Online gambling sites UK in 2026 means two different markets: the sites licensed by the Gambling Commission and bound by GamStop, and the offshore sites that are not licensed here, are not connected to the scheme, and sit outside every protection that comes with a British licence. GamStop holds those sites to a block, not the rest.
The head keyword for this page is broad, and so is the market it describes. On the figures the Gambling Commission published on 17 September 2026, gambling in Great Britain generated £17.5 billion in gross gambling yield in the year to March 2026, up 4.4% on the year before, with £8.3 billion of it from remote casino, betting and bingo. That is the licensed trade. Beside it, the Commission identified 586 illegal gambling websites accessible to British consumers in September 2026.
I have covered this trade for long enough to be wary of the phrase "best online gambling sites uk", because most of what sits behind it is affiliate copy wearing a suit. The honest version of the question is narrower and more useful: which sites are licensed here, and what does that licence actually guarantee? The answer to the second half of that question has a single spine running through it — the national self-exclusion scheme, and the fact that it works absolutely inside the licensed market, and not at all outside it.
This page covers what British licensed sites are held to, how the exclusion register works and how long an exclusion lasts, how offshore licences compare, what withdrawal and identity rules apply, and how to tell a trustworthy operator from a well-dressed one.
One note on the name itself, because it is a small fact people keep getting wrong: the scheme is GamStop, and it is very often typed "gamestop".
If gambling is causing harm, the National Gambling Helpline is run by GamCare on 0808 8020 133, free, 24 hours a day, every day. In Wales the number given is 0808 2819 265. GamCare also answers by live chat and WhatsApp, and Citizens Advice offers free, confidential help with the debt that usually follows. This page is about how the market is built, not about anyone's own circumstances.
Table of Contents13
- What the Licence Is Actually Worth
- How Long Does a GamStop Exclusion Last, and What Happens Afterwards
- Five Signs an Operator or Service Can Be Trusted
- Licensed, Offshore and Everything Between
- Payments and the Licence
- Six Steps to Check a Site Before Depositing
- The Identity Checks Behind the Delay
- New Sites, Old Tricks
- The Register in Numbers
- When the Scheme Has No Reach
- The Land-Based Schemes
- Does Self-Exclusion Have a Loophole?
- How to Read This Market
What the Licence Is Actually Worth
The single benchmark worth carrying around comes from the operator of the scheme itself. At the end of 2025 the register held 561,983 active exclusions, and by July 2026 that had risen to 614,738 — more than one in two of them a five-year exclusion, and only one in four a six-month one. In the year to 31 December 2025 GamStop recorded 117,756 new registrations. In the first half of 2026 it reported a 16% year-on-year increase, with May 2026 setting a monthly record of 12,236 sign-ups.
Read those numbers as a market fact rather than a human one and they say something stark. Around 614,738 people have asked the British-licensed industry, in writing, to refuse their custom for at least six months. The industry checks every one of those names at least every 24 hours, because it has to.
That obligation is not a convention. Since 31 March 2020 every online operator has been required to participate in the national multi-operator self-exclusion scheme as a condition of its licence, under social responsibility code provision 3.5.5 of the Licence Conditions and Codes of Practice. The Commission does not bluff on this one. In April 2020 it suspended the licences of two operators for missing the integration deadline.
So what does a British licence buy a player? A named regulator with a public register, statutory dispute resolution, a ban on reverse withdrawals, a cap on wagering requirements, a credit card ban and an exclusion register that operators must query. None of it is a guarantee of a pleasant evening. All of it is enforceable.
How Long Does a GamStop Exclusion Last, and What Happens Afterwards
This is the point on which the whole topic turns, so it is worth stating slowly.
Registration takes a few minutes. It can take up to 24 hours for the block to bite across the market. Choose six months, one year, five years, or five years with auto-renewal, and the block applies to every online gambling company licensed in Great Britain.
You cannot cancel it. Not by ringing the operator, not by opening a new account with a different email address, not by asking the Commission, and not by moving to a site that does not check. GamStop's refusal to remove registrations early is so settled that the group devoted a section of its 2025 annual report to it.
The part that catches people out is what happens when the term ends. The exclusion does not simply lapse. It stays in place until the person contacts GamStop to remove it. Take the five-year term with auto-renewal: under the terms of use, updated 20 May 2026, the auto-renewal switch can only be turned off during the last six months of a minimum five-year period, and it otherwise continues for up to four further five-year periods. And if someone does nothing at the end of their chosen term, GamStop holds their data through a further automatic seven-year self-exclusion period during which operators are told they were previously excluded.
