Non GamStop Sites and the Self-Exclusion Gap

Non GamStop sites are gambling operators that are not part of GamStop, the British self-exclusion scheme, usually because they hold no Gambling Commission licence. A self-exclusion is not a bar on gambling everywhere — it is a block held by participating operators, and it persists after its term until it is removed.

There is a small industry built on a category error, and it goes like this: that a casino outside the British licensing system is a "non GamStop" casino, and that this is a feature. It is £16.6 billion of staked money a year by H2 Gambling Capital's estimate for 2025, up from about £5 billion in 2019 — and the same analysis reckons the legal share of British gambling fell from 97% to 92% over that stretch. So the phrasing is not innocent. Non GamStop sites exist as a category because the scheme covers only operators licensed in Great Britain, and an operator without that licence is not obliged to check the register at all. The awkward part, which the affiliate pages tend not to say in bold, is that the same absence of a licence also removes the credit-card ban, the 10× wagering cap, the reverse-withdrawal prohibition, the eight-week complaint clock and the requirement to hand disputed money to an adjudicator. What is being marketed as freedom from a block is, in the paperwork, freedom from everything else too. The scheme's own name is often typed "gamestop", a slip the word "game" invites; the register it refers to is GamStop.

What GamStop Actually Covers

The scheme is run by The National Online Self Exclusion Scheme Limited, the body set up in June 2017 after the Remote Gambling Association was asked by the Department for Digital, Culture, Media and Sport and the Gambling Commission to design a national online self-exclusion system. It went live on 27 April 2018. It is free, it is used by over half a million people, and by July 2026 the register stood at 614,738 names — more than one in two of them on the maximum five-year term, and only one in four across all age groups on six months.

Its reach is defined by a licence condition. Since 31 March 2020 every online operator must participate as a condition of its Commission licence, under social responsibility code provision 3.5.5. Since April 2020 operators must also sweep their entire customer base against the register at least every 24 hours. When two firms missed the integration deadline in April 2020, the Commission suspended their licences under section 118(2) of the Gambling Act 2005 — a reminder that the scheme is enforced, not advertised.

The block itself is one-directional. Registration takes minutes, may take up to 24 hours to bite, and covers online accounts with British-licensed operators only. It cannot touch a site that does not participate, which is the whole commercial premise of the non GamStop category.

How Long an Exclusion Lasts

Four terms: 6 months, 1 year, 5 years, or 5 years with auto-renewal. Of the registrants in 2025, 29% chose six months, 24% chose a year, 25% chose five years and 22% chose the version that renews itself.

The part that matters most to anyone weighing up a non GamStop site is what happens at the end. Nothing happens automatically. The registration cannot be cancelled or deactivated during the term, and it stays in force after that term expires unless the person contacts GamStop to have it removed. Auto-renewal can only be switched off during the final six months of a five-year minimum exclusion period, and otherwise continues for up to four further five-year periods. Fail to act and the scheme holds the data through a further automatic seven-year period, during which operators are told the person was previously excluded. The group's 2025 annual report devotes a whole section to its refusal to remove registrations early, and the data consequence is already visible: it says it can no longer publish a lifetime registration total because the seven-year retention period from 2018 has begun to expire.

That is the mechanism non GamStop sites are selling an escape from — not a technicality, but a term that outlives the term.

The British Licence and the Standard It Sets

Before comparing, it is worth being plain about the baseline. Offering commercial gambling to consumers in Great Britain without a Commission licence is illegal: section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without a licence, carrying on summary conviction up to 51 weeks' imprisonment, a fine at level 5, or both — six months in Scotland. It is immaterial whether the facilities are provided by remote communication and whether they are provided inside or outside the UK. For remote gambling the section bites where at least one piece of remote gambling equipment is in Great Britain, or where the provider knows or should know the facilities are likely to be used there.

