The risks, explained without the marketing

No UKGC oversight, what that means day to day

The absence of UKGC oversight is not a single missing item; it is a set of missing items that a UK adult does not notice until the one they need is the one that is absent. On a UKGC-licensed remote site the operator is bound by the Licence Conditions and Codes of Practice, which carry the complaints route, the ADR requirement, the GamStop query at registration and deposit, the source-of-funds triggers written into the Commission's guidance, the social responsibility interventions, the customer fund-segregation categories under Licence Condition 4, and the co-operation obligations under the Money Laundering Regulations 2017. On an offshore site none of these apply as UK law. Each is replaced by whatever the operator's home regulator has chosen to require of it, and the substance of that replacement varies materially by jurisdiction.

Day-to-day this shows up in small, cumulative differences. A withdrawal that would have been paid inside twenty-four hours under UKGC Licence Condition guidance sits at the offshore operator for a week while a fresh KYC document is requested. A complaint that would have gone to a UKGC-registered ADR provider inside eight weeks sits at the operator's own review desk. A source-of-funds check that would have been triggered at a defined threshold under UKGC guidance is triggered on the operator's own risk model, which the customer cannot read. A bonus term that would have been outlawed under the UKGC Consumer Protection Guidance is enforceable on the operator's own house terms. None of these differences reads as a scandal in isolation. They add up, and the cumulative delta is the substance of the offshore consumer position.

No fund segregation guarantee

UKGC Licence Condition 4 requires operators to hold customer funds in a way that ring-fences them from operational funds, and requires the operator to disclose to the customer at registration the level of protection those funds attract. The three protection levels defined by the Commission, that is, basic, medium and high, map to different arrangements ranging from a segregated bank account to a fully trust-protected account, and the operator must disclose which one applies. That disclosure is enforceable at licence-condition level and is one of the strongest structural consumer protections inside the UK regime. It is not present in any of the four offshore frameworks in the same form, and the reader who looks for a similar disclosure on an offshore footer will not usually find one.

Under the Curacao LOK regime the CGA has stated licence-condition powers over customer fund handling, but the practical requirement as of 2026 is materially lighter than the UKGC Licence Condition 4 disclosure model, and the register does not publish the fund-protection status of individual operators in the way the Commission does. Under the Anjouan online gambling regulations the fund-handling requirement is lighter again. The MGA rulebook requires customer funds to be held separately and imposes disclosure obligations that come closer to the UK model, though not identical to it. The Gibraltar Regulatory Authority framework similarly requires segregation and disclosure. In every case the substance sits below the UKGC level, and in the two lighter cases the substance is materially below it.

A closer look

The fund-segregation delta shows up most sharply in the case at which the operator ceases to trade. Under a UKGC medium- or high-protection arrangement, customer funds held in trust or in a separately segregated account are not part of the operator's insolvent estate and are returned to customers in priority. Under a lighter offshore arrangement, customer funds may sit inside the operator's general balance sheet, in which case they rank alongside general creditors in an insolvency. The 2020 to 2023 wave of Curacao master-licence-era exits saw exactly this scenario play out for customers on operator balances at the moment of shutdown. LOK has changed the paper trail but it has not changed the substantive position for a customer sitting on a balance at the moment an operator stops trading, and that is the row a policy analyst reads first.

No mandatory ADR body

The UKGC-registered ADR body list is the enforcement mechanism that turns a complaints procedure into a consumer route with an outside adjudicator. On a UKGC-licensed remote site a customer whose complaint has not been resolved through the operator's own procedure inside eight weeks has the right to escalate to a UKGC-registered ADR provider, whose determination is binding on the operator as a licence condition. That is a defined, funded, English-language, UK-jurisdiction route with an enforceable outcome. It has no direct equivalent in any of the four offshore frameworks, and the difference between having and not having such a route is the difference between a substantive complaints resolution and a complaint that closes on the operator's own reading of its own terms.