Spelling that out matters, because it is precisely the trap the offshore trade sells against. The Commission's industry warning notice of 20 January 2025 said unlicensed sites were often targeting customers who had self-excluded through GamStop. That is not an escape route; it is a description of the pitch, and the pitch is the problem.
Under-25s accounted for nearly one in three of all registrations in the first half of 2026, a 26% year-on-year rise — worth remembering next time someone argues the young are immune to the paperwork.
Five Signs an Operator or Service Can Be Trusted
Five checks, each of which takes a minute. None of them requires an account.
The Licence Entry Actually Matches the Domain
Any operator advertising to British customers must hold a Commission licence, and the Commission publishes a register listing the domain names attached to each one. A licensed brand may legally operate a site that is outside its licence — it happens, usually after a corporate reshuffle. Check the domain, not the logo. The same discipline applies offshore: a Curaçao Certificate of Operation seal must redirect to the CGA's verification page and must display the domain you are actually on. If it shows a different domain, you are looking at another operator's certificate.
The Terms Say Where the Money Sits if the Firm Fails
Operators holding customer funds must choose one of three insolvency ratings — not protected, medium protection, high protection — state it in writing, and, if they are rated not protected, remind customers every six months with the value of the funds held. That disclosure has to be acknowledged before funds are used for gambling. If you cannot find the rating in a minute, that is the finding.
The Bonus Terms Fit on a Screen
Since 19 January 2026, British licensees cannot apply wagering requirements above ten times, and cannot wrap more than one type of gambling product into a single incentive. Before that date it was common to see 60× attached to a welcome offer. A term that takes a calculator and a lawyer to price is not a generous term.
The Complaints Page Names a Real ADR Provider
Operators must let customers escalate an unresolved dispute to an approved alternative dispute resolution provider, free of charge, once eight weeks have passed or a deadlock letter has been issued. Naming one is a sign of a grown-up operator. A terms page with no route out of the operator's own inbox is a red flag dressed as confidence.
The Withdrawal Page Explains Itself Before You Deposit
British rules require players to be told what identity documents might be needed and when. The Commission has been blunt that asking for documents only at withdrawal is unacceptable: over a quarter of complaints reaching its contact centre concerned identity verification. A site that explains verification up front is doing the thing that gets it complained about least.
Licensed, Offshore and Everything Between
Not all offshore licences are the same, and pretending otherwise is lazy. Malta's regulator publishes a list of unauthorised URLs and carries a substantial fee schedule. Curaçao has rebuilt its regime entirely. Anjouan issues licences for a fraction of the cost and has been described in rather harsher terms by Comorian officials. Costa Rica does not license gambling at all, whatever a website's footer claims.
| Criterion | British licence (UKGC) | Malta (MGA) | Curaçao (CGA) | Anjouan |
|---|---|---|---|---|
| Access to the GamStop register | Mandatory, checked at least every 24 hours | Not connected to it | Not connected to it | Not connected to it |
| Wagering requirement ceiling on bonuses | 10× since 19 January 2026 | Not set at UK levels | Not set at UK levels | Not set at UK levels |
| Licence application fee | Not publicly set out at these levels | EUR 5,000 | EUR 4,592 | EUR 17,828 |
| Annual regulator-facing cost | Statutory levy at 1.1% of online GGY | EUR 25,000 plus 5% gaming tax | EUR 47,450 total | EUR 17,828 renewal |
| Minimum paid-up capital | Not published in these terms | EUR 100,000 (Type 1 and 2); EUR 40,000 (Type 3 and 4) | Not published in these terms | Not published in these terms |
| Statutory dispute route | Approved ADR, free to the consumer | Complaints form, English or Maltese | Seal and certificate verification, ADR required | Named ADR provider |
The table is by criterion, not by brand, and that is deliberate. The interesting column is not the fee one. Note what the money buys. Malta requires a Maltese or EU/EEA entity with €100,000 of paid-up capital before it will licence a Type 1 or 2 B2C operation, plus €25,000 a year and 5% of gaming revenue. Anjouan charges €17,828 and says plainly that its licences carry no territorial restrictions under Anjouan law, while also warning — in a statement of 10 June 2026 — that no licensing authority can exempt an operator from local law. That is the regulator telling you the licence does not travel.
Two structural details complete the picture. Curaçao's old master-licence model is gone: the 2018-vintage "orange" sub-licence certificates of operation ended on 15 October 2025, and the four former master licensors stopped issuing on dates staggered between 18 August 2024 and 31 January 2025. Historic /JAZ numbers are therefore not proof of anything current. Any page still waving one is waving a souvenir.
And the sums involved in offshore play are smaller than the noise suggests. Commission analysis published on 5 November 2026 puts engagement with illegal gambling sites at 0.6% of all respondents in the previous four weeks, and at 2.5% among those who had gambled online in that period. The black market is real, and it is not the majority of anything.
Payments and the Licence
Withdrawal rules are where the licensed market earns its keep, and the numbers are less dreary than the reputation.
Commission data covering June to September 2024, cited in a speech delivered on 6 November 2025, records 44.2 million withdrawals by customers of large online operators. Of those, 96.3% cleared automatically, 3.5% cleared within 24 hours, and 0.1% took up to 48 hours. Separate complaints data tells the same story from the other side: complaints coded "withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025.
The reason the process is less fluid than it looks is that bits of it are legally stuck. Reverse withdrawals were banned outright from 31 October 2021 — a requested withdrawal cannot be cancelled, and the funds cannot be put back into play. A withdrawal request cannot trigger a demand for information the operator could reasonably have asked for earlier, which is the rule that makes the classic "documents, please, right at the finish line" move a licence breach rather than bad manners.
Presence of a rule is not the same as observance. In October 2026 the Commission settled with one licensee for £900,000 over failures that included unnecessarily delaying consumer withdrawals: a term letting customers request only one withdrawal at a time, and manual review of every fifth or tenth withdrawal that forced extra documents before processing. That is the shape of the abuse to watch for.
Complaints that do not resolve go to ADR, and the providers publish what they see. eCOGRA's report for 1 October 2024 to 30 September 2025 records 911 disputes, of which 150 valid ones concerned deposits and withdrawals, with an average of 31 days to resolve and 17.8% decided in the consumer's favour. IBAS handled 3,721 domestic disputes in its 2024–25 year, 217 of them banking or financial, completing domestic cases in 20 days on average.
Six Steps to Check a Site Before Depositing
- Find the operator's licence entry on the Commission's public register and confirm your domain is listed. The register is the only source that matters; a licence badge is an image, and images are cheap.
- Open the bonus terms and read the wagering multiple. Anything above ten times cannot be applied by a British licensee, so a higher figure tells you where the licence sits — or does not.
- Read the customer funds clause. Look for the insolvency rating and the words "not protected", "medium protection" or "high protection". If it is absent, the terms are incomplete.
- Locate the complaints and ADR section before you need it. Note the provider's name and the eight-week point at which you may escalate. Disputes are lost early, not late.
- Check the withdrawal method against licence condition 5.1.2. Payments from British customers must come through a provider regulated under the Payment Services Regulations 2017, and credit cards have been banned since 14 April 2020. Crypto and unregulated rails are a different regime entirely.
- Set the deposit limit at the first prompt and check the self-exclusion status of the site. Since 31 October 2025 operators must prompt for a financial limit before a first deposit and make it easy to review; setting it as the default is the regulatory expectation.
The Identity Checks Behind the Delay
Identity verification is the mechanism that everything else in this market hangs from: the exclusion register only functions because operators can match a name to a face to a document.
For British-licensed remote operators, licence condition 17 requires identification and verification before a customer is permitted to gamble, with name, address and date of birth as the minimum. In practice many sites use what the Commission calls a hybrid approach — checks at registration, full verification deferred — but the AML regulations bite at €2,000 in deposits or withdrawals, in a single transaction or transactions that appear linked, including those within one logged-on session. That threshold is a floor, not a licence to ask for nothing below it.
The first time, the check is usually invisible: the operator matches the account against databases such as credit reference agencies and the electoral roll, and no document is produced. Later — and particularly when a withdrawal is requested — the documents appear: passport, driving licence, household bill, sometimes a selfie where fraudulent activity is suspected, sometimes bank statements where source of funds matters.
The warning signs are familiar. Being asked for everything only at withdrawal. A partial verification waved through on a middle name rather than a forename, which the Commission has flagged as a route to mismatches with GamStop records and therefore to a broken exclusion. And the hard-edged version: an operator confiscating funds because identity was never verified. Customer funds deposited and not yet staked remain the customer's, and the un-staked balance may not be confiscated on identity grounds.
New Sites, Old Tricks
Every year brings a fresh crop of operators with a new licence number and a tidy design. Novelty is not a quality signal, in either direction. A new British-licensed site is bound by exactly the rules an older one is, including the exclusion register and the 10× wagering cap, and it will have had to integrate with GamStop before it took a single bet. A new offshore site is bound by none of it, whatever its welcome offer says.
The number worth watching is not the count of sites — the Commission's own dashboard recorded 586 illegal gambling websites accessible to British consumers in September 2026, 4% more than a year earlier — but the enforcement behind them. In the quarter July to September 2026 the Commission referred 1,835 websites to search engines and issued 546 cease and desist notices. Its own analysis, published in October 2025, found that registrar blocks and website suspensions cut engagement by around 91% each, against 30% for Google removals. Discovery is not the same as access.
The Register in Numbers
| Exclusion term chosen in 2025 | Share of registrants |
|---|---|
| 6 months | 29% |
| 1 year | 24% |
| 5 years | 25% |
| 5 years with auto-renewal | 22% |
The pattern in that table has shifted. Of the 614,738 people on the register in July 2026, more than one in two had taken the maximum five-year term, while across all age groups only one in four had chosen six months. People who sign up for a block increasingly sign up for a long one — which makes the removal mechanics, not the registration, the live issue. The Commission's 2025 annual report also recorded the gender split of registrants as 94.3% male and 5.7% female, a statistic that says as much about who asks for help as about who needs it.
When the Scheme Has No Reach
Self-exclusion sits inside a rope, and the rope is the licence.
GamStop blocks access to gambling websites and apps licensed in Great Britain only. Offshore sites holding no Commission licence are not connected to the scheme, and are not covered by it, because the obligations apply solely to UK-licensed operators. That position is stated by trade and press sources rather than a single regulator page — the Commission's own warning notice of 20 January 2025 describes unlicensed sites targeting GamStop customers, which amounts to the same thing in practice.
The difference in kind is stark. Breach social responsibility code 3.5.5 and you have breached your licence condition by virtue of section 82(1) of the Gambling Act 2005; it is a regulatory matter with fines and suspensions attached. Offshore, there is no scheme to breach. Anjouan requires licensees to segregate player funds and appoint an ADR provider, and Kahnawake runs a dispute resolution officer and calls its own voluntary self-exclusion permanent and irrevocable — but neither has the register, neither checks every 24 hours, and neither answers to a British regulator.
There is also a version of events that sites occasionally offer, in which a player excluded in Britain can simply play elsewhere. That is wrong, and not merely because of the scheme's terms. Section 33 of the Gambling Act 2005 makes it an offence to provide facilities for gambling without an operating licence, and the prohibitions apply whether the facilities are provided inside or outside the UK if the operator knows or should know they are being used in Great Britain. The Commission states that offering commercial gambling to consumers in Great Britain without a Commission licence is illegal even where the operator holds a licence elsewhere.
The help system is genuinely good, and free. GamCare's National Gambling Helpline is 0808 8020 133, 24 hours a day, 365 days a year. Gamblers Anonymous England, Wales & Ulster answers on 0330 094 0322 between 7:30am and 10:30pm, with around 250 meetings and no appointment needed. GamFam supports families through its five-stage peer programme, Gam-Anon takes enquiries at [email protected], and the NHS National Gambling Clinic in London can be reached on 020 7381 7722. NHS England has opened 15 specialist gambling clinics since 2019.
The Land-Based Schemes
Online is not the whole of it. Every premises licence holder in the arcade, betting, bingo and casino sectors must participate in a land-based multi-operator self-exclusion scheme under social responsibility code 3.5.6, and the terms are different in every particular.
SENSE covers licensed land-based casinos, with a minimum of six months extendable to twelve from enrolment, and removal only in person at a casino during the six-month "Thinking" period that follows the minimum term, after which a 24-hour cooling-off period applies. The Commission's May 2026 FOI response put SENSE's active self-excluded customers at 12,445 between 1 April 2025 and 1 April 2026. Gamstop Betting Shops, formerly MOSES, covers bookmaker shops by telephone on 0800 294 2060, works with over 60 operators across roughly 6,000 shops, and applies a fixed 12-month term that cannot be ended early — 9,075 active customers over the same April-to-April period. Arcades use BACTA and Boomerang Digital; bingo clubs use the Bingo Association's scheme.
Note the contrast with the online register. Land-based exclusions auto-remove at the end of the term in the betting shop scheme, and SENSE removes automatically if nothing is done at the end of the Thinking period. Online, the exclusion sits there until the person asks GamStop to lift it — one more reason the online version is the one that holds.
Blocking software adds a further layer, and the prices have moved. GamStop signposts Gamban and BetBlocker. TalkBanStop, which funded free Gamban licences in the UK, ended on 31 March 2026; Gamban is now free for residents of Wales but costs £4.99 a month or £29.99 a year in England and Scotland after a seven-day trial. BetBlocker remains free worldwide, requires no registration and states it blocks over 1,368,000 gambling websites and 3,100 apps.
Bank blocks are the quietest tool. The Commission's list, last updated 16 October 2026, names Bank of Scotland, Barclays, Halifax, HSBC, Lloyds Bank, MBNA, Monzo, NatWest, Royal Bank of Scotland, Santander and Starling. They work at card level, so each card must be switched on separately, and most banks apply a 48-hour or 72-hour cooling-off period before gambling transactions are allowed again after a block is lifted.
Does Self-Exclusion Have a Loophole?
No. An offshore casino can no more return an excluded player's custom to them than a British one can, because offshore sites are not connected to GamStop at all — they are simply outside its reach, which is a reason to treat them as unprotected, not as a way round anything. Nothing in the scheme's terms, and nothing in the Gambling Act 2005, offers a route back in before the chosen term ends.
How many online gambling sites are there in the UK?
There is no single published count of licensed brands, because operators hold licences covering multiple domain names, and the Commission's register lists domains rather than brands. Beside the licensed market, its illegal gambling dashboard recorded 586 illegal websites accessible to British consumers in September 2026, 4% more than September 2025. Any "top 10" list is a commercial selection, not a census.
Which are the safest online gambling sites UK players can choose?
Safety here is a licence question before a reputation question. A site holding a Commission licence is bound by licence condition 17 on identity, the 10× wagering cap in force since 19 January 2026, the reverse withdrawal ban, and the requirement to check the GamStop register at least every 24 hours. Offshore sites, by contrast, are not connected to GamStop and cannot be held to those rules by a British regulator.
Can an offshore site get round a GamStop exclusion?
No, and the framing is wrong. Offshore sites are not connected to the scheme, so an exclusion never reached them in the first place — there is nothing to get round. That is precisely why they are unsuitable for anyone relying on an exclusion holding, and why the Commission's January 2025 warning notice singled out unlicensed sites targeting self-excluded customers.
Do UK online gambling sites have to join GamStop?
Yes. Since 31 March 2020 every online operator must participate in the national multi-operator self-exclusion scheme as a condition of its licence, under social responsibility code provision 3.5.5, and operators must check their entire customer base for registrations at least every 24 hours. The deadline was not decorative: in April 2020 the Commission suspended the licences of two operators that missed it.
How do I cancel a GamStop self-exclusion?
By contacting GamStop once the chosen period has run its course — not before. The registration cannot be cancelled or deactivated during the exclusion term, and registrations are not removed early. What it never does is simply lapse: the exclusion stays in place after the end of the chosen period until the person contacts GamStop to remove it.
Is a Curaçao or Anjouan licence the same as a British one?
No, and the fee gap shows why. A Curaçao B2C licence costs EUR 4,592 to apply for, with EUR 47,450 a year in total fees; Anjouan charges EUR 17,828 to issue and the same to renew. The Gambling Commission's licence brings obligations those regimes do not mirror, including the exclusion register, statutory ADR and a fixed schedule of fair-terms rules.
Where do withdrawal delays actually come from?
Three places. Anti-money-laundering duties can require a suspicious activity report and clearance from the National Crime Agency before funds move. Identity verification can be deferred to withdrawal, which the Commission says is unacceptable where it could have been asked for earlier. And some operators simply add friction at the cash-out, which is what the £900,000 settlement with one licensee in October 2026 addressed.
How to Read This Market
The licensed market is imperfect, slow and heavily papered, and it is the only part of this trade with a rope around it that has been tested in public — 614,738 names on a register, 44.2 million withdrawals of which 96.3% cleared automatically, and a regulator willing to suspend licences over a missed deadline. Judged against that standard, offshore sites are not a freer version of the same product. They are a different product, sold with the sameulary.
The exclusion register is the clearest test of the difference, because it is the one piece of British regulation that offshore operators cannot replicate even in principle. And the register is where the trend lies: of the 614,738 people on it in July 2026, more than one in two had chosen the maximum five-year term. Long exclusions, held firmly, until someone asks GamStop to lift them.