Independent Casinos Not on GamStop: Licences, KYC and Accountability in 2026

GamStop blocks. That is its job. The UK's national self-exclusion scheme, run by GAMSTOP Ltd and funded by the gambling industry since 2018, lets a player lock themselves out of every UK-licensed operator with a single registration. Around 500,000 people have used it since launch, and the scheme covers roughly 99% of the British online gambling market by revenue. So when someone searches for casinos not on GamStop, they are searching for the gap.

Here is the uncomfortable part. That gap is not a loophole in the law. It is a structural feature of it.

A casino outside the UK licensing regime cannot be compelled to join GamStop, cannot be compelled to report to the Gambling Commission, and cannot be compelled to honour a self-exclusion you set up somewhere else. What it can do is hold a licence from another regulator, and that licence comes with its own obligations.

This article looks at those obligations in detail: what an operator must prove to get a licence, what it must keep proving to retain one, and how anti-money laundering rules, identity checks and third-party audits actually work in practice.

What a Gambling Licence Actually Requires in 2026

Licences are not decorative. They are operating conditions with teeth. An operator that holds a UK Gambling Commission licence agrees to roughly 300 pages of licence conditions and codes of practice, and the Commission has withdrawn or suspended more than 40 licences since 2014. Fines in the same period run past £200 million in aggregate, with individual penalties reaching £32 million in the case of one high-street bookmaker in 2023.

That enforcement record matters for anyone weighing up an offshore option, because it tells you what regulators actually punish. The pattern is consistent: failures in anti-money laundering controls, failures in customer interaction, and failures to act on information that should have triggered a review. In 2024 alone the Commission issued financial penalties against operators totalling more than £30 million, and the majority of those cases involved AML or safer gambling failures rather than rigged games or unpaid winnings.

Which regulators licence casinos outside GamStop?

The four you will meet most often are the Malta Gaming Authority (MGA), the Curaçao Gaming Control Board, the Kahnawake Gaming Commission in Canada, and the Anjouan Gaming Authority.

Malta is the heavyweight: an MGA licence requires a physical presence in Malta, a minimum share capital of €100,000 for a gaming service licence, and compliance with the EU's fourth and fifth anti-money laundering directives.

Curaçao reformed its regime in 2023 and now issues licences through a single authority rather than the old master-licence system, with application fees starting around €4,000 and annual costs scaling with revenue.

Anjouan and Kahnawake sit at the lighter end. Anjouan licences have become popular with newer brands because the application process is faster and cheaper, but the supervisory depth is thinner. Kahnawake has been issuing licences since 1999 and has a longer track record, though its standards are not equivalent to Malta's. None of these regulators can force an operator to join GamStop. That is a matter of UK law, and UK law stops at the UK border.

Why do offshore operators skip GamStop registration?

Because they can, and because joining is not free. GamStop charges operators for participation, and participation requires integration with the scheme's API and the UK licensing framework that underpins it. An operator with no UK licence has no legal route into the scheme even if it wanted one. A handful of offshore brands have voluntarily built their own self-exclusion tools that mimic GamStop's function, but they are not connected to the national database, so an exclusion set there does not travel.

This is the single most misunderstood point in the whole debate. GamStop is not a global registry. It is a UK registry with UK members. Searching for a casino "not on GamStop" is really searching for a casino "not licensed in the UK", and those two things are not identical but they overlap almost completely.

AML, KYC and the Paper Trail Behind Every Deposit

Identity checks are where offshore casinos live or die. The Financial Action Task Force sets the international baseline, and every credible regulator transposes it into local rules. In practice that means an operator must identify a customer before allowing significant play, verify the identity documents supplied, monitor transactions against expected patterns, and report anything suspicious to its national financial intelligence unit.

Malta-licensed operators must file suspicious transaction reports with the Financial Intelligence Analysis Unit. UK-licensed operators file with the National Crime Agency. Curaçao operators file with the local FIU under the National Ordinance on the Reporting of Unusual Transactions. The reporting chains differ, but the trigger conditions are broadly similar: a deposit that does not match a customer's profile, a sudden change in betting pattern, or a document that fails verification.

What documents will an offshore casino demand?

Expect a photo ID such as a passport or driving licence, a proof of address dated within the last 90 days, and increasingly a source-of-funds declaration if your activity crosses a threshold. That threshold varies. Some operators trigger enhanced checks at £2,000 in cumulative deposits. Others set it at £5,000. A few apply a monthly net-loss trigger instead, often around £1,500. There is no single number because there is no single rulebook.

Payouts are the moment these checks bite hardest. A first withdrawal will almost always sit in a pending queue while documents are reviewed, and 24 to 72 hours is a normal turnaround. Some operators handle it in under 6 hours. Others take 5 working days and blame the payment processor. The difference usually comes down to how much verification was done at sign-up rather than at withdrawal.

How do audits catch operators that cut corners?

Two types of audit matter. The first is the regulator's own inspection, which can be announced or unannounced, and which examines records, policies and staff training. The second is the independent testing house. eCOGRA, iTech Labs, GLI and BMM Testlabs certify random number generators and payout percentages, and their certificates are published by operators that want to prove fairness. An operator with no testing certificate from any recognised lab is telling you something.

Malta requires licence holders to submit monthly reporting and to undergo periodic compliance audits. The MGA has cancelled or suspended dozens of licences since 2018, and the reasons are published, which makes it a useful research tool. Search a brand's licence number on the MGA register and you will see its status, its licence class and any regulatory action. Curaçao's new register, live since 2024, does something similar though with less detail. Anjouan's register is thinner still.

The Operators Worth Knowing, and What Their Licences Tell You

Not every offshore brand is created equal. Some hold a single lightweight licence and little else. Others hold multiple licences, publish audit certificates, and run their own self-exclusion tools. The distinction matters more than any welcome bonus figure, because a licence is the only document that gives you a route to complain to someone other than the operator's own support desk.

Which brands hold the strongest offshore credentials?

Start with the ones that carry Malta or UK licences alongside their offshore operations. LeoVegas casino has held an MGA licence since 2012 and a UK licence since 2014, and its games come from NetEnt, Pragmatic Play and Evolution among others. Casumo casino holds both MGA and UK licences and has been publicly fined by the UK Commission, which tells you the regulator is watching. Unibet casino, part of Kindred Group, holds licences in Malta, the UK and several other jurisdictions, and publishes its responsible gambling framework in detail.

Then there are the brands built specifically for players outside the UK scheme. Mr Vegas casino operates under an MGA licence and markets heavily to players who cannot use UK-licensed sites. PlayOJO casino holds a UK licence but is known for a no-wagering bonus model that removes one of the most common complaint categories. Casumo, LeoVegas and Mr Vegas all publish RTP figures on individual game pages, which is more than most UK-licensed operators do.

At the other end, brands like NineWin casino, Donbet casino, Lucky Pants casino and Fat Pirate operate under Curaçao or Anjouan licences. That is not automatically a problem, but it changes your options if something goes wrong. There is no UK ombudsman route, no Commission complaint, and no GamStop protection. What you have is the regulator named in the footer, and the question is whether that regulator answers emails.

Does a licence guarantee you get paid?

No. A licence guarantees there is a regulator you can escalate to, and that the operator has met minimum capital and compliance requirements. It does not guarantee the operator will not collapse, and it does not guarantee a payout arrives in 24 hours. What it does is give you a documented complaints process. Malta requires operators to respond to complaints within 10 days, and the MGA will step in if that fails. Curaçao's process is slower and less predictable.

The practical check is simple. Find the licence number in the footer, search it on the regulator's public register, and confirm the brand name matches. If the licence is held by a different company name, that is normal, but the register should show the relationship. If nothing comes back, treat it as a warning sign.