The MGA-approved ADR bodies come closest as a substantive route, though the working framework sits under Maltese law and the enforceability of a determination in the UK is not the same as under a UKGC-registered ADR provider. The Gibraltar Regulatory Authority operates a broadly analogous framework at smaller scale. The Curacao Gaming Authority under LOK has established its own dispute-resolution route, but the practical operation of that route is still bedding in and its enforceability in the UK is not established at the paperwork level. The Anjouan framework has no equivalent that a UK reader would recognise as an ADR route. This is one of the rows in which the differential across offshore licences is largest, and it is the row that most often decides whether a complaint reaches a substantive determination or drops out.

Offshore licensing landscape after Curacao LOK 2024

The Landsverordening op de Kansspelen, or LOK, took effect on 24 December 2024 and reshaped the Curacao licensing landscape at the paper-trail level. Under the previous regime a small number of master licensees held the four historic Curacao master licences and issued sub-licences to operators, which produced an opaque paper trail and a poorly defined enforcement pathway. Under LOK the master-licence structure is abolished. The Curacao Gaming Authority (CGA), formalised by the same legislation, becomes the single regulator that issues operator licences directly, maintains a public register, and holds licence-condition powers over the operators it licenses. This is a genuine improvement in transparency, and it moves the Curacao regime from a jurisdiction whose enforceability was largely theoretical to a jurisdiction with a defined single-regulator framework.

What LOK does not do is import UK-style consumer protection. It does not establish a mandatory fund-segregation model on the UKGC Licence Condition 4 disclosure standard. It does not establish an ADR route enforceable in the UK. It does not establish a self-exclusion database on the GamStop model. It does not establish source-of-funds thresholds equivalent to the UKGC guidance. The CGA now has statutory power to withdraw a licence, which the master-licence system in practice did not, and that is a material improvement in the operator's exposure to regulatory sanction, but the consumer-side substance sits at a different level from UKGC. LOK is a domestic reform for Curacao, not a UK-side upgrade. A UK reader looking at a Curacao licence badge on a footer in 2026 is looking at a more legible paper trail than they would have seen in 2023, and no more.

Anjouan, MGA, Gibraltar, how they compare

The four offshore frameworks a UK-facing operator is most likely to use are not equivalent. Set against UKGC on the six substantive rows a UK adult would care about, that is, fund segregation, complaints route, ADR enforceability, self-exclusion interoperability, source-of-funds threshold, and licence-condition enforceability, the four sit in different places, and reading them as a single offshore category is the misreading that undoes most consumer-side analysis of the sector. The comparison below sets out where each sits on each row, cited to the source framework and dated to the current review cycle. A reader who takes nothing else off this page should take the matrix.

The pattern the matrix produces is the pattern the sector's own paperwork produces. MGA sits closest to UKGC on the substantive rows, though not on UK-side enforceability. Gibraltar sits close behind. Curacao under LOK sits materially below MGA and Gibraltar on most rows, though it has closed the gap on the master-licence paper trail that used to sit under it. Anjouan sits materially below all three. For a UK reader the useful conclusion is not that offshore is a single category but that the four regimes are separated by material differentials, and the differential between MGA and Anjouan on the substantive rows is larger than the differential between MGA and UKGC on some of them. Reading the licence badge on a footer without reading the row-level substance behind it is the misreading this page is written against.

A closer look

The row that swings the practical experience most for a UK adult is the complaints route row, because it is the row that determines whether a dispute gets to an outside adjudicator. On the MGA and Gibraltar frameworks a customer has a substantive escalation route, though not one enforceable in the UK. On the LOK Curacao framework a route exists on paper but is still bedding in as of 2026. On the Anjouan framework a route does not exist in a form a UK reader would recognise as an ADR path. Reading the matrix down that column, before reading it across, is the shortest route to a working sense of what each licence actually delivers to a UK customer at the moment they need it. Every other row can be read once the complaints row is understood.