So a site on a Curaçao, Anjouan or Kahnawake licence and marketing itself to British players is not a legal alternative to a British casino. It is an unlicensed operator with a foreign permit, and the Commission's own words are that a licence in another jurisdiction does not change that. Users have drifted towards these sites anyway — Commission analysis published on 5 November 2026 puts engagement with illegal gambling websites at 0.6% of all respondents in the past four weeks, rising to 2.5% among those who had gambled online in that period. Put the other way: 94.4% showed no sign of using one.

What the British Standard Actually Guarantees

The comparison is not abstract. On a Commission-licensed site a player gets, by rule rather than by promise:

• Payouts. Commission data for June to September 2024 records 44.2 million withdrawals by customers of large online operators, of which 96.3% cleared automatically, 3.5% within 24 hours and 0.1% in up to 48 hours. Delaying a withdrawal that needs no concern addressed is not acceptable, and operators must explain a delay or refusal.
• No reverse withdrawals. Requirement 14B, in force since 31 October 2021, states customers must not be given the option to cancel their withdrawal request.
• Identity checks that cannot be sprung at the till. Licence condition 17.1.1 says a withdrawal request must not trigger a demand for information the operator could reasonably have requested earlier.
• No cap on what can be withdrawn. Guidance gives "You may withdraw up to £50 per day and up to £500 per week" as the textbook prohibited term.
• A ten-times wagering ceiling. From 19 January 2026, social responsibility code 5.1.1 caps wagering requirements at ten times and bans mixed-product promotions.
• Credit cards off the table, since 14 April 2020, with e-wallets obliged to prove the money did not come from one.
• An adjudicator. Complaints unresolved after eight weeks go free of charge to an approved alternative dispute resolution provider.

Where Offshore Terms Are Harsher

An offshore licence is not a synonym for a bad one, and several regulators have tightened up. But the terms that build in delay or erase winnings survive far more often outside the British rulebook, and they are usually sitting in the bonus schedule rather than the headline. Trade comparisons of offshore welcome offers put the wagering multipliers at 35× to 50×, with no-deposit offers at 40× to 60× against a €50–€100 cashout cap. One of the largest offshore brands publishes a contribution chart in which slots count 100%, table games 20%, video poker and blackjack 10%, roulette and baccarat 5%, and craps, live dealer and certain jackpot games count nothing at all. Another caps the amount withdrawable from bonus-derived winnings at 300% of the credited bonus. Neither clause has an equivalent that would survive on a British licence.

The slow-release mechanisms are the subtler ones. A maximum bet while a bonus is live — one published limit is €5 for regular players and €10 for VIPs — means a single stake above the line can forfeit the bonus and everything won with it. Manual review of every fifth or tenth withdrawal, which is exactly what drew a £900,000 regulatory settlement from the Commission in October 2026, adds days of "processing" to a cash-out that a licensed operator's system would have cleared automatically. And the practical point about identity checks stands: when documents are demanded only at the withdrawal screen, the operator has held the money for as long as it liked and the player has no regulator to complain to.

How the Licences Compare

The table below sets out the paperwork behind the labels, on the criterion that decides how much protection comes with the badge.

Two things worth pulling from that table. Curaçao's annual B2C fee of €47,450 is roughly double Anjouan's €17,828 renewal, and the CGA reform that took effect on 24 December 2024 abolished the old master-licence model — the legacy orange certificates ended on 15 October 2025, and a historic /JAZ number is no longer proof of anything. Kahnawà:ke, meanwhile, has regulated interactive gaming since 1999 and has just raised its CPA renewal fee to USD 40,000, which tells you something about whose clients it courts. And the last column is the same everywhere except the first row.

The First Time and Every Time After

If there is one section of this market that turns on a single mechanism, it is the identity check, because that is where the promise and the paperwork separate. On a British-licensed site the rule since 7 May 2019 has been that a customer cannot gamble before their identity is verified, and the Commission now expects age and identity checks brought forward to before a deposit or a stake, not held back for the cash-out. Verification is often invisible — matching a name, address and date of birth against credit reference agencies and the electoral roll needs no paperwork at all. If a business can verify electronically, it may be instant; if documents are requested, it will not be. Passports, driving licences and household bills are the usual asks, a selfie typically follows a suspicion of identity theft, and bank statements appear where source of funds needs checking.

The first time is not the last time, and this is the bit players underestimate. Customer due diligence is ongoing. Under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, a remote casino must identify and verify a customer once deposits or withdrawals reach €2,000 — counted across linked transactions, not just single ones — and the "hybrid approach" lets a remote casino verify age at registration and defer full identity verification until that threshold. Higher-risk accounts then need source of wealth on top of source of funds. A licence condition that applies to every remote operator, meanwhile, requires the identity information held on a customer to be kept accurate. So a change of address, a name change or a mismatch between a middle name and a forename can resurface years later, and the Commission has been explicit that onboarding on nicknames, initials or commercial addresses is not good enough — it undermines the register itself, because a mismatched name is exactly what a fuzzy-matched self-exclusion check fails to catch.

The warning signs are the same wherever the site is licensed, and they are loud:

• A withdrawal is met with a document request that never arose at deposit. That is the pattern Licence Condition 17.1.1 exists to prevent, and over a quarter of complaints reaching the Commission's Contact Centre are about identity verification on withdrawal.
• A term allows the operator to confiscate funds because verification was not completed. British guidance forbids it; the CMA's position is that consumers are entitled to deposited money, winnings from money deposited and gambled, and bonus winnings where conditions are met.
• A maximum withdrawal limit appears in the small print. Prohibited in Britain, live and well offshore.
• Every fifth or tenth cash-out goes to manual review. There is no reason a system needs to re-examine one in ten; the regulator's own case in October 2026 treated it as a failure.
• The account is "inactive" so the balance is absorbed. British rules say inactivity cannot be used to confiscate a deposit balance, and after twelve months an operator must try to return money to the last payment method used.

Five Signs an Operator Can Be Trusted

None of these requires an account, a deposit or a leap of faith. All of them are matters of public record.

The Licence Matches the Domain

Not the licence, not the regulator's name in a footer graphic — the actual domain. The Commission advises checking the public register and clicking through to see whether the site's activities and the domain names match. A regulator's seal should resolve to the regulator's own certificate page: a CGA Certificate of Operation Seal must redirect to cert.cga.cw, and if the certificate behind it names a different domain, the site is displaying someone else's paperwork. The MGA publishes a list of unauthorised URLs for precisely this reason; the most recent entries carry notice dates of 30 October 2026. Kahnawà:ke's logo certificate program, running since 15 January 2010, generates a Certificate of Good Standing on clicking the logo. Quick check: click the seal and read the domain on the page it opens.

Customer Money Is Separated and Rated

Under licence condition 4.1.1 a remote operator must hold customer funds in a client bank account separate from its own business accounts, and must pick one of three disclosure ratings — "not protected", "medium protection" or "high protection" — state it in the terms, and, if unprotected, remind the customer every six months that their funds are at risk in an insolvency. Money staked inside an open bet is not customer funds and is not covered by the arrangement at all. A separate account in an overseas bank is still permitted. Quick check: search the terms for the words "protected in the event of insolvency" and read what follows.

The Bonus Terms Are Bonuses, Not Traps

Read the wagering requirement, the game-weighting chart, the maximum bet while a bonus is live, the cashout cap and the expiry. On a British licence the cap is ten times and mixed-product promotions are banned; off it, the same offer can carry 40× or more. Blackwell's formula for this: if the terms cannot be summarised in two sentences without losing their sense, they were not written to be understood. Quick check: find the wagering multiple and the contribution chart, and see whether slots and live dealer games are valued the same. They almost never are.

Withdrawals Are the Default, Not the Exception

The prohibition on reverse withdrawals has been in force since 31 October 2021: no option to cancel a withdrawal request, no chance to put the money back into play. Automatic processing is the norm on regulated sites — 96.3% of the 44.2 million withdrawals in the Commission's June to September 2024 dataset cleared automatically. A site that still offers a "cancel withdrawal" button, or that routes cash-outs to manual review on a schedule, has told you what it thinks of the difference between a deposit and a payout. Quick check: request a small test withdrawal before staking anything meaningful and time it.

Complaints Go Somewhere That Is Not the Operator

A licensed operator must have arrangements for free referral to an approved alternative dispute resolution provider when a complaint is not settled within eight weeks, and a person must have used the operator's own procedure first. The Commission approves ADR group, Pegasus ADR Service, Blexr, CEDR, eCOGRA, IBAS, ProMediate and Tattersalls Committee. Offshore regulators run their own versions: Anjouan requires licensees to name an approved ADR provider — currently EGIS ADR, Axion ADR, iGaming ADR or an approved operator — in player-facing terms, and Kahnawà:ke employs a full-time dispute resolution officer. There is a sting in the numbers: eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes received, 499 invalid, and 361 of those thrown out because the customer had not gone through the operator's own procedure first. Quick check: find the named adjudicator in the terms, and confirm it is not the operator's own complaints department under a different name.

A Working Method in Six Steps

1. Establish what a self-exclusion does and does not cover. Registration blocks online accounts with British-licensed operators for a chosen term of 6 months, 1 year, 5 years or 5 years with auto-renewal; it does not follow a person elsewhere, and nothing ends it at the term's close unless GamStop is contacted. Reason: the entire category rests on this gap, and it is easier to think clearly about a site once the mechanism is separated from the marketing.
2. Check the licence on the regulator's register, not on the site. Match the legal entity and the domain against the Commission's public register, or the CGA, MGA, Anjouan or KGC register, whichever is claimed. Reason: a permitted regulator can be named in a footer; only the register tells you whether the operator actually holds the licence.
3. Read the payout section of the terms before anything else. Look specifically for a maximum withdrawal limit, a manual review schedule, a processing fee above the direct cost of the transfer, and any right to cancel a withdrawal. Reason: these are the clauses the British rulebook removes, so their presence or absence is the cleanest available signal.
4. Price the bonus, not the headline. Convert the offer into the amount that must be wagered: bonus times multiplier, adjusted for the weighting of the games involved. A 40× requirement on a small bonus with slots at 100% and live dealer at nil is a different instrument from a 10× one with the same headline. Reason: the multipliers are the single number most often quoted at the wrong scale.
5. Establish the limit position before playing, not after. From 31 October 2025 all licensed operators must prompt customers to set a financial limit before a first deposit as the default option, must make it easy to review and alter, and must remind customers every six months to review their account and transaction information. Reason: a limit set in advance is honoured by the operator's own system, and it is the only control that does not depend on memory.
6. Write down the route out before using anything. Know which regulator or adjudicator has jurisdiction, and keep the complaint within its time limits — most ADR providers on the Commission's list require submission within not less than twelve months of the operator's notice that it could not resolve the matter, and eCOGRA may refuse a dispute older than a year. Reason: disputes are lost more often to the calendar than to the merits, as the 361 invalid disputes in a single year's eCOGRA caseload show.

Layers Worth Knowing About

Two other forms of cover exist, and neither depends on the operator's goodwill. Blocking software installed on a phone, tablet or computer sits in front of the browser: BetBlocker, a Delaware non-profit, says it blocks over 1,368,000 gambling websites and 3,100 apps and needs no registration, while Gamban states it blocks licensed and unlicensed sites and is designed to be as difficult to remove as possible — it is free for residents of Wales, but costs £4.99 a month or £29.99 a year in England and Scotland following the end of its free UK licence scheme on 31 March 2026.

Bank-level blocks are the other layer, and they are the ones offshore sites struggle with most. The Commission's list of banks offering a gambling blocking service, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. They work by declining payments to merchants categorised under gambling Merchant Category Codes, cover online casinos, betting sites, gaming apps and physical venues, and are applied at card level, so each card must be activated separately. Most banks apply a 48-hour or 72-hour cooling-off period before gambling transactions clear again, and the block does not touch a credit score.

Where these fail, the Commission is the wrong address. It is a regulator, not an ombudsman: it cannot resolve an individual complaint or help recover money, though it records every complaint and refers disputes to an independent third party. What it does do is chase the operators. Since April 2024 its Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Bing and Google URLs and secured 287,961 removals, and it estimates an average 32% fall in engagement across 160 illegal sites following disruption. Its own assessment is that GEO IP blocking removes 60% of engagement and registrar blocks 91%, while Google removal manages 30%. The gap between those numbers is the honest summary of how the enforcement war is going: access is hard to sever and easy to hide.

Self-exclusion has no such gap. A term is a term, and it holds.

Questions About Non GamStop Sites

Are there any safe non GamStop sites?

Safety is not a binary badge, and the phrase itself does the marketing's work. An offshore operator can hold a genuine licence, segregate player funds and name an adjudicator — Anjouan requires all three — but it is not licensed in Great Britain, so the British protections do not apply and the Commission cannot act for a player with a complaint. Judge the terms, not the adjective.

What are best non GamStop sites best at?

Two things, honestly. Payment methods: offshore casinos take crypto far more readily, and their wagering is set by contract rather than capped at ten times, so a high-roller sees fewer friction points. And acceptance: a British-licensed operator must check the GamStop register before letting anyone play, so a person on the register cannot open an account at all. Those are the whole of the advantage.

Do non GamStop casino sites pay out?

Some do, and often quickly, because crypto settlement is genuinely faster than a card refund — a USDT transfer on TRON costs roughly 13 TRX without staked Energy, and Bitcoin's protocol targets a block every ten minutes. The lie in the question is the word "pay out". What varies between operators is not whether winnings arrive but the terms attached: a maximum bet while wagering, a 300% cashout cap on bonus winnings, or manual review of every fifth withdrawal.

Is GamStop permanent?

No, but it lasts longer than most people assume. The chosen term — six months to five years — cannot be cut short, and it does not lapse at the end. It remains in force until the person contacts GamStop to remove it. Auto-renewal can only be switched off in the final six months of a five-year minimum exclusion period, and if nothing is done the scheme holds the data through a further automatic seven-year period.

Do non GamStop sites UK players use accept bingo and poker?

Mostly, yes, and the licence categories decide it. Anjouan issues a single Internet Gaming Licence category covering casinos, sports betting, poker and bingo, and a Kahnawà:ke CPA holder is entitled to offer casino, poker and sportsbook. The poker and bingo variants offshore are structurally the same machines as anywhere else — what differs is the wagering schedule attached to any bonus sitting on top of them.

How do I complain about an operator outside Britain?

Start with the operator's own procedure, because every route requires it first. If eight weeks pass on a British licence, the complaint goes free to an approved ADR provider such as IBAS or eCOGRA. Offshore, the regulator names approved providers — Anjouan's current list is EGIS ADR, Axion ADR, iGaming ADR and an approved operator — and expects the operator to resolve a complaint within 30 days before escalation. Keep it inside twelve months.

Non GamStop Sites and Rules

Non GamStop sites are not a loophole in the scheme and not a route around it; they are operators that never joined it, and the reason they never joined is that they hold no British licence and therefore were never required to. A self-exclusion holds for its full term and stays in place until the person contacts GamStop to remove it — and the register, at 614,738 names in July 2026, keeps growing regardless.

If gambling is causing harm, the National Gambling Helpline, run by GamCare, is free on 0808 8020 133, twenty-four hours a day, every day of the year; callers in Wales are given 0808 2819 265. And for anyone still weighing up the trade: the Commission's own analysis puts engagement with illegal gambling websites at 2.5% of those who gambled online in the past month, which sounds like a minority until you notice that 0.6% of the entire adult population is not a rounding error — it is roughly 300,000 people entered into a market that answers to nobody in this country.