Online Gambling UK and Your Balance Against Bad Operators

Online gambling in the UK is legal only through operators holding a Gambling Commission licence. Their sites must join the GamStop self-exclusion scheme, ban credit cards and reverse withdrawals, and hold customer money in a separate account. Offshore sites have none of these duties, so the first question for any balance is whose law stands behind it.

The British online market is not small, and it is not marginal. Gross gambling yield for the year to March 2026 was £17.5 billion, up 4.4%, with the remote casino, betting and bingo sector alone contributing £8.3 billion. Those numbers describe a regulated market doing what regulated markets do: taking a serious amount of money, and being answerable for how it takes it.

I have spent years reading licence conditions and settlement notices, and the thing that strikes me is how much of the protection around a British balance is invisible until it is needed. Nobody notices client-account rules on a winning Tuesday. They notice them when a company folds. They notice the reverse-withdrawal ban when the urge to chase is at its loudest, and by then the rule is the only thing standing in the way.

So this is a page about what protects a player's balance and what does not. Not about which site is best — that is a question for the sites themselves — but about which rules follow the money, and where the paper trail simply stops.

Offshore operators are not licensed in Great Britain. UK protections do not apply to them, and the Gambling Commission cannot act for a customer of a company it does not license. If gambling stops being fun, the National Gambling Helpline on 0808 8020 133 is free and answers at any hour, every day.

The Licence That Decides Everything

Is online gambling legal in the UK? Yes, and only through a licence. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and it does not matter whether the facilities are provided wholly or partly by remote communication, nor whether the provider sits inside or outside the country. On summary conviction the offence carries up to 51 weeks' imprisonment, a fine at level 5, or both.

The Commission is blunt about the international version: offering commercial gambling services to consumers in Great Britain without a Commission licence is illegal, including where the operator holds a licence somewhere else. That sentence does a lot of work, because it removes the most common defence an offshore site's marketing implies — that a licence is a licence.

Then the scheme. Since 31 March 2020 every licensed online operator has had to be part of GamStop, under social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice. Since April 2020 operators have also had to check their entire customer base against the register at least every 24 hours, which is what stops a self-excluded person receiving a tempting email on a Friday night.

GamStop is the UK's national online self-exclusion scheme, run by The National Online Self Exclusion Scheme Limited, and it is free to use. It is often typed "gamestop", which is a slip and nothing more. Registering blocks online accounts with every British-licensed operator for six months, one year, five years, or five years with auto-renewal, and it can take up to 24 hours to take effect. The exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it — it does not lapse on its own. It cannot be cancelled during the term, and it is never a thing an offshore site can undo.

The two companies whose licences were suspended on 3 April 2020 for missing that 31 March deadline are a decent reminder that this is not a voluntary badge. The Commission can and does pull the plug.

Best Online Gambling Sites UK and What the Phrase Should Mean

Search "best online gambling sites UK" and you get a list shaped by commercial arrangements, which is not the same as a list shaped by protection. The useful version of "best" is boring and checkable: holds a current Commission licence, lists its domain on the public register, states its customer-funds protection rating in writing, processes withdrawals without a queue of conditions, and appears on an approved ADR provider's panel.

A few numbers help sort the field. The remote casino sector was rated high risk for money laundering in the Commission's 2026 risk assessment, unchanged from the previous rating — so the sector being licensed and the sector being clean are two different statements. Gross gambling yield for the remote casino sector was £5.0 billion in the year to March 2025, £4.2 billion of it from slots. Whatever a site claims about itself, it is competing inside that.

Online UK Gambling Without the Marketing

Strip the offers away and online UK gambling is a fairly plain transaction: money in, games out, money back if you win. What varies is the friction. A licensed operator is not allowed to introduce friction when money leaves; the Commission has said plainly that it is unacceptable to place the operator's commercial interests above the customer's and that, absent regulatory concerns, there is no valid reason to delay a payout.

Offshore, that principle has no force. The house can write whatever it likes into the terms, and the only remedy is a contract dispute in a jurisdiction the player has never visited.

