Gambling Sites UK License and Protection

A gambling site licensed in Great Britain is regulated by the Gambling Commission, must be part of the GamStop self-exclusion scheme, must hold your money in a separate client account and cannot set a maximum limit on what you withdraw. An offshore site holds no such licence, so none of that applies.

The UK gambling market is not a small pond. Gross gambling yield for Great Britain was £17.5 billion in the year to March 2026, up 4.4% on the year before, and the remote casino, betting and bingo sectors accounted for £8.3 billion of it. Somewhere in that number sits whatever anyone reading this might recognise. But a market that size is the point: where there is that much money, there is a queue of operators who would rather not buy a licence, and a queue of affiliates paid to describe them warmly.

The argument on uk gambling sites for years has been about speed, bonuses and choice. I have always thought the more useful question is what stands behind the balance when the relationship goes wrong. A licence is dull, bureaucratic and enormously valuable: it is the thing that means someone can suspend an operator, order it to hand money back and make it answer for the small print. Take the licence away and nothing remains but a server in another jurisdiction and a support chat that has stopped replying.

The scheme's own name is often typed "gamestop", which is a fact about the spelling rather than the scheme. What follows is the standard a British licence sets, how offshore operators compare with it, and where the gaps in your own protection actually lie.

Offshore sites that accept UK players are not licensed in Great Britain. UK protections do not apply to them. They are not connected to GamStop, and they are not a way round it: a GamStop exclusion holds for its full term and then stays in place until the person asks GamStop to remove it. If gambling is causing harm, the National Gambling Helpline is 0808 8020 133, free and open 24 hours a day. The National Gambling Helpline is not a crisis line; callers at immediate risk should use NHS 111 or emergency services.

The Benchmark a British Licence Sets

For a checkable standard, take the one thing players complain about most: getting money out.

The Gambling Commission's own figures cover June to September 2024, when customers of large online operators made 44.2 million withdrawals. Of those, 96.3% cleared automatically, 3.5% cleared within 24 hours and 0.1% took up to 48 hours. That is the British baseline, and it comes from the regulator rather than an operator's marketing page.

Note what it does not say. There is no fixed maximum number of days in the Licence Conditions and Codes of Practice within which an operator must complete a withdrawal. The regime leans on three things: the fair and open terms condition, the identity-verification condition, and the general prohibition on unfair terms. Speed is a by-product of those, not a promised number.

The complaint data behind the benchmark is less flattering. Problems with withdrawals were the number-one subject of consumer calls to the Commission's Contact Centre, and by July 2024 the regulator said it was still receiving around 2,000 complaints a year about withdrawal delays. Its Annual Report and Accounts 2024-25 repeats that withdrawals remain the cause of most complaints it receives. Complaints coded "Withdrawals and/or financial transactions" did fall from 2,416 in the year to December 2022 to 1,791 in the year to December 2025, which is progress of a slow, grinding kind.

Consumer research published in July 2026 found that 49% of people who had gambled in the past 12 months agreed it was quick and easy to withdraw and collect winnings, 33% were neutral and 18% disagreed. Roughly half happy, one in five unhappy: that is what the British standard feels like in practice.

UK-Licensed and Offshore, Side by Side

Here is the comparison that matters, run by criterion rather than by brand. Every value below is a published figure, and each one appears again in the text.

The wagering row is the one that surprises people. The Commission capped wagering requirements on bonus funds at ten times from 19 January 2026, and said plainly why: the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". Offshore terms sit in the 25× to 50× region for welcome offers, with published terms elsewhere showing a 25× playthrough requirement and a wagering contribution chart where slots count 100%, table games 20% and live dealer games 0%. A multiplier is not a bonus size. It is a distance, and the distance is usually longer than the headline suggests.

Delay is built in by design in some of these terms rather than by accident. A term limiting a customer to one withdrawal at a time, with no further request until the first is authorised, was found unfair under the Consumer Rights Act 2015 in an October 2026 settlement. The same case involved manual review of every fifth or tenth withdrawal for some customers, which is a queue dressed up as diligence.

What the Licence Actually Covers

The point that most articles bury is that the licence's protections are conditional on where the operator sits, not on how polished the site looks.

