Gambling Not on GamStop and the Hidden Costs

Gambling not on GamStop means any site that is not part of the UK's national self-exclusion scheme — almost always because it holds no Gambling Commission licence and answers to an offshore regulator instead. Such sites are legal for the operator only if they avoid the British market; for anyone in Great Britain, the protections of a UK licence do not apply and there is no way back through the scheme.

The pitch for a gambling site not on GamStop is always the same: more bonus, fewer questions, fewer documents, and a register that never sees your name. What is never on the banner is the bill that arrives afterwards — the withdrawal that takes four days instead of four minutes, the identity documents demanded only once you want your money, the wagering figure buried in clause fourteen. I have spent years reading the trade press and the regulator's enforcement notices, and the pattern is dull and consistent. The sites with the loudest welcome offers have the quietest terms.

A gambling site not on GamStop is not thereby illegal for the player. The offence under section 33 of the Gambling Act 2005 sits with the person providing facilities without a licence, not with the adult who uses them. That is cold comfort. The law protects you from prosecution; it does not protect you from a company in a jurisdiction you have never heard of, run by directors you cannot check, holding your money in a bank account you cannot see. This page is about the difference between the two — and about the costs that do not appear until the moment a player tries to leave with winnings.

What "Not on GamStop" Actually Describes

The scheme has an official name now. In November 2025 GAMSTOP was renamed Gamstop Online following a website update, and the shop-based scheme once called MOSES became Gamstop Betting Shops. The word is often typed "gamestop" — a slip the search box invites and the register does not recognise.

Gamstop Online is free, run by The National Online Self Exclusion Scheme Limited, and blocks a person from all online operators licensed in Great Britain. A registration takes a few minutes and can take up to 24 hours to bite. It cannot be cancelled during the chosen term — six months, one year, five years, or five years with auto-renewal — and it stays in place afterwards until the person contacts Gamstop to remove it.

Which means the phrase in the head keyword describes one thing only: the gap between that register and the sites that never joined it. A gambling website not on GamStop is not in the scheme because it is not a licensed British operator. Since 31 March 2020 every online operator holding a Gambling Commission licence has had to be part of it — the duty sits in social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, and in April 2020 the Commission began requiring operators to check their whole customer base against the register at least every 24 hours. Two operators had their licences suspended in April 2020 for missing the deadline. Nobody with a British licence is outside the scheme; only the unlicensed are.

There are offshore sites that hold no UK Gambling Commission licence, are not connected to Gamstop and are not covered by it, since the scheme's obligations apply only to UK-licensed operators — a point stated by trade and press sources rather than a regulator page, though it follows directly from Gamstop's own terms of use.

Where to Get Help in Great Britain

Before the money, the person. The National Gambling Helpline is run by GamCare and is free on 0808 8020 133, twenty-four hours a day, every day of the year; callers in Wales are given 0808 2819 265 alongside the England and Scotland number. BeGambleAware, GambleAware's public-facing brand, routes to the same line and to online chat. GamFam (charity number 1191139) supports families and friends through its five-stage GRA5P programme, Gamblers Anonymous England, Wales and Ulster runs around 250 meeting locations on 0330 094 0322, and Gam-Anon UK & Ireland covers the family and friends of compulsive gamblers through [email protected]. The NHS National Gambling Clinic in London takes self-referrals, and integrated care boards commission eight regional NHS gambling services receiving almost 5,000 referrals a year.

None of those bodies can retrieve money from a company that has no British licence. That is the practical asymmetry: the help exists, the leverage does not.

Licence, Right, and What Leaves With It

The licence is the whole architecture. It is what makes the register binding, the complaints route available and the terms enforceable.

I will take the difference apart, because it is where most of the invisible cost lives.

What a British Licence Requires

A Gambling Commission licence imposes duties that cost operators real money, which is precisely why some of them go without. Withdrawal requests must not trigger a demand for documents the operator could reasonably have asked for earlier (licence condition 17.1.1), terms must not be unfair under the Consumer Rights Act 2015 (condition 7.1.1), reverse withdrawals have been banned outright since 31 October 2021 under RTS 14B, and no operator may impose a maximum limit on how much a customer can withdraw from their deposit balance — the Commission's own example of a prohibited term being "You may withdraw up to £50 per day and up to £500 per week".

