Gambling Not on GamStop and Player Balance Protections

It is often typed "gamestop". The scheme is GamStop, and the spelling is the only thing about it that is careless — the rest of it is a 24-hour block that 614,738 people were sitting behind as of July 2026, which is a lot of people to write off as a clerical error.

The phrase is usually set down as though it describes a loophole. It does not. It describes a market, and a market has two ends. At the near end, an operator in Curaçao or Anjouan pays a licence fee in the tens of thousands of euros and gets a certificate to hang on a website. At the far end stands a player whose balance is held under terms written by that operator, in a jurisdiction whose regulator has no power over it and, in more than one case, no office that a British complaint can reach.

I take the money side of this. Not which site has the prettiest welcome offer — the offers are the least interesting part of any of them — but who holds the cash between the deposit and the payout, who can stop it moving, and what a player can actually do about it when something goes wrong. That is where the difference between a licensed operator and an unlicensed one stops being rhetorical.

Two numbers set the stakes. GamStop recorded 117,756 new registrations during 2025, and the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices since April 2024. Those figures pull in opposite directions. One is a queue of people asking to be stopped; the other is a regulator struggling to stop the sites that will take them anyway.

Gambling Sites Not on GamStop and How the Map Is Drawn

The dividing line is a licence, not an attitude. Under section 33 of the Gambling Act 2005 it is an offence to provide facilities for gambling without an operating licence, and the offence applies whenever the person providing the facilities knows or should know that they are being used, or are likely to be used, in Great Britain. The Commission has said plainly that a licence from another jurisdiction does not change that. So the operator's exposure is real, and so is the gap: enforcement is sporadic, and the sites move faster than the paperwork.

What that means for a player is narrower and more practical. A licence is the hook on which every consumer protection hangs. No licence, no hook. The money in an offshore account is not covered by the £2 slots stake cap, not covered by the financial vulnerability checks brought in at £150 net deposits over 30 days from 28 February 2025, not covered by the ban on reverse withdrawals, and not covered by the requirement that a customer be able to take a dispute to an approved Alternative Dispute Resolution provider free of charge after eight weeks.

Licensed Comparisons for Gambling Sites Not on GamStop

British-licensed operators are the standard, and it is worth being exact about what that standard buys. Since 31 March 2020 all online operators have had to be part of GamStop as a condition of their licence, under social responsibility code 3.5.5, and since April 2020 they have had to check their entire customer base against the register at least every 24 hours. The Commission suspended the licences of two operators in April 2020 for missing that deadline.

The protection that matters most to a balance is duller than either. Licence condition 4.1.1 requires customer funds to be held in a separate client bank account, separate from the operator's own money, and condition 4.2.1 requires the operator to state in writing whether those funds are protected if it becomes insolvent, using one of three ratings: not protected, medium protection or high protection. Keeping funds in a client account does not guarantee their return, and operators are permitted to hold them in overseas bank accounts. But the disclosure is compulsory, it has to be acknowledged on the first deposit and after any change to the terms, and an operator rated "not protected" has to remind the customer of that every six months, with the value of the funds held.

An offshore site may do all of this voluntarily. Some do — Anjouan's published standards require player funds to be segregated from operational funds. The distinction is what happens when it does not: at a British-licensed site, the failure is a licence breach with a regulator attached; offshore, it is a matter of contract, and the contract was written by the other side.

Offshore Websites and the Names on the Certificates

The certificate on an offshore site says less than it appears to. Take Curaçao, the most common address for these operations. The National Ordinance on Games of Chance took effect on 24 December 2024, ending the old master-licence and sub-licence model: the four former master licensors stopped issuing on 18 August 2024, 1 October 2024, 1 November 2024 and 31 January 2025, and the legacy orange certificates of operation ended on 15 October 2025. A historic /JAZ number or legacy seal is not proof of a current licence.

The Curaçao Gaming Authority now issues a Certificate of Operation Seal only for an approved, registered player-facing domain, and clicking it must redirect to cert.cga.cw. If the certificate behind the seal names a different domain from the one being used, it belongs to someone else. The Authority said on 7 October 2026 that its previous online portal would not return to service and that the old digital seal may be affected by the transition, which is a polite way of saying that verification is currently harder than it used to be.

Anjouan is the other name that turns up. Its fee schedule is EUR 17,828 for B2C licence issuance and EUR 17,828 for annual renewal, identical for B2B. Its certificates carry a unique licence number and a QR code linking to a public register, and the Authority itself says a certificate that cannot be verified there should not be relied on. That is the honest part. The less honest part is the volume: an ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 each per year, and that a former attorney-general of the Comoros called the entity selling them "an illegal entity". Anjouan Gaming said on 10 June 2026 that its licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world" — which is a fair statement of the law and a poor advertisement for the certificate.

Comparing the Structures of Balance Protection

The table below compares licences and structures, not brands, because the brand is the part that changes and the structure is the part that decides who wins an argument about a withdrawal. Values are drawn from the regulators' own schedules.

Three things fall out of that table. The first is that the Gambling Commission line is the only one that carries an unconditional contribution to the treatment system — the 1.1% levy raised just under £120 million in its first year, ringfenced for research, prevention and treatment. The second is that a Curaçao annual fee of EUR 47,450 and an Anjouan renewal of EUR 17,828 are real money, which is why these licences are sold at all, and also why a site that has stopped paying is not obviously distinguishable from one that has not. The third is that Kahnawà:ke is the outlier: it has regulated interactive gaming since its Regulations concerning Interactive Gaming came into force on 8 July 1999, it publishes a permit-holder list, and its rules state that a player who breaches a self-exclusion prohibition forfeits funds deposited or won to a charity selected by the Commission. That last provision is worth reading twice. It is a genuine enforcement mechanism, and it is not on the player's side.

The Term That Builds in the Delay

If there is one clause to read before depositing anywhere offshore, it is the maximum cashout on bonus winnings, because it is the most common way a balance quietly stops being a balance.

The mechanism is simple. A bonus is credited, and the terms cap what can be withdrawn from anything won using it. One offshore operator's terms, in version 5.11 last updated 15 October 2026, reserve the right to limit winnings generated with bonus funds — including free spins and cashback — to 300% of the credited bonus amount, with the excess voided. Another states that if a deposit is made while a no-deposit bonus is active, the wagering requirements and the maximum allowed cash-out of that bonus still apply to the combined position. Neither is a hidden term in the sense of being buried; both are published, and both are easy to miss because they are not what the offer page is selling.

Read alongside them, the wagering multiplier does the rest of the work. Ignition publishes a 25× wagering requirement on casino bonuses, calculated either on the bonus or on bonus plus deposit, with a time limit attached and a contribution chart that pays slots 100%, table games 20%, video poker and blackjack 10%, roulette and baccarat 5%, and live dealer games 0%. A player who takes a bonus and then plays live dealer has a wagering balance that does not move, a clock that does, and a cashout cap above it. Nothing in that chain is illegal in Curaçao or Anjouan. All of it is legal precisely because those regulators do not impose the cap that Great Britain does.

GamStop, Self-Exclusion and the Term Nobody Can Vote On

This is the part I would put in bold if the page allowed it. Registering with GamStop Online blocks a person from gambling with companies licensed in Great Britain for six months, one year, five years or five years with auto-renewal. Once registered, the exclusion cannot be cancelled or deactivated during the period, and it stays in place after the chosen period ends unless the person contacts GamStop to remove it. If they do not, GamStop holds the data through a further automatic seven-year self-exclusion period, during which operators are told the person was previously excluded. The minimum term could not be cut short even if the scheme wanted to: the group's 2025 annual report devotes a section to its refusal to remove registrations before the chosen term ends.

An offshore site is never a way round that. It is a site that happens not to have asked, and the distinction matters because the point of self-exclusion is the request, not the register. The Commission issued an industry warning notice on 20 January 2025 about casino games from licensed operators appearing on unlicensed websites, noting that such sites often target customers who have self-excluded via GAMSTOP — and that they may have inadequate social responsibility and anti-money-laundering controls. That is the regulator describing the loophole as a business model.

The practical fallback sits on the device and the card, not on the register. GamStop signposts Gamban and BetBlocker as blocking software; BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, requires no registration and is free worldwide, while Gamban is free for residents of Wales and, following the end of TalkBanStop funding on 31 March 2026, costs £4.99 a month or £29.99 a year in England and Scotland. Bank gambling blocks are the other lever, and the Commission's list last updated 16 October 2026 names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. Those blocks work by declining payments to merchants categorised under gambling Merchant Category Codes, and they are applied at card level, so each card has to be set individually. Most banks use a 48-hour or 72-hour cooling-off before gambling transactions are allowed again.

Five Signs a Site Can Be Trusted With a Balance

None of these proves a site is honest. All of them are cheap to check and expensive to fake.

The licence can be verified at the regulator, not on the site

Check the register, not the badge. For a Curaçao site, click the Certificate of Operation Seal and confirm it reaches cert.cga.cw and that the certificate names the domain in use. For Anjouan, scan the QR code and confirm the licence number appears in the public register. For a British-licensed operator, the Commission's public register should show the domain and the activities. A badge that does not survive a click has failed the only test that matters.

The insolvency rating is stated, in writing, before the first deposit

Hunt for the phrase "not protected", "medium protection" or "high protection" and a sentence explaining what happens to the money if the company fails. A Gambling Commission licensee must put this in front of the customer and obtain acknowledgement. An offshore site has no equivalent duty — so if the rating is presented voluntarily, that is a positive signal, and if the terms are silent about insolvency, that silence is the answer.

The maximum cashout term is published and does not scale with the deposit

Read the maximum cashout clause before reading the welcome offer. A cap expressed as a multiple of the bonus is a known and bounded limitation; a cap that the operator may apply "at its discretion", or a term reserving the right to void winnings, is a different instrument. The Commission's fair-terms guidance treats sole-discretion terms in the "may" and "reserve the right" family as unfair within the meaning of the Consumer Rights Act 2015, and it has fined on that basis. Offshore, the drafting is legal and the balance is still exposed.

Withdrawals are not routed through a manual review

The rule is that a withdrawal should be as frictionless as the deposit. Licence condition 17.1.1 states that a withdrawal request must not produce a demand for additional information the operator could reasonably have requested earlier. One operator paid £900,000 in a regulatory settlement on 21 October 2026 for failures including unnecessarily delaying consumer withdrawals — among them a term allowing only one withdrawal at a time and manual review of every fifth or tenth withdrawal. Offshore, the equivalent clause is a marketing document rather than a breach, which is why the Commission's own figures matter: of 44.2 million withdrawals by customers of large online operators between June and September 2024, 96.3% cleared automatically.

There is a named dispute route outside the operator

Look for the name and contact details of the ADR provider in the player-facing terms. Anjouan requires licensees to designate an Authority-approved provider — currently EGIS ADR, Axion ADR, iGaming ADR and others — and expects complaints to be resolved within 30 days before escalation. The MGA takes complaints in English or Maltese. Kahnawà:ke employs a full-time dispute resolution officer. Where there is no named body, the only route left is a court in a jurisdiction most players will never visit.

How to Check an Offshore Operator Before Depositing

Six steps, in order, each with the reason it earns its place.

1. Pull the licence number and verify it at the regulator's own register. Reason: the certificate is the operator's document; the register is the regulator's. A site that displays a certificate but whose number does not resolve has told you the most important thing about itself.
2. Read the terms and conditions before the offer page. Search for "maximum cashout", "maximum withdrawal", "wagering", "abuse" and "discretion". Reason: the offer page describes the upside and the terms describe the ceiling, and the two are written by different people on the same side.
3. Establish who holds the funds and what the insolvency position is. Look for a segregation statement or an insolvency rating. Reason: a balance in a separate client account behaves differently from a balance sitting in the operator's own bank account when the company stops trading.
4. Test the small things at low value first. Register, deposit a modest amount, withdraw most of it, and time the process from the account statement. Reason: withdrawal friction is a of the operator's process, and it is visible at £20 as clearly as at £2,000 — and the Commission receives about 2,000 complaints a year about withdrawal delays, still its most common consumer topic.
5. Confirm what the operator cannot do: reach into the register. Check whether the site participates in GamStop at all, and set a bank gambling block on each card and a blocking app on each device. Reason: those two controls sit outside the operator's terms entirely and are the only levers that do not depend on its goodwill.
6. Write the complaint route down before there is a complaint. Note the operator's internal procedure, the ADR provider named in the terms and the eight-week deadline for escalation to ADR. Reason: disputes become unresolvable mainly through timing, not through merit — 361 of 499 invalid disputes in one provider's report, 72.3%, had not been through the operator's own complaints procedure first.

What the Numbers Look Like When the Money Moves

Withdrawals are where the two markets separate most visibly, and the Commission's data is unusually candid about it. Across the 44.2 million withdrawals it recorded between June and September 2024, 96.3% cleared automatically. Consumer research published on 23 July 2026 found 49% of people who had gambled in the past 12 months agreed that it is quick and easy to withdraw winnings, 33% were neutral and 18% disagreed. Complaints coded to withdrawals and financial transactions fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025.

The payment rails themselves are not the problem. Faster Payments has a £1 million scheme ceiling per transaction, raised from £250,000 on 10 February 2022, though individual banks set lower limits — NatWest's online personal limit is £100,000 — and Faster Payments limits apply per transaction, so larger sums can be split. Visa Direct's Fast Funds service settles in real time, with funds often available within 30 minutes of approval. A Bitcoin block arrives, on average, every 10 minutes, and the classic six-confirmation default puts a typical crypto payout in the hour range rather than the minute range. These are the mechanics. They are fast in every structure, which is precisely why a delay is nearly always a decision rather than a queue.

That is the honest core of this corner of the market. An offshore casino can pay in half an hour, and some do. The licence it holds tells a player almost nothing about whether it will.

Help, and Where the Protections Actually Come From

The bodies that matter are British and free, and none of them depends on which licence the site in question holds. The National Gambling Helpline, run by GamCare, is on 0808 8020 133, 24 hours a day, every day of the year, also reachable by live chat and WhatsApp, with 0808 2819 265 given for callers in Wales. It is not a crisis line: staff cannot transfer someone at immediate risk of harm and follow their own safeguarding procedures instead. Gamblers Anonymous England, Wales and Ulster is on 0330 094 0322, with around 250 meeting locations and no appointment needed. GamFam supports families affected by someone else's gambling. Gam-Anon UK & Ireland does the same for friends and family, whether or not the gambler attends meetings. The NHS National Gambling Clinic — 69 Warwick Road, London SW5 9HB, 020 7381 7722 — takes self-referrals for 13- to 18-year-olds anywhere in England and for adults in Greater London and the South East. Citizens Advice Scotland runs a gambling support line on 0800 328 1131, Monday to Friday, 10am to 3pm.

Money for all of it comes from the operators now, through the statutory levy introduced by the Gambling Levy Regulations 2025 and commenced on 6 April 2025: 1.1% of previous-year Gross Gambling Yield from all online operators, just under £120 million in its first year, ringfenced for research, prevention and treatment, and split 50% treatment, 30% prevention and 20% research. From 1 April 2026 NHS England took commissioning responsibility for treatment in England against roughly £100 million a year. A licensed operator pays that. An unlicensed one pays nothing, and its players are still eligible for every service the levy funds — which is the least obvious subsidy in this market, and not a small one.

Questions About Offshore Gambling

What gambling sites are not on GamStop?

Any site holding no Gambling Commission licence, since the duty to participate in GamStop comes from licence condition 3.5.5 and applies only to British licensees. In practice those are operators licensed in Curaçao, Anjouan or Kahnawà:ke, or holding no gambling licence at all. A site's own claim about GamStop is not evidence either way; the Commission's public register is.

Are UK gambling sites not on GamStop legal to use?

Using one is not an offence for the player. Section 33 of the Gambling Act 2005 targets the person providing the facilities, and the Act's other gambling offences are drafted the same way, with the narrow exceptions around children and young persons. The operator, not the customer, commits the offence — and the practical result is that the player has no licence-backed protections to fall back on.

Are online gambling sites not on GamStop safer than people say?

Some are better run than the worst British-licensed operators, and it is worth saying so plainly. Anjouan's standards require segregated player funds, certified random number generators and anti-money-laundering controls. Kahnawà:ke publishes a permit-holder list and employs a dispute resolution officer. The problem is not that every offshore site is a fraud; it is that the good and the bad are difficult to tell apart from outside, and the certificate on the homepage is the same shape on both.

Do gambling apps not on GamStop bypass self-exclusion?

They do not bypass it; they were never subject to it, which is a different thing. A GamStop registration blocks use of accounts with companies licensed in Great Britain, and it holds for its full term and then remains in place until the person contacts GamStop to remove it. An app with no British licence has no obligation to check the register, and the Commission's own warning notice of 20 January 2025 noted that such sites often target self-excluded customers.

How long do withdrawals take to reach an eye?

At the fast end, Faster Payments settles in seconds and Visa Direct's Fast Funds service can make funds available within 30 minutes of approval. Crypto is slower than the advertising suggests: Bitcoin blocks average 10 minutes, and six confirmations put a payout in the hour range. The Commission's own figure is that 96.3% of 44.2 million withdrawals between June and September 2024 cleared automatically — so a wait of days offshore is a term, not a queue.

Which regulators cover gambling companies not on GamStop?

Curaçao, Anjouan and Kahnawà:ke are the ones that appear most often, and each has a verification route: cert.cga.cw for a Curaçao Certificate of Operation Seal, a QR code and public register for Anjouan, and a click-through Certificate of Good Standing for Kahnawà:ke. Malta is a stricter regime and publishes a list of unauthorised URLs, but an MGA licence still carries no obligation to participate in GamStop. None of them gives a British player the protections a Commission licence does — and that is where the balance sits.

The Balance Is Only Ever as Protected as the Licence Behind It

A licence is not a logo on a footer; it is the thing that decides whether a delay is a breach or a term, whether a lost deposit is a regulatory failure or a line in a contract, and whether a player has a body to write to at a body's own address. That is the whole argument, and the offshore market is a demonstration of it rather than an exception to it.

The two ends of this market are easy to state. On one side sit 561,983 active GamStop exclusions at the end of 2025, and 614,738 people on the register by July 2026, more than one in two of whom chose the maximum five-year term. On the other sit 586 illegal gambling websites accessible to British consumers and identified in September 2026 alone. My view is that the second number is smaller than the first for a reason that has little to do with virtue: most people, most of the time, prefer their money to be governed by a rule someone else can enforce. Anyone who wants help with any of it can call 0808 8020 133, free, at any hour.