Casinos without GamStop are offshore operators holding no Great Britain licence and sitting outside the national self-exclusion scheme. Nothing blocks a player from opening an account or depositing. Nothing protects it either: no Gambling Commission oversight, no adjudicator on the Commission's approved list, and no guarantee the balance survives the company's insolvency.
The word "without" carries two meanings, and the trade likes both. It can mean a casino that does not check GamStop at all; it can mean a casino that checks and still accepts people who are not on the register. GamStop reached 614,738 people on the register as of July 2026, and more than one in two of them chose the maximum five-year term, so the pool of players who would fail a UK check is large — big enough to build a business on. That business is legal in Curaçao or Anjouan and unlawful here: under section 33 of the Gambling Act 2005 it is an offence for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, and that is the operator's offence, not the player's.
My interest on this page is narrower than the legal question. It is what actually stands between a player and their money: the licence, the account terms, the payment route and the complaints ladder. A UK-licensed casino has rules about all four; an offshore one has whatever its own regulator wrote down, and those rules vary from detailed to decorative.
One small note before the rest. The scheme is called GamStop, and a good number of searches type it as "gamestop", presumably because the word "game" suggests itself. It is the same scheme on the register either way.
Table of Contents9
- What a GB Licence Actually Guarantees
- Offshore Sites, Measured Against That Standard
- Casino Sites Without GamStop Exclusion and the Word That Misleads
- Why a Keeping-Money-Good Column Ends in Friction
- Five Signs an Operator Can Be Trusted With a Balance
- How to Judge a Site Before Depositing, in Six Steps
- Where the Harm Actually Shows Up
- Frequently Asked Questions
- The Balance Is the Only Thing Worth Checking
What a GB Licence Actually Guarantees
A Commission licence is not a badge of virtue; it is a set of enforceable obligations. Since 31 March 2020 all online operators must take part in the national multi-operator self-exclusion scheme as a condition of that licence. The requirement sits in the Licence Conditions and Codes of Practice, social responsibility code provision 3.5.5. In April 2020 the Commission added the practical half: every operator must check its entire customer base against the register at least every 24 hours, which also stops registered people receiving direct marketing.
After that, the licence governs money. Condition 17.1.1 says a withdrawal request must not trigger a demand for information the operator could reasonably have asked for earlier. Condition 7.1.1 requires terms to be fair within the meaning of the Consumer Rights Act 2015. Condition 4.1.1 requires customer funds to be held in a separate client account, and condition 4.2.1 forces every operator to declare one of three protection ratings — "not protected", "medium protection" or "high protection" — in writing, acknowledged by the customer, on the first deposit and after any change.
That last rule is the honest one. Keeping money in a separate account does not mean a player is repaid if the operator goes under; a rating of "not protected" must be repeated to the customer every six months with the value of funds held. The Commission's own guidance says an operator may hold customer funds in an overseas bank account. A player weighing the safety of a balance should read that sentence twice before looking at the welcome offer.
Reverse withdrawals were banned outright for remote operators on 31 October 2021: once a withdrawal is requested, the funds cannot be pushed back into play. In the UK there is a complaints ladder with an end to it — social responsibility code 6.1.1 requires an operator to offer a free referral to an approved alternative dispute resolution provider if a complaint is not resolved within eight weeks. The current approved list includes IBAS, CEDR, eCOGRA and ProMediate. IBAS resolved 3,721 domestic disputes in the year to September 2025 in an average of 20 days, and reports operators complied with every consumer-favouring decision in both that year and the one before.
Copy that package into an offshore licence, and the details change. Usually downward.