Payment friction that is only growing

The payment layer is the second boundary a UK adult crosses when they open an offshore account, and the layer at which the friction gradient has moved the most since 2023. On the card side, HSBC, Monzo, Starling, Lloyds and Barclays now offer a voluntary gambling switch on their personal current accounts, with a friction period on being turned back off. Visa and Mastercard joined the UKGC-led taskforce in 2025 to tighten merchant-category enforcement, which has reduced the incidence of card-not-present transactions being successfully routed through non-gambling merchant categories. On the cryptocurrency side, the UK-registered exchanges continue to run KYC to a Money Laundering Regulations 2017 standard, which places the KYC step at the exchange rather than at the offshore operator.

This is not a total block. It is a change in gradient. A deposit that went through cleanly in 2023 from a UK card may sit at a decline in 2026; a deposit routed through a payment processor with imperfect merchant-category coding is now more visible to the bank's rules engine than it was; a deposit that a bank flags for AML review is more likely to be held for a manual check. The taskforce update published in early 2026 documents the position in more detail than a summary paragraph can hold. What it does not do is confirm that a bank will refund a UK adult who has deposited to an offshore operator and has not been paid a withdrawal; the bank's duty runs to its own AML and consumer duty obligations, and it does not carry a UKGC-style refund route into a non-UKGC transaction.

What happens to your ID documents

Every remote gambling operator, whether UKGC-licensed or offshore, collects a KYC document set at some point in the customer relationship. Under UKGC licensing the document handling sits inside the Money Laundering Regulations 2017 framework, with the Commission publishing guidance on retention periods, data-protection duties under UK GDPR, and the specific procedures around source-of-funds documentation. A UKGC-licensed operator is subject to Information Commissioner's Office oversight on the data-protection side and to the Commission's own oversight on the AML side, which produces two separate accountability routes for a customer whose documents have been mishandled.

Offshore operators sit outside UKGC's AML oversight and, unless they process data of UK data subjects in a way that pulls them into UK GDPR jurisdiction, outside ICO oversight too. The MGA framework has its own data-protection oversight under Maltese implementation of the EU GDPR. The Gibraltar Regulatory Authority framework has its own equivalents. Curacao under LOK now has a defined data-handling requirement for CGA licensees, though the enforcement position for a UK customer is not the same as ICO enforcement. Anjouan is the lightest of the four on this row. A UK adult should assume that documents supplied to an offshore operator are held under the operator's home framework rather than under UK GDPR, and that the recovery route in the event of mishandling runs through the home regulator rather than the ICO.

Practical harm-reduction if a deposit has already gone

The practical harm-reduction position, if a UK adult has already deposited to an offshore operator and now wants to step back, is to work through the layers in order rather than in the reverse. First, contact the bank and ask for the voluntary gambling switch to be enabled on the account, which will refuse further gambling merchant-category transactions once active. Second, register on GamStop for whichever period sits inside the reader's own reading of the situation, on the understanding that GamStop does not reach the offshore operator but does reach every UKGC-licensed remote site and closes off that entire tier of routes. Third, contact the National Gambling Helpline on 0808 8020 133 for a conversation that is free, confidential and open twenty-four hours a day. The order matters because the friction layer works from the outside in; blocking the card is faster than negotiating with the operator.

On the money side, StepChange, Citizens Advice and PayPlan handle the debt-facing conversation and can work with the reader's bank to arrange a manageable outcome without pursuing a hard collection route. On the treatment side, the NHS gambling clinics accept self-referral in most regions and referrals through GamCare across the network. On the peer side, GamAnon supports family members whose relative is gambling. The chapter on getting support walks the whole layer through in more detail. What matters at the moment of decision is that the immediate step, blocking the card and calling the helpline, is the useful step, and that the substantive steps behind it, treatment and debt, run alongside it rather than after it. A UK reader who has been on an offshore balance and now wants to close the loop should treat the card block as the fastest single-step lever available, followed by the GamStop registration and then by the National Gambling Helpline call, in that order, with the treatment and debt work sitting on the days and weeks that follow rather than on the same evening as the first two steps. The layer that stops the next deposit is not the same as the layer that supports the person, and running one without the other tends to reproduce the pattern that led to the deposit in the first place.

Read next

• GamStop explained, the scheme, the periods, the checks
• The legal position for UK players outside GamStop
• Payments and checks, banks, cards, crypto, KYC
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions