualifying period.

Offshore, published terms run at 25× and above. One operator's terms state a 25× playthrough before bonus-derived winnings may be withdrawn, with a contribution table giving slots 100%, table games 20%, video poker and blackjack 10%, roulette and baccarat 5%, and craps, jackpots and live dealer games 0%. Another sets a maximum withdrawable from bonus winnings at 300% of the credited bonus, with the excess voided, and caps the maximum bet while wagering at €5 for regular players and €10 for VIPs.

Two mechanisms in that paragraph deserve names. The first is weighting: a requirement is measured in staked turnover, so a 40× requirement on a game contributing 5% is 800× of real play on that game. The second is the maximum cashout clause, which is a withdrawal limit by another route and is prohibited in Britain where it applies to a deposit balance. Add a term reserving the operator's discretion over abuse, and a player can meet every condition they were shown and still lose the balance on a judgement they never see.

The timing matters too, and this is the most cynical part. A bonus that requires playthrough before withdrawal inserts a delay between winning and being paid, and that delay is the product. British rules ended the practice behind sticky bonuses by requiring that wagering requirements not apply to play with the deposit balance, that deposit and bonus balances be displayed separately, and that a player be allowed to withdraw the deposit balance at any time, bonus pending or not. Offshore terms are under no such obligation, which is why a deposit can sit behind a bonus that has not finished.

Payouts and the arithmetic of waiting

The infrastructure is not the constraint, and it is worth being clear about that because "processing times" are used as a euphemism. Faster Payments has a scheme maximum of £1 million per transaction, raised from £250,000 on 10 February 2022, and over 90% of transactions complete in under two seconds, with no minimum size. Visa Direct's Fast Funds service processes in real time with funds available within 30 minutes of approval. CHAPS settles high-value payments the same working day with no scheme upper limit. In short: the rails move money in seconds, and any delay beyond that is a decision made by a person.

Crypto is where the story gets more interesting than the marketing admits. Bitcoin targets a ten-minute average block interval, but a block is not guaranteed within that window — the probability of one arriving within ten minutes is about 63%, rising to 95% within 30 minutes and 99.7% within 60. The classic six-confirmation default assumes an attacker with under 10% of hashrate and tolerates a residual double-spend risk below 0.1%. Litecoin targets 2.5-minute blocks, but its own documentation notes that only about 55.43% of modelled six-confirmation spans complete within 15 minutes. USDT on TRON is typically the cheapest route: a transfer to a wallet that already holds USDT consumes about 65,000 Energy, roughly 13 TRX burned without staked Energy, with no free Energy quota at all and a 1 TRX charge for activating a new address. Ethereum's fee is gas used multiplied by base fee plus priority fee, charged whether the transaction succeeds or fails.

The e-wallet middlemen deserve a mention because their fees are the ones players never count. Skrill charges 2.80% with a minimum of EUR 3.50 for a bank transfer, plus a 4.49% foreign-exchange fee where conversion is needed. Neteller charges 2.80% or a minimum of USD 3.50, with 12.75 USD for a member wire, 3.49% to Skrill and 0–7.5% to Visa or Mastercard. MiFinity charges 1.8% for crypto withdrawals and applies an FX markup of up to 2.99%. PayPal charges nothing to withdraw to a UK bank account where no currency conversion occurs, and 0.50 GBP if a payment bounces back on incorrect details. None of that is hidden, exactly. It is simply spread across a fee schedule nobody reads until after the money has left.

On the British side, one protection is easy to overlook and worth naming. Money staked within an open bet is not treated as customer funds, so it is not covered by whatever protection arrangement the operator advertises if it fails. Balances sit in a client account; open bets do not.

Complaints, ADR and where a dispute actually goes

When something goes wrong, the route matters more than the outcome. In Britain, licence condition 6.1.1 requires arrangements for a customer to refer a dispute to an ADR entity free of charge if it is not resolved within eight weeks, and the consumer must have gone through the operator's own procedure first — the operator may issue a deadlock letter confirming the customer can proceed. The Commission's guidance says licence holders should allow complaints for at least six months from the incident, acknowledge within 24 hours where they offer 24-hour gambling, and complete the whole process within eight weeks of first receipt. ADR providers should get full answers from operators within ten working days.

