Online Casinos Not on GamStop and Whether the Money Comes Back

Online casinos not on GamStop are offshore sites holding a licence from another jurisdiction — Curaçao, Anjouan, Kahnawà:ke, Malta — rather than from the Gambling Commission. They are not licensed in Great Britain, so UK player protections, including GamStop itself, do not apply to them, and anyone using one is dealing with a foreign operator on that operator's terms.

Two millionths of a percentage point. That is roughly what the regulatory paperwork is worth to a player at the moment the withdrawal button is pressed. The rest is the operator's payout queue, and the queue is where this market earns or loses its reputation.

I have covered gambling long enough to be bored by the argument about these sites, which usually runs either "a haven of freedom" or "a criminal swamp" and is usually conducted by people with a commercial interest in one of those answers. The duller truth is that online casinos not on GamStop are a licence category, not a moral one. Some are well-run companies that chose a cheap regulator. Some are shells that exist to harvest deposits. The licence tells you which authority will take a phone call in a dispute, and very little else.

What the licence does tell you matters, though. The Gambling Commission states plainly that it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, and that this includes an operator licensed elsewhere. Nothing in the offshore category changes that, and I would rather say it in the fourth paragraph than bury it in a footnote.

There is a second reason to lead with the money. Over a quarter of complaints reaching the Commission's contact centre concern identity verification, and the largest single category of complaint the regulator records is withdrawals. That is the domestic, well-regulated market, where the payout rules are stacked in the player's favour. Take away those rules and you have taken away the thing players complain about most. Which is the subject of this page, and my angle throughout: not whether an offshore casino will take a deposit, which it certainly will, but how fast and how reliably it hands the money back.

13.11.2026 is my marker for the figures below; the 2026 season's numbers run through it.

What "Not on GamStop" Actually Means

The scheme's name is often typed "gamestop" — a slip the word "game" invites — but it is GamStop, and what it does is narrower than most people assume. It is a self-exclusion register: a person joins it, chooses a term, and participating operators must block that person from holding an account.

The obligation to participate is a licence condition, Social Responsibility Code 3.5.5 in the Licence Conditions and Codes of Practice, in force since 31 March 2020. It binds operators licensed by the Gambling Commission. It has no reach over an operator licensed in Curaçao or Anjouan, because the Commission cannot put a condition on a licence it did not grant. That is the entire mechanism, and there is no clever version of it.

The scheme is free, run by The National Online Self Exclusion Scheme Limited, and it held 561,983 active exclusions at the end of 2025, rising to 614,738 consumers currently on the register as of July 2026, when more than one in two registrants had opted for the maximum five-year term. That is a large and growing population of people who have asked not to be sold gambling, and it is the commercial reason this offshore sub-market exists at all.

One thing to be plain about, because it is where the market's marketing does its quietest work: registering with GamStop holds for the full term chosen, cannot be cancelled early, and remains in place after the term ends until the person contacts GamStop to have it removed. An offshore site is not a way round that, and any site that presents itself as one is selling a lie alongside the product. The Commission's own January 2025 warning notice said as much, noting that unlicensed sites often target customers who have self-excluded and may run inadequate social responsibility and anti-money-laundering controls.

How the Block Works the First Time, and Later

The first registration takes minutes and the block becomes effective within 24 hours. From that point operators must check their entire customer base against the register at least every 24 hours — a requirement the Commission added in April 2020 — so a new sign-up at a UK-licensed site will be caught on the next sweep even if the site's sign-up form did not catch it.

Later is where it bites. Once the chosen term runs out, the exclusion does not simply evaporate. GamStop holds the person's data through a further automatic seven-year self-exclusion period during which operators are told they were previously excluded. Under the terms of use, auto-renewal can only be switched off in the last six months of a five-year term, and can continue for up to four further five-year periods. The Group's 2025 annual report devotes a whole section to its refusal to remove registrations before the term ends, which tells you how often it is asked.

The Warning Signs Around the Register

Treat as a warning any operator that advertises itself by the exclusion it ignores. Sites built around "we do not check GamStop" are not making a technical point about database access; they are naming their customer acquisition strategy. Also treat with suspicion any claim that an offshore site is "GamStop-approved" or "GamStop-friendly" — the register does not approve sites, and the phrasing usually exists to make an unlicensed operator sound inspected.

For anyone who wants a second layer, GamStop signposts Gamban and BetBlocker, and the Commission publishes a list of banks offering gambling blocks — Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling, as of the list's 16 October 2026 update. Bank blocks work on gambling merchant category codes and sit at card level, so each card needs switching on separately.

The 2026 Payout Benchmark and What a Licensed Site Returns

Whatever an offshore operator's marketing claims about speed, there is one set of published numbers on how quickly British players actually get their money, and it comes from the regulator. Gambling Commission data covering June to September 2024 records 44.2 million withdrawals by customers of large online operators. Of those, 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours, and 0.1 per cent took up to 48 hours.

Read that table slowly, because it is the whole comparison. In the regulated market, a withdrawal is a near-instant event for all but a few per cent of requests. That result is not a happy accident of British banking. It rests on a specific ban: reverse withdrawals were permanently outlawed for remote operators by RTS requirement 14B, in force since 31 October 2021, which states that consumers must not be given the option to cancel their withdrawal request. Once you have asked for your money, the site cannot offer to put it back into play.

The second pillar is Licence Condition 17.1.1, which says a withdrawal request must not trigger a demand for information the operator could reasonably have requested earlier. Operators who ask for documents only at the payout stage — the classic friction tactic — are in breach, and the Commission says so.

None of this travels with an offshore licence. Nor do the numbers get better offshore; they get unmeasured, which suits some operators very well.

Comparing the Licence Regimes Behind These Sites

The word "offshore" covers regulators with wildly different appetites. This matters because a licence is not a label, it is a fee schedule, a complaints route and an enforcement record.

The Curaçao column needs a footnote, because the old shorthand no longer works. The National Ordinance on Games of Chance took effect on 24 December 2024, ending the master-licence model; the legacy orange sub-licence certificates ended on 15 October 2025, and the CGA says a historic /JAZ number must not be treated as proof of a current licence. The regulator also said on 7 October 2026 that its previous online portal would not return to service, and that it is building an alternative way to verify licensed domains because the old digital seal may be affected by the transition. In other words, the verification method itself is mid-repair. I would not stake a complaint on a seal I cannot follow through.

Anjouan is the other one worth a hard look. The territory's regulator publishes a verification framework and standards requiring segregated player funds and certified random number generators. Against that, an ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, and that Comoros financial intelligence officials described the corporate side of the operation as illegal; a former attorney-general called the licensing entity "an illegal entity". Anjouan Gaming's own position, stated on 10 June 2026, is that its licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world" — which is a fair description of offshore licensing and also an admission that the licence is not a permission to serve British players.

Malta sits in a different bracket again, and not simply because the fees are bigger. The MGA publishes a list of Unauthorised URLs, declaring that any reference to a Maltese licence on those domains is false and misleading, with entries carrying notice dates of 30 October 2026. An EU regulator that names its impostors is doing something the player can use.

The One Thing This Turns On Is Identity Checks

If you take one section of this page seriously, take this one. Identity verification is the single point where offshore terms and UK rules diverge in a way that costs players money, and it is the mechanism behind most of the withdrawal stories.

In the UK the position is now fairly hard-edged. Licence Condition 17 requires the operator to obtain and verify information establishing identity before the customer is permitted to gamble, and the Commission expects those checks brought forward to before the first deposit or stake. It has criticised onboarding on partial or equivocal verification — initials instead of full names, nicknames, commercial addresses instead of residential ones — and singled out so-called fuzzy matching through third-party providers. It has also noted that opening an account under a middle name instead of a forename can create mismatches against records such as GamStop, which quietly undermines the very self-exclusion the person registered for.

The anti-money-laundering layer sits underneath at a different level. Under the Money Laundering Regulations, remote casinos must identify and verify when a customer deposits, withdraws or wins €2,000 or more, and the threshold applies to linked transactions — same game, same session, a single logged-on period — not just to one payment. A hybrid approach is permitted: identify and check age at registration, defer full verification to the threshold. When the threshold is reached, the casino must be able to end the transaction if the customer cannot comply.

That last sentence is the crux. In a licensed market, the operator's obligation runs alongside a prohibition on springing document requests at the payout stage, and a prohibition on confiscating a deposit because identity was not provided. The Commission's fair-terms guidance is explicit that un-staked deposits remain the customer's. Those two rules form a pincer: the operator must check you, and it cannot use the check as a reason to keep your money.

Offshore, one half of the pincer is removed. Anjouan's standards do require age verification and AML controls, and Kahnawà:ke requires a licensee's relationship with players to be contractual and free of unfair or unreasonable terms. But the specific protection against late document requests is a British licence condition. At an offshore site, a demand for a notarised utility bill on the morning of a large withdrawal is not a breach of anything; it is a term in a contract the player accepted.

The warning signs are consistent and dull, which is precisely why they work. A site that verifies nothing at sign-up — no name check, no date of birth, no address — is not being considerate; it is deferring a check it intends to use later, when the account holds winnings. A site whose terms reserve the right to "request further documentation at any time" without stating what or when is building in delay on purpose. And a site whose terms give it sole discretion to void winnings is describing a business model; UK guidance treats such terms as unfair within the meaning of the Consumer Rights Act 2015, which is why the Commission fined one operator £170,000 in July 2025 over a bonus term allowing it to close accounts or forfeit winnings at its own discretion.

Five Signs an Offshore Operator Can Be Checked, Not Trusted

I do not much believe in trust as a category for this market. I believe in verifiability: whether a claim can be checked by someone other than the person making it. These five signs are all checkable before a deposit is made.

The licence points somewhere you can follow

Take the licence number and go to the regulator's own register, not the site's licence page. On Curaçao, click the Certificate of Operation Seal: it must redirect to cert.cga.cw, and if the seal differs in design, colour or format the site is not authorised. If the certificate behind the seal shows a different domain from the one you are on, the site is displaying another operator's certificate. The Gambling Commission's equivalent advice — click through to the public register and check that the site's activities and domain names match — applies whether the licence is British or foreign.

The payout terms name a number and a clock

A serious operator states a processing time and a fee, in writing, in the terms: how long internal review takes, whether the payment method adds a further delay, and what the fee is. Vague language — "withdrawals are processed promptly", "subject to verification" — is a delay clause in disguise. One caveat applies in the UK that does not apply offshore: operators may charge a cost-reflective processing fee and may reasonably limit the size or number of separate withdrawals, provided the term is fair, transparent and made clear before the deposit. So the existence of a limit is not automatically a red flag. Its invisibility is.

The bonus has a capped wagering requirement and a stated maximum cashout

Since 19 January 2026, UK-licensed operators cannot apply wagering requirements above ten times, and cannot mix more than one type of gambling product within a single incentive. Offshore, neither rule applies. Comparing published terms across offshore operators, welcome-bonus multipliers sit in a range whose top end is far above the UK cap, and maximum-cashout clauses do appear — one operator's terms limit winnings generated with bonus funds to 300 per cent of the credited bonus amount, with the excess voided. Those clauses are legal offshore and are exactly how a large win becomes a small payout. The check is dull: read the cashout cap and the wagering multiplier before claiming anything.

Customer funds are described, not promised

UK licensees must state in their terms whether customer funds are protected in the event of insolvency, using one of three ratings, and an operator rated "not protected" must remind the customer every six months that the money is not protected. Even so, holding funds in a separate client account does not guarantee their return, and operators are legally allowed to hold customer money in overseas bank accounts. Offshore, the disclosure usually is not made at all. The check: look for a stated protection rating, and treat silence as "not protected".

There is a named complaints route beyond the operator

In the UK, a licensee must let a customer take an unresolved dispute to an approved ADR provider free of charge after eight weeks, and the approved list is a matter of public record. Kahnawà:ke requires its licensees to allow players to set limits including zero, and runs a full-time Dispute Resolution Officer. Anjouan requires a designated ADR provider to be named in player-facing terms and expects complaints resolved within 30 days before escalation. The check: find the named provider in the terms, then confirm it exists independently. If the only route is an email address at the operator's own domain, the route is decorative.

Six Checks Worth Doing Before Any Deposit

1. Read the licence page, then verify it at the source. Reason: the licence is the only leverage a player has afterwards. A screenshot of a regulator's seal proves nothing; a working link to the register proves the licence exists and, on Curaçao, that the domain is registered to that operator.
2. Find the withdrawal terms before the deposit terms. Reason: the deposit page is designed to be read and the withdrawal page is designed to be found late. Locate the processing time, the fee, the maximum number of pending withdrawals, and any maximum cashout clause, and write the numbers down.
3. Check whether the site states a customer-funds protection rating. Reason: if the operator fails, the rating is the difference between a claim on segregated money and a place in a queue of creditors. Silence should be read as the lowest rating.
4. Identify the ADR provider and confirm it on the provider's own site. Reason: disputes about account management and access to funds are within an ADR's remit, but only if the operator is genuinely on that provider's list. E-cigarette cases are instructive: a provider may refuse a dispute where the website is not on its approved list.
5. Set a financial limit at the account, and a bank block at the card. Reason: UK rules require operators to prompt for a financial limit before a first deposit and to make it easy to review, and the Commission publishes the banks offering gambling blocks. Offshore sites have no equivalent duty to prompt, so the decision has to be made before the account is opened.
6. Register with GamStop if exclusion is the point, and understand the term. Reason: the register blocks all UK-licensed operators at once, for a term that holds to the end and then stays until GamStop is asked to remove it. An offshore site does not offer a shorter or softer version of that; it offers an unregulated one.

The Complaint Route, and How Much of the Market Is Offshore

Two things are worth knowing about enforcement, because both bear on whether an offshore site will still be there next year.

First, the Commission is a regulator, not an ombudsman. It cannot resolve an individual complaint or get a customer's money back. What it can do is act against the operator, and it does: since April 2024 its Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Bing and Google URLs and secured 287,961 removals. Measured across 160 illegal sites, engagement fell by an average of 32 per cent after disruption, with registrar blocks producing an average fall of 91 per cent and GEO IP blocking 60 per cent. The Commission's own assessment is that those two methods work better than search-engine removals, because a removal makes a site harder to find without blocking access to it.

Second, the market is smaller than the headlines suggest and larger than the licensed industry would like. The Commission's analysis published 5 November 2026 estimates that among respondents who had gambled online in the past four weeks, 2.5 per cent had engaged with illegal gambling websites, with a further 1.5 per cent having done so in the past 12 months. Industry-commissioned estimates run much higher: H2 Gambling Capital put stakes with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019. The Commission notes its own methodology does not capture activity hidden by VPNs, which means every published figure is a floor rather than a measurement.

Where does that leave the player who wants a payout and no GamStop check? In a market where the operator's incentive is to be easy to join and slow to leave, and where the regulator with the power to intervene has no jurisdiction over the transaction.

For anyone whose gambling has stopped being a hobby, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day of the year, operated by GamCare. In Wales the number given is 0808 2819 265. Gamblers Anonymous England, Wales and Ulster runs around 250 meeting locations on 0330 094 0322, and GamFam supports families through its GRA5P programme. None of that requires an account anywhere.

Questions About Offshore Casinos

Are online casinos not on GamStop legal?

Operating one is the offence, not using one. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without the relevant licence, punishable on summary conviction by up to 51 weeks' imprisonment, a level 5 fine, or both. The Commission states plainly that offering commercial gambling services to consumers in Great Britain without a Commission licence is illegal, including where the operator holds a licence elsewhere. The Act's general offences attach to those who provide facilities, not to adult consumers.

What is the best online casino not on GamStop?

I do not answer that, because "best" in this category usually means "fastest to open an account", which is the opposite of what a player needs. The better question is which regime can be checked. A Curaçao seal that redirects to cert.cga.cw and names the domain you are on is verifiable. A Maltese licence that appears on the MGA's own list is verifiable. So is a Kahnawà:ke logo that generates a Certificate of Good Standing. Unverifiable claims are simply claims.

Why do offshore sites ask for documents only when you withdraw?

Because that is when the leverage shifts. Under UK Licence Condition 17.1.1 a withdrawal request must not trigger a demand for information the operator could reasonably have asked for earlier, and where a business delays a payout over insufficient ID it may be in breach of the condition. Offshore, no such rule exists. The check that would have taken two minutes at sign-up becomes an open-ended condition attached to the only money that matters to the player.

Do offshore casinos pay out faster than UK-licensed ones?

There is no comparable dataset, and that is the answer. The Commission's figures for June to September 2024 cover 44.2 million withdrawals at large UK-licensed operators, of which 96.3 per cent cleared automatically, 3.5 per cent within 24 hours and 0.1 per cent in up to 48 hours. Offshore, no regulator publishes an equivalent, and consumer research published in July 2026 found only 49 per cent of people who had gambled in the past 12 months agreed that withdrawing winnings was quick and easy.

Can an offshore site get round a GamStop exclusion?

No, because the exclusion is not the site's to lift. GamStop registration holds for the full term chosen — six months, one year, five years or five years with auto-renewal — cannot be cancelled during the exclusion period, and remains in place after the term ends until the person contacts GamStop to remove it. The register then holds data through a further automatic seven-year period during which operators are told the person was previously excluded.

What happens if an offshore operator refuses to pay?

In practice, very little. The Commission cannot adjudicate; it is a regulator, not an ombudsman, and cannot help a consumer recover money. Anjouan requires its licensees to name an ADR provider and resolve complaints within 30 days before escalation, and Kahnawà:ke employs a Dispute Resolution Officer — both are real routes, though enforcement depends on the regulator's appetite. For UK-licensed sites the picture is firmer: a dispute unresolved after eight weeks can go to an approved ADR provider free of charge.

The Tell Is Not the Licence, It Is the Payout Queue

An offshore licence tells you which regulator will take the call, not whether the site will pay, and in a market where a withdrawal can be delayed by a term nobody read, the queue is the real product.

The domestic benchmark is on the record — 44.2 million withdrawals between June and September 2024 at large UK-licensed operators, 96.3 per cent of them clearing automatically — and it exists because reverse withdrawals were banned outright on 31 October 2021 and document requests at the payout stage were prohibited. Those rules are British licence conditions. They do not travel, and no offshore seal substitutes for them.

If gambling has stopped being fun for someone, the National Gambling Helpline, run by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year.