Casino Sites Not on GamStop in 2026 and the ones the regulator is chasing

Casino sites not on GamStop are operators with no Gambling Commission licence, so a GamStop self-exclusion does not reach them. They are not a loophole and not a legitimate alternative: providing gambling facilities to people in Great Britain without a licence is an offence under section 33 of the Gambling Act 2005, and the Commission actively disrupts such sites.

A fortnight's work by the Commission's Illegal Markets team, read off its own enforcement notes, tells the story better than any marketing page. In July to September 2026 it referred 1,835 websites to search engines and issued 546 cease and desist notices to illegal operators — against 226 referrals and 98 notices in the first quarter of the year. Nothing about that trajectory suggests the offshore market is settling down into respectability.

The scheme itself is easier to state than the market around it. GamStop Online is the national self-exclusion register for online gambling companies licensed in Great Britain. It is free, a registration blocks an account with every participating operator for a chosen term of six months, one year, five years or five years with auto-renewal, and the block can take up to 24 hours to become effective. It is often typed "gamestop", which explains a great deal of confused searching; the scheme's name is GamStop, and it began taking registrations in April 2018.

Where a site is unlicensed, the exclusions do not apply, the protections do not apply, and the money sits in a legal vacuum. Gambling Commission guidance is blunt that a licence in another jurisdiction does not authorise a business to serve customers in Great Britain. So the question worth asking about these sites is not whether they exist — they plainly do — but what the regulator can actually do to them, and what a careful player can see from the outside. That is what follows.

Best casino sites not on GamStop sorted by licence

The phrase "best casino sites not on GamStop" is doing a lot of work in that headline. There is no consumer body that ranks these operators, no ombudsman, no audited payout table. What exists is a set of licensing regimes with wildly different budgets, and a set of dispute routes with wildly different powers. That is the honest basis for comparison.

The British standard comes first, because it is the one with teeth. A Commission-licensed operator must participate in GamStop under social responsibility code provision 3.5.5, must check its entire customer base against the register at least every 24 hours, and must close and refund the account of anyone who self-excludes. It must not delay a withdrawal to gather information it could reasonably have asked for earlier, and licence condition 7.1.1 requires terms that are fair and not misleading under the Consumer Rights Act 2015.

Offshore regimes stack up against that baseline in very different ways, and the table below is by licence type rather than by brand — which is the only method that survives contact with reality. Fees are annual unless stated, and the numbers come from the regulators' own fee schedules.

Two things jump out. The first is the spread between a €47,450 Curaçao bill and a Costa Rican operation that pays nothing at all, which is why the Costa Rica row matters most: a site with no licensing regime has no supervisor to complain to, no funds rule to breach and no disciplinary record to check. The second is that even the respectable-looking offshore rows offer no protection against a GamStop exclusion, because GamStop participation is a British licence condition, not a global one.

Malta deserves a specific mention, because it is the regime most often waved at British readers as reassurance. The MGA does supervise its licensees, does publish a list of Unauthorised URLs declaring that any reference to a Maltese licence on those domains is false and misleading, and does take complaints in English. But it has no jurisdiction over a UK player's dispute with one of its licensees beyond that complaint form, and its most recent Unauthorised URL entries carry notice dates of 30 October 2026 — a reminder that the MGA spends real effort on operators claiming a licence they do not hold.

New casino sites not on GamStop and why the newest are least safe

"New casino sites not on GamStop" sounds like a category with a future. In practice, newness is the strongest single warning sign in this market, for a reason that has nothing to do with what the homepage says.

A new offshore operator typically launches before it has any regulatory history — no disciplinary record, no complaint data at an ADR provider, no track record of paying out. The Curaçao reform makes this concrete. The old master-licence and sub-licence model was replaced by direct licensing under the National Ordinance on Games of Chance, which took effect on 24 December 2024, and the legacy "orange" sub-licence certificates of operation ended on 15 October 2025. The four former master licensors stopped issuing on staggered dates: one on 18 August 2024, another on 1 October 2024, a third on 1 November 2024 and the final one on 31 January 2025. Operators holding a valid licence when the LOK came into force got a six-month provisional licence due to expire on 24 June 2025, later extended to 24 December 2025.

The consequence is a market full of sites displaying seals and certificate numbers that were valid under a system that no longer issues them. The CGA issued a further notice on 7 October 2026 confirming its previous online gaming portal would not return to service and that it was working on an alternative mechanism for verifying licensed domains, because the old digital licence seal may be affected by the transition. A /JAZ number is not proof of a live licence, and the CGA's own certification policy says so.

Then there is the advertising. An offshore site cannot lawfully advertise to British consumers under section 330 of the Gambling Act 2005 — knowingly advertising unlawful gambling, with section 331 covering foreign gambling facilities. A site whose .co.uk-facing pages, social posts and affiliate placements are aimed squarely at British players is therefore advertising something the law does not let it advertise, which tells you how it intends to behave on everything else.

The same pattern shows in the enforcement data. Across 160 illegal gambling websites for which the Commission had web traffic data, disruption activity produced an average 32 per cent fall in engagement — but the average hides the method. Registrar blocks and website suspensions produced the largest falls, 91 per cent each, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at just 8 per cent. The Commission's own conclusion is that GEO IP blocking and registrar blocks beat search-engine removals, because removing a result makes a site harder to find without actually blocking it. That is an unusually candid thing for a regulator to publish, and it explains why the same domains keep reappearing.

Regulator action against illegal gambling sites

Anyone comparing UK casino sites not on GamStop against the licensed sort is really asking what the Commission's illegal-markets operation can achieve. The answer, read off its own figures, is: a great deal of disruption, and almost no prosecution.

Since April 2024 the Commission has issued 3,140 cease and desist and disruption notices — 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and 3 payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs (339,757 to Google, 108,031 to Bing) and secured 287,961 removals. That is industrial-scale paperwork.

The prosecution side is close to empty. Across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced, a total of one, in October to December 2025. In April to June 2026 the Commission began 0 criminal investigations. Section 33 carries up to 51 weeks' imprisonment, a level 5 fine or both — a serious offence on paper, pursued almost never in practice, largely because the operators sit outside the jurisdiction. The leverage that does work is infrastructural: registrar blocks, host referrals and, since January 2025, referrals to the Visa Operator Scheme following a test purchase, described by the Commission as a critical and still early-stage part of its strategy.

The scale of the target is contested, and the contest is instructive. The Commission's analysis published on 5 November 2026 estimates that among people who had gambled online in the past four weeks, 2.5 per cent had engaged with an illegal gambling website, with a further 1.5 per cent in the past 12 months; across the whole adult population including non-gamblers, 0.6 per cent in four weeks. Its illegal gambling dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026. H2 Gambling Capital puts stakes with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019. An industry-commissioned Frontier Economics study instead estimated £2.7 billion staked annually online on the black market. When the estimates span a factor of six, the honest reading is that nobody knows precisely — but the direction of travel is consistent.

There is a harder edge to the enforcement story too. On 16 May 2025 the Commission reported that TGP Europe was leaving the GB market following an investigation, that sites it operated were now unlicensed and might not provide protections against criminality or gambling-related harm, and that it had contacted five football clubs about sponsorship arrangements with unlicensed gambling businesses. And on 20 January 2025 it issued an industry warning notice about casino games supplied by licensed operators appearing on unlicensed websites available to British consumers, noting that such sites often target people who have self-excluded through GamStop. That last note is the important one. An offshore site is never a route around an exclusion; it is, in the regulator's own assessment, a place where excluded players are deliberately hunted.

The licence line, and how to read it the first time

If one mechanism decides everything about these sites, it is the licence, and its logic is worth following from the first deposit onwards.

The first time a player signs up to an unlicensed site, nothing terrible necessarily happens. Registration is quick, the deposit clears, the games load. The absence of friction is the product. What is missing is invisible at that moment: no licence condition requiring the operator to check the customer against GamStop every 24 hours, no client-account rule, no insolvency rating to disclose in writing, no approved ADR provider to escalate to, no obligation to accept only payments from a provider regulated under the Payment Services Regulations 2017. A licensed British operator also has to prompt for a financial limit before the first deposit and present that as the default option, following changes effective 31 October 2025 — an unlicensed site has no such duty.

Later, the asymmetry shows up at the point of withdrawal. There is no LCCP licence condition 17.1.1 offshore, so no rule against demanding identity documents at the cashier stage that could reasonably have been requested at sign-up. There is no ban on reverse withdrawals — RTS 14B, in force since 31 October 2021, which stops a player cancelling a withdrawal request to keep gambling. There is no equivalent of the £2,000 threshold framework that governs when a British remote casino must verify identity, and no CMA-style position that wagering requirements are unlikely to be unfair where they attach only to the bonus. A maximum cashout clause applied to bonus winnings has nothing to answer to.

The warning signs are legible from the outside, and they cluster. A licence seal that does not resolve to the regulator's own verification page, or that shows a certificate in a different domain name from the one being visited, is the first. The CGA's certification policy is explicit: clicking a Certificate of Operation Seal must redirect to its cert.cga.cw portal, and a certificate showing a different domain belongs to another operator. Anjouan's framework similarly states that certificates carry a unique licence number and a QR code linking to the public register, and that certificates which cannot be verified there should not be relied upon as evidence of licensing. A site with no addressable regulator, terms that reserve the operator's "sole discretion" to void winnings, or a self-exclusion page that does not mention GamStop at all, belongs in the same pile. So does one whose bonus terms survive a 60-times wagering requirement in 2026, when British licensees have been capped at ten times since 19 January 2026.

Five signs an unlicensed operator is not worth the risk

The licence resolves to a live register entry

A regulator's own verification page is the only acceptable proof, not a seal image on a footer. Click the seal and watch where it goes: a genuine Curaçao Certificate of Operation redirects to the CGA's certificate portal, and the certificate behind it must show the domain being visited. Anjouan certificates carry a licence number and a QR code that should land on the public register. If the seal resolves nowhere, or the certificate names a different site, treat the licence as fictitious. A /JAZ number is a red flag in 2026, not a credential, because the old sub-licences ended on 15 October 2025.

The company appears on a regulator's unauthorised list

Regulators do name names, and the lists are free to check. The Malta Gaming Authority publishes a list of Unauthorised URLs and states plainly that any reference to the MGA or a Maltese licence on those domains is false and misleading; its most recent entries carry notice dates of 30 October 2026. The Gambling Commission publishes a public register of licensed operators and advises checking that the site's activities and domain names match the entry. Two minutes on those pages settles more than any review site will.

The terms do not reserve sole discretion over winnings

Search the terms for "sole discretion", "reserve the right" and "may void". British guidance is clear that terms giving an operator sole discretion to void or withhold winnings are unfair within the meaning of the Consumer Rights Act 2015, and the Commission fined an operator £170,000 in July 2025 over a term of exactly that shape. In October 2026 an operator agreed a £900,000 regulatory settlement including a breach of the fair-and-transparent-terms condition. Offshore, that enforcement pressure does not exist — so the clause stays in.

Bonus terms stay inside recognisable limits

Read the wagering requirement, the maximum cashout clause and the maximum bet while wagering, in that order. British licensees have been capped at ten times wagering since 19 January 2026, and may not impose any maximum limit on withdrawing a deposit balance. Offshore terms routinely run at 25 to 40 times or higher, and some caps limit bonus-derived winnings to a percentage of the bonus credited. A maximum bet clause of a few pounds while wagering, with forfeiture of all winnings for a single breach, is a trap rather than a rule.

There is a named dispute route and it is free

A trustworthy offshore operator names an approved ADR provider in its player-facing terms and does not charge for the service. Anjouan requires exactly that, with EGIS ADR, Axion ADR, iGaming ADR and an operator currently approved. Kahnawà:ke employs a full-time Dispute Resolution Officer and requires that a player's relationship with the licensee be contractual and free of unfair terms. If the terms route complaints nowhere, or only to the operator's own support inbox, there is no second opinion available at any price.

Six checks to run before depositing anything

1. Verify the licence on the regulator's own page. Click the seal, follow the redirect, and confirm the certificate names the domain you are on. Reason: a seal image costs nothing to copy, while a register entry is issued by the authority.
2. Search the Gambling Commission's public register for the trading name and domain. Reason: the Commission advises clicking through and checking that the activities and domain names match, which catches operators borrowing a licence's respectability without holding it.
3. Check the regulator's unauthorised list for the domain. Reason: the MGA and others name domains they have no connection with, and those entries are dated, so you can see whether the warning is current.
4. Read the withdrawal section of the terms in full before the first deposit. Reason: licence condition 17.1.1 — the rule against demanding documents at cashier stage that could have been requested earlier — does not extend offshore, and this is where friction gets added by design.
5. Confirm what happens if the operator becomes insolvent. A British licensee must state its protection rating in writing and get the customer to acknowledge it; if the terms are silent offshore, assume the funds are unprotected. Reason: money staked in an open bet is not customer funds even in Britain, and offshore there is no separation rule with any enforcement behind it.
6. Set a deposit limit at the payment provider or bank. Reason: bank gambling blocks decline payments to gambling merchant categories, are applied at card level so must be set on each card, and most banks impose a 48- or 72-hour cooling-off before gambling transactions resume. It is the one control that does not depend on the operator's honesty.

If any of that is difficult, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day, and callers in Wales can use 0808 2819 265. GamCare runs the line, with live chat and WhatsApp on the same number. The NHS National Gambling Clinic on 020 7381 7722 takes self-referrals, and Citizens Advice Scotland runs a gambling support line on 0800 328 1131, Monday to Friday, 10am to 3pm.

What payment methods tell you about an unlicensed site

Payment options are a rough proxy for how much an operator is willing to be seen.

Pay by phone is the most telling. A pay by phone casino site not on GamStop is usually settling its payments through a carrier-billing or voucher route, and the sum involved is small — the whole method exists because it leaves less of a statement trail than a card does. There is no regulatory reason for a licensed British operator to prefer it. A paypal casino site not on GamStop is a contradiction in terms as often as not: the British licence condition 5.1.2, effective 31 January 2024, requires licensees to accept payment only from a provider that counts as a payment service provider under the Payment Services Regulations 2017, and the spread of bank gambling blocks across the eleven institutions the Commission lists means card rails are increasingly closed to illegal merchants anyway. An offshore site advertising Paypal usually means a payment intermediary, not Paypal.

Banking detail is where the two worlds separate most cleanly. Faster Payments carries a scheme ceiling of £1 million per transaction, with individual banks setting lower limits and no minimum — over 90 per cent of transactions settle in under two seconds. CHAPS has no scheme limit and settles same-day to a cut-off. Those rails are all that a legitimate British withdrawal needs. When an operator asks for a crypto transfer instead, the arithmetic changes: a Bitcoin block arrives on a ten-minute average, a classic client shows a transaction as unconfirmed until it is six blocks deep, and Litecoin's 2.5-minute cadence gives a first confirmation in about 2½ minutes but completes six confirmations inside 15 minutes only about 55 per cent of the time. None of that is misconduct — it is just a slower, less reversible rail, and one with no chargeback route at all if the operator turns out to be a shell.

What the Commission says about people who are offshore

The Commission's own conduct is the most useful evidence on this whole subject, because it shows where the pressure actually lands.

In April 2020 the Commission suspended the licences of two online operators for failing to integrate GamStop by the 31 March deadline, using section 118(2) of the Gambling Act 2005. GamStop participation has been a licence condition since 31 March 2020, and operators were notified of the deadline in January 2020. That is how the British system enforces self-exclusion: by threatening the thing an operator values, which is the licence.

Offshore, that lever is absent, and the Commission mostly pushes on intermediaries. Its quarterly numbers move fast — 226 websites referred to search engines and 98 cease and desist notices in January to March 2026, then 366 referrals covering 147,721 URLs in April to June, then 1,835 websites covering 7,677,211 URLs and 546 notices in July to September. The URL counts run into millions largely because affiliate pages and mirror domains are swept up. Meanwhile 311 illegal gambling websites had disruption actions taken against them in the second quarter of 2026 to 2027, 38 per cent more than the previous quarter, and 77 per cent of disrupted sites saw a reduction in estimated traffic. That last figure is the metric that matters: disruption that reduces traffic is disruption that costs the operator money.

Two caveats belong here, because the enforcement data is easy to over-read. Ten countries' worth of blocked domains is not a market closing; a 32 per cent average drop in engagement across 160 sites is meaningful but leaves two-thirds standing. And there is the human cost of the reporting: the Commission's third annual Gambling Survey for Great Britain, published 16 July 2026, found 2.4 per cent of adults with a PGSI score of 8 or more, 3.4 per cent of those who had gambled in the past year having sought support for their own gambling, and relationship breakdown the most reported severe consequence at 1.7 per cent. For anyone who has registered with GamStop, remembering what happens next matters more than any of this: a self-exclusion holds for its full term, cannot be cancelled during it, and stays in place after the term ends until the person contacts GamStop to have it removed.

Frequently asked questions

Are casino sites not on GamStop legal in the UK?

No — the operator is the one committing an offence, not the player. Section 33 of the Gambling Act 2005 makes it an offence to provide gambling facilities without an operating licence, carrying up to 51 weeks' imprisonment, a level 5 fine or both, and it applies where at least one piece of remote gambling equipment is in Great Britain or the provider knows the facilities are likely to be used here. Playing is not the offence; the protection you lose is.

What is a non GamStop casino, in plain terms?

It is an operator with no Gambling Commission licence, so it is not part of the national self-exclusion register at all — GamStop's obligations attach only to licence holders. That means no 24-hour customer-base checks, no duty to close and refund a self-excluded account, and no approved ADR provider to escalate to. The absence of the word "GamStop" from a site's terms is itself information.

Do new offshore casinos ever hold a real British licence?

Occasionally a new brand fronts a licensed operator, and that is checkable in minutes on the Commission's public register. But a genuinely new offshore operator is usually the opposite of reassuring: since the Curaçao reform took effect on 24 December 2024, the legacy sub-licence certificates ended on 15 October 2025 and provisional licences lapsed on 24 December 2025, so many sites still display seals from a system that no longer issues them.

Can a GamStop exclusion be removed early?

No. Once registered, the exclusion cannot be cancelled or deactivated during the chosen term, and it stays in place after the term ends unless the person contacts GamStop to remove it. Under the terms of use, the auto-renewal option on a five-year minimum exclusion can only be turned off during the last six months, and if nothing is done GamStop holds the data through a further automatic seven-year period.

Which payment methods do unlicensed sites push, and why?

Usually the ones with the least trace and the least comeback: phone billing, vouchers, e-wallet intermediaries and crypto. Licensed British operators must accept payment only from providers regulated under the Payment Services Regulations 2017, and bank gambling blocks now cover eleven named institutions, so card rails are awkward for an illegal merchant. Crypto offers no chargeback route, and Bitcoin's six-confirmation convention can mean an hour's wait.

What actually happens if an unlicensed operator refuses to pay?

Very little that is enforceable. There is no Commission remit over the operator, no British licence condition to breach and, offshore, no equivalent of the £900,000 regulatory settlement an operator agreed in October 2026 over unnecessarily delayed withdrawals. A named ADR provider may help, since Anjouan and Kahnawà:ke both require one, but where the terms name nobody you are left with a support inbox and no second opinion.

Disruption, not elimination — and a helpline that still works

The thing worth saying plainly is that the closing of offshore sites is not on anyone's timetable: the Commission refers 1,835 websites in a quarter, blocks registrars and hosts, and measures its success in reduced engagement rather than in closures, and the exclusions themselves do not move at all.

Those figures are the page's own last word, and the one that sticks is the smallest constant in them. Since April 2024 the regulator has issued 3,140 cease and desist and disruption notices — and across the whole of April 2025 to March 2026 it commenced exactly one prosecution. The National Gambling Helpline is free on 0808 8020 133, 24 hours a day, and GamCare also takes live chat and WhatsApp on that number. Callers in Wales can use 0808 2819 265.

As of 13.11.2026.