Online Casinos Not on GamStop and What Actually Protects Your Balance

Online casinos not on GamStop are operators licensed abroad, usually in Curaçao, Anjouan or Malta, rather than in Great Britain. They are not covered by UK protections: no Gambling Commission recourse, no complaint to a British regulator, no automatic return of funds. What remains is a foreign licence, terms and conditions, and the payment route used.

A trade that has spent years watching the British market will tell you the numbers here are quieter than the advertising suggests. The Gambling Commission's analysis published 5 November 2026 put engagement with illegal gambling websites at 0.6% of respondents in the previous four weeks across the whole population, and 2.5% among those who had gambled online in that period. The Commission's own dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026. So this is a real market, and a small one relative to the £17.5 billion of gross gambling yield the Commission reported for Great Britain in the year to March 2026.

It is often typed "gamestop", which is a fact about the name itself rather than the scheme.

Where the topic turns, from the angle of what protects a balance and what does not, is a single structural point. A British licence drags a whole apparatus behind it: segregated client money, a self-exclusion register, an approved dispute body, a regulator that can fine. An offshore licence drags behind it a fee schedule and a set of terms written by the operator. The good offshore operators add voluntary protections, and some of them add real ones. The bad ones add nothing but a certificate design. The work of judging which is which is unglamorous, and it is the only work that matters.

Self-exclusion is worth stating flatly, because it is where the confusion lives. A GamStop exclusion holds for its full chosen term — 6 months, 1 year, 5 years or 5 years with auto-renewal — and then stays in place until the person contacts GamStop to remove it. It cannot be cancelled early. An offshore site is not a way round it, and any operator implying otherwise is selling a story, not a service.

If gambling is causing harm, the National Gambling Helpline, run by GamCare, is free on 0808 8020 133, 24 hours a day. That is where the page usefully begins, not ends.

The Licence Question About Where an Offshore Operator Is Registered

The first thing to establish about a non-UK casino is not what its homepage claims but which authority signed the paper, and whether that authority's register still lists the domain.

Curaçao is the largest source, and it has been through a genuine upheaval. The National Ordinance on Games of Chance, the LOK, took effect on 24 December 2024 and made the Curaçao Gaming Authority the direct licensing and supervisory authority. The old master-licence and sub-licence model is gone: the four former master licensors stopped licensing on staggered dates through 2024 and January 2025, and the legacy "orange" sub-licence certificates ended on 15 October 2025. A historic /JAZ number is therefore not proof of anything current. The CGA's own certification policy says clicking a Certificate of Operation Seal must redirect to cert.cga.cw, and that if the certificate behind the seal shows a different domain from the site in front of you, the site is displaying someone else's paperwork.

The money involved is modest and worth knowing, because it tells you what a licence does and does not buy. A Curaçao B2C application fee is EUR 4,592, with a total annual cost of EUR 47,450 — EUR 24,490 to the National Treasury and EUR 22,960 to the regulator. Anjouan charges EUR 17,828 for issuance and the same again annually, with EUR 500 per extra domain. Malta is the expensive end: a EUR 5,000 application fee, a EUR 25,000 annual licence fee, and 5% gaming tax on revenue, plus EUR 100,000 minimum paid-up capital for the main B2C types.

Anjouan is the awkward one. The regulator publishes two B2C and B2B licence categories, requires segregated player funds, certified random number generators and AML controls, and says certificates carry a QR code linking to a public register. It also states plainly, in a statement reported on 10 June 2026, that an Anjouan licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". An ABC News investigation published 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences, and that Comorian financial intelligence officials described a related entity as operating illegally — a claim the licensing side disputes and which it says an independent legal opinion reissued in February 2026 contradicts. I would not treat that dispute as settled, and neither should anyone choosing where to hold a balance.

