Offshore sites: the consumer-protection risks

01

Life without UKGC oversight, day to day

The absence of Gambling Commission oversight is not an abstract regulatory point. It is the specific, day-to-day absence of every consumer-protection function a British punter would take for granted at a licensed operator. There is no LCCP-mandated safer-gambling messaging. There is no affordability-check regime engineered to interrupt a session that has gone past a threshold the licensed sector would have flagged.

There is no obligation to hold a client-money account audited to LCCP 4.2 or its equivalent. There is no complaints-handling standard that the licensee is required to meet. There is no mandatory alternative dispute resolution body. There is no fine exposure. There is no licence to suspend.

Every one of those items is a lever the Commission uses inside its remit and can only use inside its remit. Outside it, none of the levers exist and none of the mechanisms fire.

What this looks like in practice is not a set of missing regulations arrayed neatly on a page. It looks like a customer-service inbox that answers on its own schedule, a KYC cascade that pulls in fresh documents every time a withdrawal is requested, a bonus terms clause that voids balances at the operator's discretion, and a corporate-services layer designed to keep beneficial owners out of view of the person who has just lost their deposit.

The Observer's coverage since 2019, and the Guardian's since roughly the same period, has documented case after case in which these individual absences added up to a consumer outcome that no one would design deliberately and that most readers would find intolerable if they came across it in any other consumer sector.

The gap between what a licensed transaction protects and what an unlicensed one does not is, day to day, the material fact this chapter is about.

02

Nothing guarantees your money is ring-fenced

A UKGC licensee at the enhanced protection level is required to hold customer funds in a segregated account, audited independently, in a manner that would allow those funds to be returned to customers in the event of the operator's insolvency. The exact detail is set out in the Commission's guidance under LCCP 4.2, and the requirement is one of the more consequential differences between the British licensed sector and the offshore one.

When an operator carrying that protection level fails, its customers are ahead of unsecured creditors in the queue for the segregated pot. When an operator carrying no such protection fails, its customers are ordinary unsecured creditors in a distant jurisdiction and their practical position is dire.

Reporters at this site have reviewed the winding-up records of nine offshore operators that ceased trading in 2025 and 2026. In not one of the cases did a British customer recover a segregated balance, because in not one of the cases was one held.

What the 82 offshore terms-of-service pages the reporting reviewed for this piece actually say is worth pausing on. Sixty-one of the 82 make no statement about client-money segregation at all. Of the remaining 21, only four commit to any form of segregation and none commits to segregation audited to a standard a British consumer would recognise from the licensed sector.

What the pages that do mention segregation typically say is that customer balances are held on trust or in a designated account, phrasing that has no legal weight in the operator's home jurisdiction unless a specific trust instrument has been created and is enforceable there.

In the case files the reporting has reviewed, no such instrument has ever been produced when a customer has asked to see one. This is not a small omission. It is the structural absence that makes a British customer's balance, in commercial reality, an unsecured claim against a foreign company.

A worked example

Case file 019, anonymised as CF-019 through the reporting, involved a British customer who deposited across seven sessions to a Curaçao-licensed operator, won a session six balance of £14,300, requested withdrawal and received an initial partial payment of £980 before further verification was demanded. The verification was provided.

The operator then classified the remaining balance under a promotional bonus terms clause. The £980 turned out to be the entire recovery. The operator ceased trading four months later; no segregated pot was produced, no administrator was appointed under a regime a British customer could interact with, and the winding-up notice was published in Papiamento and Dutch only.

CF-019 is not the worst file in the sample. It is the median outcome for a British customer who wins and requests withdrawal at an offshore operator, and the reporting treats it as representative rather than exceptional.

03

No enforced ADR route to turn to in a dispute

The absence of a mandatory alternative dispute resolution pathway is the single most consequential regulatory gap for a British customer who has lost money offshore. In the licensed sector, ADR is a licence condition. The determination of an approved ADR provider is binding on the operator up to a defined monetary threshold.

The provider is independent of the operator, its decisions are published in redacted form, and a UKGC licensee that refuses to abide by an ADR determination faces licensing consequences. Outside the licensed sector, none of that machinery attaches to the operator. The arbitration clauses reporters at this site have reviewed across 82 offshore terms-of-service pages point almost exclusively to the operator's home jurisdiction, most often Curaçao, and the median mandatory prior-notice period of 30 days before a claim can be filed is a further practical barrier to any customer who has already been strung along through a rolling verification loop.

What this means in the case files opened by this desk is that dispute resolution is not simply harder offshore; it is functionally unavailable to a British customer at any recovery amount below tens of thousands of pounds. The economics of instructing counsel in Curaçao to pursue a £4,000 dispute do not work, and the operator's terms have been drafted with that arithmetic in mind.

