The risks, explained without the marketing

No UKGC oversight, what that means day to day

The absence of UKGC oversight is often described, in the marketing copy this page was written to read against, as freedom. Freedom from the affordability check, freedom from the stake cap, freedom from the identification and verification at account opening. Read carefully, the word freedom is doing an unusual amount of work in that construction. What it names is a set of protections that no longer apply to the customer, and it names them from the point of view of the operator rather than from the point of view of the customer. The affordability check is a protection for the customer. The stake cap is a protection for the customer. Identification and verification at account opening are protections for the customer. In their absence, the customer is not more free. The customer is less protected, and the word freedom has been chosen to obscure that fact.

The day-to-day meaning of the absence is that the operator's own conduct governs the customer's experience. The operator sets the withdrawal timescale, the KYC threshold at which verification is triggered, the maximum bet on bonus-linked play, the game weighting on the wagering requirement and the confiscation clause under which a balance can be voided. Each of those is written in the operator's terms and conditions. Each of them is enforceable by the operator without reference to a UK regulator, without reference to an ADR body approved by the Commission, and without reference to a code that sits above the operator's own document. The customer's protection against any single one of those clauses is the operator's own goodwill, calibrated by the operator's own commercial judgment. That is a materially different position from the one a UKGC-licensed customer occupies, and it is the position the phrase non-GamStop actually names.

No fund segregation guarantee

Fund segregation is a licence condition on UKGC-licensed operators. Under Licence Conditions and Codes of Practice paragraph 4, an operator must hold customer funds separately from operational funds, in a manner and to a standard that the Commission specifies, and the operator must disclose the level of protection to the customer at account opening. The three levels the Commission recognises are basic, medium and high. Basic separation means customer funds are held in a separate account but are not protected in insolvency. Medium separation adds insolvency protection through a trust or a guarantee. High separation puts the funds in a trust with a designated trustee. The disclosure is required at account opening and is required to appear in the operator's terms of service.

No equivalent condition applies to an operator that does not hold a UKGC licence. A Curaçao-licensed operator is not required by its home-jurisdiction framework to segregate customer funds to a UKGC-recognised standard, and no marketing language in the operator's footer, however comforting, changes that mechanical position. The words safe, secure, trusted and protected are legible in this context as ordinary marketing intensifiers rather than as statements of a specific regulatory protection. That is a critical distinction. A UK adult depositing a substantial balance at an offshore operator is depositing that balance without the fund-segregation guarantee that the UK licence would carry, and the risk of loss on operator insolvency is a real risk rather than a theoretical one. Insolvencies in the sector do occur, and where they have occurred the offshore customer has generally been the last party recovered against.

A closer look

The safest reading of an operator's fund-segregation position is the operator's own terms of service. Search the document for the word segregation, for the word trust, and for the word insolvency. If none of those words appears, no protection has been offered, and the customer's balance is at the operator's ordinary trading risk. If the words appear only in the context of a warranty from the operator's parent company, the protection is a contractual promise from a related party rather than a regulator-mandated segregation, and the strength of the promise turns on the parent's own solvency. That is not the same protection.

No mandatory ADR body

The alternative dispute resolution architecture that a UKGC customer relies on is a licence-driven creation. The Commission approves ADR bodies for the sector under the Alternative Dispute Resolution for Consumer Disputes Regulations 2015. The licensed operator names its ADR body on its terms of service page. The service is free to the customer. The decision is binding on the operator by force of the licence condition. That is the pathway that the Commission, when it lists the two-step complaints process, is referring to. Nothing about the pathway follows the customer to an offshore operator. The ADR body approved for a UKGC operator is approved for that operator specifically, and the binding effect of the adjudication is the effect of the operator's licence condition rather than of any general commercial arbitration law.