Kahnawà:ke is the older jurisdiction, regulating interactive gaming since 8 July 1999, with operators hosted in Mohawk Internet Technologies and a Logo Certificate Program that generates a Certificate of Good Standing. Its Client Provider Authorization fees rise on 1 January 2027: the application fee from USD 35,000 to USD 40,000, the five-year renewal from USD 5,000 plus the annual fee to USD 40,000 including it.

What all of this means for a balance is narrower than it looks. None of these regulators can order a British consumer made whole, none is bound by the Gambling Commission's fair-terms conditions, and none polices the marketing language on the homepage.

Comparing the Protections by Licence, Not by Brand

Method, not brand, is the only honest way to compare these: what a licence obliges, and what follows when it fails.

The row that matters most is the first, and the reason is not sentimentality. The Gambling Commission's licence condition 4.1.1 requires client money to sit in a separate bank account, and conditions 4.1.1 and 4.2.1 require the operator to state which of three insolvency ratings applies — "not protected", "medium protection" or "high protection" — with a written disclosure the customer must acknowledge before gambling. An operator rated "not protected" must remind the customer every six months and state the value of funds held. That is an unusually blunt piece of consumer protection, and offshore, it simply does not exist as a requirement.

Note also, on the Kahnawà:ke row, how sharp the consequences of its self-exclusion rules are: a player who breaches a self-exclusion prohibition there forfeits deposited or won funds to a charity chosen by the Commission. Different jurisdictions take the same subject in very different directions.

One Benchmark Regarding 44.2 Million Withdrawals

The benchmark I would put against any promise of fast payouts is the regulator's own data. Covering June to September 2024, it records 44.2 million withdrawals by customers of large online operators. Of those, 96.3% cleared automatically, 3.5% cleared within 24 hours, and 0.1% took up to 48 hours. Earlier Commission data from some of the largest firms showed roughly 99% of withdrawal requests approved, processed and fulfilled within 24 to 48 hours.

That is the British-licensed standard, and it is the right yardstick for "instant" claims made elsewhere. It also explains why the phrase "measure the instant payout" is worth handling carefully: nothing in the data is literally instant, and the story in the figures is automation rather than magic.

The counterweight is complaints. The Commission's Contact Centre receives over 6,000 calls a year from consumers and prospective licensees, and withdrawal problems from accounts were the number one topic raised. By July 2024 it was still getting around 2,000 complaints a year about withdrawal delays. The Annual Report and Accounts 2024-25 confirms that withdrawal issues continue to cause most of the complaints received. Complaints coded "Withdrawals and/or financial transactions" did fall, from 2,416 in the year to December 2022 to 1,791 in the year to December 2025. And a 2026 blog reported that over a quarter of complaints now concern identity verification — a concern customers raise when documents are demanded at the moment of withdrawal. Consumer research published 23 July 2026 found 49% of people who had gambled in the past 12 months agreed it is quick and easy to withdraw, with 33% neutral and 18% disagreeing.

The regulator's position is that friction at withdrawal rather than at deposit is unacceptable, and that where it has no regulatory concerns about a customer there is no valid reason to delay a payout. Licence condition 17.1.1 backs that: a withdrawal request must not trigger a demand for information the licensee could reasonably have requested earlier, though it does not override anti-money-laundering obligations. These are British-licensed protections. Offshore, the withdrawal clause is whatever the operator wrote.

The Single Factor This Topic Turns On With Identity Checks

Identity verification is where offshore casinos differ most sharply in practice, and it is worth understanding properly, because the difference is structural rather than a matter of politeness.

Under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, in remote casinos identification and verification are required when a customer deposits to take part in remote gambling, or withdraws such funds or winnings, amounting to €2,000 or more — and the threshold applies both to a single transaction and to transactions that appear to be linked, including activity within a single logged-on period. That is the anti-money-laundering floor. Licence Condition 17 goes further: since 7 May 2019 it has required licensees to obtain and verify information establishing identity before the customer is permitted to gamble, including name, address and date of birth. The "hybrid approach" lets a remote casino identify at registration and verify age, then defer full verification until the €2,000 threshold bites. Before permitting a deposit, licensees should tell customers which documents may be needed, in what circumstances and in what form.

First time, then: usually a database match against the electoral roll or a credit reference agency, which needs no paperwork at all, or an electronic identification process where the operator can verify against a source independent of the customer. The Commission has been explicit that the Commission itself cannot give a timescale because it varies, and that electronic verification may be instant while document-based checks take longer. Later, checks recur. Customer due diligence is ongoing and can be refreshed when circumstances or details change, and higher-risk accounts may require source of wealth. Since August 2024 financial vulnerability checks have been a licensing requirement, initially at £500 net deposits over a rolling 30 days and lowered to £150 over 30 days from 28 February 2025 — a check that may only use publicly available risk flags such as a bankruptcy order, a county court judgment, an individual voluntary arrangement, a High Court judgment, an administrative order or a debt relief order. Financial Risk Assessments, announced on 7 July 2026, arrive in stages, starting at £5,000 net deposits in a rolling 24 hours for customers aged 25 and over and £2,500 for under-25s, and the Commission has said no enforcement action will be taken during the early stages for failing to act on one.

The warning signs are specific. A demand for documents at the withdrawal screen, when nothing was asked at deposit, is the classical one — and it is a breach of Licence Condition 17 where a British licence applies. Paperwork that arrives only after a large win is worse. Onboarding on partial or equivocal data, which the Commission has criticised as "fuzzy matching" through third-party providers, creates mismatches with records held elsewhere, including GamStop. That last point is not academic: an account opened under a middle name instead of a forename can sail past self-exclusion checks, which is how a blocked person ends up gambling.

Offshore, none of this binds. A Curaçao or Anjouan licence holder adopts verification because it suits them, not because a condition compels the timing. Where identity documents are the price of a withdrawal, the pricing is set by the operator.

Five Signs an Offshore Operator Can Be Trusted

Not proof, but signs — and each one is checkable in a few minutes.

The Seal Resolves to the Regulator's Own Register

Click it. A genuine Curaçao Certificate of Operation Seal must redirect to cert.cga.cw, and the certificate behind it must carry the same domain as the site. A different domain means the site is showing another operator's paperwork. Anjouan certificates carry a licence number and a QR code linking to a public register, and Anjouan's own framework says a certificate that cannot be verified through that register should not be relied on. The Gambling Commission makes the same point from the other direction: consumers should check the public register and see whether the site's activities and domain names match the licence entry.

The Terms Say Which Funds Are Protected, and in Plain Numbers

Look for a sentence about what happens to the balance if the operator becomes insolvent. A British licence requires one of three named ratings and a written acknowledgement before gambling; offshore, a serious operator still volunteers something specific. Absence of the subject entirely is the loudest answer. Be careful here about a subtlety the Commission has published: money staked within an open bet is not "customer funds", so it is not covered by any insolvency arrangement, and holding client money in a separate account does not guarantee return if the business fails. Gambling businesses are legally allowed to hold customer money in overseas bank accounts.

The Bonus Terms Are Quantified, Not Adjectival

Under Social Responsibility Code 5.1.1, from 19 January 2026 British-licensed operators cannot apply wagering requirements above ten times, cannot mix two or more gambling product types within a single incentive, and must present terms that are clear, transparent, fair and readily accessible. Offshore, look for the same discipline voluntarily. Ignition publishes a 25× playthrough requirement, states whether the multiple applies to the bonus alone or to bonus plus deposit, and prints a contribution chart: slots and specialty games 100%, table games 20%, video poker and blackjack 10%, roulette and baccarat 5%, and craps, Hot Drop Jackpots and live dealer games 0%. A contribution table of that kind is the mark of an operator that expects to be read.

The Withdrawal Rules Are Specific About Fees, Limits and Bet Caps

A maximum-bet rule while wagering is normal; it matters whether the number is stated. BlueChip caps the maximum bet while wagering at €5 for regular players and €10 for VIP players and rejects any bet above the limit, and reserves the right to limit withdrawable winnings from bonus funds to 300% of the credited bonus amount. Ignition caps the casino maximum bet at 20% of the deposited amount, and warns that breaching it may mean account closure, forfeiture of the bonus and of winnings generated during wagering. Terms like that are harsh, but they are legible. The danger sign is a clause reserving sole discretion in vague language — which is precisely the kind of wording that has drawn regulatory action onshore: a term stating the operator had "the right at their own discretion to close accounts or forfeit winnings" formed part of a £170,000 penalty in July 2025.

There Is a Named Dispute Route With a Deadline

Anjouan requires licensees to designate an approved alternative dispute resolution provider and to print its name and contact details in player-facing terms, with complaints resolved within 30 days before escalation; its approved providers are EGIS ADR, Axion ADR, iGaming ADR and an independent dispute body. Kahnawà:ke employs a full-time Dispute Resolution Officer. Malta asks players to lodge complaints through a form reviewed in English or Maltese, and publishes a list of Unauthorised URLs, declaring that any reference to the MGA or a Maltese licence on those domains is false and misleading. A named body with a stated timescale is a sign. "Contact our customer support team" is not.

How to Check an Offshore Casino Before Depositing

Six steps, each with a reason. All of them are ordinary, lawful checks on public information.

1. Verify the licence on the regulator's own register, not the site's footer. Reason: the footer is marketing. The CGA register, the Anjouan public register reached via a certificate QR code, the MGA's lists and the Kahnawà:ke permit-holder list are the sources that count, and a historic /JAZ number or a legacy orange seal proves nothing now.
2. Click the seal, then compare the domain on the certificate with the domain in the browser bar. Reason: the CGA certification policy says a mismatched domain means the site is displaying another operator's certificate and should be treated as unauthorised or fraudulent.
3. Read the customer-funds clause and the maximum cashout clause in the bonus terms together. Reason: these are the two places where an offshore operator's balance protection and bonus generosity are actually determined, and a 300%-of-bonus cashout cap quietly converts a headline offer into something much smaller.
4. Find the wagering multiple, what it attaches to, and the game contribution table before accepting anything. Reason: a 25× requirement on bonus alone and a 25× requirement on bonus plus deposit are different products, and a roulette contribution of 5% turns a ten-times cap into an effective two hundred bets.
5. Check the withdrawal route against the payment method actually used, and note the fee. Reason: e-wallet and bank-transfer costs sit outside the operator's control — Skrill charges 2.80% of the amount withdrawn with a EUR 3.50 minimum for a bank transfer, Neteller 2.80% or USD 3.50 minimum — and a payment method loaded from a credit card is banned for British-licensed gambling, so onshore it will not even be an option.
6. Write down the dispute route and the deadline before there is a dispute. Reason: Anjouan gives 30 days with the operator first; eCOGRA may refuse a dispute where at least two weeks have not passed since the problem began or where it arose more than a year ago; and ADR providers will not take customer-service complaints at all. Know the door before you need it.

Why Speed Claims and Self-Exclusion Are Two Different Subjects

Payout speed and self-exclusion get bundled together in the marketing because both sound like freedom. They are unrelated, and conflating them is a technique.

Take the speed claim first. Bitcoin's protocol targets a ten-minute average block interval, and within any ten-minute window the probability of a block being found is about 63%, rising to 95% within 30 minutes. Six confirmations — the classic default for anyone bearing double-spend risk — therefore take an hour on average, though where loss from a double spend is negligible a payment may be accepted as soon as it is seen. Litecoin targets 2.5-minute blocks, and only about 55.43% of modelled six-confirmation spans actually complete within 15 minutes. A USDT transfer on TRON costs roughly 13 TRX in burned energy to an existing wallet and about 26 TRX to a new one. Ethereum's gas price was reported at 0.8993 gwei on 19 September 2026, and a live calculator priced a 21,000-gas transfer at roughly $0.005 to $0.009 on 3 November 2026. Pull a withdrawal to a bank account instead and the machinery changes again: Visa Direct's Fast Funds service processes transactions in real time with funds available within 30 minutes of approval, while Faster Payments has a scheme ceiling of £1 million per transaction but bank-set limits far below that, with over 90% of transactions completing in under two seconds.

None of that is "instant". It is a chain of systems, each with its own latency, and an operator that says otherwise is selling a noun.

Now the other subject. Self-exclusion under GamStop Online blocks gambling with all online gambling companies licensed in Great Britain for 6 months, 1 year, 5 years or 5 years with auto-renewal. Registration takes a few minutes and can take up to 24 hours to take effect. Once registered, the exclusion cannot be cancelled or deactivated during the period, and it stays in place after the chosen period ends unless the person contacts GamStop to remove it. The terms of use permit turning off auto-renewal only during the last six months of a five-year minimum exclusion period, and auto-renewal continues for up to four further five-year periods. If nothing is done, GamStop holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded. The group's 2025 annual report devotes a section to its refusal to remove registrations before the term ends.

The scale is not trivial: 117,756 new registrations during 2025, 561,983 active exclusions at the end of that year, and 614,738 consumers on the register as of July 2026, of whom more than one in two had chosen the maximum five years. A 16% year-on-year rise in registrations was reported for the first half of 2026, with May 2026 setting a monthly record of 12,236 sign-ups, and under-25s accounted for nearly one in three exclusions in that half-year, a 26% increase. Of the periods chosen in 2025, 29% opted for six months, 24% for a year, 25% for five years and 22% for auto-renewal.

That is the population an unlicensed site is fishing for, and the Commission knows it. Its industry warning notice of 20 January 2025 told licensees that games supplied by them were appearing on unlicensed websites available to British consumers, noted that such sites often target customers who have self-excluded via GAMSTOP, and flagged inadequate social responsibility and anti-money-laundering controls. Licence condition 3.5.5, which sits in the LCCP's social responsibility code, requires participation in the national multi-operator self-exclusion scheme, and the Commission's April 2020 requirement obliges operators to check their entire customer base at least every 24 hours — which also stops registered people receiving direct marketing. That requirement is why onshore self-exclusion works and why offshore it cannot.

GamStop Online itself is blunt about its limits: it blocks access to gambling websites and apps licensed in Great Britain only, and cannot prevent access to services run by organisations that do not participate. The scheme is free to users, was established in June 2017 by the Remote Gambling Association at the request of DCMS and the Gambling Commission, went live on 27 April 2018, and was renamed "Gamstop Online" in November 2025. Land-based exclusions work through separate schemes — SENSE for casinos, Gamstop Betting Shops for bookmakers — and their terms differ.

Blocking software is the practical supplement rather than a substitute. BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, needs no registration and is free worldwide. Gamban blocks licensed and unlicensed sites and is designed to be as difficult to remove as possible, but its free UK licence scheme, TalkBanStop, ended on 31 March 2026: it remains free for residents of Wales while in England and Scotland it costs £4.99 a month or £29.99 a year after a seven-day trial. Bank blocks are the other layer — the Commission's list, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. They work by declining payments to merchants categorised under gambling merchant category codes, apply at card level so must be set on each card, and most banks use a 48-hour or 72-hour cooling-off period before gambling transactions are allowed again. They do not affect a credit score.

Can a UK Online Casino Not on GamStop Be Trusted With a Balance?

The honest answer is: not on the strength of its licence, and only partly on the strength of its terms. What can be checked is checkable — the register entry, the seal, the funds clause, the bonus arithmetic, the dispute body — and those checks are worth doing because they separate an operator that has thought about its paperwork from one that has not. What cannot be bought offshore is the thing the first row of that table represents: an external party with the power to order a refund, plus a self-exclusion register that a site is obliged by licence to query every 24 hours.

Questions I Get Asked About Offshore Casinos

Are online casinos not on GamStop legal to use in Great Britain?

For the operator, offering commercial gambling services to consumers in Great Britain without a Gambling Commission licence is illegal — the Commission states that plainly, and it includes cases where the operator holds a licence in another jurisdiction. Section 33 of the Gambling Act 2005 carries, on summary conviction, up to 51 weeks' imprisonment, a fine up to level 5, or both. For the adult consumer, the Act's general gambling offences attach to those who provide facilities, not to those who use them.

Why do UK players look for a casino online not on GamStop at all?

Because a GamStop exclusion is comprehensive onshore and lasts. Since 31 March 2020 every online operator must be part of the scheme as a licence condition, and an April 2020 requirement means customer bases are checked at least every 24 hours. A person who wants to keep gambling while excluded has nowhere licensed to go. That is the demand, and the Commission's warning notice of 20 January 2025 says unlicensed sites actively target it.

2026 restrictions do not apply offshore, do they?

Correct, and this is the largest practical difference on the page. The ten-times wagering cap and the ban on mixed-product incentives, both in force from 19 January 2026, are licence conditions on British licensees. So are the £5 maximum stake per game cycle for online slots for all adults since 9 April 2025 and the £2 limit for 18 to 24-year-olds since 21 May 2025, the 2.5-second minimum between game cycles, and the credit card ban in force since 14 April 2020. Offshore wagering multiples are commonly reported in the 25× to 40× range, and no-deposit offers at 40× to 60× with a €50 to €100 cashout cap.

What is the catch with a free spins no deposit offer?

Two catches. The first is arithmetic: a no-deposit bonus typically carries the highest playthrough and the tightest cashout ceiling, so a headline of 60× against a €100 maximum is not a gift. The second is rules. One operator states that free bonuses are not to be redeemed consecutively and that redeeming two or more no-deposit bonuses in a row can result in removal of subsequent winnings. Another says that if a deposit is made while a no-deposit bonus is active, the no-deposit wagering requirements and maximum cashout still apply to it.

If an offshore casino refuses to pay, who can help?

Nobody with force. The Commission is a regulator, not an ombudsman: it cannot resolve individual complaints or get money back, though it records complaints and typically refers disputes to an independent third party. Anjouan requires a named ADR provider and a 30-day window with the operator first; its approved providers are EGIS ADR, Axion ADR, iGaming ADR and an independent dispute body. Malta takes complaints by form in English or Maltese. Note that ADR bodies will not hear customer-service complaints or disputes about refusing custom.

Do offshore sites share data with each other about self-excluded players?

No, and that is the point. GamStop Online works because a scheme obligation binds every British licensee to check the register. There is no equivalent multi-operator register behind a Curaçao or Anjouan licence, and Kahnawà:ke's arrangement is its own, with an operator-level voluntary self-exclusion that is permanent and irrevocable — and a rule that a player who breaches it forfeits deposited or won funds to a charity chosen by the Commission. Cross-jurisdiction sharing does not exist.

The Balance Nobody Offshore Is Obliged to Protect

So the picture is this: offshore casinos are a legally grey market for the player, a plainly illegal one for the operator, and the protections that make a British balance feel safe — a client account requirement, three named insolvency ratings disclosed in writing before gambling, an approved dispute body free of charge, a self-exclusion register checked every 24 hours, and ten-times wagering terms — exist because a licence condition says so, not because an operator is nicer than its competitors. That is the whole finding, and it is why I trust the first row of a table over the prose on a homepage.

The fact I keep coming back to is smaller and harder. As of July 2026, GamStop Online reported 614,738 consumers currently on the register, and more than one in two of them had chosen the maximum five-year exclusion. A market that knows all of this and still chooses five years is telling the advertising something the advertising does not want to hear. And if the gambling has stopped being a choice, the National Gambling Helpline is free on 0808 8020 133, day or night, all year.