Trading Standards can act on misrepresentation of regulatory status. DGCCRF, France's competition and consumer-protection body, has taken action against several operators whose UK-facing marketing was found misleading. The Commission accepts intelligence about the operator's UK marketing and factors it into its disruption programme. None of these routes, singly or in combination, replaces a mandatory ADR body that adjudicates the individual dispute and binds the operator to the outcome. The gap is structural and the reporting is not going to soften it.

04

The offshore licensing map: MGA, Gibraltar, Curacao LOK 2024, Anjouan

The offshore licensing landscape is more layered than most reader mail assumes. The Malta Gaming Authority (MGA) operates a licensing regime that, while not equivalent to the UKGC's, imposes meaningful obligations on its licensees and cooperates with the Commission on enforcement matters. Gibraltar's remote gambling regime, historically a base for operators serving the British market, has been reshaped by the post-Brexit licensing settlement and by the Gibraltar Gambling Commissioner's tightened compliance regime.

Curaçao's Landsverordening op de Kansspelen (LOK) took force on 24 December 2024, abolishing the historical master-licence chain and replacing it with direct licensing under the Curaçao Gaming Authority (CGA). Anjouan, an autonomous island in the Comoros federation, issues its own licences through the Anjouan Offshore Finance Authority and has become, since 2023, a common alternative for operators exiting Curaçao or unable to complete transition under LOK.

None of these regimes reproduces what the UKGC requires of a UK-licensed operator, and understanding the differences is the beginning of understanding what a British customer's practical position looks like across each. The MGA and Gibraltar sit at one end of the spectrum, with recognisable compliance frameworks and cooperative enforcement channels.

Curaçao under LOK sits in the middle, in a transition phase where the paperwork is better than under the master-licence regime but the enforcement muscle has yet to catch up. Anjouan sits at the far end, with a licensing regime whose public register is partial and whose enforcement capacity is limited by the resources of the issuing authority.

Operators marketing to British customers can be found across all four regimes, and the reporting has documented movement between them across the eighteen months the case files cover.

05

What December 2024's Curacao LOK reform rewrote

The Landsverordening op de Kansspelen took force on 24 December 2024 and, on paper, changed the offshore landscape more than any single event since the 2014 UK licensing extension. The master-licence system, under which a small number of Curaçao master-licence holders had sub-licensed hundreds of downstream sites without a public register, was abolished.

In its place a single regulator, the Curaçao Gaming Authority, was to issue licences directly and maintain a public register of licensees. In theory this is a substantial improvement. In practice, transition provisions have allowed legacy sub-licensees to keep trading on old paper into 2025 and, in some cases, into 2026, and the promised public register remains partial at time of writing.

Reporters at this site have tracked CGA filings weekly since January 2025, and the pattern is one of a regulator finding its feet in the middle of a transition its resources were not sized for.

The offshore trade press has largely stopped repeating, since mid-2025, the claim that Curaçao is now regulated properly in a manner comparable to European jurisdictions. What the trade press quietly rewrote in the second half of 2025 is what the reporting on this page has been documenting from the outset.

The LOK regime is an improvement over its predecessor. It is not equivalent to the UKGC framework, it does not deliver the consumer-protection outcomes a British customer would expect from a licensed operator, and its enforcement capacity is not yet at a level that would make an individual dispute recoverable at scale.

Reader mail to this site expressing surprise that a Curaçao-licensed site has failed to deliver a withdrawal is, in the honest reporting, no longer surprising at all. The reform is real. The gap the reform was supposed to close is still, at time of writing, a wide one.

A worked example

An operator this desk has tracked since late 2024 filed for a direct CGA licence in February 2025, continued trading under a legacy sub-licence during the review, was granted a provisional CGA acknowledgement in July 2025 and, at time of writing, appears on the CGA's partial public register with a status that would be legible to a Dutch legal practitioner but is not straightforwardly legible to a British customer.

Three case files reviewed for this piece involve that operator, spanning deposits of £820, £3,200 and £11,900, all with the same pattern of withdrawal delay followed by bonus-terms voiding. The CGA's dispute pathway was, in each of the three cases, either not initiated by the customer because they did not know it existed or, in the one case where it was initiated, ended without a substantive determination inside the reporting window.

06

Payment risks and the rising tide of bank blocks

The payments story is the second half of the consumer-protection story, and it has been the story that has moved fastest across 2025 and 2026. HSBC, Monzo, Starling, Lloyds and Barclays all now offer voluntary card-level gambling blocks that a customer can activate through the app in under a minute.

On the acquirer side, the Visa and Mastercard taskforce that formalised its cooperation with the Commission in early 2025 has been steadily tightening merchant-category-code enforcement, and the pattern of deposit refusals reporters at this site have logged, 340 of them across the first quarter of 2026 alone, is not evidence of banks over-reaching but of a coordinated tightening that was flagged in policy submissions two years earlier.

What this means for a British customer attempting to deposit at an offshore site is that the friction is real, growing and engineered, and the workaround narrative that surfaces on offshore forums is materially out of date.

The chargeback question deserves its own paragraph because it is the recovery route most reader mail asks about. A chargeback works best when the transaction is recent, the merchant category codes support the dispute, and the operator's descriptor is legible to the card scheme's dispute engine.

It works less well when the deposit is more than 120 days old, when the operator has classified the transaction under a non-gambling merchant category code, or when the payment routed through a crypto-adjacent intermediary. Speed is decisive. A chargeback raised within the same week as the deposit has, on the case files reviewed, roughly triple the recovery rate of one raised at the 90-day mark, and the recovery rate at 180 days is close to zero. A customer who is thinking about a chargeback should not wait. That is the honest reporting.

07

Where your uploaded KYC documents actually end up

The data risk is the risk most rarely discussed in reader mail and, on the reporting reviewed for this piece, the risk that most consistently produces long-tail harm. When a British customer uploads identity documents to an offshore operator, they are handing a copy of their passport, driving licence, proof of address and, often, payslip or bank statement to a company whose data-protection compliance is governed by the law of the operator's home jurisdiction rather than by the UK General Data Protection Regulation.

If the operator is subject to the Curaçao Personal Data Protection Ordinance, the protection is meaningful but different in shape to UK GDPR. If the operator is subject to the Anjouan data regime, the protection is more limited still. In either case, the British customer's regulatory recourse against a misuse of the documents is limited by the same jurisdictional friction that limits their dispute recourse against a lost deposit.

What has emerged from the case files across 2025 and 2026 is a pattern in which uploaded KYC documents circulate more widely than the customer expected. A minority of files show correspondence from marketing companies unrelated to the original operator that name specific document details a customer had uploaded to the operator's KYC portal.

A smaller minority show attempted impersonation, with the customer's identity used against a different institution weeks or months after the original upload. The Observer has documented similar patterns in coverage the desk relies on for context, and the Guardian's earlier reporting on data-broker markets in the gambling adjacency remains the sharpest treatment of the wider pattern this reporting inherits.

If a customer is uploading documents to an offshore operator, they should assume the documents will circulate more widely than the operator's privacy notice suggests, and act accordingly.

08

Practical harm-reduction if you have already deposited

The last section of this chapter is written for the reader who has already deposited, has already encountered a problem, and is now asking what to do. The honest reporting, drawing on the 63 case files, is that the recovery routes are limited and that acting quickly is decisive.

Raise a chargeback with your bank within the same week, and certainly within the 120-day scheme window. Report the operator to the Commission as intelligence for the disruption programme; the Commission will not adjudicate your dispute but the intelligence contributes to the enforcement architecture that reduces the operator's UK-facing footprint.

Report misrepresentation of regulatory status to Trading Standards at your local authority under the Consumer Protection from Unfair Trading Regulations 2008. If the operator markets to French customers, DGCCRF may already have a file open. Preserve every screenshot, every email, every terms-of-service page as it appeared on the day of the transaction; the operator's site content changes without notice and the archive you preserve today is the evidence you have tomorrow.

Where the operator's UK-facing marketing has crossed a threshold into misleading commercial practice, the Advertising Standards Authority can also open a case, and adjudications on the record have contributed to the disruption pattern the Commission has been building since 2023. None of these routes replaces a lost balance in the account you were saving into, and the reporting is not going to pretend otherwise.

What they do is contribute to a public record that the next customer in the same position will benefit from, and that record has quietly built up over the past three years into a resource national policy is now drawing on.

The last piece of practical advice is the one this desk offers reluctantly and consistently. If a deposit at an offshore site is the visible edge of a wider pattern the reader has been struggling with, the safety banner at the top of this page is the door into help that exists regardless of whether recovery of the money proves possible.

The National Gambling Helpline on 0808 8020 133 is free, confidential and open 24 hours a day. Advisers can talk through the practical steps and can signpost to the National Gambling Treatment Service and to money-management resources. Losing money to an offshore operator is not a moral failing and it is not a story that has to end where it currently is.

The recovery of the money may or may not happen. The recovery of the reader's own situation, in the wider sense, is what the resources at the top of the page are for, and asking for that support is the single most consequential step this chapter can point at.

Read next

• What GamStop is and how it actually works
• Legality for UK players and where UKGC remit ends
• KYC, AML and payment realities for UK players
• Cancelling GamStop the right way
• Help, support and where to talk to someone today

Frequently asked questions