A Gambling Commission licence is required for anyone offering commercial gambling services to consumers in Great Britain, and the Commission states that this includes operators who hold a licence in another jurisdiction. Providing facilities for gambling without an operating licence is an offence under section 33 of the Gambling Act 2005, punishable on summary conviction by up to 51 weeks' imprisonment, a fine at level 5, or both. The offence attaches to the provider, not to the customer. That is worth stating precisely, because a good deal of misleading copy implies otherwise.

What flows from the licence is a list of dull, load-bearing obligations. Since 31 March 2020 every online operator must be part of GAMSTOP as a licence condition, sitting in social responsibility code provision 3.5.5. Since April 2020 operators must check their entire customer base for GamStop registration at least every 24 hours, which also stops registered people receiving direct marketing. Deposits by credit card have been banned since 14 April 2020, and that ban reaches the e-wallet case too: where an operator accepts payment from an e-wallet, the money must not have been loaded from a credit card.

Then there is the money itself. Customer funds must be kept in a separate client account, distinct from the operator's business accounts, and an operator must choose one of three insolvency ratings — "not protected", "medium protection" or "high protection" — state which applies in its terms, and, if it is "not protected", remind the customer every six months that the funds are not protected, giving the value held. A separate client account is not a guarantee of return; operators are permitted to hold customer money in overseas bank accounts. This is the part of the UK regime where the words are strongest and the certainty is weakest, and I would rather say so than pretend otherwise.

Two consumer-law rules matter just as much. LCCP condition 17.1.1 says a withdrawal request must not trigger a demand for information the operator could reasonably have requested earlier, and CMA undertakings that the Commission treats as applying to all online operators forbid maximum withdrawal limits, confiscation of funds for failure to supply identity documents, and confiscation after inactivity. A prohibited term, in the regulator's own example, reads "You may withdraw up to £50 per day and up to £500 per week".

None of this travels with a domain name. It travels with the licence.

Gambling Sites UK Identity Verification

If a single mechanism decides whether money moves, it is verification, and the first time is a different experience from every time after.

The first time, the standard is British and it is early. Licence condition 17 requires an operator to obtain and verify information establishing identity before the customer is permitted to gamble, and the information must include name, address and date of birth. Practically, operators match an account against databases such as credit reference agencies and the electoral roll, in which case no documents are needed at all; where that fails, passports, driving licences and household bills are the usual requests. The Commission's own line is that it cannot give a timescale because the process varies: electronic verification may be instant, documents take longer. There is a separate layer under the money-laundering rules — identification and verification for a remote casino are triggered when a customer deposits or withdraws €2,000 or more, and the €2,000 applies to linked transactions too, not just one payment.

Later, the ordinary case should be frictionless. The Commission accepts an approach it calls the hybrid one, where identity and age are checked at registration and full verification waits for the €2,000 threshold, and under condition 17.1.1 an operator cannot sit on documents it could reasonably have asked for at the start and then produce the demand at the moment of withdrawal. Where an operator asked for nothing until a withdrawal was attempted, it may be in breach of the condition and exposed to regulatory action.

The warning signs are recognisable. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and the Commission has said it is concerned about operators using "fuzzy matching" through third-party providers and onboarding customers on partial or equivocal verification. Onboarding someone under a middle name rather than a forename creates mismatches with records held elsewhere — including GamStop records, which quietly undermines the point of self-exclusion.

Abroad, the chronology inverts. Offshore terms often defer verification, which reads as generosity until the winning ticket arrives, at which point source-of-funds documents are requested, a maximum cashout clause appears and the account is reviewed manually. A 2026 Commission risk assessment reports an increase in false documents, deepfake videos and AI-generated face swaps used to bypass customer due diligence. If nobody is checking properly on the way in, nobody is checkable on the way out either.

Five Signs an Operator Can Be Trusted

Each of these is checkable in a few minutes, without depositing anything.

The licence is verifiable at the source

A British licence can be confirmed on the Commission's public register, and the register shows whether the site's activities and domain names match what is claimed. For Curaçao, a Certificate of Operation Seal must redirect to cert.cga.cw; if the seal differs in design, colour or format, the site is not authorised by the CGA, and if the certificate behind the seal names a different domain from the one being visited, it belongs to someone else and the site should be treated as unauthorised or fraudulent. A legacy /JAZ number or an old orange certificate proves nothing: the legacy sub-licence certificates ended on 15 October 2025. Anjouan issues certificates with a unique licence number and a QR code linking to a public register, and its own guidance says a certificate that cannot be verified there should not be relied upon.

The terms disclose what happens to your money if the company fails

A UK-licensed operator must state its customer-funds insolvency rating — "not protected", "medium protection" or "high protection" — in writing, and the customer must acknowledge receipt before using funds for gambling. The word to look for is "protected", and the honest answer for many firms is that it is not. Money staked in an open bet is not customer funds at all and is not covered by any protection arrangement.

The withdrawal terms contain no ceiling

Search the terms for a maximum withdrawal figure, a one-withdrawal-at-a-time rule, or a manually reviewed withdrawal interval. In the UK market, a cap on withdrawing from the deposit balance is prohibited, and a one-withdrawal-at-a-time term was found unfair under the Consumer Rights Act 2015 in an October 2026 regulatory settlement involving a £900,000 payment. Offshore, a bonus cashout cap expressed as a percentage of the bonus — 300% is a published example — is an ordinary clause.

Bonuses are stated as multipliers with the game weightings given

An honest bonus page states the playthrough multiple and which games contribute how much, because the multiplier is meaningless without them. UK rules cap wagering on bonus funds at ten times and ban incentives that mix product types, so that "bet £5 and get £20 of free spins" is a non-compliant offer in Britain but an ordinary one offshore. A no-deposit bonus with a €50 to €100 cashout cap and a 40× to 60× multiple is not a gift; it is a lottery ticket with a strict upper bound.

There is a named free dispute route

British-licensed operators must let a customer refer an unresolved dispute to an approved ADR provider free of charge after eight weeks, and the Commission's approved list includes IBAS and eCOGRA alongside ADR Group, CEDR, ProMediate, Pegasus ADR Service, Blexr and the Tattersalls Committee. IBAS records 100% operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. eCOGRA's report for October 2024 to September 2025 records 150 valid "Deposits & Withdrawals" disputes and an average 31 days to resolve domestic cases, with 17.8% ruled for the consumer. Those numbers are modest for the consumer, and that is precisely the point: a forum exists, it publishes its outcome rate and the operator complies. A site with no forum beyond its own support inbox has replaced the process with a polite shrug.

How to Check a Site Before Depositing

1. Verify the licence on the regulator's register, and check the domain matches. The Commission advises clicking through to the public register to see whether the site's activities and domain names are covered. One minute spent here settles the question that every other check depends on.
2. Confirm the operator participates in GamStop. Participation is a licence condition under social responsibility code 3.5.5, so a UK-licensed site that will not confirm its participation is telling you something. Registrations take a few minutes to make and up to 24 hours to become effective.
3. Read the customer-funds section of the terms. Find the insolvency rating and the acknowledgements required on first deposit. If the answer is "not protected", treat the balance as unsecured credit extended to a company you cannot audit.
4. Read the withdrawal terms and the bonus terms separately. Look for a maximum withdrawal figure, a processing fee, a review interval, or a maximum bet while wagering — published examples include 20% of the deposited amount and a flat €5 cap. A rejected bet above the limit can mean forfeited winnings.
5. Run a small withdrawal before trusting the account with more. Given that 96.3% of withdrawals at large operators clear automatically, a first withdrawal that stalls for days is information, not bad luck. The Commission's view is that where there are no regulatory concerns there is no valid reason to delay a payout.
6. Add a bank-level block and keep the complaints route. Eleven banks offer gambling blocks on the Commission's list, including Barclays, HSBC, Lloyds, Monzo, NatWest, Santander and Starling, applied at card level and reversible only after a 48- or 72-hour cooling-off period. If a dispute does arise, the operator must allow ADR referral after eight weeks, and the Commission confirms it is a regulator rather than an ombudsman, so it will not get money back for an individual.

Gambling Sites Not on GamStop

The cluster of searches around gambling sites not on GamStop uk deserves a direct answer rather than a wink.

GamStop is the national online self-exclusion scheme, run by The National Online Self Exclusion Scheme Limited, and it has been available to consumers since April 2018. It is free to use, signing up takes a few minutes and the block can take up to 24 hours to bite. The periods offered are six months, one year, five years, or five years with auto-renewal. A registration cannot be cancelled during the exclusion period, and it stays in place after the chosen term ends unless the person contacts GamStop to remove it. Under the terms current as of 20 May 2026, auto-renewal can only be switched off during the last six months of a five-year term, and auto-renewal can run for up to four further five-year periods. If nothing is done, GamStop holds the data through an additional automatic seven-year self-exclusion period during which operators are told the person was previously excluded.

The scale is not anecdotal. GamStop recorded 117,756 new registrations during 2025 and had 561,983 active exclusions at 31 December 2025, of which 58,675 came in the final six months — an average of 319 a day. Registrations rose 16% year on year in the first half of 2026, with May 2026 setting a monthly record of 12,236 sign-ups. As of July 2026, 614,738 consumers were on the register, and more than one in two had chosen the maximum five-year term; across all age groups only one in four had chosen six months. Under-25s accounted for nearly one in three of all self-exclusions in the first half of 2026. Of the periods chosen in 2025, 29% picked six months, 24% a year, 25% five years and 22% auto-renewal. The gender split in 2025 was 94.3% male and 5.7% female.

Which brings us to the offshore market. Sites operating without a Commission licence are not connected to GamStop, and the scheme's own terms say it cannot prevent access to gambling services run by organisations that do not participate. The Commission issued an industry warning notice on 20 January 2025 about games from licensed operators appearing on unlicensed sites available to GB consumers, noting that such sites often target people who have self-excluded via GamStop. There is no version of this story in which the offshore site is protecting anyone. Self-exclusion holds for its full term and then until the person asks GamStop to remove it; a site outside the scheme does not shorten that, it simply ignores it.

The illegal market is a real business, not a fringe. The Commission estimated in November 2026 that 2.5% of people who had gambled online in the previous four weeks had engaged with illegal gambling websites, with a further 1.5% in the past 12 months. Its dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, and it took disruption action against 311 in the quarter, with 77% of disrupted sites showing a reduction in estimated traffic. Since April 2024 its Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Bing and Google URLs and secured 287,961 URL removals. Across 160 illegal sites with traffic data, engagement fell by an average of 32%.

The enforcement picture is uneven by method. Registrar blocks and website suspensions produced the largest average fall in engagement at 91% each, ahead of GEO IP blocking at 60%, Bing removal at 52%, Google removal at 30% and Facebook removal at 8%. The Commission itself notes that search-engine removal makes a site harder to find without fully blocking access. In April to June 2026 it referred 366 websites and began zero criminal investigations; in July to September 2026 it referred 1,835 websites and issued 546 cease and desist notices. Across April 2025 to March 2026, every quarter recorded zero or one prosecutions commenced.

What none of that changes is the arithmetic on the player's side.

What Protects a Balance, and What Does Not

A British licence is not a promise about a website's character. It is a set of hooks: someone can be fined, a term can be struck out, a payment can be chased, a dispute can be heard. Fine-tuned enforcement is patchy — the Commission's own quarterly figures show heavy referral volume and almost no prosecutions — but theulary exists, and thatulary is what a player needs when something goes wrong.

Offshore, theulary changes. A Curaçao licence is a real licence with real fees — EUR 4,592 to apply, EUR 47,450 a year for a B2C operation — and real obligations, including segregating player funds and certified random number generators. It is also a jurisdiction whose regulator announced in October 2026 that its verification portal would not return and that it was working on an alternative way to confirm licensed domains. Anjouan licenses sit at USD-equivalent EUR 17,828 for issue and the same for renewal, and the regulator states that no licence can exempt an operator from local law where local authorisation is required. That is a sentence that reads rather differently once the reader has established that Great Britain does require local authorisation.

Then there are the sites that hold no licence worth the name. Costa Rica operates no comprehensive gambling licensing regime, and the so-called data processing licence is not a licence in the strict legal sense; a bill that would have created a mandatory regime was rejected in early 2026. A site registered there is not lightly regulated. It is unregulated, with a flag on the homepage.

Three things genuinely protect a balance in Britain, and none of them is a welcome offer. The licence, because it carries conditions with teeth. The terms, because unfair ones can be struck down and the operator must reveal its insolvency rating. And the dispute route, because it is free, named and publishes its own numbers. Offshore, the equivalent list is a licence you must verify yourself, terms that routinely build in delay and caps, and a dispute forum that may or may not exist in a language you read.

For anyone who needs help rather than a comparison, the National Gambling Helpline is 0808 8020 133, run by GamCare, free and open 24 hours a day, every day of the year, also reachable by live chat and WhatsApp. Callers in Wales have a separate number, 0808 2819 265. Gamblers Anonymous England, Wales and Ulster can be reached on 0330 094 0322 and runs around 250 meeting locations with no appointment needed. Citizens Advice Scotland's gambling support line is 0800 328 1131, open Monday to Friday, 10am to 3pm. The NHS National Gambling Clinic in London takes self-referrals and professional referrals on 020 7381 7722. Blocking software adds a layer that a licence cannot: Gamban blocks licensed and unlicensed sites and is free for residents of Wales, while in England and Scotland it costs £4.99 a month or £29.99 a year after a seven-day trial, following the end of TalkBanStop funding on 31 March 2026. BetBlocker is free worldwide, states it blocks over 1,368,000 gambling websites and 3,100 apps, and needs no registration.

None of this is a substitute for a licence, and none of it is meant to be. It is the layer for the case where the licence is absent.

Frequently Asked Questions

How many online gambling sites are there in the UK?

The Commission has never published a total count of licensed gambling websites, and the Group behind GamStop has said it can no longer report a lifetime registration figure because the seven-year retention period from the scheme's 2018 launch has begun to expire. What is measurable is the other direction: the Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, 4% more than September 2025.

What gambling sites accept credit cards in the UK?

None that hold a Commission licence. The use of credit cards for gambling was banned with effect from 14 April 2020 under licence condition 6.1.2, covering online betting, casino and bingo and lotteries accepting online or telephone payments. The ban reaches e-wallets too: where an operator takes payment from an e-wallet, it must ensure the money was not loaded from a credit card. Non-remote lottery tickets bought in a shop are the exception.

Are there legitimate gambling sites outside the UK?

Legitimate in their own jurisdiction, yes: Curaçao issues direct licences through its Gaming Authority, Anjouan issues B2C and B2B internet gaming licences, Kahnawake licenses operators through Client Provider Authorizations, and Malta's MGA licenses B2C services. Legitimacy abroad is not permission here. The Commission is explicit that offering commercial gambling services to consumers in Great Britain without a Commission licence is illegal, including where the operator holds a licence elsewhere.

How do I check whether a gambling site is safe?

Start at the Commission's public register and confirm the licence covers the domain and activities claimed. Then check participation in GamStop, the customer-funds insolvency rating in the terms, and the withdrawal and bonus clauses. For a Curaçao seal, click it — it must redirect to cert.cga.cw — and confirm the certificate names the same domain you are visiting. A certificate showing another operator's domain means the site is unauthorised.

How can I block non-UK gambling sites?

Use both layers. A bank gambling block declines payments to merchants categorised under gambling Merchant Category Codes and covers online casinos, betting sites, gaming apps and physical venues, applied at card level on each card, with most banks applying a 48- or 72-hour cooling-off period before gambling transactions are allowed again. Blocking software covers the browser and the app as well: BetBlocker states it blocks over 1,368,000 gambling websites and 3,100 apps.

What is the best-payout gambling site in the UK?

There is no published ranking, and any list presented as one is a commercial artefact rather than a measurement. The checkable number is speed, not size: 96.3% of 44.2 million withdrawals at large operators cleared automatically in June to September 2024, and 3.5% cleared within 24 hours. A site with a stated maximum withdrawal cap is not a high-payout site at all — in the UK that term is prohibited.

Gambling Sites UK Free Spins Terms

The multiple, the game weightings and the cap, stated together. UK rules since 19 January 2026 cap wagering on bonus funds at ten times and ban mixed-product incentives, so "bet £5 to get 20 free spins" is non-compliant here while it is ordinary offshore, where welcome-bonus multipliers typically run at 25× to 50× and no-deposit offers at 40× to 60× with a €50 to €100 cashout cap. A free spin offer without weightings is not fully disclosed.

Why was my withdrawal delayed for verification?

Usually because the operator asked for documents at the wrong moment. Condition 17.1.1 says a withdrawal request must not trigger a demand for information the operator could reasonably have requested earlier, though a separate anti-money-laundering duty can still justify a request at the time. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and the Commission's view is that absent regulatory concerns there is no valid reason to delay a payout.

The Short Version

An offshore site is not a version of a British one; it is a different product with the protection removed, and the only reason its terms look generous is that nobody with the power to strike them out is watching. The Commission's figures put 96.3% of 44.2 million withdrawals at large operators clearing automatically during June to September 2024 — a number that exists because the terms behind it can be challenged. In the same period, the regulator said it was still receiving around 2,000 complaints a year about withdrawal delays, so the standard is imperfect and proven in public. That, rather than the size of a welcome bonus, is what a uk gambling site is selling.