Player Protections That Replace What GamStop Would Have Done

Losing access to GamStop does not mean losing every protection. It means the protections are self-administered rather than centrally enforced, and that shift puts more responsibility on you. The tools exist. The question is whether you use them before you need them.

What self-exclusion options exist outside the UK scheme?

Most MGA-licensed operators offer a cooling-off period of 24 hours to 6 weeks, and a full account closure that can be permanent or set for 6 months to 5 years. These are operator-level tools, so they only apply to that one brand. If you hold accounts at 8 different offshore sites, you need to set 8 separate exclusions. That is the core weakness.

Some operators participate in GAMSTOP's international counterpart schemes or in industry-run alternatives. BetMGM casino, for instance, operates in multiple regulated markets and applies market-specific exclusion rules depending on which licence the customer falls under. The pattern to look for is a clearly published responsible gambling page with named tools, not a generic paragraph about playing for fun.

Which limits should you set before you deposit?

Deposit limits are the most effective single control, and they are usually the easiest to set. A daily limit of £50 is enforceable immediately at most MGA-licensed sites, though decreases take effect straight away and increases typically carry a 24-hour cooling-off. Loss limits work similarly. Session reminders, usually firing at 30 or 60 minutes, are weaker tools but they do interrupt autopilot play.

Time-out features are worth knowing about because they are reversible. A 24-hour time-out blocks access without closing the account, which suits players who want a break rather than an exit. Permanent closure is the nuclear option and should be treated as such. If you are considering it, do it on every account you hold, not just the one that prompted the decision.

Where does the UK regulator stand on offshore play?

The Gambling Commission's position is straightforward: it regulates operators, not players. Using an offshore casino is not a criminal offence for the individual in the UK. What changes is your legal standing. A dispute with a UK-licensed operator can go to the Commission or to an alternative dispute resolution provider. A dispute with a Curaçao-licensed operator goes to Curaçao, and enforcement of any ruling in the UK is not automatic.

There is also a tax angle worth flagging. UK-licensed operators pay the remote gaming duty of 21% on gross gambling yield. Offshore operators do not, which is part of why they can offer larger bonuses. That advantage is real, but it is funded by the absence of the UK framework, not by superior efficiency.

Reading the Small Print Before You Register

Bonus terms are where offshore casinos differentiate themselves, and also where most complaints originate. A 100% match up to £200 sounds identical across 20 brands until you read the wagering requirement. At 35x on the bonus alone, you need to stake £7,000 before withdrawing anything from a £200 bonus. At 40x on bonus plus deposit, that figure becomes £16,000. The gap between those two numbers is the entire product.

What wagering terms should trigger a second look?

Anything above 40x is expensive. Anything above 50x is close to unachievable for a casual player. Watch for game weighting too: slots usually contribute 100% toward wagering, live dealer games often contribute 10% or nothing, and table games are frequently excluded entirely. A bonus that cannot be cleared on the games you actually play is not a bonus, it is a deadline.

Maximum bet rules during wagering are the other common trap. Many operators cap individual bets at £5 while a bonus is active, and breaching that cap voids the bonus and any winnings from it. Read that clause before you spin, not after. Withdrawal caps are the third item: some bonuses limit cashout to 10x the bonus amount, so a £200 bonus caps at £2,000 regardless of what you win.

How do payment methods affect your protection?

Card deposits through Visa or Mastercard give you a chargeback route that e-wallets do not. That matters if an operator refuses a payout without a stated reason. PayPal, Skrill and Neteller transfers are faster but harder to reverse. Cryptocurrency deposits are effectively irreversible, which is fine if the operator is reliable and painful if it is not.

Withdrawal times vary by method and by operator. E-wallets typically clear in under 24 hours once verification is complete. Card withdrawals take 1 to 5 working days. Bank transfers can take 3 to 7. If an operator quotes 48 hours for an e-wallet withdrawal and consistently delivers in 72, that is a data point about how it runs its back office.

