The legal position for UK players outside GamStop

The player position, short and long

The short version of the player position is that a UK adult who places a deposit at an operator outside UKGC remit does not commit an offence under the Gambling Act 2005 for doing so. The offence sits on the operator, under Section 33, wherever remote gambling is supplied to a customer in Great Britain without a UKGC operating licence. The Act is written that way on purpose. It is written to give the regulator a workable enforcement route against the supply side, which is the side that can be licensed, audited and, in the last resort, fined or cut out of the payment rail, rather than against a diffuse population of consumers who cannot easily be audited and whom the state has no policy interest in prosecuting for the act of placing a bet.

The long version is that the absence of criminal liability on the player side is not, and has never been, a regulatory endorsement of the practice. The UK adult who deposits at an offshore operator is outside the UKGC's consumer-protection regime, outside the technical standards regime that applies to a UKGC-licensed remote operator, and outside the advertising code that governs how UKGC-licensed operators can present themselves to UK customers. From the fintech-compliance side, the interesting point is that the same deposit remains inside the UK payment-side regime for as long as it originates from a UK current account, a UK-issued card or a UK-linked exchange account. The Money Laundering Regulations 2017 do not stop caring about the transaction because the operator sits outside UKGC remit. If anything, the risk profile of the transaction rises.

Section 33 of the Gambling Act 2005

Section 33 of the Gambling Act 2005 is the operator offence, and it is the anchor point for the whole regulatory architecture that sits around remote gambling supplied to Great Britain. The section makes it an offence to provide facilities for gambling without an operating licence where the activity is caught by the Act, and its extraterritorial reach captures remote gambling supplied to customers in Great Britain wherever the operator's servers, corporate seat or licensing regime happen to sit. The wording is not accidental. It was drafted to close the earlier gap under which an operator hosted offshore could plausibly deny that it was operating within the jurisdiction of the UK regulator. The 2014 Licensing and Advertising Act reforms carried that closure through to advertising, and the position has held since.

What the section does not do is create an offence for the customer. There is no mirror provision under the Act that criminalises the placing of a bet by a UK adult at an offshore operator, and successive amendments have not added one. The result is a supply-side offence and a demand-side non-offence, which is a common shape in UK regulatory design where the state prefers to police the market at the point of supply rather than at the point of consumption. A payments-compliance reader recognises the pattern from the same architecture used elsewhere in retail-facing financial regulation, where the licensing perimeter falls on the firm rather than the consumer, and the consumer's exposure is managed through disclosure, redress and codes rather than through criminal liability.

A closer look

Enforcement of the section is a matter for the UKGC and, in the last resort, for the Crown Prosecution Service, and it is enforced principally through cease-and-desist notices, licensing action against connected UKGC licensees, domain-removal requests routed through Google, and disruption work at the payments-processor layer. The public compliance report published by the UKGC each year records the volume of that activity. What the section does not do, and was never designed to do, is reach into the settlement of a specific transaction that has already cleared through a UK card and a Curaçao acquirer. That transaction has already happened by the time the offence would be provable, and the enforcement remedy for the customer is not a criminal one. It is the absence of the UKGC consumer-protection regime around the operator that was on the other end of the wire.

Where UKGC jurisdiction stops

UKGC jurisdiction stops at the border of UKGC-licensed operators. The regulator supervises the operators it has licensed, enforces the operating licence conditions and code of practice against them, audits them on remote technical standards, receives their regulatory returns, imposes financial penalties on them where the conditions have been breached and, in the last resort, revokes the licence. Every consumer-facing protection that a UK player is aware of, from the requirement that customer funds be held in an appropriate protection regime, to the availability of an alternative dispute resolution provider, to the advertising code, to the age-verification regime, sits on the operator side of that boundary. On the far side of the boundary, none of it applies.

From the payments-compliance side, that boundary is where the fintech story starts rather than ends. A UK bank continues to sit inside the Money Laundering Regulations 2017 for the whole life of the customer relationship regardless of where the beneficiary of a card debit is licensed. The Payment Systems Regulator continues to supervise the operation of the UK payment systems that carry the transaction. Visa and Mastercard continue to apply their scheme rules to the merchant category code on the acquirer's file. HMRC continues to have its own interest in the tax profile of large-value outflows from UK accounts. Nothing about the offshore location of the operator removes the UK payment side from the transaction. It only removes the UK consumer-protection side.

What UKGC can and cannot do about offshore sites

The regulator can, and does, act against operators supplying UK customers without a licence. The 2024 to 2025 compliance activity records more than seven hundred and seventy cease-and-desist notices issued against illegal remote gambling activity, in the region of sixty-four thousand URL removals routed through Google's advertising and search-side interfaces, and two hundred and sixty-four domain removals. It can act against payment processors that continue to facilitate the traffic. It can act against affiliates and against advertising placements. It can, and does, publish public warnings against named operators on its own site. It cannot, however, license the operator into compliance from a distance, and it cannot pull an already-cleared deposit out of the customer's card statement.

What the regulator cannot do is compel a Curaçao-licensed operator, or an Anjouan-licensed operator, or an operator run out of any other jurisdiction with a less strict consumer-protection regime, to accept UKGC-style obligations against a UK complainant after the fact. It cannot arbitrate a disputed withdrawal. It cannot enforce a fund-segregation regime on a foreign operator. It cannot compel the return of ID documents held on a foreign server. And it cannot answer the correspondence of a UK complainant who reaches out about a non-UKGC operator with anything other than a signpost back to the fact that the operator sits outside UKGC remit. Those limitations are not a failure of the regulator. They are the boundaries of its statutory remit, and they matter because they set the shape of what any UK consumer is looking at when the operator is not UKGC-licensed.

The complaints path, or the absence of one

The complaints path that a UK consumer expects when a UKGC-licensed operator holds a balance, closes an account or refuses a withdrawal runs through the operator's own internal process, then through an alternative dispute resolution provider named in the operator's terms and conditions, and, in parallel, feeds into the UKGC's own compliance intelligence. When the operator is not UKGC-licensed, none of that architecture is available. There is no ADR provider that a UK consumer can escalate to. The UKGC cannot open a complaints case against an operator it does not license. And the operator's own internal complaints process is contractually bounded by whatever the terms and conditions signed at sign-up allow, which is typically a foreign choice of law and a foreign choice of jurisdiction.

From a payments-compliance angle, the practical route open to the UK consumer collapses into a card-side or bank-side action. That means a chargeback request through the card scheme if the transaction was a card debit, a Faster Payments recall through the sending bank if the transaction was a push payment, or, in the last resort, a civil claim in a foreign jurisdiction against an operator whose corporate structure may or may not be resolvable to a defendant that can be served. The card scheme routes are not neutral to the underlying facts. A card debit that was authorised by the cardholder and cleared by the merchant is not an easy chargeback candidate, and the scheme rules on gambling transactions have hardened rather than softened since 2023. None of that is a substitute for the ADR pathway a UK consumer would expect against a UKGC-licensed operator.

A closer look

The compliance-side reading of the missing complaints path is that it is the single most consequential loss on the consumer side of the boundary. A regulator that cannot open a complaints case cannot enforce a remedy. A consumer whose only route is a foreign civil claim is a consumer whose remedy is not, in any practical sense, available. The UKGC has been explicit about this on its own public pages, and its recurrent guidance to UK consumers about non-UKGC operators consistently returns to the point. It is worth reading alongside the UKGC's own material rather than relying on a summary here, because the regulator's own wording is deliberate and the summary always shortens what should not be shortened.

Alternative Dispute Resolution and its limits

UKGC-licensed remote operators are required to name an alternative dispute resolution provider in their terms and conditions, and that provider is available to a UK consumer who has exhausted the operator's internal complaints process. The ADR route is a real route, sits at no cost to the consumer at the point of use, and produces determinations that the licensed operator has to comply with under its licence conditions. It is not perfect, it is not fast, and the volumes it processes are not enormous, but it is a real regulatory feature and it is one of the material differences between the licensed environment and the environment outside it. It is also a feature that a fintech-compliance reader is likely to notice in comparison to the routes available under the Financial Ombudsman Service on the retail-finance side, because the shape of the ADR is the shape a licensed-market ADR tends to take.

Outside the UKGC-licensed environment, the equivalent route does not exist. A Curaçao-licensed operator is not required by its licensing regime to route UK complaints through an ADR provider recognised by the UKGC. Its terms and conditions may name a provider, but that provider is not audited by the UKGC and its determinations are not enforceable through UKGC licence conditions because the operator does not hold one. The Curaçao Gaming Authority following the Landsverordening op de Kansspelen reforms has been running a public complaints intake in an English-language format, and that is a materially different position from the pre-LOK arrangement under the master-licence system, but it is still not the same institution as a UK-recognised ADR provider and cannot be substituted for one in the reader's expectations.

White Paper 2023 reforms in force by 2026

The UKGC White Paper of April 2023, published as "High Stakes: Gambling Reform for the Digital Age", set out the reform programme that has been landing across 2024 and 2025 and is now largely in force. The affordability check regime for higher-value remote losses, the online slot stake caps at £2 and £5 by age group and £15 for older adults, the reform of the Gambling Act's advertising and marketing regime, and, most consequentially for the payments layer, the Statutory Levy in force from 6 April 2025 under the Gambling Levy Regulations 2025, are the pieces of the reform programme that a fintech-compliance reader is most likely to encounter in the wild. The Statutory Levy raises approximately £120 million in its first year, split fifty per cent to NHS treatment services, thirty per cent to Office for Health Improvement and Disparities prevention work and twenty per cent to research funded through UKRI and the UKGC.

The reforms sit inside the UKGC-licensed environment, and the levy applies at 1.1 per cent of gross gambling yield for online operators, at lower rates across other categories. None of them apply directly to a non-UKGC operator supplying a UK customer, but their indirect effects on the UK payment side are considerable. The affordability regime raises the operational cost of a UKGC-licensed account for higher-value players, which shifts some of that demand towards offshore alternatives, which in turn tightens the payments-side friction that UK issuers apply to offshore gambling debits. The levy funds the treatment pathway that a distressed player of any operator, licensed or not, will encounter through the National Gambling Helpline on 0808 8020 133. The reforms did not create the non-GamStop question, but they have changed the shape of the payments-side response to it in ways that are worth reading closely rather than dismissing as a licensing detail.

What the law does and does not protect

What the law protects, on the UK consumer side, is any player whose deposit sat inside a UKGC-licensed operator's cashier, and any subsequent dispute over that deposit that runs through the operator's internal complaints process into an ADR provider and, in the last resort, into the UKGC's own compliance intelligence. It protects the player against advertising that breaches the code, against age-verification breaches, against the sale of gambling products to under-18s, against the retention of customer funds in operating capital rather than in a segregated account of the appropriate protection level, and against the marketing of specific products in ways that misrepresent them. All of that is real and all of that continues to work in the licensed environment.

What the law does not protect is any transaction with an operator that does not hold a UKGC licence. The absence of criminal liability on the player side is not a substitute for that protection, because the criminal law was never the vehicle that would have provided it. The vehicle that provides it is the operating licence and the code of practice, and the licence is held by the operator or it is not. The compliance-side reading of the position is that a UK adult who has understood the split between operator liability and consumer protection has understood everything the law is going to tell them about their exposure, and the rest of the story runs through the payments layer, the AML regime and the harm-reduction stack rather than through the statute book. That is where the practical response to the position lives, and it is where the rest of this site is oriented.

Read next

• GamStop explained, the scheme, the periods, the checks
• The risks, explained without the marketing
• Payments and checks, banks, cards, crypto, KYC
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions