Online gambling sites in the UK must hold a Gambling Commission licence to take bets from British customers. That licence brings self-exclusion through GamStop, withdrawal rules, fair-term standards and an independent adjudicator for disputes. Offshore sites hold foreign licences instead, sit outside all of it, and leave complaints to a regulator in another jurisdiction that will not get anyone's money back.
The question I am asked most often is not which site pays fastest. It is who settles an argument. That is the right question, because everything else on this page — the licence, the withdrawal clock, the bonus terms — only matters at the moment a site and a customer disagree. British-licensed online gambling sites sit inside a system where someone else decides. Offshore sites sit outside it. I have covered this trade long enough to know that most of the shouting about unlicensed casinos concentrates on speed and bonuses, and almost none of it on the small, unglamorous fact that a complaint against an offshore operator usually ends in a shrug.
There are several hundred licensed operators here and rather more websites than that, since one licence can cover a family of domains. A separate, unlicensed market runs alongside them, and it is larger than the industry likes to admit and smaller than its critics claim. What separates the two is not the design of the website. It is the paperwork behind it, and what happens when something goes wrong.
If gambling is causing harm, the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day of the year.
Table of Contents10
- The Licence Is the Product
- What the Commission's Own Numbers Show
- British Licence and Offshore Licence, Side by Side
- The Check That Decides Everything Else
- Five Signs a Site Can Be Trusted
- Where a Complaint Actually Goes
- Self-Exclusion Does Not Have a Shortcut
- Judging the Whole Market in One Paragraph
- Frequently Asked Questions
- The Short Version
The Licence Is the Product
Every commercial gambling service offered to consumers in Great Britain needs a licence from the Gambling Commission — including, as the Commission states plainly, an operator that already holds a licence somewhere else. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without one, carrying on summary conviction up to 51 weeks' imprisonment, a fine at level 5, or both. That is a rule aimed at the operator, not the player. An adult punter who stumbles onto an unlicensed roulette table commits no offence under the Act; the person running it does.
The practical consequences of holding a Commission licence are the whole substance of the UK standard:
- GamStop participation, required since 31 March 2020 under social responsibility code 3.5.5, with the customer base checked at least every 24 hours.
- Identity verification before gambling, not before withdrawing.
- No reverse withdrawals — banned outright since 31 October 2021, so a requested payout cannot be cancelled back into a spendable balance.
- No credit cards, banned for remote gambling since 14 April 2020.
- A 10× cap on bonus wagering requirements, in force since 19 January 2026, replacing terms that in some cases ran to 60×.
- Access to an approved alternative dispute resolution provider, free to the customer.
Strip the licence away and every one of those obligations goes with it. That is not a debating point; it is the arithmetic of the thing. GamStop's own terms of use say the scheme binds participating operators only. A site with no Commission licence does not participate, so it is not covered, and no amount of good intentions on the operator's part changes it.
One aside on the name, since I see it mangled constantly: the scheme is GamStop, run by The National Online Self Exclusion Scheme Limited, and it is very often typed "gamestop". The spelling does not affect the block. Everything else about it does.
What the Commission's Own Numbers Show
I prefer a benchmark from the regulator to a league table from an affiliate. The Commission's data on withdrawals covers 44.2 million withdrawals made by customers of large online operators between June and September 2024. Of those, 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours, and 0.1 per cent took up to 48 hours.
Read that carefully, because it says something an affiliate page never will: the mechanism is not the problem. The overwhelming majority of payouts on licensed sites need no human being at all. The complaints come from the minority that do, and the Commission's Contact Centre has said for years that withdrawal problems are its single largest consumer topic, receiving around 2,000 complaints a year as of July 2024. Its 2024-25 annual report put the same point more baldly: despite work with some operators, withdrawal issues continue to cause most of the complaints it gets. There is no fixed statutory deadline for completing a withdrawal. The regime relies on the fair-and-open condition, the identity-verification condition and the consumer law ban on unfair terms, rather than on a stated number of days.
The enforcement that followed is instructive. In October 2026 the Commission announced a £900,000 regulatory settlement with an operator that had delayed withdrawals, including a term allowing only one withdrawal request at a time and manual review of every fifth or tenth withdrawal. That is what built-in delay looks like when you strip off the marketing: not a locked door, a queue with a person in it.
British Licence and Offshore Licence, Side by Side
The table below compares the two arrangements by what each obliges, not by which brands sit where. Payment speeds are ordinary working numbers, not promises.
| Criterion | Great Britain (Commission licence) | Offshore (no Commission licence) |
|---|---|---|
| Self-exclusion | GamStop participation required; register checked at least every 24 hours | Not connected to the scheme |
| Identity checks | Required before the customer gambles | Usually triggered on withdrawal |
| Reverse withdrawals | Banned since 31 October 2021 | Permitted unless the operator chooses otherwise |
| Credit cards | Banned since 14 April 2020 | Commonly accepted |
| Bonus wagering cap | Maximum 10× since 19 January 2026 | Frequently 35× to 50× on welcome offers |
| Maximum cashout clause | Prohibited on the deposit balance | Common; one operator cited caps bonus winnings at 300% of the bonus |
| Dispute route | Free ADR through an approved provider | Regulator of another jurisdiction; usually no consumer remedy |
| Speed of payout | 96.3% of withdrawals cleared automatically, per Commission data | Mixed; crypto is quick, verification is not |
Two rows in that table deserve a sentence each. The UK maximum-cashout position is not a matter of taste: the Commission's fair-terms guidance states that operators must not impose any maximum limit on the amount a consumer may withdraw from their deposit balance, and its example of a prohibited term is a daily £50 and weekly £500 ceiling. Offshore terms routinely do exactly that for bonus-derived winnings. And the bonus row is where the two systems diverge most sharply in the customer's favour: the Commission said the 10× cap "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements" — a sentence I would frame if I had wall space.
The Check That Decides Everything Else
Identity verification is the hinge this topic turns on. A British-licensed operator must hold verified name, address and date of birth before a customer is permitted to gamble, under Licence Condition 17, in force since 7 May 2019. First time round, a competent operator matches the account against databases, credit reference agencies and the electoral roll, and the check is invisible. If the match is weak — a middle name instead of a forename, a nickname, an address that is a letting agent's office — documents get requested: passport, driving licence, household bill. The Commission says it cannot give a timescale because it varies, but that electronic verification may be instant while documents take longer.
Later, the check is ongoing rather than repeated from scratch. The Money Laundering Regulations set a €2,000 trigger for identification and verification in remote casinos, applied both to single transactions and to linked ones, and high-risk relationships bring a source-of-wealth question on top. What matters legally is sequence. Condition 17.1.1 says a withdrawal request must not result in a demand for information the licensee could reasonably have asked for earlier. A site that says nothing for six months and then wants a utility bill before paying out is not being careful; it is being late, and the Commission has said that may breach the condition.
The warning signs are recognisable once you know the sequence. Verification demanded only at withdrawal. A "hybrid" threshold approach used as an excuse to hold funds rather than an orderly deferral. Fuzzy third-party matching that verifies three-quarters of a person. A mismatch between the name on the account and the name on the payment method. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and it is one of the most common dispute types reaching adjudicators — which tells you the failure is routine, not exotic.
Five Signs a Site Can Be Trusted
Each of these takes under five minutes and requires nothing more than a browser and a reference number.
The Licence Number Matches the Domain
Check the licence number against the public register, and check that the domain being used appears there — the Commission's own advice is to click through and confirm that the site's activities and domain names match the licence. A licence covering something else is not a licence for this. Offshore equivalents fail the same test in the same way: Curaçao's regulator says clicking a Certificate of Operation seal must redirect to its own certificate page, and that a certificate showing a different domain belongs to somebody else.
Withdrawal Terms Are Already Written Down
Look for the payout terms before depositing, not after winning. Licensed sites must present terms that comply with the fair-and-open condition, and a cap on withdrawal amounts or a "we may withhold winnings at our discretion" clause is a red flag the Commission itself calls unfair. The Commission has fined operators for exactly that: a £170,000 penalty in July 2025 included a term giving the operator discretion to close accounts or forfeit winnings.
Complaints Land at a Named Adjudicator
A complaints page that ends in a phone number and nothing else is telling you where the buck stops. Licensed operators must offer referral to an approved ADR entity, free, if a complaint is unresolved after eight weeks. IBAS and eCOGRA have historically handled most gambling disputes; eCOGRA's Great Britain report for October 2024 to September 2025 records 911 disputes received and an average of 31 days to resolve domestic cases, with 17.8 per cent ruled in the consumer's favour.
The Deposit Route Is Sensible
Cards and bank transfers leave a trail. Crypto does not, and the Commission's 2026 risk assessment flags the remote sector's exposure to e-wallets, prepaid methods and crypto-linked funds. That is not a moral objection to Bitcoin; it is the observation that the recovery route and the dispute route both get shorter when nobody can see the money move.
The Block Actually Blocks
If the plan involves self-exclusion, test the premise before relying on it. GamStop registration is free, takes a few minutes, can take up to 24 hours to take effect, and offers terms of six months, one year, five years, or five years with auto-renewal. It cannot be cancelled during the term. Anyone can install blocking software alongside it — GamStop signposts both — but software is a fence, not a lock, and no software changes which sites are bound by the scheme.
Where a Complaint Actually Goes
This is the section the rest of the page has been walking towards. There are five doors, and only the first three belong to anyone in Britain.
- The operator. Start here, because every other route requires it. Licensed operators must let customers complain for at least six months from the incident and complete the whole internal process, including escalation, within eight weeks. Keep the reference number. This step exists because a regulator will not look at a case that has not been through it.
- An approved ADR provider. Free to the customer, and the operator must offer it if eight weeks pass without resolution or a deadlock letter is issued. Adjudicators decide on the evidence and the term in question, and they are the only body that will rule on a dispute about account access or funds. eCOGRA reports that 72.3 per cent of its invalid disputes in the year to 30 September 2025 had not been through the operator's internal process first — a wasted complaint is usually a skipped step.
- The Gambling Commission. Worth telling, because it collects patterns, and worth being clear about: the Commission is a regulator, not an ombudsman. It cannot resolve an individual complaint, cannot retrieve money, and says so itself. It will typically refer a dispute onward. Its value is aggregate — 3,140 cease-and-desist and disruption notices since April 2024, 287,961 URLs removed — not individual.
- The offshore regulator. This is where the trail goes cold for UK players. An MGA complaint form is reviewed in English or Maltese; Curaçao's own verification mechanism has been through a portal transition and the regulator has said its former digital seal may be affected. Anjouan requires its licensees to name an approved ADR provider and to resolve complaints within 30 days, which is more than nothing, but the venue is not one a British customer can easily reach.
- Civil action. Always available in theory. The Consumer Rights Act 2015 and the consumer law prohibitions on unfair terms do not stop at a website's jurisdiction clause. In practice, suing a company with no UK assets over a £400 balance is a hobby, not a remedy.
The pattern is worth stating flatly. Offshore sites are not licensed in Great Britain. UK protections do not apply to them, and that includes the complaint route. If a site cannot say which regulator licenses it, or names one whose certificate page does not open, the honest conclusion is that no one is deciding anything.
Self-Exclusion Does Not Have a Shortcut
GamStop registrations rose 16 per cent year on year in the first half of 2026, with 12,236 sign-ups in May 2026 alone — a monthly record. As of July 2026 the scheme reported 614,738 people on the register, and more than one in two had chosen the maximum five-year term. Those numbers describe a system people take seriously, which is exactly why the myth that an offshore site is a way round it deserves a blunt answer.
It is not. GamStop blocks online gambling companies licensed in Great Britain. It cannot touch operators that do not participate, and that limitation is written into the scheme's own terms rather than being a gap someone forgot to close. What the underwriting of an exclusion actually is — an operator checking the register and refusing the account — does not exist where the register is not consulted.
The term itself does not soften. Once registered, a person cannot cancel or deactivate during the exclusion period, and the exclusion stays in place after the chosen period ends unless they contact GamStop to remove it. Auto-renewal can only be switched off in the final six months of a five-year term, and it continues for up to four further five-year periods. If nothing is done, the data is held through a further automatic seven-year period during which operators are told of the previous exclusion. The scheme's 2025 annual report devotes a section to its refusal to remove registrations before the term ends.
Judging the Whole Market in One Paragraph
The useful comparison between British-licensed and offshore online gambling sites is not speed, bonuses or design. It is who answers when the thing goes wrong: an approved adjudicator in this country, or an address in another jurisdiction with a certificate page that may or may not load. Everything else is a detail on top of that. The National Gambling Helpline, free on 0808 8020 133, is there day and night for anyone the gambling itself has outgrown.
Frequently Asked Questions
How many online gambling sites are there in the UK?
Nobody has a clean total, and anyone quoting one is guessing. One licence can cover multiple domains, and the Commission's own illegal-market tracking identified 586 illegal gambling websites accessible to British consumers in September 2026 alone. That is the unlicensed side, measured by a monthly dashboard rather than by a register. The licensed side has no single published count.
Are offshore casinos illegal to use?
The offence sits with the operator, not the player. Section 33 of the Gambling Act 2005 makes it illegal to provide gambling facilities in Great Britain without the relevant licence, and the Commission states this covers an operator licensed in another jurisdiction. An adult customer commits no offence under the Act by gambling with such a site. The exposure is different: no UK protections, no GamStop coverage, and no practical complaint route.
What is the safest way to check a gambling site?
Check the licence number and domain against the Commission's public register, then read the withdrawal terms before depositing rather than after winning. Look for a named ADR provider in the complaints section and a properly separated deposit balance. Those three checks catch most of what matters. Speed claims and bonus headlines, by contrast, tell you nothing about whether the site will pay.
How do I complain about an online casino?
Complain to the operator first and keep the reference. If eight weeks pass without resolution, or you receive a deadlock letter, the operator must offer referral to an approved ADR entity, free of charge. Adjudicators decide on evidence and terms; IBAS and eCOGRA have handled most gambling disputes. Skipping the operator stage is the commonest reason a complaint is rejected as invalid.
Do UK sites have to be part of GamStop?
Yes. Since 31 March 2020 participation in the national multi-operator self-exclusion scheme has been a licence condition under social responsibility code 3.5.5, and the Commission has required operators to check their entire customer base at least every 24 hours since April 2020. Failure is not theoretical: in April 2020 the Commission suspended the licences of two operators that missed the integration deadline.
Which payment method is quickest for a withdrawal?
Bank cards and Faster Payments usually beat a bank transfer, and crypto is fastest in raw network terms but sits outside the card-based protections and is slower to recover if a dispute arises. The more useful point is that the method rarely decides anything: 96.3 per cent of withdrawals by customers of large operators cleared automatically in the Commission's 2024 data. What slows a payout is verification, not plumbing.
The Short Version
The gap between a licensed British site and an offshore one is not about how the games feel; it is about who picks up the phone when it goes wrong, and in the Commission's October 2026 enforcement against an operator for delayed withdrawals — a settlement of £900,000 — you can see the entire value of a licence in a single number.