Offshore Sites, Measured Against That Standard
The three jurisdictions that show up most often behind sites aimed at British players are Curaçao, Anjouan and Kahnawake, with Malta sitting in a different category altogether. Malta's authority licenses EU-facing B2C operators, charges a EUR 25,000 fixed annual licence fee on top of a EUR 5,000 application fee and 5 per cent gaming tax, and requires EUR 100,000 of paid-up share capital for its main B2C classes — the closest thing offshore to a regulator with muscle, and it works to its own rules, not the Commission's. Curaçao has been rebuilding since the National Ordinance on Games of Chance took effect on 24 December 2024; a B2C licence now costs EUR 4,592 to apply for and EUR 47,450 a year, and the legacy orange sub-licences ended on 15 October 2025. Anjouan charges EUR 17,828 a year and states plainly that a licence is not a universal authorisation to operate anywhere.
A comparison is easier to hold in the head if it is organised by what each thing protects rather than by name.
| Criterion | GB-licensed operator | Offshore operator (Curaçao, Anjouan, Kahnawake) |
|---|---|---|
| Self-exclusion check at sign-up | Required, whole customer base checked at least every 24 hours since April 2020 | Not part of the scheme; membership rests on being licensed in Great Britain |
| Spent deposits | Deposit balance withdrawable at any time, including while a bonus is active | Withdrawal can be gated behind wagering and capped by a maximum cash-out clause |
| Reverse withdrawal | Prohibited since 31 October 2021 (RTS 14B) | Commonly permitted; the option is written into the cashier |
| Customer funds | Separate client account plus a declared "not protected" / "medium" / "high" rating | Segregation required in Anjouan's published standards; the rating system does not exist |
| Free dispute ladder | Approved ADR provider, referral within eight weeks, free to the consumer | The operator's named ADR provider, or none; Anjouan names four approved bodies |
Row two is where the money goes. British guidance says players must be allowed to withdraw their deposit balance at any time, including when a bonus is pending or active. Two offshore terms show what the alternative looks like. One operator requires 25× playthrough on casino bonuses and weights contributions by game: slots 100 per cent, table games 20 per cent, video poker and blackjack 10 per cent, roulette and baccarat 5 per cent, craps and live dealer 0 per cent. Another caps maximum bet during wagering at the sterling equivalent of €5 for regular players and €10 for VIPs, and rejects anything above it. A player whose usual roulette stake breaches that cap has handed the operator a reason to void — for conduct nobody warned them about in a readable font.
There is one more row worth reading in the Curaçao paperwork. A Curaçao Certificate of Operation Seal is issued only for an approved player-facing domain and must redirect to the authority's certificate portal. If the certificate behind the seal carries a different domain name from the site being viewed, the site is displaying somebody else's paperwork. That is a five-second test, and it fails more often than it should.
Casino Sites Without GamStop Exclusion and the Word That Misleads
Most of the searches on this subject contain "without GamStop exclusion", and the phrase deserves unpacking, because it describes the player rather than the site. A self-exclusion is a personal registration against a name, date of birth and address. An operator with no access to the register has not removed anyone's exclusion. It has simply never seen it.
That is why the marketing on these sites tends to be about what they never ask, and why the offer reads as a route around a wall. It is not one. A registration with GamStop Online holds for its full term — six months, a year, five years, or five years with auto-renewal — and it stays in place after that term ends until the person contacts GamStop to ask for its removal. Auto-renewal can only be switched off in the last six months of a five-year minimum term, and can run through up to four further five-year periods. If nobody deactivates it, the register holds the data through a further automatic seven-year period, during which operators are told the person was previously excluded. The Commission's 2025 annual report devotes a section to the scheme's refusal to remove registrations before the term ends, and GamStop's registrations cannot be removed early.
Betting on an offshore site while excluded is not a loophole, it is a second problem: unregulated credit balances, no ADR ladder, and a set of terms written by whoever holds the licence. A person who wants the register altered should ask GamStop, not a casino.
Two further hard limits. GamStop Online can only exclude a person from operators that participate, and it cannot stop access to services run by organisations that do not. And a person in crisis needs a person, not a website: the National Gambling Helpline, run by GamCare, is free on 0808 8020 133, 24 hours a day, every day of the year, with the same number reaching live chat and WhatsApp. For Wales the number given is 0808 2819 265.
Why a Keeping-Money-Good Column Ends in Friction
Identity checks are the hinge of the whole subject, and they are where the paperwork and the reality part company. In the UK, licence condition 17 has applied since 7 May 2019: a customer's identity must be established and verified before they are allowed to gamble, including name, address and date of birth. The money-laundering rules then add a threshold. Identification and verification are required when a remote customer deposits, withdraws or wins €2,000 or more, and the figure applies to a single transaction or to transactions that appear to be linked — with linked meaning, for example, the same customer in one logged-on period.
The first time through, the check can be invisible. Operators match details against credit reference agencies and the electoral roll, so nothing is asked for, and no document changes hands. Where a document is needed, the Commission names passports, driving licences and household bills, and it does not specify which information a business may request. It also states it cannot give a timescale, because the process varies: instant where electronic verification succeeds, slower where documents are sent.
Later, the pattern is the problem. The failures turn up at the withdrawal, not the deposit, and the Commission has been blunt about the reason. It says operators must not introduce friction when a customer tries to withdraw rather than when they deposit, and that where the operator has no regulatory concerns about a customer there is no valid reason to delay the payout. More than a quarter of the complaints reaching its contact centre concern identity verification — the classic shape being a customer asked for documents only when money is going out. The Commission's own expectation is that checks move forward to before a deposit or a stake, and that someone onboarded on initials instead of a full name, or a commercial address instead of a residential one, has not really been onboarded.
The warning signs are consistent. A demand for documents that arrives at the withdrawal and could plainly have arrived at sign-up. A verification process the terms describe in one line and the cashier enforces in another. A mismatched name quietly pointing towards an address rather than a person. Identity mismatches are not only a complaints problem: onboarding on a middle name instead of a forename can create mismatches with records held elsewhere, including GamStop, which undermines the whole point of an exclusion. So the check that feels like an intrusion at the deposit stage is the same check that makes a self-exclusion stick later.
Five Signs an Operator Can Be Trusted With a Balance
The licence is named and checkable
Every GB-licensed operator appears on the Commission's public register, and its domain names are listed there; anyone can click through from the regulator's own page and compare the site's address with the entry. For offshore paperwork, Curaçao issues two different seals — a Certificate of Operation for an approved player-facing domain, and a License Certificate for a B2B or B2C entity — and the two are not interchangeable. Click the seal. If it does not land on the authority's certificate page, or the certificate shows a different domain, the claim is not doing the work it appears to do. Attention to a five-second verification test is a better predictor than any badge in a footer.
The terms say what happens to the money if the company fails
Under condition 4.2.1 a GB operator must declare a protection rating and have the customer acknowledge it in writing on the first deposit. An operator that hides that sentence, or repeats it nowhere in six months, has told you something about how much weight its paperwork carries. The reading test is short: separate client account is not the same as insured, and "not protected" is a permitted answer.
Bonus terms fit on one screen and change nothing halfway
British rules capped wagering at ten times from 19 January 2026 and banned incentives that mix two or more product types, so "bet £5 to get 20 free spins" no longer belongs in a compliant offer, while "bet £5 and get £10 free bet" still does. Fee caps and maximum-cashout clauses belong to the offshore model, along with maximum bet limits during wagering. If the version on screen differs from the version in the account, that is the check.
The withdrawal cannot be reversed and is not gated behind a fresh check
Since 31 October 2021 a remote operator must not offer the option to cancel a withdrawal request, and the accompanying guidance says once a withdrawal has been requested the funds must not be available to deposit again. A cashier with a confirm-your-withdrawal button in a different colour has failed a rule that has been in force for five years.
Complaints have a ladder that ends somewhere
A GB operator must offer a free referral to an approved ADR provider if eight weeks pass without resolution, and may not use terms that restrict a customer's right to go to court. Ask which provider and how to reach it, before there is a dispute, and see whether the answer is on the site or in a reply. Where Anjouan licensing is claimed, the operator must name an approved ADR provider in its player-facing terms; the bodies currently approved are EGIS ADR, Axion ADR, iGaming ADR and one other approved provider
How to Judge a Site Before Depositing, in Six Steps
- Check the licence against the regulator, not the badge. Pull up the Commission's public register and confirm the site's domain is listed, or, if the licence is Curaçao, follow the seal to the certificate page and check the domain it names. Reason: licence claims are cheap to print and expensive to verify, and verification is the only step that catches a borrowed certificate.
- Read the customer-funds clause and the protection rating. Look for the words "not protected", "medium protection" or "high protection", and note the six-monthly reminder if the rating is the first of the three. Reason: that rating is the only statement about insolvency an operator is obliged to make, and it answers the question a welcome offer is designed to bury.
- Read the withdrawal section before the bonus section. Note the processing time, any fee, any maximum withdrawal term and any maximum bet while wagering. Reason: a fee of 2.80 per cent on a cash-out, or a €5 stake cap, costs more than any bonus is worth.
- Set a deposit limit when the account opens. Since 31 October 2025 every operator must prompt a financial limit before the first deposit and must present the limit as the default option, with the customer taking an action to decline. Reason: the limit set at three in the morning for a clear head is the one that survives the afternoon.
- Check where a dispute would go. Identify the named ADR provider and confirm it appears on the Commission's approved list if the operator is British. Reason: eCOGRA's figures for the year to September 2025 show 361 of 499 invalid disputes failed because the customer had not used the operator's own complaints procedure first — the route only works if it is followed in order.
- Install a blocker as well as setting a limit. GamStop signposts Gamban and BetBlocker; BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, needs no registration and is free worldwide. Reason: some offshore operators ignore a deposit limit entirely, and the block sits on the device rather than in the operator's database.
Where the Harm Actually Shows Up
The Commission's enforcement figures are worth reading as a description of the market's shape rather than as a scoreboard. Its Illegal Markets team has issued 3,140 cease and desist and disruption notices since April 2024, referred 447,778 search URLs and secured 287,961 removals. Measured across 160 illegal websites, engagement fell by an average of 32 per cent after disruption; by method, a registrar block produced a 91 per cent fall and GEO IP blocking 60 per cent, while a Google removal produced 30 per cent and a Facebook removal 8 per cent. Removing a listing makes a site harder to find. It does not close the door.
The door matters because the customers behind it are heavy. In the quarter April to June 2026 the Commission referred 366 websites to search engines, covering 147,721 URLs; in July to September 2026 it referred 1,835 websites covering 7,677,211 URLs and issued 546 cease and desist notices. Its industry warning notice of 20 January 2025 flagged casino games from licensed operators appearing on unlicensed sites available to British consumers, and noted that those sites often target people who have self-excluded and may have inadequate social responsibility and anti-money-laundering controls. That sentence is the whole argument of this page in one line: the audience is chosen, and the protections are absent.
Scale is contested, so treat every figure as a range with an author. The Commission's own analysis, published 5 November 2026, estimates that among respondents who had gambled online in the previous four weeks, 2.5 per cent had engaged with an illegal site, with a further 1.5 per cent in the previous twelve months. H2 Gambling Capital puts the amount staked with illegal operators in the UK at £16.6 billion in 2025, up from about £5 billion in 2019. A study by Frontier Economics for the Betting and Gaming Council conservatively estimated £2.7 billion staked annually online on the black market, 2.1 per cent of the amount staked with GB-regulated remote casino, betting and bingo operators — and the BGC is not a neutral party. The honest note is that the Commission's own October 2024 methodology says it does not capture activity hidden behind VPNs, so the low estimates are floors and the high ones are advocacy.
None of that says anything about the ordinary player's own gambling, and it is not meant to. It says that the balance sitting in an unlicensed account has no regulator behind it, no adjudicator at the end of the ladder, and no route back if the company stops paying. GamStop registration figures are the other half of the picture and they are not shrinking: 117,756 new registrations during 2025, a 16 per cent year-on-year rise in the first half of 2026, and a monthly record of 12,236 sign-ups in May 2026. Under-25s accounted for nearly one in three of all self-exclusions in that half-year, up 26 per cent year on year. Whatever people are told about bypasses, plenty are choosing the register instead.
Frequently Asked Questions
Are casinos without GamStop legal for British players?
The criminal offence attaches to the operator. Section 33 of the Gambling Act 2005 makes it an offence to provide gambling facilities without a licence, and the Commission states it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence elsewhere. A person at an offshore site commits no offence by opening an account; the terms and protections a British licence carries simply do not travel with them.
Does a "casino without gamestop" check mean anything in practice?
Not the way the advertising implies. No offshore operator can lift a registration, because a registration lives with the scheme, not with an operator. A site that never queries the register has not removed anything — it has never looked. The register held 614,738 people as of July 2026, so the number of accounts failing a UK check is large, and that is why the marketing leans on the omission.
What does a GB licence protect that an offshore licence does not?
The list is concrete: a 24-hourly customer-base check against GamStop, a prohibition on reverse withdrawals since 31 October 2021, a cap on wagering at ten times since 19 January 2026, a ban on mixing two products in one incentive, a declared customer-funds protection rating, and a free referral to an approved dispute-resolution provider within eight weeks. Each of those is a rule with an enforcement history behind it, and none of them travels with an offshore licence.
Which offshore regulators appear behind these sites, and what are they worth?
Curaçao, Anjouan and Kahnawake account for most of them. Curaçao's licensing was rebuilt after the National Ordinance on Games of Chance took effect on 24 December 2024; Anjouan charges EUR 17,828 a year and says its licence is not a universal authorisation; Kahnawake has regulated interactive gaming since 1999 and hosts licensees in one Mohawk Territory data centre. Malta is a serious regulator with its own rulebook, but it applies Maltese and EU rules, not the Commission's.
Do "pay by phone bill casinos without GamStop" handle withdrawals safely?
Phone-billing deposits often run through methods that a sterling withdrawal cannot be paid back into, so the cash-out route is decided by the site's terms, not by the deposit method. There is no British rule forcing a specific payout deadline: the regime rests on fair-and-open condition 7.1.1 and the identity condition, not a stated number of days. Check the deposit line and the withdrawal section as two separate clauses, because that is how the operator drafted them.
Are live dealer casinos without GamStop treated differently?
Not in respect of the exclusion. Live dealer games sit outside the remote casino definition only for stake limits: the £5 and £2 per game cycle caps apply to online slots only, and do not touch roulette, blackjack or live tables. For self-exclusion and fund protection, a live dealer site is judged exactly like a slots site, and the game weighting on an offshore bonus usually gives it zero contribution towards wagering.
The Balance Is the Only Thing Worth Checking
The conclusion of all this is small and unglamorous: the question is not whether a casino asks about GamStop, it is what stands behind the balance once it is sitting there — a licence with enforcement history, a separate client account with a declared rating, a withdrawal that cannot be reversed, and a dispute route that ends with an adjudicator who can order payment. Everything else on the site is decoration.
The register keeps growing in a way that makes the point for me. GamStop Online reported 614,738 people on the register as of July 2026, with more than one in two of them holding out for the full five years. For anyone who needs a person rather than a paragraph, the National Gambling Helpline is free on 0808 8020 133, day or night, every day of the year, and free debt and housing advice is available through Citizens Advice, with Citizens Advice Scotland's gambling support line on 0800 328 1131 on weekdays.
An offshore casino is not a way round a registration. It is a way round the rules that would have protected the money.