Online Gambling Sites UK The Market the Regulator Polices and the One It Chases

Britain's online gambling market is worth £8.3 billion in gross gambling yield, and almost all of it runs through operators holding a Gambling Commission licence. A measured 2.5% of people who gambled online in the past four weeks also engaged with an illegal site. The regulator's answer is disruption, not prosecution: since April 2024 it has issued 3,140 notices.

The Two Markets, and Why Only One Has a Licence

Every question about online gambling sites in the UK begins with a fork in the road, and the fork is the licence. A site either holds a Gambling Commission operating licence or it does not. If it does, the Licence Conditions and Codes of Practice apply to it in full: identity checks, self-exclusion obligations, the credit card ban, the slots stake cap, fair-term rules, the complaints route to an adjudicator. If it does not, none of that applies — and under section 33 of the Gambling Act 2005 it is an offence for a person to provide facilities for gambling without a licence, whether the facilities are provided inside or outside the UK. The Commission put the point bluntly in October 2024: it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence in another jurisdiction.

That is the law. The practice is messier, and the gap between the two is the most interesting thing about this market.

The regulator's own numbers give the shape of it. Total Great Britain gross gambling yield was £17.5 billion in the year to March 2026, up 4.4%. The remote casino, betting and bingo sector accounted for £8.3 billion of that, up 6.9%. Online slots alone produced £773 million in the first quarter of 2026, from 25.1 billion spins.

Against that, the illegal market. The Commission's analysis published on 5 November 2026 — covering April 2025 to April 2026 — estimates that among respondents who had gambled online in the past four weeks, 2.5% had engaged with illegal gambling websites, with a further 1.5% having done so in the past 12 months. Across the whole population, including non-gamblers, 0.6% had engaged with an illegal site in the past four weeks and 94.4% showed no indication of using one.

Read those two paragraphs together and the perspective changes. The offshore trade is loud, well-marketed and genuinely persistent. It is also, by the regulator's own measurement, a small fraction of play. The battle is real, but it is not for the soul of the market — it is for the margin around the edges.

One thing to be plain about, early. Offshore sites that hold no Gambling Commission licence are not licensed in Great Britain, are not connected to GamStop, and UK protections do not apply to them. If something goes wrong — a withheld withdrawal, a confiscated balance, an account closed with winnings inside it — there is no British licence to complain against, no adjudicator the operator is obliged to answer, and no regulator with jurisdiction. The Commission is a regulator, not an ombudsman, and it cannot resolve individual complaints or get anyone's money back.

And if gambling is causing harm, the help exists and it is free. The National Gambling Helpline is operated by GamCare on 0808 8020 133, twenty-four hours a day, every day of the year, with the same number reaching live chat and WhatsApp. Callers in Wales can use 0808 2819 265. GamCare also runs a peer-support chatroom and forums. Nobody needs a licence check to use any of it.

What the Disruption Numbers Actually Say

The Method, and the Measure

Here is the checkable benchmark, and I would put it above every affiliate list on the internet. Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist notices and disruption notices, comprising 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and 3 payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs — 339,757 to Google and 108,031 to Bing — and secured 287,961 URL removals. Those figures were published on 21 October 2025.

The team also measured whether any of it worked. Across 160 illegal gambling websites for which traffic data existed, there was an average 32% decrease in engagement following disruption activity.

Thirty-two per cent. That is the number to keep in your head, because it is honest. The regulator knocked roughly a third off the traffic and said so, rather than rounding it up.

The Escalation

The quarterly series shows the pace increasing. Websites referred to search engines rose from 124 in July to September 2024 to 321 in April to June 2025. Cease and desist notices issued by quarter ran 113, 83, 129 and 145 across those same four quarters, with removals from search engines at 123, 109, 170 and 214.

It did not slow down. In January to March 2026 the Commission referred 226 websites to search engines and issued 98 cease and desist notices. In April to June 2026 it referred 366 websites covering 147,721 URLs. In July to September 2026 it referred 1,835 websites — 7,677,211 URLs — and issued 546 cease and desist notices to illegal operators.

Note the arithmetic. Referrals to search engines in a single quarter went from the low hundreds to well over a thousand. Either the illegal market grew sharply, or the Commission's detection machinery got a great deal better at finding it. I suspect both, and I would not trust anyone who claims to know the split precisely.

What Works, and What Is Theatre

The method breakdown is the most useful table the Commission has published, because it ranks the tools by effect rather than by effort. Registrar blocks and website suspensions produced the largest average fall in engagement at 91% each, ahead of GEO IP blocking at 60%, Bing removal at 52%, Google removal at 30% and Facebook removal at 8%.

The Commission says it plainly: GEO IP blocking and registrar blocks are more effective than search-engine removals, because search-engine removal makes a site harder to find but does not fully block access. Thirty per cent for a Google delisting, against ninety-one for a registrar block, is the whole argument in one line. Removing a site from a search results page is PR as much as policing; taking its domain away is policing.

The measurement window is the period from April 2024 onwards, published on 21 October 2025 and updated in March 2026. Scale of the problem, for context: just over 1,000 unique illegal gambling websites were accessed by consumers in Great Britain over May 2024 to July 2025. The Commission's dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026 — 4% less than the previous three-month average, 4% more than September 2025. In the second quarter of 2026-27, 311 illegal gambling websites had disruption actions taken against them, 38% more than the previous quarter, and 77% of disrupted websites saw a reduction in estimated traffic.

The Prosecution Problem

Now the part that rarely makes it into the affiliate blogs. Across April 2025 to March 2026, every quarter recorded 0 or 1 prosecutions commenced — a total of one prosecution, in October to December 2025. April to June 2026 began 0 criminal investigations.

One. In a year and a quarter. Meanwhile the Commission has referred 447,778 URLs to two search engines and taken down 287,961 of them.

You can read that two ways and both are defensible. The generous reading is that disruption is the proportionate response: the operators are offshore, the beneficial owners are layered behind nominee directors and holding companies, and a prosecution that cannot be served achieves nothing except a press release. The sceptical reading is that a notice regime is what you get when enforcement is expensive and the political will is thin — a great many letters, very few charges. What it definitively is not is deterrence in the ordinary sense. Cease and desist notices are, by definition, requests. They are only as frightening as the consequences of ignoring them.

The People Behind the Sites

British players are not the Commission's only concern here, and the numbers show why. The Commission reported in May 2025 that TGP Europe was leaving the GB market following an investigation, that sites it operated were now unlicensed and may not provide protections against criminality or gambling-related harm, and that it had contacted five football clubs about sponsorship arrangements with unlicensed gambling businesses.

Follow that thread. A shirt sponsor is not a payment processor and not a licence holder — it is a face, a name and a logo on television. The Commission's concern is that the branding of a regulated sport lends the halo of legitimacy to an unlicensed operator. Whether that concern is proportionate to the scale of the problem is genuinely arguable. That the concern exists, and is acted on, is not.

The financial route is younger. The Commission made its first referral to Visa in January 2025 following a test purchase on an unlicensed website, and has since made a further three referrals covering three separate unlicensed websites. Reporting payment transaction data to the Visa Operator Scheme is described by the Commission as a critical and still early-stage part of its financial disruption strategy. Early-stage is the operative word: four referrals in total is a pilot, not a blockade, and anyone claiming the payment rails are closed to these operators is selling something.

Finally, the market-wide estimates, which should be read with their sponsors in mind. Market-intelligence firm H2 Gambling Capital estimates the amount staked with illegal gambling operators in the UK reached £16.6 billion in 2025, up from about £5 billion in 2019. A Frontier Economics study for the Betting and Gaming Council put £2.7 billion staked annually online on the black market, equal to 2.1% of the £128 billion staked with GB regulated remote casino, betting and bingo operators, involving 1.5 million Brits. Yield Sec analysis for the Campaign for Fairer Gambling put the GB online market at £8.8 billion gross gaming revenue in 2025, split 91% regulated and 9% unregulated.

Look at the range. One industry-funded estimate says 2.1% of stakes; one campaign-funded analysis says 9% of revenue. That is not a rounding difference, it is a different market. The Commission's own methodology combines web-traffic data with a licensed-play assumption of £0.32 gross gambling yield per minute for online slots and explicitly notes it does not capture activity hidden by VPNs. Everyone is guessing, and the guesses are priced to support a conclusion.

Where the Regulator's Reach Stops

Why the Licence Is Not Interchangeable

The Commission's regulatory remit, as it states plainly, only allows it to regulate gambling websites which trade or advertise to customers in Great Britain, and those websites must hold a Commission licence. A Curaçao licence, a Maltese licence, an Anjouan licence — none of these are a British licence. The Commission's position, published in October 2024, is that offering commercial gambling services to consumers in Great Britain without a Commission licence is illegal, including where the operator holds a licence in another jurisdiction.

So the honest summary of offshore licensing is this: the licence tells you which authority supervises the operator's behaviour in its home jurisdiction, and it tells you nothing about whether the operator may lawfully serve British customers. Those are two separate questions, and the marketing depends on players conflating them.

The regulator's own advice is mundane and correct. The Commission tells consumers to check before gambling that a business holds a British Gambling Commission licence and to click through to the public register to see whether the site's activities and domain names match. The register check is the whole test. Not the seal, not the footer text, not the awards banner.

What Happens to the Ones That Slip Through

The Commission issued an industry warning notice on 20 January 2025 about casino games supplied by licensed operators appearing on unlicensed websites available to GB consumers, noting that such sites often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls.

That notice is the crux of the whole topic, and it deserves a plain statement. Self-exclusion under the national scheme holds for its full term. When the term ends, it stays in place until the person contacts GamStop to remove it. It is not a pause that expires quietly, and no offshore site is a way round it. An operator outside the scheme has no obligation to check the register and no obligation to refuse a registration, which is precisely what the Commission's warning notice is about.

Free independent blocking has limits worth knowing. BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, requires no registration and is free worldwide. Gamban states it blocks licensed and unlicensed sites and that its protection is designed to be as difficult to remove as possible, and it is free for residents of Wales, while in England and Scotland it costs £4.99 per month or £29.99 per year after a 7-day free trial, following the end of TalkBanStop funding on 31 March 2026. Your bank may add a second layer: the Commission's list of banks offering a gambling blocking service, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. Those blocks work by declining payments to merchants categorised under gambling Merchant Category Codes, are applied at card level so must be activated on each card, and most banks use a 48- or 72-hour cooling-off period before gambling transactions are allowed again.

The Land-Based Parallel Nobody Mentions

Online self-exclusion gets the coverage; the land-based schemes are where the rules get genuinely strange, and they are a useful control on the assumption that more regulation always means better protection.

The Commission's May 2026 FOI response put active self-excluded customers at 12,445 for SENSE between 1 April 2025 and 1 April 2026, with a further 8,695 enrolled under previous terms subject to auto-removal, and 9,075 for the betting shops scheme over the same period. GamStop Betting Shops works with over 60 operators and covers approximately 6,000 shops. Compare 12,445 with the 614,738 consumers on the online register as of July 2026 and you see where self-exclusion actually lives: on phones, not on high streets.

And note the asymmetry. The casino scheme, with its Thinking period and its in-person removal, is in some ways more protective than the online one and in others less predictable. The online scheme is absolute: registering with GamStop Online blocks a person from all online gambling companies licensed in Great Britain, and the exclusion is never lifted early. The land-based casino scheme expires automatically at the end of the Thinking period if nobody renews it or asks for removal. Same country, same regulator, materially different deal.

A Right Way and a Wrong Way to Get a Licence

The point of a licence is that someone stands behind it. Two regimes show how differently that can work.

Curaçao rewrote its framework. The National Ordinance on Games of Chance took effect on 24 December 2024, making the Curaçao Gaming Authority the direct licensing and supervisory authority, replacing the old master-licence and sub-licence model so that private master licensors can no longer grant new licences. The legacy orange sub-licence certificates ended on 15 October 2025, and a historic /JAZ number or legacy seal must not be treated as proof of a current licence. Operators holding a valid licence received a six-month provisional licence expiring on 24 June 2025, extended to 24 December 2025 on condition of full compliance. A B2C application costs a one-time, non-refundable EUR 4,592, and the total annual B2C fee is EUR 47,450 — a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee payable in full by 15 January. The CGA issues two separate seals, and a Certificate of Operation Seal is valid only for an approved, registered player-facing domain; clicking it must redirect to cert.cga.cw, and if the certificate behind it names a different domain, the site is displaying another operator's certificate and should be considered unauthorised or fraudulent.

Anjouan is the cautionary tale with a price list. A B2C licence costs EUR 17,828 one-time and the same again on annual renewal, with EUR 500 per additional domain or URL. Anjouan says licences contain no territorial restrictions under Anjouan law but that holders must comply with all applicable laws in the jurisdictions in which they operate. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 per licence per year, that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally, and that a former attorney-general of the Comoros called Anjouan Licensing Services "an illegal entity". The regulator's own statement of 10 June 2026 is the one to remember, because it concedes the point that matters: "An Anjouan Internet Gaming Licence is not, and has never been presented as, a universal authorisation to operate in every country in the world."

A licence, in other words, is worth exactly what the authority behind it is willing to enforce. Some are willing. Some charge EUR 17,828 and send a certificate.

Five Signs an Operator Can Be Trusted

The Licence Register Match

The single most useful check, and it takes a minute. The Commission publishes a public register, and the advice is to click through to it and confirm whether the site's activities and domain names match what the register records. A licence held by one company for one set of trading names is not a licence for a different domain that happens to carry the same branding. Quick check: open the register, search the brand, and read the domain name field — if the domain you are looking at is not listed, or the listed activities do not include the product you want, stop there.

Participation in GamStop Online

Since 31 March 2020 all online gambling operators must be part of GamStop as a condition of their Gambling Commission licence, and operators were notified of that deadline in January 2020. On 3 April 2020 the Commission suspended the licences of two online operators, including Dynamic and Sportito, for failure to integrate by the deadline under section 118(2) of the Gambling Act 2005 — so it is a condition it enforces. Quick check: the scheme's participation is what makes the national register mean anything; if a site's own terms describe self-exclusion as an internal option only, that is the answer.

Terms That Do Not Build In Delay

Terms that put friction on the way out rather than the way in are the clearest tell of an operator's real priorities. The Commission states it is not acceptable for operators to introduce friction when a customer tries to withdraw rather than when they deposit, and that operators should explain to the customer why a withdrawal has been delayed or refused. The clearest recent example: on 21 October 2026 the Commission announced that one licensee, which runs seven websites, will pay £900,000 in a regulatory settlement for failures including unnecessarily delaying consumer withdrawals, with withdrawal-specific failures including a term stating customers could request only one withdrawal at a time and could not request another until the original was authorised — a term found unfair under the Consumer Rights Act 2015 — and manual review of every fifth or tenth withdrawal for some customers, leading to extra information being required before withdrawals were processed. Reverse withdrawals were banned outright for all remote operators by requirement 14B, in force since 31 October 2021, which states that consumers must not be given the option to cancel their withdrawal request. Quick check: read the withdrawal section of the terms before depositing, and count the separate conditions attached to getting money out.

A Named Adjudicator

A complaints route with teeth leaves a paper trail: a named alternative dispute resolution provider, listed, free to the consumer, and a real chance of the consumer winning. The Commission's list of approved providers includes the ADR Group, Pegasus ADR Service, one licensee, the Centre for Effective Dispute Resolution, eCOGRA, IBAS, ProMediate and the Tattersalls Committee, and licensed operators may use only providers approved by the Commission. The outcomes are not window-dressing: eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, of which Deposits and Withdrawals accounted for 150 valid disputes, an average of 31 days to resolve domestic disputes, and 17.8% of completed disputes ruled in favour of the consumer. IBAS, over 2024-25, recorded 3,721 domestic disputes including 217 categorised as Banking or Financial Disputes, an average completion time of 20 days, and 100% operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. Quick check: the provider's name should be in the terms, and a customer must generally have gone through the operator's own complaints procedure first.

Customer Funds, Rated and Disclosed

Gambling businesses must select one of three customer-funds protection ratings — "not protected", "medium protection" or "high protection" — must make clear in their terms which applies, and an operator rated "not protected" must remind the customer once every six months that their funds are not protected in the event of insolvency, stating the value of funds held. The disclosure must be in writing and the customer must acknowledge receipt before they are permitted to use funds for gambling, on the first deposit and after any change to the terms. Two honest caveats: keeping customer funds in a separate client account does not mean customers will get their money back if the operator becomes insolvent, and gambling businesses are legally allowed to hold customers' money in overseas bank accounts. Quick check: the insolvency rating should appear in writing before the first deposit — an operator that cannot produce it in one sentence is either unsophisticated or avoiding the subject.

How to Judge a Site Before Depositing Anything

Five signs are the fast filter. This is the slower read, and it is ordinary, lawful checking — nothing here involves testing a bonus, opening an account to see what happens, or anything else that requires a stake.

1. Check the Commission's public register for the domain, not the brand. Search the brand name and confirm the exact domain you are looking at appears against a current licence, and that the licensed activities include the product you intend to use. The reason: a licence is granted to a company for named domains and activities, so a match on the logo and a mismatch on the domain is the oldest trick in the category.
2. Read the customer-funds paragraph in the terms before reading anything about bonuses. The terms must state the insolvency rating, the level of protection and the method used to achieve it, and that disclosure must be acknowledged in writing before you can gamble. The reason: this is the only paragraph that tells you what happens to money sitting in an account if the company fails — and if a sportsbook or casino has hidden it, that tells its own story.
3. Count the conditions attached to withdrawal, and compare them with the conditions attached to deposit. Requirement 14B has banned reverse withdrawals since 31 October 2021, so no legitimate operator should offer to cancel a pending withdrawal. The Commission has said repeatedly that friction belongs on the way in, not the way out, and that where it has no regulatory concerns about a customer there is no valid reason to delay the payout. The reason: an operator's withdrawal terms reveal more about its business model than its entire welcome page.
4. Confirm which adjudicator the operator uses and whether the route is free. Social responsibility code provision 6.1.1 requires licensees to have arrangements for customers to refer a dispute to an ADR entity free of charge if it has not been resolved to the customer's satisfaction within eight weeks, and the operator may issue a deadlock letter confirming a customer can escalate. The reason: this is the difference between a complaint that can go somewhere and a complaint that ends in an email inbox — and note that ADR providers will not accept complaints about customer service issues or about the refusal to accept a bet.
5. Where a bonus is involved, check the wagering multiple, the maximum bet while wagering and whether there is a cashout cap. From 19 January 2026 licensees are banned from offering mixed-product promotions requiring two or more types of gambling, and wagering requirements on bonus funds are capped at a maximum of ten times, delivered by amending Social Responsibility Code 5.1.1. The Commission chose a cap over an outright ban and said the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". The reason: on a licensed site the cap is a ceiling, so anything above it is a signal about which regime the operator thinks it is in.
6. Write down the helpline number somewhere other than the device you gamble on. The National Gambling Helpline is 0808 8020 133, free, 24 hours a day, every day, operated by GamCare, with the same number reaching live chat and WhatsApp. Callers in Wales can use 0808 2819 265. The reason: the point of a support number is that it is available at the moment it is needed, which is rarely the moment it was saved — and the Helpline is not a crisis line, so its staff cannot transfer anyone at immediate risk of harm and instead follow their own safeguarding procedures.

The Exclusion Term, Explained Properly

Where offshore gambling sites are discussed, one argument comes up again and again in the marketing: that an offshore account is a way round a self-exclusion. It is the most damaging claim in the whole category, and it needs correcting with the mechanism rather than with a tone.

Here is how it works. Registering with GamStop Online blocks a person from gambling with all online gambling companies licensed in Great Britain, for a chosen period of 6 months, 1 year, 5 years, or 5 years with auto-renewal. Signing up takes only a few minutes, but it can take up to 24 hours for the block to become effective. Once registered, the registration cannot be cancelled or deactivated during the exclusion period. That much is the first time.

Then comes the part that people get wrong. When the chosen period ends, the exclusion stays in place unless the person contacts GamStop to remove it. It does not lapse. The scheme's terms of use go further again: auto-renewal may only be switched off during the last six months of a five-year minimum exclusion period, and auto-renewal continues for up to four new five-year periods. If the person does not deactivate after their chosen period, GamStop holds their data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded. The Group's 2025 annual report devotes a section to its refusal to remove registrations before the chosen term ends, and the scheme's registrations cannot be removed early.

This is a deliberately sticky, deliberately asymmetric design, and I think it is the right one. A self-exclusion that could be undone by a phone call in a bad moment would be close to useless; the value of the commitment comes precisely from the fact that it cannot be renegotiated at 2am. The seven-year retention that follows a lapsed exclusion is harder to defend on intuitive grounds, but it is disclosed in the terms and it is not hidden.

The warning signs around all of this are consistent and recognisable. An operator that checks the self-exclusion register only at withdrawal, rather than at registration and continuously, is running the check in the wrong direction. The Commission has also flagged a subtler failure: onboarding a customer using a middle name instead of a forename can create mismatches with records held elsewhere, such as GamStop, undermining the effectiveness of self-exclusion — and it has expressed concern about operators using "fuzzy matching" through third-party verification providers and onboarding customers on partial or equivocal verification.

And the scale of the thing, for anyone who still thinks self-exclusion is an edge case. GamStop recorded 117,756 new registrations during 2025 and had 561,983 active exclusions at the end of the year, with 58,675 registrations in the final six months — an average of 319 per day. Registrations rose 16% year-on-year in the first half of 2026, with May 2026 setting a new monthly record of 12,236 sign-ups. As of July 2026 GamStop Online reported 614,738 consumers on the register, of whom more than one in two had opted for the maximum five-year exclusion, while across all age groups only one in four had self-excluded for six months. Of the periods selected in 2025: 29% chose 6 months, 24% chose 1 year, 25% chose 5 years and 22% chose auto-renewal. Under-25s accounted for nearly one in three of all exclusions in the first half of 2026, a 26% year-on-year increase, and the 2025 annual report recorded the gender split as 94.3% male and 5.7% female.

More than one in two choosing five years is the striking figure. It suggests that a large share of people registering are not taking a break — they are trying to make the decision binding. Which is exactly why the offshore pitch, that a licence outside the scheme means the block does not reach there, is worth answering with the mechanism rather than with outrage. The scheme's own terms state that it blocks access to gambling websites and apps licensed in Great Britain only, and can only exclude the person from participating operators. That is a limit of jurisdiction. It is not an invitation.

Identity Checks Why the Money Stops Just Before It Arrives

If there is one thing this topic turns on, it is the identity check — specifically, its timing. It is the single most complained-about feature of online gambling in Britain, and the mechanism is worth understanding on both sides.

The rule first. Licence Condition 17 was introduced on 7 May 2019 and requires licensees to obtain and verify information establishing a customer's identity before that customer is permitted to gamble. The information must include, but is not restricted to, the customer's name, address and date of birth. Before permitting a customer to deposit funds, licensees should tell customers what types of identity documents or information they may need to provide, in what circumstances and in what form. Separately, anti-money-laundering duties under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 require identification and verification in remote casinos when a customer deposits funds to take part in remote gambling, or withdraws such funds or winnings, amounting to €2,000 or more — and the threshold applies both to a single transaction and to transactions that appear to be linked, including where they form part of overall activity during a single logged-on period. The Commission has also allowed a "hybrid approach" under which a remote casino may identify customers and verify their age at registration but defer full identity verification until the €2,000 threshold is triggered.

That is the theory: verify before play, top up the checks at the threshold. The first time someone opens an account at a licensed operator, the process is usually invisible — companies can often verify identity by matching the account against databases such as credit reference agencies and the electoral roll, in which case no documents are needed. Documents the Commission says a business can ask for include passports, driving licences and household bills. A business may ask for a selfie where it suspects fraudulent activity, and may obtain bank statements to check that source of funds are legitimate as part of anti-money-laundering checks. The Commission does not specify which types of information gambling businesses should ask for, and it cannot provide a timescale for identity checks because the length of the process varies.

Later, the picture changes. Where a withdrawal triggers a fresh request for documents, that is the pattern the regulator has been trying to kill for years. Licence condition 17.1.1 requires that a customer's request to withdraw funds must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier — though that does not stop a licensee seeking information it must obtain at that time under another legal obligation, such as an anti-money-laundering requirement. Where a business delays a withdrawal because of insufficient ID it may be in breach of Licence Condition 17 and may be subject to regulatory action. The Commission's 2024 position was that it continued to receive around 2,000 complaints a year about withdrawal delays and that this was still the number one subject of complaints, and its 2026 blog reported that over a quarter of complaints reaching its Contact Centre concern identity verification — a concern customers raise when they are asked for documents only on attempting to withdraw.

Now the warning signs, because they are specific.

An operator that has never mentioned documents suddenly requiring a utility bill, a payslip, a bank statement and a selfie, all at the moment of a withdrawal, on an account that has been running for months without a question, is not conducting compliance. It is conducting a delay, and the Commission has said as much. Related and worse: relying on a term granting the operator sole discretion to void or withhold winnings. The Commission's guidance is explicit that operators should not use terms giving them sole discretion — "may" or "reserve the right" — to void or withhold a customer's winnings, because such terms are unfair within the meaning of the Consumer Rights Act 2015, and one licensee was fined £170,000 in July 2025 for regulatory failures including a bonus term stating that "the operator has the right at their own discretion to close accounts or forfeit winnings".

Then there is the confiscation question, which is the one that frightens people most and where the law is clearest. A customer's un-staked deposits remain their, and licensees must not have terms allowing confiscation of money deposited but not yet staked, nor may they confiscate or deduct any part of a deposit balance on the basis that the consumer has failed identity or age verification. The Competition and Markets Authority has obtained written undertakings from six operators — Ladbrokes, William Hill, PT Entertainment, BGO, Jumpman Gaming and Progress Play — under which they agreed not to impose any maximum limit on the amount a consumer may withdraw, not to remove funds from accounts unused for a specific timeframe, and, in Progress Play's case, not to remove a player's money if they do not meet identity verification requirements. The Commission states the CMA's principles apply to all online gambling operators. An operator may not impose, use or rely on any term imposing a maximum limit on the amount a consumer may withdraw from their deposit balance; the Commission's own example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week".

One caveat keeps all of this honest. The LCCP sets no fixed maximum number of days within which an operator must complete a withdrawal. The regime relies on the fair-and-open condition 7.1.1, the identity-verification condition 17.1.1 and the prohibition on unfair terms rather than a stated payout deadline. So "how long should a withdrawal take" has no clean legal answer — which is exactly why the practical evidence matters more than the promise.

What the Payout Numbers Show

Withdrawal speed is where the gap between reputation and record is widest, so it is worth putting the recorded figures against the popular impression.

Gambling Commission data covering June to September 2024 records 44.2 million withdrawals by customers of large online operators in that period. Of those, 96.3% cleared automatically, 3.5% cleared within 24 hours and 0.1% took up to 48 hours. Earlier Commission data from some of the largest gambling companies showed those firms approved, processed and fulfilled around 99% of customer withdrawal requests within 24 to 48 hours of the request being made — published 17 July 2023.

Ninety-six per cent automatic is a strong number, and I would read it as evidence that the ordinary case works. But two things sit alongside it. First, recorded complaints to the Commission's Contact Centre coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025 — a fall, from a base that was still the largest single category. Second, the Commission's Annual Report and Accounts 2024-25 states that, despite work with some operators, issues relating to withdrawals continue to be the cause of most of the complaints the Commission receives. And consumer research on trust published in July 2026 found 49% of people who had gambled in the past 12 months agreed that "it is quick and easy to withdraw and collect my winnings", with 33% neutral and 18% disagreeing.

Unless you are planning to gamble, none of this matters to you personally. Pooled across millions of accounts, half of players reporting that withdrawals are quick and easy is not the same as a broken system, and it is certainly not the clean bill of health the industry would prefer. The tail is where the harm lives.

Which brings the payment methods into focus, because the method is often the reason a withdrawal is slow rather than the operator.

Your pay-out is limited by your bank, not by the scheme, and not by the casino.

The e-wallet column is the one that changes the arithmetic of a session. Skrill charges 2.80% of the amount withdrawn, minimum EUR 3.50, for a transfer from a Skrill account to a bank account, and Neteller the same on the same basis, effective 12 January 2026. Neither charges a service fee while the account is used at least once every six months; both deduct a monthly fee if it is not — EUR 5.00 for Skrill, USD 5.00 for Neteller. Both apply a 4.49% foreign-exchange fee when a transaction requires currency conversion. So the friction on the way out of an e-wallet is a percentage, and on a withdrawal of any size that is the visible cost of the speed.

The crypto column inverts the usual trade-off. Bitcoin's protocol targets an average of 10 minutes between blocks, but a block is not guaranteed in that window: within any 10-minute window the probability of a block being found is about 63%, rising to 95% within 30 minutes and 99.7% within 60 minutes. Six confirmations is the common default among merchants bearing double-spend risk — not a magic number, but a convention assuming an attacker with less than 10% of network hashrate and a residual double-spend risk below 0.1%. Litecoin's block interval is 2.5 minutes on average, giving about 2.5 minutes for one confirmation and about 15 minutes for six, though only about 55.43% of modelled six-confirmation spans actually complete within 15 minutes. USDT on TRON is where the numbers get genuinely awkward: a transfer to an existing USDT wallet consumes about 65,000 Energy and to a brand-new wallet about 130,000 Energy, which without staked Energy burns roughly 13 TRX and 26 TRX respectively — with a 1 TRX account-creation fee, and a transfer that can fail outright if an account has neither Energy nor enough TRX.

And a regulatory note that applies to all of it. Since 31 January 2024, licence condition 5.1.2 has required licensees to accept payment from Great Britain customers only by a method whose provider is a "payment service provider" within the Payment Services Regulations 2017. That is the mechanism behind the credit card ban, which took effect on 14 April 2020 with licence condition 6.1.2. It is also the reason a British-licensed casino and an offshore one can offer visibly different banking pages: the licensed one is required to care where the money came from, including where an e-wallet was loaded from a credit card.

Bonuses The Rule That Separates the Two Regimes

If you want a single test that tells a British-licensed site from an offshore one, ignore the welcome offer headline and read the wagering multiple. It is the fastest available discriminator.

From 19 January 2026, licensees are banned from offering mixed-product promotions that require two or more types of gambling, and wagering requirements on bonus funds are capped at a maximum of ten times. The cap is delivered by amending Social Responsibility Code 5.1.1, which states that licensees must not "apply wagering requirements, which requires a customer to play through bonus funds, over a maximum of 10 times". The definition matters as much as the number: a wagering requirement is where a customer is required to make wagers totalling a particular value for funds to become withdrawable.

The Commission's reasoning is on the record. It consulted on an outright ban or a cap, with thresholds of 1, 5 or 10 times, and chose the cap of 10 because it judged licensees would otherwise be highly likely to introduce terms preventing customers cashing out bonuses. It said the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". There is the whole story: 60 times was a real number in this market, and ten is now the ceiling.

The mixed-product ban is narrower and sharper than it sounds. It covers the mixing of products within an individual incentive or promotional offer, including where terms are linked and shared, and applies irrespective of whether a stake is required. "Bet £5 and get £10 free bet" is compliant, because it does not mix product types between the initial activity and the prize. "Bet £5 to get 20 free spins" is not. An offer whose prize is itself mixed — "Bet £5 and get a £5 free bet and 20 free spins" — is not. The ban does not apply where the customer freely chooses, on an unrestricted basis, which product category to use bonus money on, so "Bet £5 to get £10 credit or bonus to be used on all products available" is compliant.

Three more rules in the same code are worth knowing because they close the obvious loopholes. Terms and conditions for an incentive must be clear, transparent, fair and readily accessible; licensees must not alter or increase the receipt, value or amount of an incentive if the qualifying activity is reached sooner than the full period over which the benefit is offered; and incentives designated "high value", "VIP" or equivalent must be offered consistently with the licensing objectives. The previous requirement that neither the receipt nor the value of a benefit be dependent on gambling for a pre-determined length of time or with a pre-determined frequency was deleted in the same restructure.

Now the offshore contrast, which is where the cap earns its keep. Offshore welcome-bonus multipliers typically run at 35x to 50x, and no-deposit bonuses at 40x to 60x with a €50 to €100 cashout cap, per a 2026 casino-guide comparison table. One offshore operator states that casino bonus amounts are subject to a 25x wagering requirement before any winnings derived from such bonuses may be withdrawn, with slots and specialty games contributing 100% towards wagering, table games 20%, video poker and blackjack 10%, roulette and baccarat 5%, and craps, Hot Drop Jackpots and live dealer games 0% unless stated otherwise. Another states that for deposit bonuses the required bet amount equals the bonus amount multiplied by the wager, and that "the deposit amount itself is not included in the wagering calculation".

That contribution chart is the quietly vicious part. A casino offering 100% weighting on slots and 0% on live dealer games is not offering a bonus on the whole casino; it is offering a bonus on the specific games that carry the house's best margin. Nothing about the headline number reveals it.

Then come the caps. One offshore operator reserves the right to limit the amount withdrawable from winnings generated with bonus funds, including free spins and cashback, to 300% of the credited bonus amount, with any excess voided. Another caps the maximum bet while wagering a bonus at ₹400, €5, $5 or C$5 for regular players and double that for VIP players, and rejects any bet above the limit. Another states that unless stated otherwise all bonuses have a max bet restriction relative to the deposit amount, with the casino max bet per wager at 20% of the deposited amount, and that failure to adhere "may result in account closure, forfeit of the Bonus, and any winnings generated during the wagering of the Bonus".

Compare that with the British position and the difference is structural, not a matter of degree. In the UK, the Commission's fair-terms guidance states operators must not impose any maximum limit on the amount a consumer may withdraw from their deposit balance. Wagers on a deposit balance must not count towards wagering requirements. Deposit and bonus balances must be displayed separately. And players must be told they can withdraw their deposit balance at any time, including when a bonus is pending or active, and must be allowed to do so. The CMA's do's and don'ts put it as plainly: operators must allow customers to exit promotions at any time with their remaining deposit plus any winnings from play with their deposit, and must ensure customers can distinguish bonus funds from their own money.

There is one enforcement lesson in this area worth keeping. Terms covering prohibition and sanctions for fraud, collusion, multiple accounts, software manipulation, loophole exploitation or deliberate cheating must be contained in separate terms from those relating to promotional play restrictions, and promotional play restriction terms must specify all prohibited types or patterns of play rather than reserving sole discretion for the operator to decide when play breaches them. The rule exists because "we may confiscate at our discretion" was, for years, the standard clause.

How Many Sites Are There, and How Many Should Be on Any List

The question "how many online gambling sites are there in the UK" has no tidy answer, and the honest reply is that the number depends entirely on which market you are counting.

The licensed market has a countable population: operators holding a Gambling Commission licence, each with named domains and activities on a public register. The remote casino, betting and bingo sector generated £8.3 billion in gross gambling yield in the year to March 2026, up 6.9%, and total online gross gambling yield for January to March 2026 was £1.55 billion, with 13.4 million average monthly active accounts. Note that the operator dataset those figures come from covers approximately 70% of the online gambling market — the largest operators — and should not be compared with the Commission's separate industry statistics, as it may include free bets and bonuses.

The unlicensed market is a moving target, which is the point of it. The Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026. Over the monitored period May 2024 to July 2025, just over 1,000 unique illegal gambling websites were accessed by consumers in Great Britain. The number identified through the Commission's affiliate-page method rose from 364 in May 2024 to 535 in July 2025, with crypto-casino search terms added to the methodology in December 2024.

So: over a thousand in the wild, several hundred at any given month, and a licensed population you can actually look up. Any "top 10" or "best of" list is a selection from the first group, chosen by whoever wrote it, usually on the basis of commercial arrangements rather than quality. The phrase "best online gambling sites UK" has no objective referent. What can be compared objectively is the terms — wagering caps, withdrawal conditions, funds protection, adjudicator, register match — and that comparison is the only ranking worth trusting.

Here is the closing question nobody in the affiliate trade wants to answer directly: whether the proliferation of these lists is itself part of the enforcement problem. The Commission's illegal-gambling detection method is built on affiliate pages, because affiliate pages are where unlicensed operators recruit. Its referrals rose from 364 sites identified in May 2024 to 535 in July 2025 on that method alone. Every such list, however carefully worded, is a page an algorithm can find, and the Commission is searching.

Frequently Asked Questions

Are online gambling sites in the UK all licensed by the Gambling Commission?

No. Sites that trade or advertise to British customers must hold a Commission licence, and offering commercial gambling services to consumers in Great Britain without one is illegal under section 33 of the Gambling Act 2005 — including where the operator holds a licence in another jurisdiction. But offshore operators accept British players anyway, so the licence status of a given site is a check, not an assumption.

Where can I find a safe list of online gambling sites in the UK?

Only one source qualifies: the Commission's public register, which lists licensed operators with their activities and domain names. The advice is to click through and confirm the domain you are looking at matches. "Safest online gambling sites UK" lists published elsewhere are selections, usually commercial ones, and cannot be verified against anything except the register — which is free to check and takes a minute.

What is the difference between a UK licence and a Curaçao or Anjouan licence?

A Commission licence obliges the operator to follow the Licence Conditions and Codes of Practice, including identity verification, self-exclusion participation since 31 March 2020, the credit card ban and the ten-times wagering cap. A Curaçao or Anjouan licence is supervised abroad: Curaçao's reform took effect on 24 December 2024 and legacy orange certificates ended on 15 October 2025, while Anjouan's framework dates from 2005 legislation and its B2C fee is EUR 17,828.

Do new online gambling sites in the UK have to follow the same rules?

Yes, from the first day they accept a British customer. The obligations attach to the licence rather than to the operator's age or size: participation in the national self-exclusion scheme since 31 March 2020, the £5 maximum stake per game cycle for online slots for all adults from 9 April 2025 and £2 for adults aged 18 to 24 from 21 May 2025, and the bonus rules in force from 19 January 2026. Newness is irrelevant.

Can an offshore site get round a GamStop self-exclusion?

No, and the claim is worth dismantling. GamStop Online blocks a person from all online gambling companies licensed in Great Britain, and the scheme states it can only exclude from participating operators — offshore operators are not participants. The exclusion itself holds for its full term and then stays in place until the person contacts GamStop to remove it. It is never lifted early. Sites outside the scheme simply are not answerable to it.

Why do withdrawals suddenly require documents?

Usually because a check was deferred that should have been done earlier, or because an anti-money-laundering threshold has been crossed. Identification and verification are required in remote casinos at €2,000 or more in deposits or withdrawals, including linked transactions during a single logged-on session. Licence condition 17.1.1 forbids requiring extra information at withdrawal if the operator could reasonably have asked earlier, unless another legal duty applies at that point.

How many online gambling sites are there in the UK?

Nobody knows the total, and anyone quoting one is guessing. The licensed population is countable through the Commission's register. The Commission's dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, and just over 1,000 unique illegal sites were accessed from Great Britain over May 2024 to July 2025. The commercial estimates of stakes placed offshore range from 2.1% to 9% depending on who funded the research.

What the Enforcement Figures Add Up To

Britain has built an unusually complete set of rules for the sites it licenses — identity checks before play, the ten-times wagering cap, a funds-protection rating disclosed in writing, a free route to an adjudicator — and an unusually blunt set of tools for the sites it does not, where the answer since April 2024 has been 3,140 cease and desist notices, 774 registrar referrals and 287,961 URL removals, backed by exactly one prosecution commenced in a year and a quarter.

That asymmetry is the honest finding. The regulated market is well-policed and imperfect; the unregulated margin is continuously disrupted and never quite closed. The numbers that matter most are the two that keep the argument grounded: an average 32% fall in engagement across 160 illegal sites measured, and a regime that, for all its 447,778 URL referrals, still commenced one prosecution between April 2025 and March 2026.

If gambling stops being a cost and starts being a problem, the National Gambling Helpline is 0808 8020 133 — free, operated by GamCare, twenty-four hours a day, every day of the year, with callers in Wales able to use 0808 2819 265. That number works whether or not the site involved ever held a licence.

Page current as of 13.11.2026, and the year referenced throughout is 2026. ukfastpayoutfinder.com