Games not on GamStop are games at operators holding no Gambling Commission licence, so the self-exclusion scheme never reaches them. Around 614,738 people sit on the register in 2026, and the Commission's Illegal Markets team spends its days hunting the sites that ignore it.
It is worth being blunt about the phrase itself, because it is used two different ways. Sometimes it means offshore casinos with no British licence at all. Sometimes it means a licensed operator whose games are simply not part of the national self-exclusion scheme — which, for online gambling, is nobody. Since 31 March 2020 every online operator must be part of GamStop as a condition of its licence, under social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice. A person typing that phrase is often thinking of the second thing and will only find the first. The name itself is a small trap, too: it is often typed "gamestop", one word, one letter out.
So the honest answer is geographic rather than technical. A game is "not on GamStop" when the company offering it sits outside the Commission's reach. The Commission's own risk assessment, published 30 July 2026, rates the remote casino sector high risk for money laundering; its enforcement reporting from 21 October 2025 put an average 32 per cent fall in engagement across 160 illegal sites after disruption. That is the story: not a gap in the rules, but a running fight at the border.
Table of Contents8
- What the Numbers Say About the Sites Outside the Scheme
- How the Regulator Actually Fights These Sites
- UK-Licensed Sites Set the Bar, and Offshore Sites Are Measured Against It
- Terms That Build In Delay
- Five Signs an Operator Can Be Trusted
- How to Check a Site Before Playing on It
- Questions About Games Not on GamStop
- The House View
What the Numbers Say About the Sites Outside the Scheme
Start with scale, because scale is where the argument usually goes wrong. The Commission's dashboard recorded 586 illegal gambling websites accessible to consumers in Great Britain in September 2026 — 4 per cent below the previous three-month average and 4 per cent above September 2025. Read those two percentages together and the picture is a plateau, not a collapse. The Commission has been removing sites and finding replacements in roughly equal number.
The stake estimates disagree with each other, and that disagreement is itself informative. H2 Gambling Capital put money staked with illegal operators at £16.6 billion in 2025, up from about £5 billion in 2019, with the legal share of gambling falling from 97 per cent to 92 per cent. Frontier Economics, working for the Betting and Gaming Council, reached £2.7 billion online and up to £4.3 billion including illegal premises. Yield Sec, for the Campaign for Fairer Gambling, split a £8.8 billion market 91 per cent regulated and 9 per cent not. Three credible houses, three different numbers, because none of them can see the traffic hidden behind a VPN — the Commission says as much of its own October 2024 methodology. Any round figure quoted confidently should be treated as a sales document.
Player-level data is firmer. The Commission's analysis of 5 November 2026, covering April 2025 to April 2026, estimates that 0.6 per cent of all respondents had engaged with an illegal gambling website in the past four weeks and a further 0.4 per cent in the past twelve months, while 94.4 per cent showed no indication at all. Among people who had gambled online in the past four weeks, the figure rises to 2.5 per cent. That is a small minority — and a persistent one.
How the Regulator Actually Fights These Sites
The Commission does not have a switch it can flip. What it has is paperwork, and the numbers on the paperwork are the most concrete thing in this whole subject.
Since April 2024 its Illegal Markets team has issued 3,140 cease and desist notices and disruption notices — 2,032 of the first, plus 774 registrar referrals, 402 host referrals and 3 payment provider referrals. Over the same period it referred 447,778 Bing and Google URLs and secured 287,961 removals. Quarterly output has risen sharply: 226 websites referred to search engines in January to March 2026, then 366 in April to June, then 1,835 in July to September, when 546 cease and desist notices went out.
The uncomfortable part is what follows. The Commission's own analysis, published 21 October 2025, finds that registrar blocks and website suspensions cut engagement by an average of 91 per cent each, GEO IP blocking by 60 per cent, Bing removal by 52 per cent and Google removal by 30 per cent. Search-engine removal makes a site harder to find; it does not stop anyone who has the address. Criminal prosecution, meanwhile, barely features: across April 2025 to March 2026 every quarter recorded 0 or 1 prosecutions commenced, one in total. The Commission is a disruptive force rather than a prosecuting one, and it says so.
Its financial lever is younger. It made its first referral to the Visa Operator Scheme in January 2025 after a test purchase, and has since made three more covering three separate sites; it describes payment-data reporting as critical and still early-stage. That is the lever to watch, because card rails are where the money has to travel.
UK-Licensed Sites Set the Bar, and Offshore Sites Are Measured Against It
The comparison only means something if the baseline is real. On withdrawal speed the Commission has hard figures: across 44.2 million withdrawals by customers of large online operators between June and September 2024, 96.3 per cent cleared automatically and 3.5 per cent within 24 hours. That is the standard a licensed site is held to. It is not a guarantee of instant money — 49 per cent of people who had gambled in the past 12 months agreed it is quick and easy to withdraw winnings, per research published 23 July 2026, with 18 per cent disagreeing — but it is a documented default.
Identity checks are the hinge. A licensed site must verify name, address and date of birth before it lets anyone gamble, under licence condition 17. Identity may be matched electronically against credit reference agencies and the electoral roll, in which case no documents are needed. Under the anti-money-laundering regulations a remote casino must identify and verify when deposits or withdrawals reach €2,000, singly or in linked transactions. Over a quarter of the complaints reaching the Commission's contact centre concern identity verification, usually because documents were demanded only at the moment of withdrawal — precisely what licence condition 17.1.1 forbids where the operator could reasonably have asked earlier.
Offshore, none of that applies. There is no licence condition, no €2,000 rule enforced by a British regulator, no statutory eight-week complaints clock and no route to an approved alternative dispute resolution provider. The good offshore operators exist, and some of them pay faster than any British site. The bad ones build the delay into the terms and let the terms do the work, which is cheaper than refusing a withdrawal outright.
| What is being compared | UK-licensed operator | Offshore operator, regulated elsewhere |
|---|---|---|
| Identity check timing | Before the first bet, by licence condition 17 | Varies; often only at withdrawal |
| AML threshold | €2,000 in deposits or withdrawals, linked transactions included | Set by the local regime, if any |
| Wagering cap on bonuses | 10× maximum since 19 January 2026 | Commonly 25× to 50× |
| Maximum cashout clause | Prohibited on the deposit balance | Common; one operator caps at 300 per cent of the bonus |
| Dispute route | Commission-approved ADR provider, free to the consumer | Operator's own choice, sometimes a paid ADR |
| Withdrawal friction | Friction after a withdrawal request is not acceptable | Delay often written into the terms |
| Self-exclusion | GamStop, since 31 March 2020 | Not connected to GamStop |
Take one row and follow it. The maximum-cashout clause is where offshore terms quietly gut a headline bonus: 300 per cent of the credited bonus sounds generous until the win is larger, at which point the excess is voided. British rules forbid any maximum limit on withdrawing the deposit balance, and the Commission's example of an unlawful term is "you may withdraw up to £50 per day". Same game, same table, two entirely different sets of arithmetic.
Terms That Build In Delay
A delay does not have to be dishonest to cost money; it only has to be lawful where the operator sits. The classic instruments are a processing window measured in working days, a manual review of every fifth or tenth withdrawal, a term permitting one withdrawal request at a time until the previous one is authorised, and a maximum bet while wagering set at 5 per cent of the bonus or 20 per cent of the deposit — a rule that voids winnings after the fact if it is broken.
British regulators have attacked all three of the first. The Commission banned reverse withdrawals outright on 31 October 2021 under requirement 14B: once a withdrawal is requested, the funds cannot be offered back as a deposit. It states plainly that introducing friction at withdrawal rather than at deposit is not acceptable, and that where there are no regulatory concerns there is no valid reason to delay a payout. In October 2026 it settled with an operator for £900,000 over failures that included a one-withdrawal-at-a-time term and manual review of every fifth or tenth withdrawal. Offshore, those same clauses are simply standard drafting.
The mirror image is the deposit side. Licensed operators must prompt a customer to set a financial limit before the first deposit, under rules in force from 31 October 2025, and financial vulnerability checks apply at £150 of net deposits over 30 days. An offshore site has no such obligations, and its onboarding is correspondingly frictionless. That frictionlessness is the product.
Five Signs an Operator Can Be Trusted
The licence is on the public register, and the domain matches
The Commission advises checking that a business holds a British licence and clicking through to the public register to see whether the site's activities and domain names match. A logo alone proves nothing; registered domains are what count. If the register lists a different domain from the one being displayed, the answer is no.
The seal resolves to a verification page, not a picture
Offshore seals are easy to copy. Curaçao's regulator requires a Certificate of Operation Seal to redirect to its own certificate site, and states that a seal differing in design, colour or format, or sitting over a certificate naming another domain, indicates an unauthorised site. Kahnawà:ke runs something similar: clicking the Commission's logo should generate a Certificate of Good Standing. Click it. A seal that does nothing when clicked is decoration.
The terms state a cooling-off and removal process in plain words
Licensed self-exclusion holds for its full term, and then stays in place until the person contacts GamStop to remove it — signing up blocks accounts with all British-licensed online operators for six months, one year, five years, or five years auto-renewing. Terms that describe an easy early exit from an exclusion are describing something else.
Payout terms carry a period, not a mood
Look for a stated processing time and a stated method. Where the terms reserve sole discretion to void winnings, or use "may" and "reserve the right" loosely, the fair-terms rules that apply in Britain do not apply there. A period written down can be tested; a discretion cannot.
The complaint goes somewhere named and free
British licensees must let a customer refer an unresolved dispute to a Commission-approved ADR provider free of charge if it is not settled within eight weeks, and must not use terms restricting the right to go to court. Offshore, check the named provider and its published record. Some jurisdictions require one — Anjouan names EGIS ADR, Axion ADR, iGaming ADR and another approved provider. Where nothing is named, nothing is possible.
How to Check a Site Before Playing on It
- Search the licensed public register for the trading name, then for the domain. The Commission's register is the only list that matters for British protections, and the domain check is the step most people skip; a licence held by a company says nothing about the site in front of you. A mismatch is the finding.
- Read the withdrawal section of the terms before depositing. Look specifically for a processing period, a withdrawal-at-a-time clause, a maximum cashout tied to bonus funds, and a maximum bet while wagering. These four clauses account for most of the arguments that follow. Reading them costs five minutes.
- Check whether the site's own complaints route leads to a named ADR provider, and how long it takes. Approved providers publish resolution times: eCOGRA's Great Britain report for the year to 30 September 2025 records 911 disputes received, an average of 31 days to resolve domestic cases, and 17.8 per cent of completed disputes ruled in the consumer's favour. IBAS completed domestic disputes in an average of 20 days. Those are reference points for what reasonable looks like.
- Set a financial limit at account level before the first deposit, wherever the option is offered. Licensed operators must prompt for it; where an operator does not prompt, that absence is itself information about whose interests the design serves.
- Install blocking software as a separate layer, whichever sites you use. GamStop signposts Gamban and BetBlocker. BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps, needs no registration and is free worldwide. Gamban blocks licensed and unlicensed sites and states its protection is designed to be as difficult to remove as possible; it is free for residents of Wales, and in England and Scotland costs £4.99 a month or £29.99 a year following the end of the TalkBanStop funding on 31 March 2026.
- Use a bank's gambling block on every card. The Commission's list, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. Blocks work at card level by declining gambling merchant category codes, so each card needs switching on separately, and most banks impose a 48- or 72-hour cooling-off before gambling payments resume. They do not affect a credit score.
One route matters more than the other five put together, so it goes here rather than in the list. If gambling stops being a pastime, the National Gambling Helpline is run by GamCare on 0808 8020 133, free, 24 hours a day, every day of the year, also reachable by live chat and WhatsApp; callers in Wales are given 0808 2819 265. Gamblers Anonymous England, Wales and Ulster answers on 0330 094 0322, Citizens Advice Scotland runs a gambling support line on 0800 328 1131, and NHS gambling clinics take self-referrals. None of this is a crisis service — the helpline says so itself — so anyone at immediate risk needs emergency help instead.
Questions About Games Not on GamStop
What gambling sites are not on GamStop?
Any operator offering games to British players without a Gambling Commission licence, because the scheme's obligations attach only to licensed operators. That covers a wide range: sites under Curaçao, Anjouan, Kahnawà:ke or Maltese licences, and sites under no meaningful licence at all. Costa Rica is a good example of the last sort — it operates no comprehensive gambling licensing regime, and its Legislative Assembly rejected a mandatory licensing bill in early 2026, so the "data processing licence" sometimes quoted from there is not a licence in any strict sense. The distinction matters, because a jurisdiction that regulates at least leaves a paper trail.
Are the games themselves different?
Not usually. The slots, tables and live dealer studios are frequently the same products. What differs is the wrapper around them: the terms, the withdrawal handling, the complaints route and the protections that follow a licence. The Commission issued an industry warning notice on 20 January 2025 about casino games from licensed operators appearing on unlicensed websites, noting those sites often target people who have self-excluded and may have weak social responsibility and anti-money-laundering controls. So the game can be identical while everything that determines whether the money arrives is not.
Can an offshore site get round a GamStop exclusion?
No, and the framing is the wrong way round. A GamStop exclusion holds for its full chosen term and then stays in place until the person contacts GamStop to remove it; registrations cannot be removed early, and the Group's 2025 annual report devotes a section to that refusal. An offshore site is not a way round the scheme — it is a site the scheme cannot see. That gap is exactly what the Commission's warning notice describes being exploited, and it is why blocking software and a bank block matter as separate layers.
How well does the regulator do at taking these sites down?
Better at disruption than at removal. Since April 2024 it has issued 3,140 cease and desist and disruption notices and secured 287,961 URL removals, and it reports that registrar blocks and suspensions cut engagement by an average of 91 per cent against 30 per cent for Google removals. But 586 illegal sites accessible to British consumers were still identified in September 2026, and prosecutions across April 2025 to March 2026 came to one. Reading the whole set, the pattern is containment: traffic knocked down, addresses replaced, and the count broadly flat.
What about bingo, arcades and betting shops?
Online, the scheme is the same one. Land-based is a separate world: casinos use SENSE, which had 12,445 active self-excluded customers between 1 April 2025 and 1 April 2026 per the Commission's May 2026 freedom-of-information response, with removal only requestable in person during a six-month thinking period. Betting shops use GamStop Betting Shops, formerly MOSES, a telephone scheme on 0800 294 2060 covering over 60 operators and roughly 6,000 shops, with 9,075 active customers over the same period. One word of warning from the regulator's own data: onboarding with a middle name instead of a forename creates mismatches against such records and undermines the exclusion.
Why do people end up on these sites at all?
Usually because something on a licensed site felt like friction. Over a quarter of complaints to the Commission's contact centre concern identity verification, and withdrawal complaints have been the single biggest category for years — 1,791 complaints coded to withdrawals and financial transactions in the year to December 2025, down from 2,416 in the year to December 2022. An offshore site advertises the absence of exactly that friction. It is an honest observation to make and still a poor trade, because what is being sold is the removal of the checks as well as the delays.
The House View
The phrase "games not on GamStop" describes a border, not a product, and everything follows from which side of it a company sits: a British licence buys protections that are written down and enforceable, and an offshore one buys terms that are written down and enforceable by somebody else. The Commission has made itself a nuisance to these sites rather than a wall against them — 3,140 notices, 287,961 removals, and a site count that has barely moved — while self-exclusion itself is settled: it runs for its full term and stays until GamStop is asked to lift it. If any of it stops being a pastime, the National Gambling Helpline on 0808 8020 133 is free and answers around the clock.