Gamble Online UK and the Tax Question

Gambling winnings are not taxed in the UK for the player; the duty sits with the operator, and the statutory levy took just under £120 million in its first year, ringfenced for research, prevention and treatment. So the common phrase "UK online gambling tax" is mostly a question about somebody else's bill. The 1.1% levy rate on online operators applies to previous-year gross gambling yield, and it is paid whether the customer wins or loses — which is a neat illustration of who carries the commercial risk in this market.

Where the Balance Actually Sits in British and Offshore Sites

The table below compares terms by criterion, because comparing by brand tells you nothing a marketing department did not already decide. Every figure here is drawn from the same sources as the text.

Read the withdrawal row twice. On the British side, the licence conditions remove outright the practice of capping what a customer can take out of their own deposit balance — the Commission's own example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". Offshore, a maximum cashout clause is ordinary drafting rather than a scandal, and it is precisely the kind of clause a player discovers after a good night.

The bonus row is the other one worth memorising. Since 19 January 2026 wagering requirements on bonus funds are capped at ten times under social responsibility code 5.1.1, and mixed-product promotions requiring two or more types of gambling are banned outright. The Commission's own reasoning is revealing: it chose a cap rather than a ban because some licensees were applying requirements of up to 60 times. Those numbers did not come from a player forum. They came from the regulator.

The Terms That Build In Delay

Here is the single thing this topic turns on: verification, and when it happens. A licensed operator must verify a customer's identity before that customer gambles — name, address and date of birth at minimum under licence condition 17.1.1, which came in on 7 May 2019. In practice much of that is done electronically against databases at registration, so a first deposit usually goes through without a single document being photographed.

The trouble starts later. The anti-money-laundering rules require identification and verification when a customer in a remote casino deposits or withdraws €2,000 or more, and the €2,000 threshold catches linked transactions too — the same game, one session, or a single logged-on period. So the first time a player sees a request for a passport scan is often the first time they try to take out a few thousand pounds, which is the worst possible moment for paperwork.

Which is exactly why licence condition 17.1.1 says a withdrawal request must not trigger a demand for information the operator could reasonably have asked for earlier. Where a business delays a payout because it did not collect ID at the right time, the Commission treats that as a potential breach. The sensible reading is that a decent operator verifies early and quietly; a poor one verifies late and loudly. Over a quarter of complaints reaching the Commission's Contact Centre concern identity verification, and it is among the most common dispute types sent to ADR providers — a statistic that tells you how often the second pattern happens.

The warning signs are consistent. A site that asks for documents only at withdrawal. A site whose verification page mentions "fuzzy matching" of names, or accepts an account opened in a middle name, because a mismatch with the GamStop register undermines the whole point of self-exclusion. A site that holds funds while documents are "reviewed" without saying which obligation requires it. None of these is proof of bad faith. All of them are proof that the operator's verification is built for its convenience rather than the customer's.

And the money does not vanish in the meantime. The Commission's position has been steady: operators cannot confiscate funds on the basis that ID has not been provided, and the CMA's undertakings say the same. An un-staked deposit remains the customer's.

Five Signs an Operator Can Be Trusted

It Appears on the Public Register

The Commission keeps a public register and advises consumers to click through it and check that the site's activities and domain names match. The check takes a minute: find the operator, confirm the domain is listed, confirm the licence type covers casino, betting or bingo as offered. A domain that is absent is not licensed to trade in Great Britain, whatever else its footer claims.

It Tells You How Your Money Is Held

Customer funds must be kept in a separate client bank account under licence condition 4.1.1, and every operator must pick one of three ratings — "not protected", "medium protection" or "high protection" — state it clearly in the terms, and, if rated not protected, remind the customer every six months what that means. A site rated not protected must say so in writing and obtain acknowledgement. If you cannot find the rating, treat "not protected" as the working assumption.