Here is the part most players get wrong: the Commission is a regulator, not an ombudsman. It cannot resolve individual complaints or get money back. It records everything and refers disputes on. The bodies that decide are the ADR providers, and their numbers are public. IBAS handled 3,721 domestic disputes in 2024-25 with an average completion time of 20 days, 217 of them categorised as Banking/Financial Disputes, and upheld 65 consumer complaints by written decision against 693 not upheld and 737 resolved by a consumer-satisfactory outcome before a ruling. eCOGRA recorded 911 disputes in the year to 30 September 2025, with 150 valid deposits and withdrawals disputes, an average 31 days for domestic resolution, and 17.8% of completed disputes ruled for the consumer. IBAS also reports 100% operator compliance with decisions in the consumer's favour across two years — which is the strongest argument I know for the regulated route being worth the friction.

The scale tells its own story. eCOGRA found that 361 of 499 invalid disputes — 72.3% — had not been through the operator's internal complaints procedure first. Most disputes die in the queue, not in the adjudication. And no British ADR body has jurisdiction over an operator with no British licence, so the offshore equivalent is whatever the licence regime nominates: Anjouan requires operators to designate an approved ADR provider and list it in player-facing terms, with complaints expected to be resolved within 30 days before escalation. That is a framework. It is not the same as a body with published statistics and a two-decade record.

There is movement on this. IBAS notes that the UK government's 2023 review of gambling legislation recommended creating a Gambling Ombudsman with an expanded remit of ADR work. If it arrives, it will cover British licensees. Offshore sites will remain outside it.

Why the licensing map keeps changing

Anyone assessing an offshore operator is assessing a moving target, and the paperwork rarely keeps up with the reality. Curaçao is the clearest case: direct licensing by the Gaming Authority replaced the master-licence model on 24 December 2024, the legacy orange sub-licences ended on 15 October 2025, a six-month provisional licence granted to compliant operators was extended to 24 December 2025, and the previous online portal stopped being maintained as of October 2026. Supplier licensing becomes fully mandatory in Curaçao from 24 December 2026. So a Curaçao certificate printed two years ago may describe an entity that no longer holds anything.

Anjouan is the other one that turns up constantly, and the record there is contested. The Gaming Authority describes an independent legal opinion, issued on 19 September 2024 and reconfirmed in February 2026, confirming that the Offshore Financial Authority is the lawful regulatory authority and that licences under the 2005 Act are valid — that is the licensee's own statement and should be weighed accordingly. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, and quoted Comorian financial intelligence officials describing Anjouan Corporate Services as operating illegally, with a former attorney-general of the Comoros calling the licensing entity "an illegal entity". Anjouan Gaming's own statement on 10 June 2026 conceded the sensible point: that an Anjouan licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". Correct — which is exactly why a British player is outside the arrangement it does create.

Costa Rica is worth a line because it is where a site lands when it has given up pretending. Costa Rica has no comprehensive gambling licensing regime and no formal framework for issuing gambling licences; the "data processing license" sometimes cited in the trade is not a licence in any strict legal sense. The Legislative Assembly rejected Bill No. 25,057 in early 2026, which would have introduced mandatory licensing. Under Costa Rican law, games of chance determined primarily by luck are generally prohibited, and only land-based casinos integrated into qualifying hotels are authorised. A site citing Costa Rica is citing a jurisdiction that does not regulate it.

What all of this adds up to for a limit-conscious player

Strip away the marketing and the topic reduces to three facts.

The protections are not portable. A Gambling Commission licence carries the £5 slot stake cap, the £2 cap for the under-25s, the ban on credit cards, the ten-times wagering limit, the prohibition on maximum withdrawal limits from a deposit balance, the ban on reverse withdrawals and a free ADR route. None of it travels with the player. An offshore site is not licensed in Great Britain, so British protections do not apply, and the licence it does hold comes from a regulator with no remit over a British consumer's complaint.

The help is local even when the operator is not. The National Gambling Helpline is 0808 8020 133, run by GamCare, free and open 24 hours a day, every day of the year, with callers in Wales able to use 0808 2819 265. Gamblers Anonymous England, Wales and Ulster is on 0330 094 0322, with around 250 meeting locations and no appointment needed. Citizens Advice Scotland runs a gambling support line on 0800 328 1131, Monday to Friday, 10am to 3pm. Gambling harms treatment in England is commissioned by NHS England from 1 April 2026 and funded by a statutory levy worth approximately £100 million a year. That infrastructure was paid for by licensed operators and reaches the people who use them.

And the exclusion is not a door to be walked around. A GamStop registration holds for the full term chosen — six months, one year, five years or five years with auto-renewal — and stays in place afterwards until the person contacts GamStop to remove it. Registration takes minutes and can take up to 24 hours to take effect. During the term, nothing can cancel it. An offshore site is not a way round that; it is simply a site the scheme was never able to bind.

Questions about this market

What gambling sites are not on GamStop?

Any operator without a Gambling Commission licence is outside the scheme, because participation in the national multi-operator self-exclusion scheme is a licence condition under social responsibility code 3.5.5. That means the whole offshore market — Curaçao, Anjouan, Kahnawà:ke, Malta-licensed sites that do not hold a British licence — plus the unlicensed sites the Commission disrupts. There is no published list, and any site claiming to publish one is guessing.

Are UK gambling sites not on GamStop legal to use?

Using one is not an offence for the player. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and the Commission states plainly that offering commercial gambling to British consumers without a Commission licence is illegal — including where the operator holds a licence in another jurisdiction. The offence attaches to the operator, on summary conviction up to 51 weeks' imprisonment, a level 5 fine, or both.

What does an offshore site offer that a British one cannot?

Higher limits, mostly, and fewer interruptions. There is no statutory cap on slot stakes, no requirement to prompt a financial limit before the first deposit, no financial vulnerability check at the £150 threshold and no Financial Risk Assessment. Withdrawal speeds are the reverse of the marketing: a British operator's data show 96.3% of 44.2 million withdrawals clearing automatically, and no offshore regime publishes comparable figures.

Do gambling apps not on GamStop still work on a phone?

Yes, and that is a meaningful part of the market. Apps appear in stores but are frequently distributed as direct downloads outside the official stores, which means no store review and no easy removal. Blocking software signposted by GamStop — BetBlocker, which states it blocks over 1,368,000 gambling websites and 3,100 apps, and Gamban — works at device level rather than site level. Note that Gamban costs £4.99 a month or £29.99 a year in England and Scotland after the end of TalkBanStop funding on 31 March 2026, and is free in Wales.

Can I self-exclude from an offshore site through GamStop?

No. GamStop Online can only exclude a person from participating operators, meaning those licensed in Great Britain, and its own terms confirm it cannot prevent access to services run by organisations that do not participate. A minority of offshore regulators require their own voluntary schemes — Kahnawà:ke's is described as permanent and irrevocable — but these are separate arrangements that a British GamStop registration does not trigger.

Is there a best offshore casino, or is that just marketing?

It is marketing. Nothing in this market can be ranked by quality the way a regulated market can, because there is no common dispute mechanism and no body publishing comparable statistics. What can be compared is the licence fee, the named ADR provider, the customer-funds rating and the withdrawal terms — and on those criteria the British regime is not merely different but betterd, funded by a levy that raised just under £120 million in its first year.

The limits are the product

The overused phrase is that offshore sites offer freedom from British rules; the accurate one is that they offer freedom from British limits, and that is not the same commodity. A player who wants a bigger stake can find it, at the price of the £5 cap and the £2 cap and the deposit prompt and the vulnerability check at £150 — precisely the mechanisms that slow a losing run — and at the price of a withdrawal term that no British regulator would permit and no British ADR body will adjudicate. The offshore market exists because the limits are the product, and the product is sold to whoever wants it.

What I would want anyone to take from the numbers is the asymmetry. On the regulated side, 96.3% of 44.2 million withdrawals in four months cleared automatically, IBAS closed domestic disputes in an average of 20 days with 100% operator compliance on decisions in the consumer's favour, and £900,000 was extracted from an operator whose withdrawal terms were unfair. On the other side, 586 illegal websites were reachable in September 2026, one criminal prosecution commenced across the year to March 2026, and a licence costs EUR 17,828.

If gambling is causing harm, the National Gambling Helpline on 0808 8020 133 answers 24 hours a day, every day of the year, free, and it is the one number on this page that leads somewhere useful without a terms and conditions page.