Legality for UK players, where UKGC remit ends

01

The legal position for UK players, in short and in full

The short answer, uncomfortable as it is for anyone hoping the statute would do more work than it does, is that a UK adult gambling at an unlicensed offshore site is not committing an offence under the Gambling Act 2005. The Act places the offence on the supply side.

It is the operator who commits the offence by providing facilities for remote gambling to a customer in Great Britain without a Gambling Commission licence. The player is not the party the statute regulates, and no British court is being asked to prosecute a punter for logging in.

This is not, whatever offshore marketing sometimes suggests, a loophole. It is a deliberate architectural choice made when Parliament drafted the Act, and it reflects a settled view that the state's regulatory attention should focus on the entity taking the deposit rather than on the individual placing it.

The long answer is more interesting, and it is the answer reporters at this site spend most of their time on. Not being the subject of a criminal offence is not the same as being protected, and a great deal of harm to British consumers happens in the interval between what the statute prohibits and what British institutions can actually deliver on the ground when a dispute goes wrong across a jurisdictional line.

The rest of this chapter walks that ground. Section by section through the Act, then through what an investigator sees when they open the file on a UK-facing offshore operator, then through the enforcement record the Commission has been quietly building since the White Paper 2023, and finally into what a British consumer's practical position looks like when the money has already left the account.

02

Gambling Act 2005, where UKGC jurisdiction stops

The Gambling Act 2005, as amended by the Gambling (Licensing and Advertising) Act 2014, is the statutory anchor. Section 33 makes it an offence to provide facilities for gambling without a licence, and the 2014 amendment extended the licensing requirement to remote gambling operators anywhere in the world offering their services to a customer in Great Britain.

Before 2014 the Commission's licensing writ ran to operators physically inside the country. After 2014 it followed the customer, and every remote operator serving Great Britain became legally required to hold a UKGC licence regardless of where their servers or their directors were sitting. That single amendment is why the Commission now writes to operators registered in Curaçao and Anjouan and Costa Rica, and it is why offshore operators marketing at British customers are, from the perspective of the statute, unlicensed British operators rather than legitimately overseas ones.

Where the jurisdictional writ ends is a harder line to draw than the statute makes it look. The Commission can prosecute in the criminal courts, and has. It can and does issue cease-and-desist notices, refer matters to overseas regulators, coordinate with the Financial Conduct Authority, engage payment schemes, ask domain registrars to withdraw registrations and press internet service providers to block IPs.

What it cannot do, unaided, is reach into a jurisdiction that will not cooperate and pull an operator's servers offline. Cross-border enforcement is a matter of diplomacy as much as law, and the Commission's public reporting is candid about the friction. The current cooperation with the Curaçao Gaming Authority, the Malta Gaming Authority and, increasingly, with the DGCCRF in France and Trading Standards colleagues at the local UK authority level, has closed the gap over the past three years, but the gap has not been fully closed and the reporting on this site treats that fact honestly.

A worked example

A domain reporters at this site started tracking in October 2025 was registered to a corporate-services agent in Nicosia, ultimate beneficial ownership traced to a holding company in a UAE free zone whose beneficial owners are in turn visible only through the Estonian beneficial-ownership register.

The site was advertising to British customers, took deposits from British bank cards, and carried a small footer stating that Great Britain was not a permitted jurisdiction. The Commission issued a cease-and-desist notice in November 2025, the domain was moved to a different registrar in early December, the payment processor was replaced twice inside six weeks, and the site is at time of writing operating on a different domain with the same operational fingerprint.

That is the shape of the enforcement front. Not a single decisive intervention, but an unending back and forth in which the Commission is now materially better resourced than it was two years ago.

03

Why unlicensed remote gambling to UK customers is an offence

The policy reason the Act places the offence on the supply side is that consumer protection is engineered at the operator, not at the punter. The licensing regime is a bundle of duties, and the Commission's Licence Conditions and Codes of Practice describe those duties in fine-grained detail.

Client-money segregation, safer-gambling messaging, affordability checks, source-of-funds enquiries, dispute resolution routes, complaints handling standards, KYC verification protocols. Every one of those obligations attaches to the licensee. If the operator is not licensed, the obligations do not attach, and the British consumer is transacting outside the protective architecture the licensing regime built.

The statute treats an unlicensed operator serving British customers as though it were an underground supplier, because that is what, in practical consumer-protection terms, it functionally is.

What this looks like from the receiving end of a cease-and-desist notice is worth setting out. Reporters at this site have reviewed, on the record and off, three such notices delivered in the second half of 2025. The Commission cites the section of the Act, sets out the evidence that UK customers have been served, requires the operator to cease serving Great Britain within a defined window and to provide written confirmation of the withdrawal.

Some operators comply, quietly and quickly. Some pretend to comply while continuing to serve UK IP addresses through different domains. Some ignore the notice and reappear under different corporate paperwork six weeks later. The pattern is not one operator behaving badly; it is a market whose entry costs are low, whose exit costs are lower and whose corporate-services layer is deliberately structured to keep beneficial owners out of view. Understanding that market is the beginning of understanding why the licensing offence is the lever it is.

04

What powers the UKGC holds over offshore sites

The Commission's public reporting through 2024 and into 2025 has quietly documented a scaled illegal-gambling operation whose scope is not widely appreciated outside the sector. More than 770 cease-and-desist notices were issued in the 2024/25 reporting year. Roughly 102,000 URLs were flagged as promoting illegal gambling to British customers.

Approximately 64,000 URL removals were delivered through Google's own trust and safety pipeline in the same window. Some 264 domain removals were processed through registrars, a tenfold jump on the year before. These are not one-off enforcement gestures. They are the visible edge of an intelligence and disruption operation that has been growing inside the Commission since the White Paper 2023 and that has accelerated since the Statutory Levy took effect on 6 April 2025 and channelled roughly £120m of first-year yield across treatment, prevention and research including into the Commission's own research remit.

The Commission's fine record inside the licensed sector is, in a different way, part of the same picture. Spreadex Ltd was fined £2.0m on 15 May 2025 for licence-condition failures. AG Communications was fined £1.4m on 4 March 2025. Corbett Bookmakers was fined £686,070 on 20 March 2025.

Those are the numbers the licensed sector faces for shortcomings the Commission can prove. Outside the licensed sector, an operator faces no equivalent financial exposure because there is no licence to fine, and this asymmetry is one of the reasons the disruption operation focuses on payment corridors, domains, hosting infrastructure and search-result indexing.

If you cannot fine an operator that is not licensed, you can make it materially harder for that operator to reach the customer you were trying to protect. That is the operational logic and it is written across the enforcement volumes reviewed for this piece.

05

The player's missing complaints route to the UKGC

The Commission's complaints route is designed for disputes with licensees. A UK player who deposits at a UKGC-licensed operator and encounters a problem the operator will not resolve has the operator's mandatory ADR route to escalate to, and if the ADR body finds against the operator the finding is binding to a defined threshold.

If the same UK player deposits at an unlicensed offshore site and encounters the same problem, there is no equivalent route. The Commission will accept intelligence about the operator and factor it into the disruption programme described in the previous section, but it will not adjudicate the individual dispute because the operator is not a licensee and the machinery does not fit.

This is not a policy failure. It is a structural consequence of the licensing model. Regulators regulate the entities they license; they do not adjudicate contracts they have no jurisdiction over.

What the player actually has, outside the ADR route, is the general civil courts and the mechanisms of consumer protection that apply regardless of the operator's sector. A chargeback through the card scheme may recover a deposit if the transaction was recent and the merchant category codes support it.

Trading Standards may take an interest if the operator is misrepresenting its regulatory status or engaging in unfair commercial practices under the Consumer Protection from Unfair Trading Regulations 2008. In practice these routes are slow, uncertain and often expensive to pursue when the operator is offshore, and reporters at this site have documented reader case files where every route was tried and none returned the deposit.

The honest reading of the position is that the licensing regime protects the licensed transaction and does not protect the unlicensed one, and no amount of technical work at the enforcement end can fully close that gap.

A worked example

A reader who contacted this site in early 2026 had deposited approximately £4,200 across three sessions at an offshore site, won a further £6,800 on the third session, and requested withdrawal. The operator required additional verification, then a second layer of verification, then applied a bonus terms clause that the reader had not activated and voided the balance including the original deposit.

The reader tried a chargeback, which was refused because the deposits were more than 120 days old at the point of dispute. Trading Standards took a note but the operator's UK-facing presence had by then moved to a different domain. The Commission accepted the intelligence and added the operational fingerprint to the disruption queue. The £11,000 did not return. The chapter on consumer-protection risks walks through the pattern in greater detail.

06

Why Alternative Dispute Resolution stops at the border

ADR is a licence condition. Under LCCP provisions the Commission has developed since the 2014 amendment, every remote licensee must be signed up to an approved ADR provider, and the outcome of an ADR determination is binding on the operator up to a defined monetary threshold.

The ADR body is independent of the licensee, its determinations are published in redacted form and the model has, over the past decade, become a functioning consumer-protection layer that sits between the operator's own complaints team and the courts. What ADR is not, and cannot be, is an ombudsman for operators that hold no British licence and are contractually bound to no British ADR provider.