Offshore operators often display, in their footers, a mark that resembles the mark of a recognised ADR body, or the name of a private arbitration service that the operator itself has appointed. Read carefully, the mark and the name describe an internal complaint-handling arrangement rather than an independent adjudication. The private service typically operates under the operator's own terms, is paid by the operator, and issues decisions that are not enforceable against the operator through any UK mechanism. The distinction between that arrangement and the ADR pathway a UK licence carries is not visible from the operator's home page, and reading the operator's terms of service is the only reliable way to see what the customer has actually signed up to. Where the customer's own reading is uncertain, the Citizens Advice service can help a UK adult understand the position their contract puts them in.

Offshore licensing landscape after Curacao LOK 2024

The Landsverordening op de Kansspelen came into force on 24 December 2024 and replaced the master-licence system under which four master-licence holders had for years issued sub-licences to hundreds of operators serving customers across Europe. Under the new legislation, the Curaçao Gaming Authority is the single regulator of remote gambling incorporated in the jurisdiction, and every operator now requires a direct licence issued by the CGA. The transition window closed during 2025, and operators that failed to complete their direct-licence applications by the end of the window ceased to be licensed under Curaçao law from that point. The new framework introduces responsible gambling requirements, anti-money-laundering obligations, and a dispute-resolution structure that were substantially thinner under the master-licence regime.

A well-read footer therefore now carries a Curaçao Gaming Authority direct licence number, a company registration in Curaçao, and a physical address that can be verified against the CGA register. What is worth reading against that footer is the operator's own conduct under the new framework. Marketing copy in the sector has drifted, since the transition, into descriptions of a fully regulated operator, an internationally licensed casino, or a compliant and audited platform. Each of those constructions is doing more work than the underlying licence supports. A CGA direct licence is a licence issued by a jurisdiction with a population of around 160,000 and a regulator whose enforcement resources are in proportion to that population. The licence is real. The comparability of the framework to the UKGC framework is a separate question, and one that the marketing tends to elide rather than answer.

Anjouan, MGA, Gibraltar, how they compare

The three jurisdictions that appear most often, alongside Curaçao, in the licensing disclosures of operators marketing to UK consumers are Anjouan, the Malta Gaming Authority and the Gibraltar Regulatory Authority. Each represents a different enforcement culture, a different range of licence conditions, and a different practical position for the UK customer. Anjouan is a licence issued by the Union of the Comoros, and is the newest of the three to appear in the offshore sector's marketing. Its licence terms are relatively light, its enforcement footprint outside the jurisdiction is small, and its dispute-resolution architecture, as of 2026, is not comparable to the UK framework. Malta is a mature European regulator with an operator base that overlaps with the UKGC licensee base at the group level, and its dispute-resolution mechanism through the Player Support Unit is functional though not enforceable through UK courts. Gibraltar is a smaller but historically stringent regulator, closely aligned with UK standards on responsible gambling and on advertising, though its operator base is now largely served through arrangements that fall outside the UK licence.

The comparison is not a ranking. It is a reading. What matters, when a UK adult is confronted with a footer that names any one of those regulators, is that none of them is the UK Gambling Commission and that none of the customer protections that the UK licence carries follow to an account opened with an operator under one of them. That is the mechanical position, and the marketing copy that tries to soften it, through phrases like European Union licensed or under strict regulatory supervision, is doing exactly what the CAP Code has repeatedly ruled against when the copy has been directed at UK consumers by parties within the ASA's jurisdiction. The reading a UK adult ought to give a footer of that kind is a plain one. The operator is licensed somewhere. The somewhere is not the United Kingdom. Everything else is a matter for the customer's own careful reading.

A closer look

The Advertising Standards Authority holds jurisdiction over the marketing copy that any of those operators directs at UK consumers, whether or not the operator itself falls within the UKGC licence. Rulings against offshore operators for misleading responsible gambling messaging, for inadequate disclosure of significant conditions in promotional offers, and for placing gambling advertising where it is likely to reach under-18s have been made and are searchable on the ASA's rulings database. The rulings do not lift the licence. They do rule the advertising in breach of the CAP Code, and they carry sanctions at the intermediary layer that reach the ad-serving platforms and, through them, the operator's ability to place further copy in front of a UK audience.

Payment friction that is only growing

The payment layer is the layer of the offshore proposition that has moved the furthest in the past three years. The five largest UK retail banks now carry a gambling-block switch inside their mobile applications. HSBC, Monzo, Starling, Lloyds and Barclays each publish a page on how their block operates, and each has run public campaigns encouraging the block's use by customers concerned about their own gambling exposure. The block operates against the merchant category code that the acquiring bank assigns to gambling transactions, and it stops the transaction at the point of card authorisation. The switch, when toggled off, runs a cool-off before the first authorised gambling transaction is permitted, and the cool-off varies between the banks from a matter of hours to several days depending on the bank's own policy.

The Visa and Mastercard taskforce with the UK Gambling Commission, formed in 2025, has tightened enforcement at the acquiring end of the payment chain. The taskforce works on merchant category classification, on the identification of operators that are misclassifying gambling transactions under non-gambling merchant category codes, and on the withdrawal of acquiring services from operators that persistently miscategorise. The direction of travel is toward less payment optionality for offshore operators serving UK cards, not more, and the offshore sector's own marketing copy on payment methods has begun to migrate toward cryptocurrency rails as a consequence. Those rails hit the Money Laundering Regulations 2017 at the exchange layer, and the same identification and verification obligations attach to a sterling-to-token transaction that would attach to a bank transfer of the same amount. The friction has not been removed by moving to a different rail. It has been moved to a different point in the payment chain.

What happens to your ID documents

The identification documents that a customer hands to an offshore operator in the course of a withdrawal review are the customer's own government-issued identity records. Typically they include a passport or driving licence, a utility bill or bank statement dated within the past three months, and increasingly a live selfie taken against the identity document itself. The retention of those documents, the security under which they are held, and the parties to which they may be disclosed are all governed by the operator's own privacy policy, and by whatever data-protection framework applies in the operator's home jurisdiction. In Curaçao that framework has been developing under the LOK reforms but is not yet equivalent to the United Kingdom General Data Protection Regulation in either scope or in enforcement culture.

What is worth reading, before those documents are handed over, is the operator's privacy notice. Search for the retention period, for the words third party or affiliated company, and for any reference to marketing or profiling. An operator that reserves the right to retain identity documents for the duration of the customer relationship plus a further period of years, and that discloses documents to affiliated companies for the purposes of anti-fraud monitoring, is describing an information architecture in which the customer's identity documents may travel further and remain retained for longer than a UK customer would ordinarily expect. That is not a hypothetical risk. It is a reading of the ordinary language of offshore privacy policies as they currently stand, and it is worth carrying in mind before the documents are uploaded.

Practical harm-reduction if a deposit has already gone

If a deposit has already been made and the reader has arrived at this page in the course of trying to work out what to do next, the first step is not the operator. The first step is the National Gambling Helpline, on 0808 8020 133, which is free, confidential and open around the clock, and which sits above every step on this page in the order of importance. If the immediate concern is a withdrawal that has been delayed or refused, the operator's own complaints process is the second step, and where the operator is licensed by the Curaçao Gaming Authority a complaint can be escalated to the CGA under its direct-licence complaints framework. Neither of those routes is a substitute for support. Both of them are worth pursuing in parallel with support, and neither of them removes the value of the helpline call.

If the deposit was funded from a UK bank card and the customer has grounds to believe the transaction was made in circumstances that a bank would recognise as vulnerability, the bank's own dispute channels are worth pursuing. The card scheme's chargeback rules do not straightforwardly cover gambling losses, but a bank's vulnerability team may be able to work with the customer on a case-by-case basis, and StepChange, Citizens Advice and the Money Advice Service can support the customer through the conversation with the bank. If the loss has caused, or is causing, financial distress, the debt advice sector is the correct next port of call, and the debt-advice services listed on the site's support page are free and impartial. Nothing about any of those steps is a substitute for the helpline call. The helpline is the step that matters most, and it is the step this page ends where it began, by repeating.

Read next

• GamStop explained, the scheme, the periods, the checks
• The legal position for UK players outside GamStop
• Payments and checks, banks, cards, crypto, KYC
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions