Online Gambling UK and Unlicensed Gambling Sites

Online gambling is legal in the UK only through operators holding a Gambling Commission licence. Anyone offering commercial gambling to consumers in Great Britain without one breaks section 33 of the Gambling Act 2005. In 2026 the Commission's Illegal Markets team answers with cease and desist notices, registrar and host referrals, search-engine removals and payment referrals.

The Promise, and the Ledger Behind It

The promise of online gambling in the UK is straightforward: a licensed operator, a regulated market, and a regulator with teeth. The ledger is more interesting. Great Britain's gambling industry generated £17.5 billion of Gross Gambling Yield in the year to March 2026, up 4.4 per cent, with £8.3 billion of it from remote casino, betting and bingo. Against that, the Commission's own survey work found 0.6 per cent of respondents had engaged with an illegal gambling website in the previous four weeks, rising to 2.5 per cent among those who had gambled online in that period. That last figure is the one worth carrying around: the black market is small, but it sits where the licensed market's customers already are.

So this page is not a list of sites. It is a look at what the regulator actually does about the sites it cannot licence, how offshore licensing is sold and worn as a badge, and how anyone can tell the difference between a licensed operator and a very convincing website wearing someone else's paperwork.

Two things should be said early and plainly, because no amount of search-engine removal changes them. Offshore sites are not licensed in Great Britain, so UK protections do not apply to them: no GamStop block, no Financial Ombudsman, no access to the Commission's approved dispute-resolution scheme, no statutory protection of the money sitting in the account. And if gambling has stopped being a pastime, the National Gambling Helpline, run by GamCare, is free on 0808 8020 133, twenty-four hours a day, every day.

One last thing on names. The self-exclusion scheme is GamStop, and it is worth saying that it is often typed "gamestop" — a slip that matters only because the scheme's reputation depends on it being found by the people who need it.

Is Online Gambling Legal in the UK?

Yes, and only through a licensed route. Section 33 of the Gambling Act 2005 makes it an offence for a person to provide facilities for gambling unless an exception applies or they hold an operating licence authorising the activity. It is immaterial whether the facilities are provided wholly or partly by remote communication, and whether they are provided inside or outside the UK. For remote gambling the section bites if at least one piece of remote gambling equipment used is situated in Great Britain, or — under the post-2014 wording — if the provider knows or should know that the facilities are being used, or are likely to be used, in Great Britain.

The curious part of the offence is who commits it. Section 33 is an offence by the operator, not by the player. On summary conviction it carries up to 51 weeks' imprisonment, a fine not exceeding level 5 on the standard scale, or both; in Scotland the term is six months. Sections 37, 330 and 331 catch premises, advertising and the promotion of foreign gambling. Section 42 makes cheating an offence — and the only one under the Act that is not a summary offence. Nowhere in that list is an adult who placed a bet.

That distinction is not a loophole for the consumer so much as a design feature: Parliament aimed the criminal law at the supply side and gave the consumer a civil claim instead. The Gambling Commission states plainly that it is illegal for anyone to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence in another jurisdiction. Its remit only reaches websites that trade or advertise to customers in Great Britain.

The Numbers the Regulator Publishes About Illegal Sites

The Commission does not talk about illegal sites in adjectives. It publishes counts, and the counts are the story.

Since April 2024 its Illegal Markets team has issued 3,140 cease and desist notices and disruption notices — 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and three payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs and secured 287,961 removals. Across 160 illegal gambling websites for which traffic data existed, engagement fell by an average of 32 per cent after disruption activity.

Then there is what works. By disruption method, registrar blocks and website suspensions produced the largest average fall in engagement — 91 per cent each — ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. SEO Sage

The Commission's own conclusion is refreshingly blunt: GEO IP blocking and registrar blocks are more effective than search-engine removals, because removing a site from search makes it harder to find without actually blocking access. The disclosure that follows is the intriguing one. In July to September 2026 the Commission referred 1,835 websites to search engines — 7,677,211 URLs — up from 366 websites and 147,721 URLs in the previous quarter. In the same quarter it issued 546 cease and desist notices. And across April 2025 to March 2026, every quarter recorded zero or one prosecutions commenced.

Consider that ratio for a moment. A regulator referring seven million URLs in three months, and beginning no criminal investigations at all in the quarter before. The enforcement model is disruption by attrition — making the black market expensive and annoying to run — rather than courtroom drama. Reporting payment transaction data to the Visa Operator Scheme is described by the Commission as a critical and still early-stage part of that financial strategy; its first referral to Visa, in January 2025, followed a test purchase.

Insistent retailers of the "black market is booming" line should also be asked who paid for the research.

Read that table down and the neat story collapses. The Commission's consumer research puts engagement in fractions of a percentage point. The market-intelligence estimate puts £16.6 billion of stakes on the black market, up from about £5 billion in 2019, with the legal share of gambling falling from 97 per cent to 92 per cent. The industry-funded estimate sits at £2.7 billion staked online, equal to 2.1 per cent of the £128 billion staked with GB-regulated remote casino, betting and bingo operators, involving 1.5 million Brits.

These are not the same measurement wearing different clothes. The Commission's methodology combines web-traffic data with a licensed-play assumption of £0.32 of yield per minute for online slots, and says explicitly that it does not capture activity hidden by VPNs. That is a deliberate understatement, and an honest one. Any headline built on the largest of these numbers should come with the funder's name attached.

How a Licence Is Sold, and How It Is Worn

Once a supplier of gambling facilities is operating outside the British regime, the question becomes what licence it holds instead — and whether that licence means anything.

Curaçao LOK Reform and Verification Seals

Curaçao is the most-cited offshore home for sites that accept British players, and it has spent the last two years rewriting itself. The National Ordinance on Games of Chance (LOK) took effect on 24 December 2024, making the Curaçao Gaming Authority the direct licensing and supervisory authority. The old master-licence and sub-licence model is gone: the four former master licensors ceased licensing activity between 18 August 2024 and 31 January 2025, and the legacy "orange" sub-licence certificates ended on 15 October 2025.

The money tells you the scale. A B2C application fee is a one-time non-refundable EUR 4,592; total annual B2C fees come to EUR 47,450, made up of a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee to the CGA. Compare that with an operator's British contribution: online operators pay a statutory levy of 1.1 per cent of previous-year Gross Gambling Yield, and that levy raised just under £120 million in its first year.

For the reader trying to check a licence, the CGA has given a genuinely useful test. It issues two seals: a Certificate of Operation Seal, only for B2C operators and only for an approved, registered player-facing domain, and a License Certificate Seal, available to B2B and B2C entities and not domain-specific. Clicking a Certificate of Operation Seal must redirect to cert.cga.cw. If the seal differs in design, colour or format, the site is not authorised. If the certificate behind it names a different domain from the one being visited, the site is displaying another operator's certificate and should be treated as unauthorised or fraudulent.

That is a checkable procedure, and it exists for a reason. Supplier licensing in Curaçao only becomes fully mandatory on 24 December 2026, at the end of a two-year transitional period, and the CGA announced on 7 October 2026 that its previous portal would not return to service at all — with a replacement mechanism for verifying licensed domains still to come.

Anjouan Licensing and Verification

Anjouan, a constituent territory of the Union of the Comoros, licenses internet gaming under legislation adopted in 2005. Its published schedule is EUR 17,828 for B2C licence issuance, one-time, EUR 17,828 for annual renewal, identical for B2B, with EUR 500 per additional domain. Anjouan Gaming states that its licences contain no territorial restrictions under Anjouan law, but that holders must comply with all applicable laws in the jurisdictions in which they operate.

That second clause is the whole game. It is reported that Anjouan Gaming said in June 2026 that its licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world", and that no licensing authority can exempt an operator from local law where local authorisation is required. Anyone quoting the first sentence should quote the second.

It is also reported that an ABC News investigation published on 31 December 2025 found Anjouan Licensing Services claiming to have issued more than 1,300 gambling licences, and that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally. Anjouan Gaming's own verification framework is at least consistent with scepticism: certificates carry a unique licence number and a QR code linking to a public register, and certificates that cannot be verified through that register should not be relied on.

Kahnawà:ke, Malta and the odd one out

The Kahnawà:ke Gaming Commission, established in 1996, has regulated interactive gaming since 8 July 1999. It issues one Interactive Gaming Licence — held by Mohawk Internet Technologies since 1999 — plus Client Provider Authorizations at USD 35,000 per application, rising to USD 40,000 on 1 January 2027, with the annual CPA fee unchanged at USD 20,000. Its Logo Certificate Program lets a player click the Commission's logo to generate a Certificate of Good Standing. The KGC also requires a licensee's relationship with players to be contractual and free of unfair terms, requires sites to let a player set limits including zero, and states that its own voluntary self-exclusion is permanent and irrevocable.

Malta's authority publishes a list of Unauthorised URLs, declaring it has no connection with those domains and that any reference to the MGA or a Maltese licence on them is false and misleading — the most recent entries carry notice dates of 30 October 2026. A one-time EUR 5,000 application fee, a EUR 25,000 annual licence fee and 5 per cent gaming tax on revenue from the service are what a real licence costs.

And then Costa Rica, which does not operate a comprehensive gambling licensing regime at all. The "data processing license" sometimes cited in the trade is not a licence in the strict legal sense, and a bill that would have created a mandatory regime was rejected by the Legislative Assembly in early 2026.

The Importance of a Gambling Licence

If there is a single thing that decides whether a gambling site is safe to deal with, it is this: does the operator hold a licence from the Gambling Commission, and can that be verified on the public register — with the site's activities and domain names actually matching what the register says?

For a British-licensed operator the first check happens before anyone deposits anything. Licence Condition 17, introduced on 7 May 2019, requires licensees to obtain and verify information establishing a customer's identity before that customer is permitted to gamble. The information includes name, address and date of birth. The Commission's expectation is that identity and age checks are brought forward to before a deposit or stake, and it has said plainly that onboarding on incomplete or inaccurate information — initials instead of full names, nicknames, commercial addresses instead of residential ones — is not sufficient.

What that looks like later is where the trouble starts, and where the rules are unusually explicit. Licence Condition 17.1.1 requires that a customer's withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested that information earlier. The carve-out is narrow: the prohibition does not prevent a licensee from seeking information it must obtain at that time under another legal obligation, such as anti-money-laundering rules. Under the Money Laundering Regulations, remote casinos must identify and verify a customer when they deposit funds or withdraw winnings amounting to €2,000 or more — a threshold that applies to a single transaction and to transactions that appear to be linked.

So the honest picture is this. Verification can be instant if it is electronic, and the Commission states it cannot provide a timescale for ID checks because the process varies. But a site that verifies nothing for months and then discovers a sudden need for a utility bill, a selfie and three months of bank statements at the exact moment of a withdrawal has not just been unlucky. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and it is one of the most common dispute types referred to alternative dispute resolution providers. The warning signs are all on the timeline: no request at deposit, no request at stake, an abrupt request at withdrawal, and terms granting the operator sole discretion to void winnings. Terms giving an operator sole discretion ("may", "reserve the right") to void or withhold winnings are treated by the Commission as unfair within the meaning of the Consumer Rights Act 2015.

Five Signs an Operator or Service Can Be Trusted

The licence is on the public register, domain and all

Check the operator's licence number on the Gambling Commission's public register and confirm that the activities and the domain names listed match the site in front of you. A register entry that names a different trading name, or a licence number that produces no match, is the end of the conversation. Offshore substitutes have their own versions of this test — Curaçao's Certificate of Operation Seal must redirect to cert.cga.cw and the certificate must name the domain being visited; Kahnawà:ke's logo generates a Certificate of Good Standing.

It asks who you are before it takes money, not after

A licensed operator needs name, address and date of birth verified before gambling, so any request for documents should arrive at or before the first deposit. Documents that are only demanded at withdrawal — and demanded in a manner no one could have predicted from the terms displayed beforehand — point to a site using verification as a brake on payouts. The fast check: read the identity section of the terms and conditions before depositing, and note whether it says when documents may be requested.

The terms are clear, accessible and free of sole-discretion clauses

Licence Condition 7.1.1 requires that terms and consumer notices are not unfair within the meaning of the Consumer Rights Act 2015. The Commission's guidance says operators should not use terms giving them sole discretion to void or withhold winnings, must not impose a maximum limit on what a consumer may withdraw from their deposit balance, and must not confiscate un-staked deposits or deduct from a balance because identity or age verification failed. A term forbidding withdrawal beyond, say, £50 a day is the Commission's own published example of a prohibited clause.

Customer money is described honestly, including the bad answer

Licence conditions 4.1.1 and 4.2.1 require customer funds to be held separately from business accounts and require the operator to state, in writing, which of three protection ratings applies — "not protected", "medium protection" or "high protection" — with the customer acknowledging receipt before using funds for gambling. An operator rated "not protected" must remind the customer every six months that their funds are not protected in the event of insolvency, stating their value. The quick check is whether that disclosure exists at all. It is required on the first deposit and after any change to the terms.

It is a participant in GamStop, and it says so

Since 31 March 2020 all online gambling operators must be part of GamStop as a condition of their licence, under social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice, which states that "Licensees must participate in the national multi-operator self-exclusion scheme". Since April 2020 operators have also had to check their entire customer base for GamStop registration at least every 24 hours, which also prevents registered people receiving direct marketing.

On self-exclusion itself, one fact deserves stating flatly, because it is the fact most often distorted: registration blocks a person from all online gambling companies licensed in Great Britain for six months, one year, five years, or five years with auto-renewal; it can take up to 24 hours to become effective; and it cannot be cancelled or deactivated during the exclusion period. It stays in place after the end of the chosen period unless the person contacts GamStop to remove it. Under the terms of use, auto-renewal may only be switched off during the last six months of a five-year minimum exclusion period, and if no deactivation happens, GamStop holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded. The Group's 2025 annual report devotes a section to its refusal to remove registrations early.

An offshore site is not a way round any of this, and no honest reading of the Commission's own warning notices could arrive at a different conclusion. On 20 January 2025 it issued an industry warning notice about casino games supplied by licensed operators appearing on unlicensed websites available to GB consumers, noting that such sites often target customers who have self-excluded via GamStop. The Commission's annual report records 561,983 active exclusions at the end of 2025 and 614,738 consumers on the register as of July 2026, of whom more than one in two had opted for the maximum five-year exclusion. That is not a market segment to be harvested.

A Working Method for Judging a Site

Anyone weighing up a casino and finding only the brand's own claims has no method at all. Here is a plain one, in order.

1. Confirm the licence on the regulator's public register, matching the domain. Not a logo in the footer — the register entry itself, with the activities and domain names listed. This single step removes most of the risk, and it takes about two minutes.
2. Read the withdrawal section of the terms and the identity section side by side. Note whether documents may be requested at payout, whether any maximum withdrawal limit is stated, and whether the operator reserves discretion to void winnings. These clauses are where a site's real character lives.
3. Check the customer-funds protection rating in writing. The operator must tell you whether funds are "not protected", "medium protection" or "high protection", and a "not protected" operator must remind you of that every six months. If the disclosure is absent, treat the answer as "not protected".
4. Open the bonus terms and find the wagering multiple stated as a number. Since 19 January 2026 UK licences cap wagering requirements at ten times bonus funds and ban mixing more than one gambling product within a single incentive. A site quoting 40 times is telling you which regime it answers to.
5. Look up who resolves a dispute, and how long the operator's own complaints process runs. Licensed operators must let customers refer a dispute to an approved alternative dispute resolution provider free of charge if it is not resolved within eight weeks, and a consumer must have gone through the operator's own complaints procedure first.
6. Note where the site sits on GamStop, and keep the helpline number. A licensed site checks the register daily and cannot accept someone who is registered. If gambling has become something other than a pastime, the National Gambling Helpline is free on 0808 8020 133, day or night.

The Rules That Changed the Offers

The bonus landscape has shifted more in the past eighteen months than in the previous decade, and most of the shift is British.

From 19 January 2026, licensees are banned from offering mixed-product promotions requiring two or more types of gambling, and wagering requirements on bonus funds are capped at a maximum of ten times. The Commission chose a cap over an outright ban and said the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". Under the same code, licence terms must be clear, transparent, fair and readily accessible, and significant conditions of marketing incentives must be displayed in full no more than one click away.

The cap is enforced against a backdrop of terms that were never designed for British players. Published offshore terms include a 25-times playthrough requirement with a contribution chart giving slots 100 per cent, table games 20 per cent, video poker and blackjack 10 per cent, roulette and baccarat 5 per cent, and live dealer games zero. Elsewhere, winnings generated with bonus funds can be limited to 300 per cent of the credited bonus amount, with any excess voided, and maximum bets while wagering can be capped at €5 for regular players, with bets above the limit rejected. The Commission's own consultation estimated offshore welcome offers at 25 to 40 times wagering, with no-deposit bonuses at 40 to 60 times against a €50 to €100 cashout cap — trade figures rather than regulator data, but consistent with published terms.

The enforcement record is not decorative. In July 2025 one licensee was fined £170,000 for failures including a bonus term stating that the operator had the right at its own discretion to close accounts or forfeit winnings. On 21 October 2026 another operator agreed a £900,000 regulatory settlement covering, among other things, unnecessarily delaying consumer withdrawals — including a term stating customers could request only one withdrawal at a time and could not request another until the original was authorised, found unfair under the Consumer Rights Act 2015, and manual review of every fifth or tenth withdrawal that led to extra information being required before payouts.

The lesson is narrow but useful. In the British regime, the remedy for a bad term is a bill, and the operator pays it.

Other Places the Same Question Comes Up in the UK

Online gambling in the UK does not arrive as one product, and the protections differ by product, which is where a great deal of confusion begins.

Online slots

Online slots generated £773 million of Gross Gambling Yield for the quarter January to March 2026, up 12 per cent year-on-year, on 25.1 billion spins. They now carry a £5 maximum stake per game cycle for all adults, live since 9 April 2025, and £2 for adults aged 18 to 24, live since 21 May 2025. The limits apply to online slots only — not to roulette or blackjack — and at least 2.5 seconds must elapse from the start of a game until the next cycle can begin. Anyone weighing whether a site is treating them seriously should ask what stake limit it applies and whether it matches the one the licence requires.

Offers and promotions

Since 19 January 2026 an incentive cannot span more than one type of gambling product, and no wagering requirement may exceed ten times bonus funds. "Bet £5 and get £10 free bet" is compliant; "Bet £5 to get 20 free spins" is not. Where a customer freely chooses, on an unrestricted basis, which product to use bonus money on, the ban does not bite.

The industry's size

Total Great Britain Gross Gambling Yield was £17.5 billion in the year to March 2026. Remote casino, betting and bingo contributed £8.3 billion, up 6.9 per cent, and land-based sectors £4.9 billion, up 1.1 per cent. The Commission's operator dataset covering roughly 70 per cent of the online market recorded £1.55 billion of online Gross Gambling Yield for January to March 2026, up 7 per cent year-on-year, with 26.8 billion bets and spins and 13.4 million average monthly active accounts.

The market's self-assessment

The third annual Gambling Survey for Great Britain, published 16 July 2026 and based on 20,775 adults, found 2.4 per cent with a Problem Gambling Severity Index score of 8 or more — stable across the survey's three years at 2.5, 2.7 and 2.4 per cent. Of those who had gambled in the past 12 months, 3.4 per cent had sought support because of their own gambling, and 2.7 per cent reported one or more severe consequence, with relationship breakdown the most reported at 1.7 per cent.

Offshore sites are not covered by any of those safeguards, and there is no regulator to complain to afterwards.

Frequently Asked Questions About Online Gambling UK

Is online gambling legal in the UK?

Yes — through operators holding a Gambling Commission licence. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and the Commission states it is illegal to offer commercial gambling to consumers in Great Britain without one, including where the operator holds a licence elsewhere. The offence attaches to the provider. An adult who places a bet is not committing it.

How many online gambling sites are there in the UK?

No one publishes an authoritative total of licensed domains, because operators hold multiple domains. What is countable is the illegal side: the Commission identified 586 illegal gambling websites accessible to GB consumers in September 2026, and took disruption action against 311 in the second quarter of 2026–27. Across the monitored period from May 2024 to July 2025, just over 1,000 unique illegal websites were accessed by consumers in Great Britain.

Do I pay tax on online gambling winnings in the UK?

No. There is no tax on a player's gambling winnings in Great Britain; the duty sits on the operator. The current shape of that is the statutory levy introduced by the Gambling Levy Regulations 2025, which commenced on 6 April 2025 and took 1.1 per cent of previous-year Gross Gambling Yield from all online operators and software licences. In its first year it raised just under £120 million, ringfenced solely for research, prevention and treatment of gambling-related harm.

Can I get a refund from an online casino?

Sometimes, and the route matters more than the hope. Licensed operators must let a customer refer an unresolved dispute to an approved alternative dispute resolution provider, free of charge, provided the operator's own complaints procedure has been used first — usually after eight weeks, or on a deadlock letter. Providers will not take customer-service complaints or a refusal to accept a bet. Above a quarter of complaints reaching the Commission concern identity verification at withdrawal, and the Commission is a regulator, not an ombudsman: it cannot get money back for an individual.

What are the safest online gambling sites in the UK?

The safest are simply the licensed ones, verified rather than assumed: check the licence on the Commission's public register and confirm that the activities and domain names match the site. Beyond the licence, look for a stated customer-funds protection rating, terms without sole-discretion clauses, an eight-week complaints route to an approved dispute provider, and GamStop participation, which has been a licence condition since 31 March 2020.

What is the biggest difference between a UK-licensed and an offshore site?

The enforcement machinery behind the licence. A British-licensed operator answers to stake limits of £5 per spin on slots and £2 for under-25s, a ten-times cap on wagering requirements since 19 January 2026, a credit card ban since 14 April 2020, and daily GamStop checks. An offshore operator holding, say, an Anjouan or Curaçao licence faces none of those obligations in Great Britain, and offers no recourse to the Commission.

Are new online gambling sites in the UK safe?

Age is not a proxy for safety; the licence is. A newly launched site on the public register is subject to the same conditions as an old one — identity verification before gambling, separate client funds, GamStop participation, the ten-times wagering cap. The practical risk with any new site is thin disclosure: a short terms page, no customer-funds rating, and a complaints route that stops at an email address.

What the Enforcement Adds Up To

The regulator cannot licence these sites, so it attacks their plumbing — worthless numbers to a search engine, ruinous ones to a registrar — and in the quarter to September 2026 it referred 1,835 websites and 7,677,211 URLs to search engines while starting no criminal investigations at all in the previous quarter.

Someone looking for an online gambling site in the UK is therefore well served by a boring habit: check the register, read the withdrawal terms, find the customer-funds rating, count the wagering multiple. And if gambling stops being a pastime, the National Gambling Helpline is free on 0808 8020 133, twenty-four hours a day.