When an offshore operator's terms of service point their arbitration clause at a Curaçao court or at an ad hoc arbitration seated in the operator's home jurisdiction, that clause is the only dispute mechanism available and it operates entirely on the operator's home ground.

Reading offshore operator terms is a small industry in itself and one this site takes seriously. Reporters at this site have reviewed 82 offshore terms-of-service pages published in the first half of 2026. The median arbitration clause points to Curaçao. The median mandatory prior-notice period before a claim can be filed is 30 days.

The median clause allowing the operator to void a balance for bonus-abuse or similar breaches is drafted with sufficient latitude to catch almost any withdrawal that inconveniences the operator. Of the 82 pages reviewed, 61 contained no statement of client-money segregation. Of the 82, only 14 named a specific ADR body.

Of those 14, none was a body a British consumer could realistically instruct without incurring costs that would exceed a typical retail dispute. The gap between the UKGC ADR framework and the offshore reality is not a modest one, and the honest reporting is that it is not closing.

07

Inside the White Paper reforms and affordability checks

The White Paper 2023, published formally as CP 835 under the title High Stakes, Gambling Reform for the Digital Age, tightened operator obligations across the licensed sector in ways that continue to work through the system. Affordability checks now apply at defined loss thresholds. Online slot stake caps have been set at £2 to £15 depending on age and product.

A statutory levy came into force on 6 April 2025 under the Gambling Levy Regulations 2025 at rates of 0.1 to 1.1 per cent of gross gambling yield, with online set at 1.1 per cent and first-year yield of roughly £120m routed 50 per cent to NHS treatment, 30 per cent to OHID prevention and 20 per cent to UKRI and UKGC research.

These reforms are the material context in which the offshore market sits. They tighten the licensed sector without reaching the unlicensed one, and the contrast between what a licensed British operator now must do and what an unlicensed offshore operator is not required to do has never been sharper.

The affordability question is where the honest reporting on this piece gets uncomfortable. Some players who have hit an affordability check inside the licensed sector have moved to unlicensed alternatives that do not run one. Reporters at this site are not pretending that pattern does not exist.

What the reporting does argue is that the affordability check is not the harm; the harm is the pattern of loss the check surfaces, and moving to an operator that does not run the check does not reduce the loss but merely removes the friction that alerted the licensed sector to it.

The White Paper 2023 reforms are not free of friction for the licensed sector or for the players it serves, and honest reporting on them acknowledges the friction. Honest reporting also acknowledges that removing the friction by moving offshore does not remove the underlying pattern, and the case files reviewed for this piece are unanimous on that point.

08

What the law protects, and what it leaves exposed

The law, in the shape a British consumer actually encounters it, protects the licensed transaction and does not protect the unlicensed one. Every substantive consumer-protection lever the Gambling Act 2005 and its LCCP subordinate framework built is attached to the licensee. The mandatory ADR, the fund segregation, the safer-gambling messaging, the affordability checks, the KYC obligations, the complaints handling standards, the fitness-and-propriety tests on directors, the financial-reporting audits, the fine exposure, the licence suspension exposure.

Every one of those levers is a licence condition, and the licence conditions do not extend to operators that are not licensed. Understanding this is not defeatist reading. It is the beginning of an accurate picture of what a British consumer's position actually is when they are deciding whether to open an account outside the licensed sector.

The law does not protect a British consumer from the consequences of that decision, and the reporting on this page is not written to pretend otherwise. What the law does is regulate the licensed sector to a standard that most other consumer sectors in the country would recognise as unusually high, and it engineers cross-border disruption where it can when unlicensed operators are marketing to British customers.

Those two functions are the shape of the state's engagement with the market. If a reader is choosing to open an offshore account after their GamStop registration ends, this chapter has laid out what that choice looks like from the statute's perspective. The reader's own choice remains the reader's own, and the safety banner at the top of this page is the door into the help resources that exist regardless of which choice the reader is making.

One further point is worth adding as this chapter closes. The reporting on this site is not written to persuade a reader out of a decision they have already made. It is written to describe the ground the decision sits on. Where the statute is clear, the reporting is clear.

Where the enforcement front is contested, the reporting says so. Where the practical outcomes for British consumers do not match the marketing that circulates around this topic, the reporting names the gap and cites the record. A reader who finishes this page and still wishes to open an offshore account after their GamStop period ends will do so with a more accurate picture of the ground than the offshore trade press provides, and that is the modest purpose the chapter is trying to serve.

Read next

• What GamStop is and how it actually works
• Consumer-protection risks of offshore sites
• KYC, AML and payment realities for UK players
• Cancelling GamStop the right way
• Help, support and where to talk to someone today

Frequently asked questions