The legal position for UK players outside GamStop

The player position, short and long

The player position under UK law is short. A UK adult who places a bet at a gambling site licensed abroad has not committed a criminal offence under the Gambling Act 2005. The Act's offences run against the operator supplying gambling to UK customers without a UKGC licence, not against the customer receiving that supply. Section 33 makes it an offence for a person to provide facilities for gambling in the UK, or to make arrangements for gambling in the UK, without a Commission licence; it does not create a matching offence for the customer who uses those facilities. This is a consistent point across the enforcement record and across the Commission's own published guidance, and it is the foundation for every other legal question a UK reader might ask on this page.

The long position is where the substance sits. What the UK adult forgoes when they cross the border of UKGC remit is not criminal liability but a stack of consumer protections that only exist inside that remit. There is no UKGC complaints route once the operator sits outside the licence. There is no mandatory Alternative Dispute Resolution provider. There is no compulsory participation in the GamStop register. There is no requirement to segregate customer funds on the model of UKGC Licence Condition 4. There is no fund-recovery guarantee if the operator ceases to trade. And there is no obligation on the operator to co-operate with a UK financial-crime investigation on the Money Laundering Regulations 2017 model. All of that lapses at the border. The rest of this page walks through what remains and where a UK adult can still turn. It also walks through the parts of the law a UK reader most often assumes still apply when they do not, which is the shorter list but the more consequential one for a consumer sitting on the far side of the licence line and reading a jurisdiction clause that names a court in a country they cannot easily reach.

Section 33 of the Gambling Act 2005

Section 33 of the Gambling Act 2005 is the statutory anchor of the UK licensing regime and is worth reading in full at legislation.gov.uk. The section creates the offence of providing facilities for gambling, or making arrangements for gambling, without the necessary UKGC licence, and it defines gambling broadly enough to cover remote betting, remote casino gaming and remote bingo. The Act is technology-neutral, which is why remote operators serving UK customers from abroad are caught by the same statutory offence as a brick-and-mortar bookmaker operating in the UK without a licence. The Commission's approach to enforcement builds outwards from this section, and its 2024/25 record of more than seven hundred and seventy cease-and-desist notices and two hundred and sixty-four domain removals is the practical footprint of the section in operation.

What Section 33 does not do is create a matching offence for the consumer. That is a deliberate choice by the drafters. A regulatory regime that criminalised the receipt of an unlicensed service would push consumers away from the regulator rather than toward it, and would in practice remove the incentive that a harmed consumer has to complain publicly. The UK regime instead concentrates its criminal liability on the operator and leaves the consumer position civil and non-punitive. That is a materially different design from a country such as the United States, where the Unlawful Internet Gambling Enforcement Act of 2006 reaches the payment layer rather than the consumer, but with a broader deterrent effect on consumer participation. The UK design keeps the consumer position clean of criminal risk and puts the regulatory pressure on the operator's own licensability and enforceability at UK level.

A closer look

A useful way to read Section 33 is as a border rather than a wall. Inside the border the Commission's licensing regime applies in full, including the Licence Conditions and Codes of Practice that carry GamStop, the Alternative Dispute Resolution requirement, the Licence Condition 4 fund-segregation categories, source-of-funds triggers and social responsibility provisions. Outside the border, none of those apply. The section itself does not say anything about the consumer position beyond that; it does not authorise offshore play, it does not prohibit it, and it does not create a duty on a UK bank to refuse a payment to an offshore operator. Every question that turns on the consumer position downstream of Section 33 is answered in the surrounding regulations or in banking guidance, not in the section itself, and reading it that way removes a good deal of the confusion that sits around it.

Where UKGC jurisdiction stops

UKGC jurisdiction stops at the operator that holds a UKGC licence. That is the whole shape of the boundary. The Commission has statutory authority to set licence conditions on operators it licenses, and it has enforcement authority against operators it should have licensed but that are supplying UK customers without a licence. It does not have jurisdiction to compel an operator that has never sought a UK licence, is based abroad, and is operating under the licence of a foreign regulator, to change its terms, to open a UK complaints channel or to participate in GamStop. The Commission's tools against such operators are external tools that work by cutting the routes into UK customers rather than by reaching into the operator's own operations.

This is the tools inventory the Commission actually uses against offshore operators. First, cease-and-desist notices under the Act, which go to the operator and are backed by the criminal offence under Section 33. Second, delisting requests made to Google under the search-engine takedown route, which drove the roughly sixty-four thousand URL removals recorded in 2024/25 and reduces the discoverability of unlicensed operators from a UK search result. Third, domain removals through the registry route, of which the Commission secured two hundred and sixty-four in the same period. Fourth, payments enforcement co-ordination with Visa, Mastercard and the UK banks under the 2025 taskforce. And fifth, referral of individuals to law enforcement in cases of gambling-linked money laundering or fraud. None of these are direct enforcement against the offshore operator; they are all indirect routes that reduce the friction gradient in the operator's favour.

What UKGC can and cannot do about offshore sites

What the UKGC can do about an offshore operator is worth setting out in the same plain language a reader would use when reading a chart. It can send a cease-and-desist notice, which the operator may or may not respond to. It can ask a search engine to delist a URL from UK search results. It can ask a registry to take down a domain. It can co-ordinate with the card networks to reduce successful merchant-category enforcement bypass. It can co-ordinate with the UK banks on the voluntary gambling switch and on transaction monitoring. It can flag payment routes to the Financial Conduct Authority and, where appropriate, refer suspicious activity to the National Crime Agency. What all of these have in common is that they are indirect. They work at the level of the operator's ability to reach a UK customer, not at the level of the operator itself.

What the UKGC cannot do is the shorter list, and the more important one for a UK reader making a decision. It cannot compel an offshore operator to open a UK-facing complaints channel. It cannot compel an offshore operator to participate in GamStop or to accept a UK ADR body. It cannot direct that an offshore operator segregate customer funds. It cannot direct that an offshore operator refund a UK customer whose complaint the operator has not upheld. It cannot direct a foreign regulator to intervene in a case involving a UK customer. And it cannot direct a foreign court to accept a UK judgment for enforcement. Each of these limits is a design fact, not a policy gap. UK regulators do not reach across jurisdictions to enforce UK licence conditions on operators that hold no UK licence, and the design of the international gambling regulatory system does not currently support that reach.

The complaints path, or the absence of one

The complaints path inside UKGC remit is set out in the licence conditions themselves. A UKGC-licensed operator must have a complaints procedure, must publish it, must escalate an unresolved complaint to a UKGC-registered Alternative Dispute Resolution provider, and must abide by that provider's determination in the manner set out in the ADR terms. That is a fully-defined route, and the Commission publishes the ADR provider list on its own site. A UK adult with a complaint against a UKGC-licensed operator has this route available from the operator's front page onwards, and the route is enforceable at licence-condition level. If the operator refuses to co-operate, the licence itself is at risk, which is the pressure that keeps the route functioning as designed.

Outside UKGC remit the same route does not exist. A Curacao-licensed operator is subject to the Curacao Gaming Authority's own complaints framework, which under the LOK now includes a formal escalation route to the CGA itself; but the CGA has no obligation to accept a UK-side ADR body's involvement and no established practice of doing so. An Anjouan-licensed operator is subject to the Anjouan online gambling regulator's own framework, which is lighter than either the CGA's or the MGA's. An MGA-licensed operator has an established complaints framework backed by the MGA player-support unit and by mandatory participation in an MGA-approved ADR body, but the MGA is not a UK regulator and cannot direct enforcement in the UK. A Gibraltar-licensed operator sits under the Gibraltar Regulatory Authority, which likewise operates its own complaints framework and its own ADR list. In none of these cases is the route the same as the UKGC route, and in none is the resolution enforceable in the UK.

A closer look

The absence of a UK-enforceable route does not mean the absence of any route at all. A UK adult with a complaint against an MGA-licensed operator has a substantive framework to work through; a UK adult with a complaint against a Gibraltar-licensed operator similarly. A UK adult with a complaint against a Curacao-licensed operator has a formally-defined route under LOK, though its practical operation is still bedding in. A UK adult with a complaint against an Anjouan-licensed operator has the lightest route of the four. Reading these routes as a matter of degree rather than as a binary of route or no route is the honest reading, and the degree matters when it comes to time cost, language cost and the enforceability of any determination that emerges at the far end.

Alternative Dispute Resolution and its limits

Alternative Dispute Resolution is the specific mechanism by which UKGC-licensed operators are required to escalate complaints they have not resolved through their own front line. The Commission maintains a list of approved ADR providers, each of which is a private body regulated under UK consumer-protection law and required to operate to published standards. A UK adult using an ADR provider does not pay a fee; the operator carries the cost of the process, and the provider's determination is binding on the operator under the licence condition that requires it to participate. That is a strong consumer position and it does not have a direct equivalent in any of the four offshore frameworks. The MGA-approved ADR bodies come closest, but a UK adult using one still sits outside UK consumer-protection law and inside Maltese law.

The limits of ADR outside UKGC remit are that the determination is enforceable only where the operator has agreed to accept it, that the working language is not always English, that the process may sit under a jurisdiction whose consumer-protection law is materially different from UK law, and that a determination in the UK adult's favour does not translate automatically into a UK-enforceable payment order. A UK adult who wants to enforce an ADR determination made in Curacao against an operator that has moved its balance sheet across borders faces the same enforceability question as any cross-border civil claim. That question does not have a clean answer at the paperwork level and is one of the strongest reasons a policy analyst would give against relying on offshore ADR as a substitute for the UKGC-registered route.

White Paper 2023 reforms in force by 2026

The White Paper 2023, published as High Stakes, Gambling Reform for the Digital Age (Command Paper 835), sits behind most of the reforms that are now in force or in the final stage of implementation by 2026. The affordability check regime, the online slot stake caps of two pounds to fifteen pounds depending on the player's age band, and the statutory levy that took effect on 6 April 2025 under the Gambling Levy Regulations 2025 all trace back to it. The levy is set at rates between 0.1 per cent and 1.1 per cent of gross gambling yield, with the online rate at 1.1 per cent and the first-year yield estimated at around one hundred and twenty million pounds. The receipts are distributed fifty per cent to NHS treatment through the National Health Service commissioning framework, thirty per cent to prevention through the Office for Health Improvement and Disparities, and twenty per cent to research through UK Research and Innovation and the UKGC.

None of these reforms apply to offshore operators. The affordability checks bind UKGC-licensed remote operators. The stake caps bind UKGC-licensed remote operators. The statutory levy is payable by UKGC-licensed operators. This is the point at which the White Paper agenda draws its own boundary, that is, at the border of the operators the Commission licenses. A UK adult sitting on the customer side of a Curacao, Anjouan, MGA or Gibraltar operator sees none of these reforms. That does not make the operator worse than it was before the reforms landed; it means that the reforms have widened the substantive gap between the inside and the outside of UKGC remit. The consumer-protection differential between a UKGC-licensed operator and an offshore operator is materially larger in 2026 than it was in 2023, and the direction of travel on the UK side is towards further widening.

What the law does and does not protect

What UK law does protect for a UK adult who plays at an offshore operator is limited to the parts of civil law that apply without regard to the licensing status of the counterparty. Consumer contracts law under the Consumer Rights Act 2015 applies to the extent that the operator can be shown to have contracted with a UK consumer, though enforcement is subject to jurisdiction clauses in the operator's terms and to the practical difficulty of pursuing an operator into a foreign court. Data-protection law under UK GDPR applies to the extent that the operator processes UK data subjects' data, and a complaint route to the Information Commissioner's Office is available on that ground. Financial-crime protections apply to the extent that a UK bank or a UK payment processor is involved in the transaction, and the bank's own AML procedures under the Money Laundering Regulations 2017 sit behind that.

What UK law does not protect for a UK adult who plays at an offshore operator is everything that sits inside the UKGC licence conditions and does not sit inside general consumer or data-protection law. That includes the complaints route, the ADR route, the fund-segregation model, the GamStop query, the affordability check regime, the stake cap regime, the social responsibility provisions, and the licence-condition-linked cooling-off measures. It also includes any regulatory redress against the operator itself, since the Commission cannot direct an operator it has not licensed to change its behaviour. The honest reading of the legal position for a UK adult who plays at an offshore operator is that UK criminal law does not touch them and UK licence-condition consumer protection does not reach them either. What sits in the middle is general civil and data-protection law, applied through the practical constraints of cross-border enforcement.

Read next

• GamStop explained, the scheme, the periods, the checks
• The risks, explained without the marketing
• Payments and checks, banks, cards, crypto, KYC
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions