The legal position for UK players outside GamStop

The player position, short and long

The short version of the player position under UK law is that it is not a criminal offence for a UK adult to place a bet with an operator that does not hold a UK Gambling Commission licence. UK gambling law is drafted with the offence sitting on the supply side of the transaction, not the demand side. That drafting choice runs through the Gambling Act 2005 and it is why the Commission's enforcement work concentrates on operators, payment providers, affiliates and advertising intermediaries rather than on the customers whose deposits form the underlying flow. What the short version does not capture is the loss of protection that the same customer accepts when they step outside the licensed sector, and that loss of protection is where every paragraph below is aimed. The Act as amended in 2014 by the Gambling (Licensing and Advertising) Act extended the licensing requirement to any operator supplying remote gambling to a customer in Great Britain, closing the historic point of consumption loophole that had previously allowed an offshore operator to argue it was outside the Act's reach.

The long version, from the compliance seat, is that the legal position is only half the picture. The other half is the enforcement machinery the Commission runs against operators that fail their licence conditions, and the loss of that machinery is what a UK adult actually gives up when they play at a site outside the UKGC register. A licensee that accepts a self-excluded customer by mistake meets an internal escalation the same day, meets its own money laundering reporting officer within days, meets a regulator that has already seen the pattern before, and lands on the Commission's public register with a named individual attached to the outcome under the personal management licence regime. None of that machinery moves when a non-UKGC operator behaves in the same way, and the practical effect for the customer is that a mistake has no consequence anyone can enforce. That asymmetry, more than anything drafted in the Act itself, is the substance of the legal position for a UK adult who is trying to understand what they are choosing when they step outside the licensed sector. The Act is a policy instrument as much as it is a criminal statute, and reading Section 33 in isolation understates the practical protection the Licence Conditions and Codes of Practice, the personal management licence rules, and the statutory levy on gross gambling yield each add on top of it.

Section 33 of the Gambling Act 2005

Section 33 of the Gambling Act 2005 is the base offence at the centre of the licensing regime for remote gambling supplied to Great Britain. In plain reading, it says that a person commits an offence if they provide facilities for gambling in Great Britain, or provide facilities for gambling that will be used in Great Britain by any person, without holding an operating licence. The offence is drafted broadly enough to reach any entity that markets, provides or profits from a facility that a UK player uses, regardless of where the entity is registered, where its servers sit or which regulator has issued it a licence in its own home jurisdiction. The provision has been used as the anchor for the Commission's cease-and-desist programme against offshore operators for more than a decade, and the reach of the offence has been tested and confirmed in a series of enforcement outcomes on the Commission's public register.

What Section 33 does not do, and this is the point most third-party writing misses, is turn the customer into an offender. The customer is not a person who provides facilities for gambling. They are a person who uses them. The Act does not need to make the customer's participation criminal to achieve its regulatory goal, because the regulator's leverage over the operator is enough to shape the market. That drafting choice is deliberate. It reflects a policy view that public health outcomes for gambling harm are better served by protecting the customer's route to help than by criminalising the same customer's use of a facility that the state has already declared unlicensed.

A closer look

Where Section 33 does reach a UK adult indirectly is through the intermediary layer. Payment providers, advertising networks, affiliate marketers and search engines can all be caught by the reasoning behind the offence when they enable a non-UKGC operator's supply to a UK market, and the Commission has used that reasoning to pull advertising and payment coverage away from offshore operators without ever prosecuting a customer. From the operator seat, that intermediary pressure is what a compliance team sees show up in the market data. A UK adult reading an offshore operator's own marketing page rarely sees any of it. The intermediary layer includes the Advertising Standards Authority, whose rulings against offshore operators for misleading claims about UK availability have grown steadily since 2020 and now form part of the regulator toolkit at market level, even though the ASA has no direct sanction against a foreign-domiciled operator either.

