Gambling Websites UK and the Licensed Market

Gambling websites in the UK split into two groups. Those holding a Gambling Commission licence must obey British rules on identity checks, bonuses and payouts; those licensed elsewhere need not, and cannot be made to. The Commission's own register is the only check worth making, and it takes a minute.

Gambling websites in the UK hide a fork in the road, where the choice is between two regimes that look identical from a browser tab and behave nothing alike when a withdrawal is stuck. One regime has a regulator that publishes its enforcement, a self-exclusion scheme wired into every licence, a statutory levy paying for treatment, and a rulebook that now caps wagering requirements at ten times the bonus. The other has a certificate on the footer, an address in a small jurisdiction, and terms written to be read after the event rather than before it.

I have spent years reading both sets of paperwork. The British ones are duller and better. That is the whole comparison in one line, and the rest of this page is the working.

My angle here is the one the evidence supports: British rules are stricter, slower to bend and much easier to check. Offshore sites are not a clever way round the system; they are a different system, with fewer promises and, crucially, nobody in Great Britain obliged to enforce them. What follows is the market as it is — the numbers, the traps, the terms that build in delay — and the handful of checks that separate a serious operation from a shopfront.

What the British Rulebook Actually Requires

Strictly, British licensing is not mainly about gambling. It is about paperwork, and the paperwork has teeth. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and it is immaterial whether those facilities are provided wholly or partly by remote communication, or inside or outside the UK. On summary conviction the penalty runs to 51 weeks' imprisonment, a fine at level 5, or both. That is the offence that attaches to the operator, not to the adult who places a bet — a distinction worth holding on to, because it explains why the enforcement you read about is aimed at websites rather than punters.

The condition that matters most for the ordinary player is Social Responsibility Code Provision 3.5.5, which says licensees must participate in the national multi-operator self-exclusion scheme. Since 31 March 2020 that has been compulsory for every online operator, and from April 2020 they have had to check their entire customer base against the register at least every 24 hours. When two operators failed to integrate on time in April 2020, the Commission suspended their licences the same week. Since April 2024 its Illegal Markets team has issued 3,140 cease and desist and disruption notices and secured 287,961 URL removals; across 160 illegal gambling websites, engagement fell by an average of 32 per cent after disruption.

Then there is the money. The statutory levy began on 6 April 2025 and charges online operators 1.1 per cent of previous-year gross gambling yield; in its first year it raised just under £120 million, ringfenced for research, prevention and treatment, split 50 per cent to treatment, 30 per cent to prevention and 20 per cent to research. Offshore sites pay none of it. That single line is, to my mind, the cleanest way to describe the difference between a British-licensed site and an offshore one: one of them is quietly funding the NHS clinics, and the other is not.

GamStop and the exclusion that does not lapse

Gamstop Online is the UK's national online self-exclusion scheme, run by The National Online Self Exclusion Scheme Limited, free to users, live since 27 April 2018 and renamed Gamstop Online in November 2025. It is often typed "gamestop", which is a slip the word "game" invites; the scheme is GamStop, and its register is what the operators check.

The register works on a simple premise with a stubborn tail. A person chooses 6 months, 1 year, 5 years, or 5 years with auto-renewal. Signing up takes a few minutes; the block can take up to 24 hours to become effective. Once registered, the exclusion cannot be cancelled or deactivated during the term — and here is the part people misremember — it stays in place after the chosen period ends unless the person contacts GamStop to have it removed. The terms of use, last updated 20 May 2026, allow auto-renewal to be switched off only during the last six months of a five-year minimum exclusion period, and provide that if someone does not deactivate, GamStop holds the data through a further automatic seven-year self-exclusion period during which operators are told the person was previously excluded. The Group's 2025 annual report devotes a whole section to its refusal to remove registrations early. It means what it says.

Offshore sites that hold no Commission licence are not connected to that register, since the obligation attaches only to British-licensed operators. That fact gets sold, in places, as freedom. It is not freedom; it is an unlocked door in a building with no fire exits. Self-exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it — and no offshore site changes that, because no offshore site is part of it.

What the licence does for the customer

The British rules reach into areas an offshore operator will simply not touch. Financial vulnerability checks became a licensing requirement in August 2024 at £500 net deposits over a rolling 30 days, lowered to £150 from 28 February 2025, and may use only publicly available risk-flag information such as a bankruptcy order, a County Court Judgment, an Individual Voluntary Arrangement, a High Court Judgment, an Administrative Order or a Debt Relief Order. Since 31 October 2025 every gambling business must prompt customers to set a financial limit before their first deposit and remind them to review their account information every six months. Online slots stakes are capped at £5 per game cycle for adults and £2 for those aged 18 to 24, and at least 2.5 seconds must elapse between game cycles.

Since 19 January 2026, wagering requirements on bonus funds are capped at ten times, and mixed-product promotions requiring two or more types of gambling are banned. The Commission's own reasoning is worth quoting for its bluntness: the cap "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". Reverse withdrawals were banned outright on 31 October 2021 — consumers must not be given the option to cancel a withdrawal request — and credit cards were barred from gambling on 14 April 2020.

None of this is available offshore. Not the caps, not the limits, not the prompts, and not the 24-hourly register check that stops a self-excluded person being marketed to by their own casino.

How the Licence Changes the Money

The most useful comparison on this page is not the welcome offer. It is what happens when a player asks for their own money back, because that is where the two regimes diverge in public.

The Commission's own data, covering June to September 2024, records 44.2 million withdrawals by customers of large online operators. Of those, 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours and 0.1 per cent took up to 48 hours. Earlier data from some of the largest firms showed around 99 per cent of withdrawal requests approved, processed and fulfilled within 24 to 48 hours. That is the standard. It is not perfection, and the complaints say so: by July 2024 the Commission still received around 2,000 complaints a year about withdrawal delays, the number one subject of complaints to its Contact Centre. Complaints coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025. Its Annual Report for 2024-25 concedes that withdrawal issues continue to cause most of the complaints it receives.

The Commission has been unusually direct about the trick itself. It states that it is not acceptable for operators to introduce friction when a customer tries to withdraw rather than when they deposit, and that it does not consider it fair, transparent or necessary to delay or prevent withdrawals purely for customer-interaction purposes. Where an operator has no regulatory concerns about a customer, it says there is no valid reason to delay the payout.

The terms that build in delay

Offshore terms rarely say "we will slow you down". They say something else, and the delay is the by-product.

A term allowing only one withdrawal request at a time, with no further request until the first is authorised, is a delay in a sentence. It was found unfair under the Consumer Rights Act 2015, and in October 2026 an operator agreed a £900,000 regulatory settlement with the Commission that included unnecessarily delaying consumer withdrawals. Higher up the scale sits the maximum cashout clause: one offshore casino reserves the right to limit the amount withdrawable from winnings generated with bonus funds to 300 per cent of the credited bonus amount, with any excess voided. No British-licensed operator may impose a maximum limit on what a consumer may withdraw from their deposit balance; the Commission's example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week".

Then the identity request, saved for the moment of withdrawal. Licence Condition 17.1.1 requires that a withdrawal request must not result in a demand for additional information if the licensee could reasonably have requested it earlier. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and a 2026 Commission blog noted it is among the most common dispute types referred to alternative dispute resolution providers.

Payments and how long money actually takes

The payment method is a second, quieter source of delay, and it behaves the same on both sides of the licence line. A crypto withdrawal is not instant because the chain is not instant.

Two lines in that table deserve a sentence each. Bitcoin's six-confirmation default is not sacred: it assumes an attacker with under 10 per cent of network hashrate and accepts a residual double-spend risk below 0.1 per cent, and where the loss would be negligible a payment can be accepted the moment it is seen. And a Faster Payments limit applies per transaction, not per day, so a large sum is simply sent in pieces — which is exactly why a bank's own per-payment limit, not the scheme ceiling, is what a player actually meets.

Where the complaint goes

A British-licensed operator must have arrangements for a customer to refer any dispute to an approved alternative dispute resolution entity, free of charge, if it is not resolved within eight weeks of receipt. The Commission's list of approved providers includes ADR Group, Pegasus ADR Service, a provider, the Centre for Effective Dispute Resolution, eCOGRA, IBAS, ProMediate and the Tattersalls Committee. IBAS and eCOGRA have historically handled most gambling disputes.

The numbers show both the workload and the odds. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, of which "Deposits & Withdrawals" accounted for 150 valid disputes, an average 31 days to resolve domestic disputes, and 17.8 per cent of completed disputes ruled in favour of the consumer. IBAS's 2024-25 report records 3,721 domestic disputes, 217 of them categorised as banking or financial, an average completion time of 20 days, and 100 per cent operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25.

Now the sting. The Commission is a regulator, not an ombudsman: it cannot resolve an individual complaint or get anybody's money back. An offshore operator with no British licence sits outside all of it — no approved ADR provider, no enforcement, no eight-week clock, and no register check. Some offshore regulators do require a named ADR provider and a 30-day resolution window before escalation. That is better than nothing. It is also not a British licence.

The Check That Decides Everything

If a player does one thing before opening an account, it should be this. Go to the Commission's public register and look up the business named in the site's footer, then check whether the activities and the domain names on the licence match the site in front of you. The regulator advises exactly this, and it is the only test that distinguishes the two regimes. A licence from another jurisdiction is not a substitute: the Commission states plainly that it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence elsewhere.

The Curaçao Licensing Regime

Curaçao's National Ordinance on Games of Chance took effect on 24 December 2024 and made the Curaçao Gaming Authority the direct licensing and supervisory authority, ending the master-licence and sub-licence model. The legacy "orange" sub-licence certificates ceased on 15 October 2025. Licensing ceased for the four former master licensors on 18 August 2024, 1 October 2024, 1 November 2024 and 31 January 2025 respectively. A historic /JAZ number or legacy seal must not be treated as proof that an operator currently holds a valid licence — a point made by the authority itself, not by a critic.

The current regime is not cheap, which is the honest counter-argument to dismissiveness: a B2C application costs a one-time, non-refundable EUR 4,592, and the total annual B2C fee is EUR 47,450, comprising a EUR 24,490 licence fee to the National Treasury and a EUR 22,960 supervisory fee. Two seals exist: a Certificate of Operation Seal, issued only to B2C operators and only for an approved, registered player-facing domain, and a License Certificate Seal, which is not domain-specific. Clicking the Certificate of Operation Seal must redirect to the authority's certificate page, and if the certificate behind the seal shows a different domain from the one being visited, the site is displaying another operator's certificate and should be treated as unauthorised or fraudulent. A third-party reading of the register in November 2026 counted 704 Curaçao licences held by 698 operators, of which 552 were active [unconfirmed].

The Anjouan Licensing Dispute

Anjouan's framework rests on legislation adopted in 2005, and its published fees are strikingly low: EUR 17,828 for B2C licence issuance, one-time, and the same for annual renewal, with EUR 500 per additional domain or URL. For roughly the annual cost of a single mid-range car, an operator can hold a licence from a jurisdiction that states its licences carry no territorial restrictions under Anjouan law, while also stating that holders must comply with all applicable laws in the jurisdictions where they operate. Anjouan Gaming said in June 2026 that a licence "is not, and has never been presented as, a universal authorisation to operate in every country in the world". The regulator is right, and it is worth reading that sentence twice: the certificate in the footer is not a permission to be here.

The jurisdiction's standing is contested. An ABC News investigation published on 31 December 2025 reported that Anjouan Licensing Services claims to have issued more than 1,300 gambling licences at around EUR 17,000 a year, and that Comoros financial intelligence officials described Anjouan Corporate Services as operating illegally; it also reported a former attorney-general of the Comoros calling the licensing arm "an illegal entity" and stating that the offshore financial authority was stripped of recognised regulator status by Comorian banking laws passed in 2013 and 2015. The licensee's own statement that an independent legal opinion of 19 September 2024 reconfirmed the authority's lawfulness is, unsurprisingly, the licensee's own statement [unconfirmed]. Anjouan does require segregated player funds, certified random number generators, AML and age verification, and an approved ADR provider — EGIS ADR, Axion ADR, iGaming ADR or another provider — with complaints expected to be resolved within 30 days before escalation.

The Kahnawà:ke Licensing Model

The Kahnawà:ke Gaming Commission was established in 1996 and enacted its interactive gaming regulations on 8 July 1999. Operators licensed by it must be hosted at a data centre in the Mohawk Territory, and the commission issues an Interactive Gaming Licence held by only one entity at a time — held by the same operator since 1999 — plus Client Provider Authorizations with no limit on how many it may issue. Its Logo Certificate Program, effective 15 January 2010, lets a player click the commission's logo on a site to generate a Certificate of Good Standing. Fees are rising on 1 January 2027: the CPA application fee from USD 35,000 to USD 40,000, the five-year renewal from USD 5,000 to USD 40,000, and Key Person Permit application and renewal from USD 5,000 to USD 6,000, while the annual CPA fee stays at USD 20,000.

Its self-exclusion terms are the toughest in the market and worth knowing precisely: a player who breaches a self-exclusion prohibition forfeits any funds deposited or won, to a charity selected by the commission. Whatever else that is, it is not a route round a British exclusion.

Five Signs an Operator Can Be Trusted

Trust is not a feeling about a website's design. It is a set of facts that can be checked in a few minutes, and each of these five checks produces a yes or a no.

The register entry matches the trading name and the domain

The Commission's public register should show the business, the activities and the domain names, all consistent with the site in front of you. A footer carrying a licence number that resolves to a different company, or a certificate showing somebody else's domain, is the classic tell. The Curaçao authority says the same thing in its own certification policy: a certificate displaying a different domain belongs to another operator and should be considered unauthorised or fraudulent. Check the licence number, not the logo.

A UK-licensed operator says what happens to your money if it fails

Licence conditions 4.1.1 and 4.2.1 require customer funds to be held in a separate client bank account, and require the operator to state clearly in its terms which of the three insolvency ratings applies — "not protected", "medium protection" or "high protection" — with the customer acknowledging receipt of that disclosure before using funds. An operator rated "not protected" must remind the customer once every six months, stating the value of funds held. If the terms are silent on insolvency, the rating is effectively "not protected" and nobody has said so.

The bonus terms fit on one screen

Since 19 January 2026 a British-licensed operator may not apply wagering requirements above ten times, and may not mix product types within one incentive — "Bet £5 and get 20 free spins" is non-compliant, while "Bet £5 and get £10 free bet" is fine. Significant conditions must be provided transparently and prominently, and where displayed online, in full no further than one click away. If the conditions that decide whether winnings are payable are three clicks deep and written in the passive voice, the operator has told you something.

A withdrawal request does not generate a new document request

The withdrawal route should not be the first time identity is examined. Commission guidance states that players must be told they may withdraw their deposit balance at any time, including while a bonus is pending or active, and that no maximum limit may be imposed on withdrawals from the deposit balance. Where a business delays a withdrawal because of insufficient identification it may be in breach of Licence Condition 17 and exposed to regulatory action.

There is a named dispute route with time limits

A British licensee must offer referral to an approved ADR entity free of charge if a complaint is unresolved after eight weeks, and must respond fully to an ADR provider's information request within ten working days. Offshore, look for a named ADR provider in the terms with a stated resolution window — Anjouan, for instance, names its approved providers and expects complaints resolved within 30 days. A terms page with no dispute route is not a page missing a detail; it is a statement about who holds the leverage.

How to Check a Site Without Betting a Penny

1. Look up the licence on the Commission's public register

Go to the regulator's register and search the business name from the footer. Check that the licensed activities cover the products on offer — slots, live casino, betting — and that the domain name you are on appears on the licence. A licence that exists but does not name this domain belongs to somebody else's website.

2. Read the customer-funds disclosure before depositing

Find the insolvency rating in the terms and note whether it is "not protected", "medium protection" or "high protection". Read it before the first deposit, because the requirement is that you acknowledge it before using funds, and because money staked within an open bet is not customer funds at all and sits outside any protection arrangement.

3. Total the bonus conditions, including the maximum bet

Read the wagering requirement, the contribution chart, the maximum bet while wagering, the cashout ceiling and the time limit, and treat the smallest number as the real offer. A 25-times requirement with a maximum bet of 20 per cent of the deposit and a cashout cap is not a 25-times offer; it is a much worse one.

4. Check whether GamStop covers the operator

If the operator holds a British licence, participation in GamStop is compulsory under Social Responsibility Code Provision 3.5.5, and the operator must check its whole customer base against the register at least every 24 hours. If it does not hold a British licence, it is not in the scheme. Self-exclusion then holds for its full term and stays in place until the person contacts GamStop to remove it — but only where the operator is in the scheme to check it.

5. Note the dispute route and the time limits before you need them

Confirm the operator's internal complaints process, the eight-week point at which a British licensee must offer ADR, and the named ADR provider. Save the terms page. A dispute is much easier to run when the deadlines were written down beforehand rather than reconstructed afterwards.

6. Test the payment route with a small amount

Withdraw a modest sum early, using the method you intend to use, and time it. The Commission's data shows 96.3 per cent of withdrawals by customers of large online operators cleared automatically, so a first withdrawal that produces a document request is information, not bad luck. If the operator is British-licensed, that is also the point to record dates.

Questions I Get Asked About Gambling Websites UK

Are gambling websites UK players use always licensed here?

No, and that gap is the whole story. The Commission states it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence, including where the operator holds a licence elsewhere, and section 33 of the Gambling Act 2005 makes the offence punishable on summary conviction by up to 51 weeks' imprisonment, a level 5 fine, or both. Enforcement is aimed at operators, not at adult punters.

What does the licence add that an offshore site cannot offer?

Four things that matter: membership of GamStop, with 24-hourly register checks; the ten-times cap on wagering requirements in force since 19 January 2026; the ban on reverse withdrawals since 31 October 2021; and free access to an approved ADR provider after eight weeks. Offshore operators are outside all four. Their terms are legal where they are written, and irrelevant where you are reading them.

How long should a withdrawal take from a top gambling website?

The Commission's data for June to September 2024 records 44.2 million withdrawals by customers of large online operators, with 96.3 per cent clearing automatically, 3.5 per cent within 24 hours and 0.1 per cent taking up to 48 hours. Payment rails add their own lag: a Skrill or Neteller transfer to a bank costs 2.80 per cent with a minimum of EUR 3.50 or USD 3.50, from 12 January 2026.

Do the sustainability certifications some sites advertise mean anything?

They are not a British regulatory category. The Commission licenses operators, not badges, and what it publishes is a public register of businesses, licensed activities and domain names. A certification is a claim about a company's conduct, made by whoever sold the certificate. The register entry is a claim the regulator itself maintains, which is why the check takes a minute and the badge takes none.

What actually happens if a self-excluded person opens an offshore account?

The exclusion survives; the enforcement does not. A GamStop registration holds for its full term and then stays in place until the person contacts GamStop to remove it, and British-licensed operators must check the register at least every 24 hours. Offshore sites are not connected to it, so nothing flags the account. The Commission warned in January 2025 that unlicensed sites often target customers who have self-excluded, which tells you how the relationship is likely to go.

Is Bitcoin or an e-wallet quicker than a bank withdrawal?

Not reliably, and never free. Bitcoin's protocol targets a ten-minute average block, with a 63 per cent chance of a block within any ten minutes and 95 per cent within thirty, and most exchanges require six confirmations. A USDT transfer on TRON burns roughly 13 TRX without staked Energy. E-wallets charge for the onward transfer. Faster Payments is where the genuine speed sits: over 90 per cent of transactions complete in under two seconds.

Where the Evidence Leaves the British Rulebook

The rulebook wins on the things that are difficult to fake — a register anyone can read, an exclusion scheme wired into every licence, a levy of 1.1 per cent of online yield funding treatment rather than advertising, and a bonus cap that the regulator justified by naming the 60-times requirements it was removing. None of that makes every British-licensed operator admirable, and the complaints figures show it: withdrawal problems remain the single largest source of consumer complaint, and identity checks saved for the exit door are still being found in 2026.

But a comparison is not a claim of perfection; it is a claim about which side of the line a player can enforce. Offshore, the answer is usually nobody. In Great Britain the answer is a regulator that has issued 3,140 disruption notices since April 2024, an ADR provider that publishes 20- and 31-day resolution times, and a helpline on 0808 8020 133, free, 24 hours a day, that does not care which site caused the problem. Start with the register; if the name in the footer is not on it, everything below that line on the page is somebody's marketing.