Add the money rules: credit cards have been banned for gambling since 14 April 2020, financial vulnerability checks became a requirement in August 2024 with the threshold lowered to £150 of net deposits over 30 days from 28 February 2025, financial limits must be offered before a first deposit since 31 October 2025, and from 19 January 2026 wagering requirements on bonus funds are capped at ten times. A British licence is expensive, intrusive and slow. That is the point of it.

What an Offshore Licence Requires Instead

Offshore regimes are cheaper and lighter, and the fees say so. A Curaçao B2C licence carries a one-off non-refundable application fee of EUR 4,592 and a total annual cost of EUR 47,450. Anjouan's schedule is EUR 17,828 to issue and the same again to renew, with EUR 500 per additional domain. Kahnawà:ke charges a USD 35,000 Client Provider Authorization application fee, rising to USD 40,000 on 1 January 2027, plus USD 20,000 a year. Malta sits between, at a EUR 25,000 annual licence fee for B2C plus a five per cent gaming tax on revenue.

Those are real regimes with real paperwork, and I would rather a site held a Maltese or Curaçao licence than none at all. But the arithmetic is the argument: a jurisdiction earning EUR 17,828 a year from a licence has less reason and less capacity to supervise it than one that charges a British licence fee, and none of them operates a self-exclusion register that reaches a British player's existing accounts.

What Costa Rica and "No Licence" Mean

There are sites that hold nothing. Costa Rica does not run a comprehensive gambling licensing regime and has no formal framework for issuing gambling licences; the "data processing license" quoted in the industry's marketing is not a licence in any strict legal sense. Its Legislative Assembly rejected Bill No. 25,057 in early 2026, which would have introduced a mandatory licensing regime. "Licensed in Costa Rica" is therefore a sentence without meaning, and it belongs in the same drawer as "fully regulated" printed on a footer with no regulator named.

The Offshore Gap, by Method

The table below compares each route by what a player can actually enforce, not by which brand advertises loudest. The Curaçao fee of EUR 47,450 a year is the same figure I used above; the Anjouan renewal at EUR 17,828 is the same one.

Two rows deserve a footnote. Under Kahnawà:ke's rules a player who breaches a self-exclusion prohibition forfeits funds deposited or won to a third-party charity chosen by the Commission — a rule with teeth, pointed at the player. And Curaçao's reform, the National Ordinance on Games of Chance, took effect on 24 December 2024, ending the old master and sub-licence model; the legacy "orange" sub-licence certificates of operation expired on 15 October 2025 and should no longer be treated as proof of a current licence. A site still waving an orange certificate or a historic /JAZ number is showing you a document that the regulator itself says proves nothing.

Identity Checks for Trust

Identity verification is the hinge, and its timing is everything. On a well-run site, name, address and date of birth are checked before a customer is allowed to gamble — the Commission expects identity and age checks to be brought forward to before deposit or stake, and says onboarding on initials, nicknames or a commercial address is not sufficient. When a business can verify electronically, through credit reference agencies or the electoral roll, the account usually opens with no documents at all. That is the first time.

Later is where it hurts. Under the money laundering regulations, a remote casino must identify and verify when a customer deposits, withdraws or wins €2,000 or more, and the threshold covers linked transactions, not just a single one — deposits made through the same game, or during one logged-on session, count together. So a player can sail through a dozen modest deposits, hit the threshold on the way out, and meet a document request at the only moment that matters. The regulator's position is blunt: a withdrawal request must not create a demand for information the operator could reasonably have requested earlier, and where a business delays a withdrawal over insufficient ID it may be in breach of licence condition 17. Offshore, that protection does not exist, and the request arrives when it is least convenient to refuse it.

The warning signs of a verification trap are specific. Documents asked for the first time at withdrawal, rather than at deposit. A selfie demanded without explanation. A request for a bank statement with the balance and every transaction visible. A "fuzzy match" failure that nobody at the company can explain. A middle name recorded as a forename, which creates mismatches with records held elsewhere — including Gamstop, which is how a self-exclusion quietly stops working. And an account that goes silent the moment the file is complete.

Where the verification is done properly, the numbers look nothing like that. Gambling Commission data covering June to September 2024 recorded 44.2 million withdrawals by customers of large online operators, of which 96.3 per cent cleared automatically and 3.5 per cent within 24 hours. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification — a concern customers raise when documents are demanded only on attempting to withdraw. The market has solved this. The sites that have not solved it have chosen not to.

Five Signs an Operator Can Be Trusted

Each of these takes a couple of minutes. None requires an account.

The Licence Matches the Domain

Check that the business holds a Commission licence and click through to the public register to see whether the site's activities and the domain names listed actually match. A licence that exists, but lists a different domain, is a licence being borrowed. Offshore, the same test applies with the regulator's own tool: a Curaçao Certificate of Operation seal must redirect to the official CGA website, and if the certificate behind it shows a different domain from the one in the address bar, the site is displaying another operator's certificate.

The Terms Are Honest About Delay

Read the withdrawal section before depositing. Look for a stated processing time, a stated limit per transaction or per day, and any fee. Under British rules a maximum withdrawal limit against the deposit balance is prohibited, and a processing fee must not exceed the direct cost of processing. Offshore, a cap expressed as a percentage of the bonus — 300 per cent of the credited bonus, in one published set of terms — is common and legal there. It is also the single term most likely to decide the outcome of a good night.

The Bonus Math Is Visible in Full

Significant conditions must be clear and, online, displayed in full no further than one click away. If the headline multiplier is not visible at a click, it is a multiplier designed not to be read. Since 19 January 2026 a UK-licensed operator cannot apply wagering above ten times, and cannot bundle two product types into one offer — "bet £5 and get 20 free spins" fails that test, while "bet £5 to get £10 free bet" passes. Offshore, multipliers of 25× to 50× remain the norm.

Player Funds Are Separately Held and Rated

British licensees must hold customer funds in a separate client bank account and must tell customers which of the three insolvency ratings applies — not protected, medium or high protection — with the disclosure acknowledged before funds are used for gambling. An operator rated "not protected" has to remind customers of that every six months. If no rating appears in the terms, ask why one is missing.

Complaints Go Somewhere Named

A trustworthy operator names an ADR provider, and a British one must offer referral to an approved body free of charge if a dispute is not resolved within eight weeks. Offshore regimes have their own approved lists — Anjouan, for instance, requires a designated ADR provider and expects 30 days of internal handling first. A site whose terms make no mention of any dispute route is telling you where complaints go, which is nowhere. The regulator is not an ombudsman: the Commission cannot resolve individual complaints or retrieve money, and refers disputes onward.

How to Judge a Site Before You Deposit

A short, lawful routine. I would do all six, and the order matters less than doing them at all.

1. Look up the licence on the regulator's own register. Not the badge in the footer — the register. Confirm the domain name appears alongside the licence holder. Reason: a badge is an image file; the register is a public record, and the two disagree more often than the industry admits.
2. Read the withdrawal clause and time it. Note the stated processing period, any per-transaction cap and any fee. Reason: this is the clause that decides how a winning week actually ends, and it is the one clause almost nobody reads before the first deposit.
3. Find the bonus terms at one click. Multiply the wagering figure by the bonus to get the playthrough in pounds, and check the maximum bet while wagering. Reason: a multiplier is a number; £400 of playthrough on a £40 bonus at a £5 maximum stake is a set of instructions, and they are not all achievable.
4. Check the customer-funds rating in the terms. Find which of the three insolvency ratings applies and whether the site is clear that a separate account does not guarantee return of money if the operator fails. Reason: money held in a client account is not money insured against a collapse, and gambling businesses may legally hold it overseas.
5. Test the support channel with one dull question. Ask what documents are needed to withdraw, in writing, before depositing. Reason: the reply is the only evidence you will ever get of how the company behaves when the balance is in its hands rather than yours.
6. Check what else is standing behind the account. A bank gambling block is applied at card level, covers online casinos, betting sites, gaming apps and physical venues, and most banks use a 48- or 72-hour cooling-off before gambling transactions are allowed again; it does not affect a credit score. Gamban or BetBlocker can sit on a device as a further layer, with BetBlocker stating it blocks over 1,368,000 gambling websites and 3,100 apps without registration. Reason: these are the only controls that do not depend on the operator's goodwill.

One more thing about the register, because it is the part people misunderstand. A self-exclusion holds for its full term and then remains in place until the person contacts Gamstop to remove it — and registration details are checked by operators whenever anyone tries to use an online gambling account. An offshore site is not an exception to that arrangement. It is a site that never agreed to it, which is a different thing entirely: the exclusion still exists, still stands, and simply cannot be seen by a company that never joined the scheme. The Gambling Commission issued an industry warning notice on 20 January 2025 about licensed casino games appearing on unlicensed sites and noted that such sites often target customers who have self-excluded through GAMSTOP. That is a regulator describing a market, not an accident.

What the Numbers Say About the Gap

The size of the offshore market is disputed, which is itself informative. H2 Gambling Capital estimates £16.6 billion was staked with illegal operators in the UK in 2025, up from about £5 billion in 2019, with the legal share of gambling falling from 97 to 92 per cent. A Frontier Economics study for the Betting and Gaming Council put it at £2.7 billion staked online annually, about 2.1 per cent of the £128 billion staked with regulated remote operators. Yield Sec's analysis for the Campaign for Fairer Gambling put the unregulated share at nine per cent of an £8.8 billion market in 2025. Compare those to the Commission's own survey analysis published 5 November 2026, which found that among respondents who had gambled online in the past four weeks, 2.5 per cent had engaged with illegal gambling websites, with a further 1.5 per cent having done so in the past twelve months.

I know which figure I trust, and it is the one with a methodology attached and a caveat admitted. The industry numbers arrive when a lobby wants something and differ by a factor of six. What is not in dispute is the volume of disruption: since April 2024 the Commission's Illegal Markets team issued 3,140 cease and desist and disruption notices, referred 447,778 search URLs and secured 287,961 removals, and across 160 illegal websites with traffic data it measured an average 32 per cent fall in engagement afterwards. By method, registrar blocks and suspensions each produced an average 91 per cent reduction, GEO IP blocking 60 per cent, Google removal 30 per cent and Facebook removal 8 per cent — the Commission itself noting that removing a site from search makes it harder to find without blocking it. The gap is being worked on. It is not closing quickly.

Questions About Gambling Not on GamStop

What gambling sites are not on GamStop?

Any site that holds no Gambling Commission licence. Since 31 March 2020 every online operator with a British licence must participate in the scheme under social responsibility code provision 3.5.5, so non-participation is a reliable sign of no British licence. The practical way to check is the Commission's public register: search the brand, then confirm the domain names listed match the site in front of you.

Are these sites legal to use from Great Britain?

Using them is not the offence. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and the Commission states it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence elsewhere. The liability sits with the operator. The absence of protection sits with the player.

Why do offshore sites ask for documents only when I withdraw?

Because a deposit is revenue and a withdrawal is a cost. Under the money laundering regulations a remote casino must verify identity at €2,000, counting linked transactions in a single session, so the threshold is usually crossed on the way out. On a British-licensed site, licence condition 17.1.1 forbids demanding information at withdrawal that the operator could reasonably have requested earlier.

What does a large wagering requirement actually cost?

Divide nothing and multiply everything: a 40× requirement on a £50 bonus is £2,000 of playthrough before a penny of bonus-derived winnings is withdrawable, and the contribution chart matters more than the headline — slots may count at 100 per cent, roulette at 5 per cent, meaning £40,000 of roulette staked. British-licensed operators are capped at 10× since 19 January 2026. Offshore, 25× to 50× is ordinary.

Do the UK's gambling protections follow me offshore?

No. The credit card ban, the reverse-withdrawal prohibition, the fair-and-open terms condition, the customer-funds disclosure and the ADR requirement all attach to a Commission licence and to nothing else. A Curaçao, Anjouan or Kahnawà:ke licensee answers to its own regulator, and the Commission cannot act for a player against a company it does not licence. The help lines remain open to anyone; the leverage does not travel.

Are there gambling apps not on GamStop?

Yes, and an app is just a domain with a shortcut. It does not change the licensing position, the verification timing or the terms. A blocking tool such as Gamban or BetBlocker works at device level and does not care whether the site was opened in a browser or an app, which is why it is the more reliable layer for anyone who wants a limit that holds.

The Cost of the Missing Licence

The gap in gambling not on GamStop is not a loophole in the scheme; it is the scheme's outer edge, and the price of stepping outside it is paid in the only currency that matters, which is time — the days a withdrawal sits in a queue, the weeks a document request goes unanswered, the months a complaint has nowhere to go, and the years before a stalled self-exclusion is noticed. My judgement is that the good offshore operators are worth describing honestly and the bad ones are not worth defending at all, and the whole difference between them shows up in two places: the terms, and the withdrawal clause. Everything else is advertising.

The regulator referred 1,835 websites to search engines in July to September 2026 alone, against 226 in January to March 2026, and issued 546 cease and desist notices in the same quarter. If you need the helpline at any point, it is 0808 8020 133, free and open every hour of the year.