Where UKGC jurisdiction stops

The Commission's jurisdiction stops at the border of the licensed sector. It has authority over every entity that holds a UKGC operating licence, personal management licence or personal functional licence, and it exercises that authority through the LCCP, through its enforcement register and through the personal accountability layer that names senior managers by role. It does not have licensing authority over an entity that holds no UKGC licence, and it has no direct route to fine, sanction or withdraw an operating permit from an operator based on a licence issued by Curaçao, Anjouan, the Isle of Man, Malta, Gibraltar or any other jurisdiction. That is a plain statement of the regulatory geography, and it is not a criticism of the Commission's remit. It is the shape the Commission was set up with.

What the Commission can and does do outside the licensed sector is exercise its offence-based authority under Section 33 through indirect routes. Cease-and-desist notices, referrals for URL delisting to Google, domain-level removals through registrars, and coordination with payment scheme operators through the Visa and Mastercard 2025 merchant-category taskforce. Those routes work at scale, and the numbers on the Commission's own 2024/25 enforcement summary are the evidence. Over 770 cease-and-desist notices in that reporting year, roughly 64,000 URL removals coordinated with Google, and 264 domain-level removals through registrars. None of those actions is a licence sanction, and none of them protects an individual UK customer whose deposit has already gone. What they do, at market level, is compress the space in which an offshore operator can reach a UK audience.

What UKGC can and cannot do about offshore sites

The Commission cannot force an offshore operator to return a customer's balance, cannot require an offshore operator to run a KYC file to UK standard, cannot impose a personal management licence duty on an offshore operator's senior staff, and cannot enter an offshore jurisdiction to inspect a licensee's controls. Those are the boundaries of the regulator's practical reach, and they are the boundaries a UK adult accepts, in law, at the point of playing outside the licensed sector. Nothing on this page is a criticism of the Commission for the shape of those boundaries. It is a statement of what a UK adult is walking into when they cross them.

The Commission can and does prosecute a UKGC-licensed operator that fails on its own licence conditions, and the recent enforcement history is the evidence a UK adult should read alongside any decision about the licensed sector. In 2025 the Commission published regulatory settlements including Spreadex Limited at £2.0m, AG Communications Limited at £1.4m and Corbett Bookmakers at £686,000 for various failings that touched on customer interaction, source of funds, and social responsibility code provisions. Those are enforcement outcomes against operators that hold licences, publishing turnover, and are named on the Commission's own register. Nothing on the offshore side is subject to the same discipline, and the absence of that discipline is one of the specific losses a UK adult accepts when they play at a Curaçao-licensed or Anjouan-licensed operator.

The complaints path, or the absence of one

For a UKGC-licensed operator, the complaints path is defined by Licence Condition 6, which requires the operator to belong to an approved alternative dispute resolution provider and to signpost that route on its own site. A customer whose complaint is not resolved through the operator's internal process can escalate to the ADR body, and the ADR body will adjudicate against the operator using published standards, a written case file and a decision the operator is contractually bound to accept. If the ADR decision reveals a broader compliance failing, the Commission can pick up the same case through its own enforcement route and open a Section 116 review of the operator's licence. That is the licensed sector's answer to the question of what a customer can do when a deposit is lost, a bonus is withheld or an account is closed without explanation.

For a non-UKGC operator, there is no equivalent route. The offshore operator may point the customer at an internal complaints team, or at the process the operator's home regulator publishes. In the Curaçao regime post-LOK 2024, the Curaçao Gaming Authority publishes a complaints intake, but there is no UK-recognised ADR body attached to a Curaçao licence, and the operator is not bound to any UK small-claims process a customer can use from home. What a UK adult is left with, when a dispute arises with an offshore operator, is a civil claim in a foreign jurisdiction where the customer's cost of pursuit will almost always exceed the value of the disputed amount. The practical answer is that most disputes end when the customer walks away, and the offshore operator's business model factors that outcome in at the design stage.

A closer look

Inside a UKGC-licensed operator, the ADR trigger is watched closely. A rising rate of referrals to the operator's ADR provider is one of the compliance indicators a safer gambling team reports to the board on a rolling basis, and a spike in referrals will draw internal audit attention before it draws regulator attention. The ADR body's own published statistics, together with the Commission's periodic customer-outcomes work, form part of the sector's public scrutiny of the licensed side. None of that scrutiny lands on the offshore side because none of it is enforceable there.

Alternative Dispute Resolution and its limits

The ADR route in the licensed sector is not perfect, and no compliance manager who has watched it operate would claim otherwise. It handles disputes about withdrawals, about bonus terms, about closed accounts and about handling of vulnerable customers, and it uses a written standard rather than a court process. What it does well is create a public floor of accountability that a licensed operator's board pays attention to. What it does not do is convert every disputed transaction into a customer win. A material fraction of ADR decisions go the operator's way when the operator has followed its own terms and the customer's complaint does not reveal a licence-condition failing, and that is the reason the process has any credibility as a floor.

The limits of ADR against offshore operators are structural and cannot be closed by writing better rules in the UK. An ADR body has no jurisdiction over an entity it does not license, has no route to enforce a decision against a foreign-domiciled operator, and has no data feed from the operator's own customer records to reason about the dispute properly. That is why the Commission has never extended the ADR requirement into the non-UKGC sector as a solution to consumer risk. The requirement can only reach as far as the licensing regime that funds and enforces it. A UK adult who plays at an offshore operator is choosing, as a legal matter, to step outside that floor.

White Paper 2023 reforms in force by 2026

The UK Government's 2023 White Paper on gambling reform, published as CP 835 under the title High Stakes: Gambling Reform for the Digital Age, set the direction for the current phase of implementation. The White Paper's headline commitments included affordability checks pitched at a light-touch level for lower stakes and a more detailed level for higher stakes, online slot stake caps in the £2 to £15 range depending on the age band of the player, a statutory levy on operator gross gambling yield, and a package of measures aimed at bringing the digital-age sector into line with the harm-reduction standard the retail sector had already begun to reach. Not every commitment has landed on the same timetable. Some measures have arrived through regulator guidance, some through statutory instrument, and some are still in the implementation cycle at the time of this review.

The measure that has landed with the clearest date attached is the statutory levy, which came into force on 6 April 2025 under the Gambling Levy Regulations 2025. The levy runs at rates from 0.1 per cent to 1.1 per cent of gross gambling yield depending on sector, with online at the top rate of 1.1 per cent, and it is projected to yield around £120 million in its first year. Of that yield, 50 per cent is directed to NHS-commissioned treatment services, 30 per cent to Office for Health Improvement and Disparities prevention work, and 20 per cent to research funded through UKRI and the Commission. The point for this page is that none of that yield reaches an offshore operator's players, because the operators supplying the offshore side do not pay the levy and their customers sit outside the treatment and prevention layer the levy funds.

What the law does and does not protect

The law does protect a UK adult against being prosecuted for playing at a non-UKGC site. It does not protect the same UK adult from losing a deposit at that site, from having a withdrawal withheld indefinitely, from finding that a bonus condition made a winning balance unwithdrawable, or from discovering that the operator has closed their account without returning the funds. The Consumer Rights Act 2015 gives some protection to UK consumers in cross-border transactions, but the practical route to enforce a Consumer Rights Act 2015 claim against a foreign-domiciled operator is a civil action in a foreign court, and the cost-benefit shape of that action almost always favours the operator. The law's protection stops at the licensed sector's boundary, and stepping outside that boundary is a decision every UK adult is entitled to make with the information the boundary implies.

The law also does protect the customer's route back to help. Nothing in UK law penalises a UK adult who has played at an offshore operator for calling GamCare, for enrolling on GamStop, for approaching an NHS-commissioned specialist gambling clinic, or for asking a bank to enable its gambling-block card switch. That route is deliberately kept clear, and every organisation on the whitelist at the end of this page will pick up a call from a person whose deposit has already gone offshore just as readily as from any other caller. The law's approach to gambling harm is public health first and enforcement second, and the compliance seat inside a UKGC-licensed operator sees the two working together on most working days of the year.

Read next

• GamStop explained, the scheme, the periods, the checks
• The risks, explained without the marketing
• Payments and checks, banks, cards, crypto, KYC
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions