Games not on GamStop in 2026 and Balance Protection

Games not on GamStop are those offered by operators holding no Gambling Commission licence, so the scheme cannot reach them and the protections attached to a British licence do not apply to the balance in the account. That gap, not the game catalogue, is the thing worth measuring.

I have spent years reading operator terms and the Commission's complaint figures, and the pattern in this niche is oddly consistent. 2026 is a good year to test it, because the Gambling Commission's own enforcement ledger now carries real numbers for illegal sites, and the offshore licensing regimes have spent two years tidying themselves up on paper. Neither development changes the arithmetic that matters to a player: what happens to the money sitting in an account when things go wrong.

The head keyword itself is a symptom of a misunderstanding. People search for games not on GamStop as though the scheme were a net with holes in it, and a careful operator might be hiding in one. GamStop is not a net. It is a register, and under Social Responsibility Code Provision 3.5.5 of the Licence Conditions and Codes of Practice, every operator licensed in Great Britain must participate in it. A site outside that register is not a clever exception. It is outside the licence, and everything the licence carries goes with it — the complaints route to an independent adjudicator, the caps on bonus terms, the ban on reverse withdrawals, the duty to keep customer funds separate and to say how well protected they are.

So this column is about the balance, not the reels. Offshore play is legal for the player; the offence in section 33 of the Gambling Act 2005 attaches to the operator providing facilities without an operating licence, not to the customer. But "not illegal" and "protected" are two different sentences, and the gap between them is measured in clauses, in processing times and in what happens at the withdrawal button.

The Numbers the Promise Rests On

Take the market estimate that gets quoted most often. H2 Gambling Capital put the amount staked with illegal operators in the UK at £16.6 billion in 2025, up from about £5 billion in 2019, with the proportion of gambling happening legally falling from 97 per cent to 92 per cent over those six years. That is a market-intelligence estimate, not a regulator's count, and I would treat the trend as the finding rather than the decimal places. The direction is real; the precision is not.

The Gambling Commission's own survey work is more conservative and, to my mind, more useful. Its analysis published on 5 November 2026, covering April 2025 to April 2026, estimates that among respondents who had gambled online in the previous four weeks, 2.5 per cent had engaged with an illegal gambling website, with a further 1.5 per cent doing so in the past twelve months. Across the whole population, including non-gamblers, 0.6 per cent had engaged with an illegal site in the past four weeks and 94.4 per cent showed no indication of using one at all.

Both figures can be true. A small share of players can account for a large share of stakes, and the £16.6 billion figure counts money moved rather than people moving it. What neither number tells you is whether the player got paid.

On that, the offshore regimes have their own paperwork. A third-party tracker reading the Curaçao Gaming Authority's public register reported 704 licences held by 698 operators, of which 552 were active, in a read taken at 03:30 UTC on 6 November 2026. That is not a CGA publication and should be read as an indication of scale, not a count. The point it makes is the one that matters: several hundred operators, and no British licence among them.

One Benchmark Worth Checking

The Gambling Commission's enforcement data is the benchmark I would pin this page to, because it is published, dated and dull in the way that real numbers are dull. Its Illegal Markets team reported that since April 2024 it issued 3,140 cease and desist and disruption notices, comprising 2,032 cease and desist notices, 774 registrar referrals, 402 host referrals and 3 payment provider referrals, and referred 447,778 Bing and Google URLs, securing 287,961 removals. Measured across 160 illegal gambling websites where traffic data existed, engagement fell by an average of 32 per cent after disruption action.

The method breakdown is the interesting part, and the Commission said so itself. Registrar blocks and website suspensions produced the largest average fall in engagement at 91 per cent each, ahead of GEO IP blocking at 60 per cent, Bing removal at 52 per cent, Google removal at 30 per cent and Facebook removal at 8 per cent. Search-engine removal, in the Commission's own words, makes a site harder to find but does not fully block access. That is a regulator admitting its most-visible tool is its weakest one, and it explains why a site can vanish from a search results page and still take a deposit from a British card.

Where the money enters, enforcement is still forming. Reporting payment transaction data to the Visa Operator Scheme is described by the Commission as a critical and still early-stage part of its financial disruption strategy, with the first referral made in January 2025 and three further referrals covering three separate unlicensed websites since.

How British-Licensed Sites Set the Standard

A British licence is not a guarantee of good manners. It is a set of obligations with a complaints route attached, and the comparison is only meaningful when you name the obligations.

Withdrawal speed first. Commission data covering June to September 2024 records 44.2 million withdrawals by customers of large online operators, of which 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours and 0.1 per cent took up to 48 hours. Note the shape of that distribution: there is no tail of month-long waits in the regulated data. When the Commission says withdrawal problems are the number one subject of consumer complaints to its contact centre, it is describing a minority of a very large base, and the complaints that do arrive concern friction rather than disappearance.

Reverse withdrawals are the clearest illustration of the difference a licence makes. Remote operators have been barred from offering the option to cancel a withdrawal request since 31 October 2021 under RTS requirement 14B. An offshore site is under no such obligation, and the temptation to deposit back a pending withdrawal is precisely the mechanism the British rule was designed to remove.

Then there is the bonus cap. Since 19 January 2026, UK licensees cannot apply wagering requirements over a maximum of 10 times, and cannot bundle more than one type of gambling product into a single incentive. The Commission chose a cap of ten rather than an outright ban, noting in its consultation response that the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". Offshore, the numbers sit where the market puts them: a 2026 casino-guide comparison table puts typical welcome-bonus multipliers at 35x to 50x and no-deposit bonuses at 40x to 60x with a cashout cap of €50 to €100 — a trade compilation rather than a regulator's figure, but consistent with individual operator terms. One operator's published terms state a 25× playthrough requirement, and another reserves the right to limit what can be withdrawn from bonus-generated winnings to 300 per cent of the credited bonus amount, voiding the excess.

And the balance itself. Under licence condition 4.1.1, customer funds held by a remote operator must sit in a separate client bank account, and "customer funds" is defined in the LCCP to include cleared funds deposited for future gambling, winnings left on deposit and crystallised but unpaid bonuses. Operators must pick one of three published protection ratings — not protected, medium or high — state it in their terms and disclose it in writing, with the customer acknowledging receipt on the first deposit. Money staked within an open bet is not customer funds. And keeping funds in a client account still does not mean you get them back if the operator becomes insolvent, nor does it prevent the money being held in an overseas bank account.

I will say plainly what I think of the phrase "safe offshore casino". It is not a category; it is a marketing line. Separate client accounts, an insolvency rating and a written disclosure before the first deposit are things a regulator compels. Everything else is a promise.

Which Kind of Games Sit Outside the Scheme

Casino games not on GamStop

Table games and live-dealer products are the easiest to move offshore, because the software supplier, not the operator, often holds the licence that matters. Since 24 December 2026, Curaçao requires suppliers established outside its territory that provide critical services or goods to its licence holders to register with the CGA, at the end of a two-year transitional period — a tightening on paper. The practical effect for a player is unchanged: the game may be certified to one standard and the account held to another, and nothing about the reel design tells you which.

Slot games not on GamStop

Slots are where the British rules bite hardest and where offshore terms diverge most. Online slots in Great Britain carry a £5 maximum stake per game cycle for adults since 9 April 2025 and £2 for adults aged 18 to 24 since 21 May 2025, plus a minimum 2.5 seconds between game cycles under RTS 14D. Those limits apply to slots only, not to roulette or blackjack. Offshore, the stake ceiling is whatever the account balance allows — and slot play is the most heavily weighted activity in nearly every wagering contribution chart, usually at 100 per cent, which is why it burns through a bonus requirement fastest.

Bingo Games

Bingo sits in an odd corner. In Great Britain the credit card ban covers online bingo, and the bonus rules since 19 January 2026 forbid mixing products within a single incentive, which happens to be exactly what a combined casino-and-bingo welcome offer does. Offshore bingo tends to come attached to a wider casino wallet, so the account is governed by casino withdrawal terms even when the play is bingo. Non-remote lottery operating licences are the exception that proves how piecemeal this can be: credit cards can still be used to buy lottery tickets from a shop or by post, because the ban never reached them.