It Names an ADR Provider You Can Use for Free

Under social responsibility code provision 6.1.1 a licensee must let a customer refer an unresolved dispute to an approved ADR entity free of charge once eight weeks have passed, and the Commission publishes the approved list. The check is a search of the terms for the provider's name, then a look at the Commission's list. A site that names no provider, or names one outside the list, has quietly removed the cheapest remedy a consumer has.

It Sets Out Bonus Terms Within One Click, Not in an Appendix

Significant conditions on a promotion — wagering, deposit, withdrawal requirements — must be clear and prominent, and online they should be no further than one click away. Then count: anything above ten times wagering on bonus funds is a term a British licence no longer permits. A number like 40× is not a spicy offer, it is a jurisdiction statement.

It Answers the Identity Question Before You Deposit

Look at the help pages for what documents may be requested, in what circumstances and in what form; licence conditions require those to be signposted before the first deposit. A help page that lists passports, driving licences and household bills, and explains that database checks usually remove the need for them, is a site that has thought about the withdrawal conversation in advance.

How to Judge an Online Gambling Site in Six Checks

These are ordinary checks any careful person can run, in order, before money moves.

1. Verify the licence on the Commission's public register, including the domain name. The register lists licensed activities; a matching brand with a mismatched domain is a warning, not a technicality. This is the only check that governs all the others.
2. Find the customer-funds rating in the terms and read which of the three it is. "Not protected" is legal and disclosable; it is the thing you want to know before, not after. Gambling businesses are also allowed to hold customer money in overseas bank accounts, so a named jurisdiction is worth noting.
3. Read the withdrawal section for maximum limits and processing charges. A term capping withdrawals from the deposit balance is prohibited in Britain. A cost-reflective processing fee is not, provided it is disclosed before you deposit and does not exceed the direct cost.
4. Check that reverse withdrawals are unavailable. Once a withdrawal is requested, the option to cancel it and stake the money again must not exist under RTS 14B. If a "cancel withdrawal" button appears, the site is not operating to British rules.
5. Count the wagering on any bonus and check the product mix. Above ten times is non-compliant on a British licence, and an offer that spans two product types is banned outright. Note the maximum bet while wagering and the maximum cashout — the second is where offshore terms do their damage.
6. Look for the deposit-limit prompt on the first deposit. Since 31 October 2025 operators must prompt customers to set a financial limit before their first deposit, present it as the default, and offer financial limits as a free-text box. Its absence is a small sign that says something large.

Offshore Sites and the GamStop Question

An offshore site that holds no Commission licence is not connected to GamStop, since the scheme's obligations bind only British-licensed operators. GamStop's own terms say the same in plainer words: the scheme blocks participating operators only, and cannot prevent access to services run by organisations that do not take part. This is reported by trade sources as much as by the regulator, so treat the precise wording with the usual caution.

What follows matters. A self-exclusion holds for its full term and then stays in place until the person contacts GamStop to remove it, and an offshore site is not a way round it — it is simply outside the scheme, which is a different thing entirely and a worse one. The Commission issued an industry warning notice on 20 January 2025 about licensed casino games appearing on unlicensed websites, noting that such sites often target customers who have self-excluded and may have inadequate social responsibility and AML controls. The targeting is the point, not an accident.

The enforcement arithmetic is sobering rather than reassuring. Since April 2024 the Commission's Illegal Markets team has issued 3,140 cease and desist and disruption notices, referred 447,778 Google and Bing URLs, and secured 287,961 removals, yet it began no criminal investigations at all in April to June 2026 and started one prosecution in the whole year to March 2026. Blocking access is faster than prosecuting anybody, and it is easier to replace a domain than to lose a licence you never held.

Blocking software adds a layer rather than a guarantee: Gamban blocks licensed and unlicensed sites, and after TalkBanStop funding ended on 31 March 2026 it costs £4.99 a month or £29.99 a year in England and Scotland, though it is free in Wales. Bank gambling blocks, offered by names including Barclays, HSBC, Lloyds, Monzo, NatWest, Santander and Starling, decline payments under gambling merchant codes and must be switched on card by card; most banks impose a 48- or 72-hour cooling-off before gambling transactions resume. Both are useful. Neither is a substitute for a licence condition that makes an operator check a register daily.

Dated Facts, Not a Hall of Fame

A few markers, because a claim with no date is a claim with no value. The £5 maximum stake per game cycle for online slots came in on 9 April 2025, with the £2 limit for 18- to 24-year-olds following on 21 May 2025, and neither applies to roulette or blackjack. The statutory levy commenced on 6 April 2025, replacing voluntary contributions. Credit cards were banned for remote gambling from 14 April 2020. Reverse withdrawals went on 31 October 2021. The wagering cap arrived on 19 January 2026.

Against that, the softer side of the ledger. The Gambling Survey for Great Britain's third annual report, published 16 July 2026 and based on 20,775 adults, found 2.4% scoring 8 or more on the problem gambling severity index — described by the Commission as broadly stable across three years at 2.5%, 2.7% and 2.4%. That stability is either a triumph of harm reduction or a sign that the measures are not moving the thing that matters. I lean towards the second reading, mildly. Regulating a market well is not the same as shrinking the harm inside it.

Common Questions About Online Gambling in the UK

Is online gambling in the UK legal?

Yes, when the operator holds a Gambling Commission licence. Section 33 of the Gambling Act 2005 makes it an offence to provide gambling facilities without one, and the Commission states it is illegal to offer commercial gambling services to consumers in Great Britain without a Commission licence even if the operator is licensed elsewhere. Offshore sites that accept British customers without one are operating unlawfully, whatever licence they display.

How many people gamble online in the UK?

The Commission's operator data for January to March 2026 recorded average monthly active online accounts of 13.4 million, with 26.8 billion bets and spins in the quarter and total online yield of £1.55 billion, up 7% year on year. That dataset covers roughly 70% of the market, the largest operators, and can include free bets and bonuses, so treat it as a floor rather than a total.

How many online gambling sites are there in the UK?

Nobody can give an exact figure, because sites open and close faster than any register is updated. The Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, 4% more than a year earlier, while enforcement action was taken against 311 in the second quarter of 2026-27. The count of lawful sites is a moving number; the count of unlawful ones is a moving target.

Are the biggest online gambling companies in the UK safer to use?

Size is not a protection in itself, but it does come with disclosure. Operators holding customer funds must state their insolvency protection rating, and a large operator is more likely to hold a client account and to publish a rating. The Commission's data on large operators found 96.3% of 44.2 million withdrawals from June to September 2024 cleared automatically, with 3.5% inside 24 hours and 0.1% taking up to 48 hours.

What are online gambling rules UK players should know?

The ones with teeth: identity verified before gambling, credit cards banned, reverse withdrawals banned, no maximum withdrawal limit on the deposit balance, customer funds held separately with a stated protection rating, a financial limit prompted before the first deposit, and a free ADR route after eight weeks. Wagering on bonus funds is capped at ten times, and mixed-product promotions are banned. Those terms are not marketing promises; they are licence conditions.

Can an offshore site get round a self-exclusion?

No. An offshore site is outside the GamStop scheme, which binds only operators licensed in Great Britain — that is not the same as overriding it, and the exclusion itself holds for its full term and then stays in place until the person contacts GamStop to remove it. The Commission's January 2025 warning notice says unlicensed sites often target self-excluded customers, which is precisely why they are the wrong answer.

The Balance Is Only as Good as the Regulator Behind It

A player's balance is protected in Britain by an accumulation of small, unglamorous rules — a register checked daily, a client account, a banned button, a capped wagering figure — and none of them exists on an unlicensed offshore site, which is the whole reason the two are worth comparing and why the comparison always ends the same way.

The numbers keep the argument honest. Zero criminal investigations begun in April to June 2026, one prosecution in the year to March 2026, and 586 illegal sites still accessible in September 2026: enforcement is a game of whack-a-mole played with cease and desist letters, while the customer's real remedy remains the fact of the licence. If gambling stops being entertaining, the National Gambling Helpline on 0808 8020 133 answers free, day and night, all year.

Facts current as of 13.11.2026.