Casino Sites Not on GamStop and Your Balance

Casino sites not on GamStop are licensed outside Great Britain, usually in Curaçao, Anjouan, Kahnawà:ke or Malta, and are not covered by British licensing or the national self-exclusion scheme. There is no British regulator and no UK alternative dispute resolution behind them. Whether a balance is safe comes down to the operator's own records.

GamStop is the national online self-exclusion scheme, and the name is very often typed "gamestop", which no doubt keeps a search engine somewhere amused. It has been the spine of British online player protection since it went live on 27 April 2018, and it is the single clearest line between the sites I can write about with a regulator behind me and the ones I cannot. Since 31 March 2020 every operator holding a Gambling Commission licence must be part of the scheme, a duty sitting in social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice. In November 2025 the scheme was renamed Gamstop Online after a website update, which is a piece of housekeeping nobody outside the industry noticed and which changed nothing that matters.

What matters is that the scheme's obligations attach to the licence, not to the customer. A site with no British licence is not in the scheme and cannot be in it. So the phrase in this article's title describes a real and legal category of operator — and also a category in which the protections a British player has come to assume simply stop. The Gambling Commission estimates that, among people who had gambled online in the past four weeks, 2.5 per cent had engaged with illegal gambling websites, with a further 1.5 per cent having done so in the previous year. Small numbers. Six figures of people, roughly, and they are the ones this page is written for. Everything below is about what does and does not stand behind the money in an account.

Before anything else, in plain words. Offshore sites hold no Gambling Commission licence, so they are not licensed in Great Britain, and UK protections do not apply to them. That means no Gambling Commission oversight, no statutory complaints route through a British-approved ADR provider, no requirement to contribute to the statutory levy that funds treatment, and no GamStop. If gambling is causing harm, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day, run by GamCare; in Wales the number given is 0808 2819 265. Self-exclusion through GamStop holds for its full term — 6 months, 1 year, 5 years or 5 years with auto-renewal — and then stays in place until the person contacts GamStop to remove it. An offshore site is not a way round that, whatever a forum post says. It is a fact I would rather state early than bury under a comparison table.

As of 13.11.2026, the market breaks down roughly like this.

Judging the Best Casino Sites Not on GamStop

The word "best" in that phrase is doing a lot of work, and the honest version is that there is no easily checkable ranking, because the thing being ranked is invisible until something goes wrong. The best of these operators are, in my experience of reading their terms, perfectly well run businesses that segregate player money and pay out promptly. The worst are shells with a licence painted on the front page and a withdrawal button that never quite works. Since there is no British regulator to sort one from the other, the judgement has to be made from paperwork before a first deposit, not from the account afterwards.

The first thing to check is which regulator actually licensed the operator, and whether the seal on the site says what the site says. Curaçao's new regime is a good example of how much a certificate can mean and how little a logo means. The National Ordinance on Games of Chance, known as the LOK, took effect on 24 December 2024 and made the Curaçao Gaming Authority the direct licensing and supervisory authority. The old master-licence model is finished: Gaming Curaçao (365/JAZ) stopped licensing on 18 August 2024, Curaçao eGaming (1668/JAZ) on 1 October 2024, an operator (8048/JAZ) on 1 November 2024 and Curaçao Interactive Licensing (5536/JAZ) on 31 January 2025. The legacy orange sub-licence certificates of operation ended on 15 October 2025. A historic /JAZ number on a footer is therefore not proof of anything current.

There is also a fee that tells you something useful. A Curaçao B2C licence carries a one-time non-refundable application fee of EUR 4,592 and a total annual fee of EUR 47,450, made up of EUR 24,490 to the National Treasury and EUR 22,960 in supervisory fees to the authority. Anjouan's published schedule is EUR 17,828 for issuance and the same for annual renewal, with EUR 500 per additional domain. Licensing is a cost, and a cheap licence is a cheap licence. That is not the same as saying every operator under a cheap regime is dishonest — it is saying the entrance price shapes who walks through the door.

The second test is the client-money promise, and here the gap between British-licensed sites and offshore sites is at its widest. A UK licensee must keep customer funds in a separate client account or accounts, separate from its business accounts, and must choose one of three published insolvency ratings — "not protected", "medium protection" or "high protection" — and state it in the terms. If the rating is "not protected", the operator has to remind the customer of that once every six months, with the value of the funds held. A separate client account is itself no guarantee; a British operator may lawfully hold customer money in an overseas bank, and separation does not mean money comes back if the business fails. But at least the rating exists, is defined and is checkable.

Offshore, the same discipline appears in Anjouan's published standards, which require licensees to segregate player funds from operational funds, to use random number generators certified by an approved independent testing facility, and to maintain anti-money-laundering controls and age verification. Read that sentence carefully: those are standards of conduct imposed on the operator. They are not a pot of money set aside to repay a player, and no regulator in that jurisdiction is promising to stand behind the balance if the company folds. There is no equivalent of the Commission's "high protection" rating, because there is no rating scheme.

The third test is the licence register itself, and it is the one most people skip. Curaçao issues two separate seals: a Certificate of Operation Seal, given only to B2C operators and only for an approved, registered player-facing domain, and a License Certificate Seal, available to B2B and B2C entities and not domain-specific. Clicking a Curaçao Certificate of Operation Seal must redirect to the authority's own certificate site; if the seal differs in design, colour or format, the site is not authorised. If the certificate behind the seal names a different domain from the one in the address bar, the site is displaying another operator's paperwork. Anjouan takes a similar approach, with certificates carrying a unique licence number and a QR code linking to a public register, and states plainly that certificates which cannot be verified through that register should not be relied upon. Both regulatory bodies, in other words, have published the exact tests a player can run in about ninety seconds — and both have done so because sites keep forging the seals.

The fourth test is the dispute route, because it is the difference between a complaint and a dead end. Anjouan requires licensees to designate an authority-approved alternative dispute resolution provider and to name it, with contact details, in the player-facing terms, and expects operators to resolve complaints within 30 days before a player may escalate. The providers currently approved there are EGIS ADR, Axion ADR, iGaming ADR and an operator. That is a genuine route, and it is worth knowing that it is a private one, funded by the industry it adjudicates, with no British regulator behind the decision. On the British side, complaints go to the operator first, then to an ADR provider free of charge if unresolved within eight weeks — and the Commission, being a regulator rather than an ombudsman, cannot get anyone's money back.

The fifth test is time. Jurisdictions move: Curaçao's supplier licensing and registration become fully mandatory on 24 December 2026, and Kahnawà:ke's Client Provider Authorization application fee rises from USD 35,000 to USD 40,000 on 1 January 2027, with the five-year renewal fee going from USD 5,000 plus the annual fee to USD 40,000 including it. An operator that has held a verifiable licence under one regime for years is a different proposition from one whose paperwork dates from last month.

New Casino Sites Not on GamStop and Licence Strength

Novelty is sold as a virtue in this market, and it is mostly a tell. A brand launched last year has no complaint history to read, no published arbitration record and, usually, a licensing footprint too young to have been tested. That is not proof of bad faith. It is simply an absence of evidence, in a category where evidence is the only thing a player can buy with.

A useful illustration of how young some paperwork is: operators holding a valid Curaçao licence when the LOK came into force on 24 December 2024 received a six-month provisional licence by operation of law, due to expire on 24 June 2025. The authority then extended those provisional licences by a further six months, to 24 December 2025, on the same conditions, and said operators had to be fully compliant by the end of that second period to be eligible for a full licence. So a large part of the market spent 2025 on probation, and some of it did not come off it. An operator's "licensed since" line means less than it appears to.

Malta sits in a different place, and it is worth naming because it is often used as a badge of quality by sites that do not hold it. A Malta Gaming Authority B2C licence brings a one-time non-refundable application fee of EUR 5,000, a non-refundable fixed annual licence fee of EUR 25,000 and gaming tax of 5 per cent of gaming revenue from the service, with minimum issued and paid-up share capital of EUR 100,000 for Type 1 and Type 2 licences and EUR 40,000 for Types 3 and 4. Those are serious numbers and a serious regime. The MGA also publishes a list of unauthorised URLs, declaring it has no connection with those domains and that any reference on them to the MGA or a Maltese licence is false and misleading; the most recent entries on that list carry notice dates of 30 October 2026. If a site waves a Maltese licence, the MGA's own list is where the claim goes to be tested.

And then there is the licence that is not a licence. Costa Rica does not operate a comprehensive gambling licensing regime and has no formal framework for issuing gambling licences; the "data processing license" sometimes cited in the industry is not a licence in the strict legal sense. The country's Legislative Assembly rejected Bill No. 25,057 in early 2026, which would have introduced a mandatory licensing regime. Under Costa Rican law, games of chance where the outcome depends primarily on luck are generally prohibited. When a footer mentions Costa Rica, it is usually telling you where the company is incorporated, not where its gambling is licensed.

None of which means a new offshore brand cannot be honest. It means that the honest ones will show you a verifiable certificate, a named ADR provider, a segregated-funds statement and terms written in plain language, and will not mind you checking. The ones that get annoyed by questions are answering one.

Benchmarking Offshore Standards

Everything in this article compares offshore operators with one benchmark, and the benchmark is the British licence, because that is the standard a British player's expectations were built on. The comparison below is deliberately not a list of brands. It is a comparison of regimes, by what each one actually promises the person holding the balance.

Two entries in that table deserve a note. First, the Kahnawà:ke self-exclusion position is startling when set beside the British one: a player who breaches a self-exclusion prohibition there forfeits funds deposited or won to a third-party charity chosen by the Commission, and the Commission's own voluntary self-exclusion is permanent and irrevocable. That is not the same product as GamStop, and nobody should assume the words "self-exclusion" mean the same thing in two jurisdictions. Second, "not prescribed in this form" in the Curaçao column is not a criticism of the authority; the LOK is new, and the register-verification mechanism was itself under reconstruction when the authority announced on 7 October 2026 that its previous online gaming portal would not return to service and that it was working on an alternative way to verify licensed domains, because the old digital seal may be affected. A regulator mid-rebuild is a regulator whose guarantees are, for the moment, thinner than they will be.

A number that belongs in this section rather than the next one: 704 Curaçao licences held by 698 operators, of which 552 were active, as read from the authority's public register at 03:30 UTC on 6 November 2026. That read came from a third-party tracker rather than the authority itself, so treat it as an indication of scale rather than an official count. The shape of it is the point. Several hundred operators share one small jurisdiction's supervision, and no British player has a vote in how that supervision works.

Identity Checks on Casino Sites Not on GamStop

If there is a single mechanism that decides whether an offshore account is usable, it is identity verification, and the reason is that it is the only point in the relationship where the operator has something to gain from delay.

The British rule is unusually well drafted on this. Licence condition 17.1.1 requires that a customer's request to withdraw funds must not result in a requirement for additional information if the licensee could reasonably have requested it earlier — with the caveat that this does not stop a licensee seeking information it is obliged to obtain at that moment under another legal duty, such as anti-money-laundering rules. The Commission has gone further and said it is not acceptable to introduce friction when someone tries to withdraw rather than when they deposit, that it is not fair, transparent or necessary to delay a payout purely for safer-gambling purposes, and that where there are no regulatory concerns there is no valid reason to delay a withdrawal. That is a regulator telling operators, in writing, that the money is not theirs to sit on.

Offshore, that sentence does not exist. Anjouan's standards require anti-money-laundering controls and age verification; they do not contain a promise that verification will be moved forward to onboarding, and there is no equivalent of condition 17.1.1 to point at when the documents request arrives on the day of the win. Nor is there a fast complaints route if it does. And the reason operators get away with it is structural: anti-money-laundering law can genuinely require a delay, and operators are barred from tipping off a customer in money-laundering cases, so a legitimate hold and a commercial one look identical from the outside.

How it works the first time. In a UK-licensed casino the expectation, stated by the Commission in its August 2026 blog, is that identity and age checks are brought forward to before a deposit or a stake, and the Commission warns against "fuzzy matching" through third-party providers and against onboarding on partial verification. Many customers sail through without documents at all, because the operator can match name, address and date of birth against credit reference agency and electoral roll data. When that match fails — a middle name used instead of a forename, a typo in a flat number — the account that worked fine on Monday asks for a passport on Friday.

How it works later. Verification is not a one-off. Customer due diligence is ongoing under the 2017 money-laundering regulations and may need refreshing when circumstances or personal details change. On the British side that duty runs alongside condition 17.1.1, which is precisely the tension the Commission keeps having to referee. On an offshore site the ongoing duty runs alone.

The warning signs, then. A site that does not tell you before your first deposit which documents it may ask for and when. A site whose terms reserve the right to request verification "at any time" without saying what triggers it. A withdrawal page with no stated timeframe. A support desk that answers questions about the licence with marketing copy. And, most telling, a request for documents that arrives only after a large win — because that is the moment the incentive changes.

There is a British figure that shows how thoroughly this problem survives even in a regulated market. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, a concern customers raise when they are asked for documents only on attempting to withdraw. The Commission received 911 ADR disputes through eCOGRA in the year to 30 September 2025, of which 150 valid disputes concerned deposits and withdrawals, and 72.3 per cent of the invalid ones had not been through the operator's own complaints procedure first. People do not know the route even where a route exists. Offshore, the route is shorter and the ground under it is softer.

Five Signs an Offshore Operator Can Be Trusted

These are checks, not endorsements. Each one is something a person can do from a kitchen table with the site open in one tab and the regulator's register in another.

The seal verifies, and it verifies to this domain

Click the licence seal and follow it. For Curaçao that must take you to the authority's certificate page, and the certificate must name the domain you are actually on; if it names a different one, the site is showing another operator's paperwork and should be treated as unauthorised. For Anjouan, enter the licence number or scan the QR code against the public register, because the authority itself says a certificate that cannot be verified there should not be relied upon. If a site shows a seal that is a static image, that is the check finished.

The licence regime is still alive, and the operator is on the current side of it

Check the seal's format as well as its existence. A Curaçao "orange" sub-licence certificate is worthless — those ended on 15 October 2025 — and a legacy /JAZ number is not proof of a current licence, because the four master licensors stopped licensing between 18 August 2024 and 31 January 2025. An operator whose only paperwork is pre-2025 has not been supervised in the current regime.

There is a named dispute route with contact details in the terms

Look for a named ADR provider in the operator's own terms, not in a support article. Anjouan requires licensees to designate an authority-approved provider and publish its details, and the currently approved names are EGIS ADR, Axion ADR, iGaming ADR and an operator. A named provider with a published process is a sign of a business that expects to be argued with. A support email with no escalation route is a sign of the opposite.

The withdrawal terms state a timeframe and do not cap the payout

Read the withdrawal section of the terms and look for two things: how long the operator says it takes, and whether there is a maximum it will pay out. Offshore, cashout caps are common and legitimate — one operator's published terms limit winnings generated with bonus funds, including free spins and cashback, to 300 per cent of the credited bonus amount, with the excess voided. That is not a scam; it is a term, and it is the kind of term a British-licensed site is not allowed to write about a deposit balance at all.

The company and the regulator are not the same thing as the country in the footer

A Costa Rica incorporation is not a licence, and the industry's "data processing license" is not a licence in the strict legal sense, because Costa Rica has no comprehensive gambling licensing framework and its parliament rejected the bill that would have created one. A footer naming a regulator should be checked against that regulator's own list of authorised domains. The Malta Gaming Authority, for instance, publishes a list of unauthorised URLs and states that any reference on those sites to the MGA or a Maltese licence is false and misleading.

How I Would Check a Site Before Depositing

Six steps, in this order, each one because the answer changes what I do next.

1. Find the operating licence and click through to the register. Reason: the seal is the only claim on the page that a third party can independently confirm, and forged seals are common enough that both Curaçao and Anjouan have published instructions for spotting them.
2. Match the certificate's domain to the address bar. Reason: a valid certificate belonging to a different operator tells you the site is displaying someone else's authorisation, which the Curaçao certification policy treats as unauthorised or fraudulent.
3. Read the customer-funds clause and decide whether "separate account" is being promised or protected. Reason: segregation is a bookkeeping arrangement, not insurance; even in the British market, separate client accounts do not mean money returns if the operator becomes insolvent, and there is no offshore equivalent of the three-point insolvency rating.
4. Read the bonus terms before the deposit, not after. Reason: this is where the arithmetic lives. A 10× wagering requirement on bonus funds is the British ceiling; offshore, published multipliers commonly run higher, and the multiple is applied either to the bonus alone or to bonus plus deposit, which changes the number by a wide margin. Where the terms say "bonus plus deposit", run the sum in your head before you click.
5. Check the withdrawal section for a stated timeframe, a payout cap and a fee. Reason: the terms are the only thing that will govern a payout, and finding the cap after a win is finding it too late.
6. Decide in advance what level of protection is acceptable, and set the deposit limit at the account before playing. Reason: since 31 October 2025 British-licensed operators must prompt customers to set a financial limit before their first deposit, so the prompt is familiar; offshore, nobody is obliged to prompt you, and a limit you set yourself is the only one that exists.

What Goes Wrong, and What to Do About It

Three failure modes account for most of the trouble I read about.

The first is the delayed verification, and it lands hardest in the withdrawal section. The Commission's Contact Centre receives around 2,000 complaints a year about withdrawal delays, and even after years of work the Commission's own annual report for 2024-25 says withdrawal issues continue to be the cause of most of the complaints it receives. That is a regulated market with a complaints process. Offshore, with no ADR provider obliged to take the case and no regulator to write to, a held balance has nowhere obvious to go.

The second is the operator simply disappearing. British licensing gives a player two anchors even in insolvency: funds must be held in a separate client account, and the operator must publish an insolvency rating, warning customers once every six months if the rating is "not protected". Offshore, the client-money promise may exist in the standards but the enforcement of it depends on a regulator in a small jurisdiction with a finite budget. And there is a real, current example of what a jurisdiction's reputation is worth versus its paperwork: on 6 October 2026 the Kahnawà:ke Gaming Commission announced that a Client Provider Authorization had been suspended with effect from 29 September 2026 following a show cause notice. Licences do get pulled off sites mid-flight, and players find out from the register, not the site.

The third is the uncomfortable one. The Commission issued an industry warning notice on 20 January 2025 about casino games from licensed operators appearing on unlicensed websites available to GB consumers, noting that such sites often target customers who have self-excluded via GamStop and may have inadequate social responsibility and anti-money-laundering controls. That is worth reading twice. The regulator's own view is that the offshore market's marketing leans on excluded players — which is exactly the group for whom a British licence means the least and a foreign one means nothing at all. The honest response to that is not to say the sites are all crooks, because they are not. It is to say that GamStop holds for its full term and then stays in place until the person contacts GamStop to remove it, that the scheme cannot touch operators outside the British licensing system, and that a person in the middle of a five-year exclusion has no more leverage over an offshore account than over a cash bet in a different country.

If the trouble is with gambling itself rather than with a withdrawal, the help bodies are free and the list is short. The National Gambling Helpline is operated by GamCare on 0808 8020 133, 24 hours a day, every day of the year, and the same number reaches it by live chat and WhatsApp; callers in Wales are given 0808 2819 265. GambleAware is the public-facing brand of the charity GambleAware and directs people to the same number. GamFam, a registered charity set up by people affected by the gambling of family members and friends, runs a five-stage peer-support programme. Gamblers Anonymous England, Wales and Ulster can be reached on 0330 094 0322. Citizens Advice offers free, confidential advice including on debt, and Citizens Advice Scotland runs a gambling support service advice line on 0800 328 1131. Treatment in England is commissioned by NHS England and funded by the statutory gambling levy, which raised just under £120 million in its first year and is ringfenced solely for research, prevention and treatment. None of that costs anything, and none of it requires a licensed operator's permission.

Frequently Asked Questions

Are casino sites not on GamStop legal?

They are illegal to offer to British consumers if they hold no Gambling Commission licence, because section 33 of the Gambling Act 2005 makes it an offence to provide gambling facilities without one. The Commission has stated plainly that this includes operators licensed elsewhere. Playing on such a site is not the offence the Act targets, but the balance held there has no British protection behind it.

Can a UK casino site be not on GamStop?

No. Since 31 March 2020 every operator holding a Gambling Commission licence must take part in the national multi-operator self-exclusion scheme, a duty in social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice. A licensed British casino cannot opt out. If a site has no GamStop integration, that is information about its licence, not its policy.

Why do British players look for these sites?

Usually because a GamStop exclusion is in force and the British market is closed to them — a route the Commission's own January 2025 warning notice says unlicensed sites actively cultivate. Sometimes simply because the bonuses are larger, which they often are, since offshore marketing is not bound by the British rules on wagering levels and promotional structure.

How can I check a licence seal before depositing?

Click it. A Curaçao Certificate of Operation Seal must redirect to the authority's certificate site, and only B2C operators get one, only for an approved and registered domain; a certificate naming a different domain means the site is displaying another operator's paperwork. Anjouan certificates carry a licence number and a QR code, and the authority says a certificate that cannot be verified through its register should not be relied upon.

What protection does an offshore account actually have?

Contractual protection, and whatever the licensing regime imposes on the operator — which is not the same as protection of the balance. Anjouan's published standards require segregated player funds, certified random number generators, and anti-money-laundering and age-verification controls. There is no British-style insolvency rating and no regulator standing behind the money if the company fails. The dispute route exists but is private.

Is a pay-by-phone or PayPal casino without GamStop different?

The payment method changes nothing about the licence. British-licensed operators must accept payment only through a provider within the Payment Services Regulations 2017, and phone billing and e-wallet methods both fall under that. Offshore, the payment rail is just a rail: the operator's licence, or lack of it, decides what happens when a withdrawal is requested and the balance is disputed.

The Balance Is Only as Safe as the Licence Behind It

On this subject the market offers a great many seals and very few guarantees, and the gap between a British licence and an offshore one is not a matter of degree but of who can be made to answer — so the sensible position is to treat the licence as the product, decide how much money that licence is worth holding, and keep an eye on the things that can be checked rather than the things that are merely claimed.

The Gambling Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, 4 per cent more than in September 2025 — and 311 of them had disruption action taken against them in the second quarter of 2026 to 2027, 38 per cent more than the previous quarter.