A Comparison by Account Type

The Costa Rica row is not a licence at all. Costa Rica operates no comprehensive gambling licensing regime, and the "data processing license" the industry references is not a licence in the strict legal sense. Its Legislative Assembly rejected Bill No. 25,057 in early 2026, which would have introduced a mandatory licensing regime. A site leaning on that phrase is telling you where the money is held and nothing more.

Identity Checks and the Account Name

If I had to choose one mechanism that decides how an offshore account ends, it is identity verification and the mismatch between the name on the account and the name on the documents.

The first time is easy. A remote casino may identify customers and verify their age at registration but defer full identity verification until the €2,000 threshold is triggered — the Commission's "hybrid approach", drawn from the Money Laundering Regulations 2017, where the trigger is a deposit, withdrawal or winnings of €2,000 or more, counting linked transactions in a single logged-on session. Offshore, that is where any resemblance ends. There is no Commission expectation that the operator brings checks forward, no licence condition 17.1.1 to stop a site demanding documents only when a withdrawal is requested, and no enforcement behind a missed deadline. The Gambling Commission has said plainly that a customer's withdrawal request must not result in a requirement for additional information if the licensee could reasonably have requested it earlier, while noting the prohibition does not override a separate anti-money-laundering obligation. That protection is a licence term. It travels with the licence and stops at the border.

Later, the checks get heavier rather than lighter. CDD is ongoing and may be updated when circumstances change, non-face-to-face relationships must be treated as high risk absent safeguards, and higher-risk accounts require source of wealth to be established, not merely source of funds. Offshore, the same demand arrives but with no independent body to test whether it was reasonable.

The warning signs are specific and cheap to spot. An operator that asks for nothing at sign-up and everything at withdrawal has arranged its checks around its own cash flow. Terms that reserve sole discretion to withhold winnings — a "may" or "reserve the right" clause — are treated by the Commission as unfair within the meaning of the Consumer Rights Act 2015, and one UK firm paid £170,000 in July 2025 for regulatory failures including a bonus term giving it discretion to close accounts or forfeit winnings. Offshore, that clause is simply a clause. The Commission has also flagged the use of third-party verification providers and "fuzzy matching" that onboards customers on partial or equivocal verification, and noted that a middle name used instead of a forename can create a mismatch with records held elsewhere, such as GAMSTOP, undermining the very check meant to catch it.

One more thing belongs here, stated as fact rather than caution. A GAMSTOP exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it. Registrations cannot be removed early: the scheme's 2025 annual report devotes a section to its refusal to do so, and the terms of use allow auto-renewal to be switched off only during the last six months of a five-year term, continuing for up to four further five-year periods. If nothing is done after the chosen period ends, a further automatic seven-year data retention period begins, during which operators are told the person was previously excluded. An offshore site is not a way round that arrangement; it is a way round the licensing condition that enforces it, which is a different sentence with a different ending.

Five Signs an Operator Can Be Trusted

The licence is verifiable on the regulator's own register

Not a logo, not a seal image, but a lookup. The Commission advises checking that a business holds a British licence and clicking through to the public register to see whether the site's activities and domain names match. For Curaçao, clicking a Certificate of Operation Seal must redirect to the CGA's certificate domain; if the seal differs in design, colour or format, the site is not authorised, and if the certificate behind it names a different domain, you are looking at another operator's paperwork. Anjouan certificates carry a licence number and a QR code linking to a public register, and the authority states that certificates which cannot be verified there should not be relied upon.

The regulator's own naming is current

Legacy identifiers are the commonest tell. Curaçao's former master licensors stopped issuing new licences on a published timetable, ending with Curaçao Interactive Licensing on 31 January 2025, legacy "orange" sub-licence certificates ended on 15 October 2025, and the CGA has said a historic /JAZ number or legacy seal must not be treated as proof of a current licence. A site still displaying an old-style seal is showing you something that expired.

Funds protection is disclosed before the first deposit, not on request

Look for a written statement of which of the three ratings applies and what it means. The British version also requires the customer to acknowledge receipt. Two checks follow: whether the operator's terms mention insolvency at all, and whether the phrasing is "your funds are protected" rather than "your funds are held in a separate account". The second sentence is compatible with losing everything.

Complaints go to an independent adjudicator, named in the terms

Under social responsibility code 6.1.1, British licensees must let a customer refer an unresolved dispute to an approved ADR entity free of charge after eight weeks. Approved providers include IBAS, eCOGRA, CEDR and others, and IBAS reports 100 per cent operator compliance with decisions in the consumer's favour in both 2023-24 and 2024-25. Offshore, the equivalent is a designation on paper: Anjouan requires licensees to name an approved ADR provider and its contact details in player-facing terms, and its approved list runs to EGIS ADR, Axion ADR, iGaming ADR and other approved bodies. Check that the named body is named on your account's terms, not just in a footer.

The bonus terms are on one page, in numbers

A trustworthy operator states the wagering multiple, the maximum bet while wagering, the game weighting and the cashout cap without a hunt. Two offshore examples show how specific this gets when it is done properly and how punitive when it is not: a 25× playthrough requirement with a published contribution chart giving slots 100 per cent, table games 20 per cent, video poker and blackjack 10 per cent, roulette and baccarat 5 per cent, and craps, jackpot games and live dealer 0 per cent; against a maximum bet while wagering of €5 for regular players and any bet above it rejected, with a cashout limited to 300 per cent of the bonus credited. On the British side, marketing of promotional offers must comply with social responsibility code 5.1.9, and the Commission states that simply including the information in website terms and conditions is not sufficient.

How Anyone Can Check a Site Before Depositing

1. Search the regulator's register, not the site's footer. Take the licence number and the domain and look for both. Reason: the Commission's own advice is that the register shows whether a site's activities and domain names match, and a mismatch is the single cheapest fraud check available.
2. Read the customer funds clause and write down the rating. Reason: three published ratings exist, disclosure must be in writing before the first deposit, and "not protected" operators must remind customers every six months that their funds are unprotected, stating the value held. If a site cannot tell you its rating, it has told you something.
3. Find the maximum withdrawal clause and the cashout cap on bonus winnings. Reason: British rules prohibit any maximum limit on what can be withdrawn from a deposit balance, so a cap is a signal about which rulebook applies. Offshore terms routinely limit bonus-derived withdrawals to a multiple of the bonus credited and void the excess.
4. Check the complaints page for a named ADR provider and the eight-week trigger. Reason: an independent adjudicator is what turns a dispute into a decision. If the only route offered is the operator's own support queue, there is no second opinion.
5. Look at when identity documents are demanded. Reason: a request arriving only at withdrawal means the checks were arranged around the operator's cash flow rather than its obligations, and the Commission has identified exactly this pattern as the source of over a quarter of the complaints reaching its contact centre.
6. Test the small things before the balance grows — a withdrawal, a limit, a live chat answer. Reason: the deposit is frictionless almost everywhere, so it proves nothing. The withdrawal path and the financial limit settings are where the terms stop being words; from 31 October 2025 British licensees must prompt customers to set a financial limit before the first deposit, with declining it an active choice.

What Protects a Balance and What Merely Sounds Like It

The protections that actually hold are dull and specified: a licence condition that funds sit in a separate client account, a published insolvency rating disclosed in writing, a ten-times cap on bonus wagering, a ban on reverse withdrawals, an eight-week clock to an independent adjudicator, an explicit prohibition on a maximum withdrawal limit against a deposit balance, and the rule that un-staked deposits remain the customer's and cannot be confiscated for failing identity or age verification. Each is a sentence in a document a regulator can enforce against a named business.

Everything else is atmosphere. An audit seal, a "certified" badge, a support line that answers quickly, a licence number from a jurisdiction whose own authority is working out how its licences are verified after a portal shutdown — none of that moves a balance.

Where it goes wrong is documented, and it is rarely dramatic. Trouble with withdrawals is the single largest category of complaints to the Commission's contact centre, a figure it has repeated across several years, and it fell from 2,416 coded complaints in the year to December 2022 to 1,791 in the year to December 2025 — a decline that says more about how complaints are coded and routed than about the disappearance of the problem. The Commission's own appeal data shows the rollover: faster payments and enforcement notices at the bottom, GEO IP blocking in the middle at a 60 per cent average engagement reduction, and registrar blocks at the top.

For anyone affected, the help bodies are free and take calls from players and families alike, whether the site was licensed here or not. The National Gambling Helpline, run by GamCare, is on 0808 8020 133, 24 hours a day, every day of the year, with callers in Wales given 0808 2819 265. GamStop itself is free and a registration takes a few minutes, though the block can take up to 24 hours to become effective. GamFam supports families through its GRA5P peer programme, Gamblers Anonymous runs around 250 meeting locations across England, Wales and Northern Ireland, and NHS England has opened 15 specialist gambling clinics since 2019, with integrated care boards commissioning a further eight regional services.

Questions About Offshore Play

What gambling sites are not on GamStop?

Any operator without a Gambling Commission licence, since the duty to join sits in social responsibility code 3.5.5 of the LCCP and binds licensees only. That covers Curaçao-, Anjouan-, Kahnawake- and Malta-licensed sites accepting British players, and it covers operations with no meaningful licence at all, which is the category worth worrying about. Costa Rica, for instance, runs no comprehensive gambling licensing regime.

Are games not on GamStop legal to play in the UK?

Yes for the player. Section 33 of the Gambling Act 2005 makes it an offence for a person to provide facilities for gambling without an operating licence, with imprisonment up to 51 weeks or a fine on summary conviction, and the offence attaches to the operator. The Commission states it is illegal to offer commercial gambling services to British consumers without a Commission licence, including where the operator holds a licence elsewhere, and it has suspended licences on exactly that basis.

Do offshore sites ever pay out reliably?

Some do, and I will not pretend otherwise. The regulated benchmark is high: of 44.2 million withdrawals by customers of large online operators between June and September 2024, 96.3 per cent cleared automatically and 3.5 per cent within 24 hours. There is no equivalent published dataset for offshore operators, which is the whole difficulty — the reliability exists as individual experience rather than as something anyone can measure.

Why do offshore casinos ask for documents at withdrawal?

Because nothing stops them. In Great Britain, licence condition 17.1.1 says a withdrawal request must not trigger a demand for information the licensee could reasonably have requested earlier, unless another legal obligation such as anti-money-laundering rules requires it then. Offshore, the verification demand is arranged around the operator's own timing, and the Commission has identified this pattern as the source of over a quarter of the complaints reaching its contact centre.

Does an offshore account get round a GamStop exclusion?

No, and it is not described that way by anyone who understands the scheme. A GAMSTOP exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it; the scheme's 2025 annual report devotes a section to its refusal to remove registrations early, and doing nothing after the chosen period begins a further automatic seven-year retention period during which operators are told of the prior exclusion.

What is the fastest payout method from any of these sites?

The £1 million Faster Payments ceiling is a scheme limit rather than an entitlement, since individual banks set lower per-payment caps, and over 90 per cent of Faster Payments transactions complete in under two seconds — a secondary-source figure rather than one taken from industry reporting. Visa Direct's Fast Funds service puts funds within 30 minutes of approval. Crypto is not faster: Bitcoin targets a 10-minute block, and a payment is often treated as settled at six confirmations, which takes about an hour.

The Balance Is the Whole Argument

Games not on GamStop are simply games on accounts whose protections were never written, and the honesty of the phrase is that it hides nothing — everything the British licence adds, from the client account to the ten-times wagering cap to the eight-week clock, is absent offshore and absent by design. The Commission's own enforcement numbers show how well its tools reach those sites: registrar blocks cut engagement by an average of 91 per cent, while search-engine removals manage 30 per cent, which is the closest thing to an official admission that the game is a chase rather than a fence.

If any of this is weighing on a household, the National Gambling Helpline on 0808 8020 133 answers at any hour, and GamCare staff will talk to families as readily as to players.