What does a compliant operator publish voluntarily?

Look for four things. A named regulator with a searchable licence number. Published RTP figures on individual games, since anything below 94% is worth questioning. Audit certificates from a recognised testing house. And a complaints process that names an external escalation route rather than looping back to the operator's own support team.

Operators that publish all four are rare, and the ones that do tend to be the ones holding multiple licences. Evolution, Pragmatic Play and NetEnt supply games to hundreds of brands, so the software is rarely the differentiator. The licence, the audit trail and the complaints route are.

Is playing at an offshore casino legal in the UK?

Yes, for the player. The Gambling Act 2005 makes it an offence to provide gambling facilities to consumers in Great Britain without a licence, but it does not criminalise the consumer. You will not face prosecution for depositing at an MGA or Curaçao-licensed site. What you lose is access to UK dispute resolution, GamStop coverage, and the protection of the UK's 21% duty framework that underpins operator solvency requirements.

Can an offshore casino voluntarily join GamStop?

Not in any meaningful sense. GamStop membership is tied to holding a UK Gambling Commission licence, and the scheme's technical integration runs through that framework. A handful of offshore operators run their own self-exclusion registers with similar names, but they are separate databases. An exclusion registered with one does not appear at the other, and there is no cross-checking between them.

How long does verification take at a non-GamStop casino?

Sign-up verification at a well-run MGA operator typically completes in under 10 minutes if you upload documents immediately. Withdrawal-stage verification is slower: 24 to 72 hours is standard, and 5 working days happens. Operators that verify at registration rather than at first withdrawal tend to pay out faster overall, because the backlog never builds. Ask support directly when verification happens before you deposit.

What happens if an offshore casino refuses to pay?

You escalate to its regulator. Malta requires operators to have an internal complaints procedure and to respond within 10 days; if that fails, the MGA can intervene. Curaçao's process is slower and outcomes are less predictable. In practice, a documented complaint with screenshots, transaction records and a clear timeline performs far better than an email saying you have been cheated. Keep everything.

Do offshore casinos pay tax on UK players' losses?

No. Remote gaming duty of 21% applies to operators licensed by the UK Gambling Commission on their UK-facing gross gambling yield. An MGA or Curaçao operator with no UK licence pays nothing to HMRC on UK player activity. That is the structural reason offshore bonuses are larger, and it is also the reason the UK framework has no leverage over those operators when disputes arise.

Which licence should you prioritise when choosing?

Malta first, then the UK, then Curaçao under its post-2023 regime, then everything else. Malta combines capital requirements, AML obligations under EU directives, and a public enforcement record you can actually read. Curaçao's reformed framework is a genuine improvement on the old master-licence system but the supervisory depth is still thinner. Anjouan and Kahnawake licences tell you the operator exists and pays for a certificate. Not much more.

Responsible Gambling: The Rules That Apply Regardless of Licence

Gambling in Great Britain is restricted to adults aged 18 and over. That age limit applies to offshore sites too, and any operator accepting registrations from under-18s is breaching its own licence conditions as well as UK law. Age verification is a licence requirement in every credible jurisdiction, and it is one of the few rules that is enforced consistently.

If gambling stops being a form of entertainment and starts being a way to recover losses, stop and get help. GamCare runs the National Gambling Helpline on 0808 8020 133, available 24 hours a day across the UK, and offers free counselling through its NetLine service. GamStop, at gamstop.co.uk, provides self-exclusion across all UK-licensed operators, and registration takes around 5 minutes. Gam-Anon UK runs support meetings for families affected by someone else's gambling.

Set deposit limits before your first session, not after a bad one. Use time-outs when you need a break rather than a full closure. And if you hold accounts at multiple offshore sites, remember that exclusion tools are operator-specific: the only way to lock yourself out everywhere is to do it everywhere, one account at a time. That is the trade-off you accept when you play outside the UK framework, and it is worth going in with your eyes open.