The risks, explained without the marketing
This chapter reads the risks of non-UKGC play from the UK bank's side of the wire. It sets out what a UK issuer sees when a cardholder authorises an offshore MCC 7995 debit, at what value and frequency the flag becomes a review, when a review becomes a freeze, and how that whole surface stacks up against the loss of fund segregation, the loss of ADR and the reworked Curaçao licensing environment on the operator's side of the transaction.
No UKGC oversight, what that means day to day
The absence of UKGC oversight is not an abstract regulatory point. Day to day it means the operator's technical standards are not audited by the UK regulator, the random-number generator on any live game is not certified against UKGC-recognised laboratories, the responsible-gambling tools presented at the cashier are not enforced by any UK regulator, and the customer's balance is not held in an account of any UK-recognised protection level. A UKGC-licensed operator publishes its customer-fund protection level in its terms, ranging from basic to medium to high, and the level of that protection is a regulatory feature the licensee has to state and hold to. Outside UKGC remit, the equivalent statement is either a marketing statement or a foreign-law statement, and neither has the same enforceability behind it.
From the UK bank's side of the same relationship, the absence of UKGC oversight increases the perceived risk of the transaction at the point of authorisation. A UK issuer's internal categorisation of the acquirer includes country risk, product risk and the presence or absence of a recognised gambling regulator over the operator sitting behind the acquirer. An acquirer in Curaçao processing gambling traffic for an operator without a UKGC licence sits inside a country-plus-product-plus-regulator combination that most UK banks treat as materially higher risk than a UKGC-licensed operator processed through a UK-domiciled acquirer. That perceived risk is the reason the same-sized debit reads differently on the monitoring surface depending on where the acquirer sits.
02No fund segregation guarantee
UKGC-licensed remote operators have to state a customer-fund protection level in their terms and conditions, from basic to medium to high, and the level a specific operator maintains is a matter of licensing supervision. At the top end of the range, the customer funds sit in trust with independent trustees and are not exposed to the operator's insolvency risk. At the basic end, the funds are held in a designated account that is segregated from the operator's own funds but does not have the same trust-level protection. Nothing about that regime is perfect and it does not remove all insolvency exposure, but it is a real feature of the licensed environment and it is enforced by the UKGC.
Outside the UKGC-licensed environment, the equivalent statement is only as strong as the licensing jurisdiction's own rules and the operator's own operational discipline. There is no requirement, enforced against a UK player, that a Curaçao-licensed operator hold UK-customer balances in a segregated account of any level, and even where the operator states that it does, the enforceability of that statement is not a UK regulatory matter. From the UK bank's side of the same picture, the absence of fund segregation is not a risk the bank can see on the authorisation, but it is a risk that shows up later when a cardholder attempts a chargeback against a merchant whose insolvency has removed the underlying funds. It is one of the reasons the bank's monitoring rules treat the offshore acquirer differently even where the cardholder has authorised the debit.
A closer look
The compliance-side reading of the fund-segregation issue is that it stops being a UK regulatory issue at the point the operator is not UKGC-licensed, and starts being a private-law issue governed by whatever the operator's terms and conditions and its licensing jurisdiction's insolvency law say. A UK player who has been told the operator segregates funds and finds, on a withdrawal request that is refused, that the operator's own balance sheet does not appear to support the withdrawal, is looking at a private-law claim in a foreign jurisdiction against a defendant that may not be straightforward to serve. That is not a hypothetical position. It is the position that follows from stepping outside the UKGC licensed environment, and it is worth understanding in advance rather than after.
03No mandatory ADR body
Every UKGC-licensed remote operator has to name an ADR provider in its terms, and that provider is available to a UK complainant who has exhausted the operator's internal complaints route. The provider sits inside the UKGC's supervised ADR panel, applies procedural rules the UKGC has approved, and produces determinations that the licensee has to comply with under its licence. The consumer pays nothing at the point of use. It is not the same institution as the Financial Ombudsman Service, but the shape of it is recognisable to a fintech-compliance reader who has spent time with FOS material, and it is one of the material differences between the licensed and unlicensed environments.
No equivalent mandatory ADR body sits over a non-UKGC operator's UK complaints. A Curaçao-licensed operator may name an internal complaints route and, following the LOK reforms of December 2024, the Curaçao Gaming Authority has taken direct complaints from consumers in a way that the pre-LOK master-licence system did not. The authority publishes information about how a complaint is intended to move through its own internal process, and that is a material change from the pre-LOK arrangement. It is not, however, a UK-recognised ADR route, and the outputs of the process are not enforceable through a UK licence condition because the operator does not hold one. The route it provides is a foreign administrative route, not a UK consumer-protection route, and the two should not be confused.
04Offshore licensing landscape after Curacao LOK 2024
The Landsverordening op de Kansspelen entered into force on 24 December 2024 and replaced the master-licence system that had defined the Curaçao offshore gambling licensing environment for two decades. Under the previous system a small number of master licensees sub-licensed operators, and direct enforcement against a specific sub-licensee was limited. Under LOK the Curaçao Gaming Authority sits as the single regulator with direct rule-making, licensing, supervision and enforcement authority over any operator holding a Curaçao licence. The authority has published an English-language register of licensees, requires operators to publish licence numbers in a format that can be verified against the register, and has taken direct disciplinary action against a set of transitional-period operators that did not meet the new standard.
None of that changes the position of a UK player. The UKGC does not recognise a Curaçao licence as a UK operating licence, the Section 33 offence continues to apply to any operator supplying UK customers without a UKGC licence, and the UK bank's monitoring surface does not recategorise an acquirer's country risk because the operator's licensing jurisdiction has tightened. The LOK reforms have made the Curaçao end of the offshore market materially more legible than it was, which is worth noting, but the payments-side friction on a UK cardholder's debit to a Curaçao acquirer has not eased in the same period. If anything it has tightened, because the UKGC's 2025 work with Visa and Mastercard on MCC enforcement has run in parallel with the LOK transition rather than in response to it.
Key points
- No UKGC oversight of the operator means no UKGC-recognised technical certification, no UKGC-enforced fund segregation, no UKGC-recognised ADR
- Card scheme MCC 7995 sits at the acquirer layer and is what a UK issuer reads to categorise a debit as a gambling transaction
- UK bank card gambling switches on HSBC, Monzo, Starling, Lloyds and Barclays apply a decline at authorisation, before the operator's cashier sees the response
- Curaçao LOK reforms of December 2024 tightened the Curaçao end of the offshore market but did not change the UK payments-side risk profile
- Chargeback is not a refund route for lost gambling stakes, and both Visa and Mastercard have hardened the gambling-related dispute rules under the 2025 taskforce
Anjouan, MGA, Gibraltar, how they compare
Anjouan-licensed operators sit under a licensing regime that has grown quickly since 2023 and is now visible across a portion of the non-UKGC-facing market. The regime's rulebook is materially less developed than the Curaçao LOK regime, the licensing supervision framework is thinner, and the UK bank's country-risk categorisation of the acquirer country tends to reflect that. Malta Gaming Authority licensees sit under a European framework that is materially closer to a UK-style consumer-protection regime, and Gibraltar licensees sit under a UK Overseas Territory framework that shares more with the UKGC regime than any other single offshore option. None of them, however, is a UKGC-licensed environment for the purposes of a UK player's consumer-protection cover.
From the payments-compliance side, the interesting observation is that the UK bank's monitoring rules are calibrated on the payments-side risk profile rather than on the marketing gloss of the operator's licence claim. A debit to an acquirer in a jurisdiction with a thinner regulatory regime reads as a higher-risk debit even where the operator's own site presents a longer list of certifications. A debit to a Gibraltar-linked acquirer reads as a lower-risk debit than a debit to an Anjouan-linked acquirer at the same size, and both read as higher-risk debits than a debit to a UK-domiciled acquirer processing a UKGC-licensed operator. The fintech-compliance reader will recognise that the risk categorisation is a bank-side categorisation rather than a marketing categorisation, and it is one of the reasons the same debit at the same size looks very different depending on where it is going.
A closer look
None of the offshore licensing options translates into UKGC consumer protection for a UK player. A Gibraltar-licensed operator that does not also hold a UKGC operating licence is not a UKGC-licensed operator for the purposes of the UK statute, an MGA-licensed operator likewise is not, and neither is an Anjouan-licensed operator. The compliance-side observation is that the licence tier of the operator matters to the operator's own regulatory exposure and to some elements of the transaction's payments-side risk score, but it does not create UK consumer-protection cover of the kind that comes with a UKGC operating licence, and no amount of licensing-tier improvement on the offshore side changes the presence or absence of Section 33 exposure on the operator side of the transaction.
06Payment friction that is only growing
Payment friction on offshore gambling debits from UK cardholders has grown steadily since the UKGC White Paper of April 2023, and has grown more sharply since the Statutory Levy came into force on 6 April 2025 and since the Visa and Mastercard 2025 taskforce work on gambling MCC enforcement. HSBC, Monzo, Starling, Lloyds and Barclays each now offer a customer-facing gambling switch on their current-account cards, with cool-offs applied between toggling the switch off and the first successful authorisation. Merchant-category-code discipline at the acquirer layer has tightened, and the card schemes have taken enforcement steps against acquirers that misclassify gambling merchants under non-gambling MCCs. The composite result is that a UK cardholder attempting an offshore gambling debit in 2026 encounters a wall of friction that would not have been there in 2022.
None of that friction is an accident. It is the payments-side response to a period of policy attention on gambling harm, on the AML risk profile of the offshore gambling sector and on the specific vulnerability of UK cardholders whose self-exclusion at the operator layer has not been backed up by any control at the card layer. The card gambling switch does not sit inside the Payment Services Regulations 2017 as a mandatory feature. It sits inside each bank's own product design, and it has been adopted across the sector because the evidence base supported it, because the FCA has signalled that it welcomes it, and because the consumer-outcome regulatory expectation under the Consumer Duty has continued to push in the same direction. The result on the ground is that a deposit that cleared in 2022 will now often sit on soft decline, with the cardholder invited to re-confirm it through a channel that adds a further layer of friction on top of the switch itself.
What happens to your ID documents
A UKGC-licensed operator that holds a UK player's identity documents is sitting inside the UK GDPR regime, is a data controller for the purposes of the Data Protection Act 2018, and has to respond to Subject Access Requests under the timing rules the Information Commissioner supervises. The identity documents themselves are held under a retention regime the operator has to publish and to justify, and the UK player has enforceable rights over their handling. If the operator misuses the documents, the player has a complaint route to the ICO in the same shape as any other data-controller complaint, and the ICO has enforcement powers against a UK-domiciled operator that are not hypothetical.
A non-UKGC operator holding the same documents is sitting outside the UK GDPR regime for the purposes of the enforcement route the ICO would use. The operator's own privacy notice may cite a foreign data-protection regime that has some family resemblance to UK GDPR, but the routes into that regime are not the same routes and the enforceability of any complaint depends on the operator's local jurisdiction rather than on UK law. From the payments-compliance side, the same observation applies to the KYC file itself: a UK cardholder whose passport, driving licence, utility bill and selfie sit on a Curaçao server is a cardholder whose data footprint is not covered by the UK regime, and any downstream misuse is a foreign-jurisdiction issue, not a UK regulator's issue. That is a real risk and it is not, in general, one that a cardholder appreciates until a specific incident makes it visible.
08Practical harm-reduction if a deposit has already gone
Where a deposit has already gone, the practical harm-reduction position is not that the money can be pulled back at will. It is that the wider harm-reduction stack is designed to work forward from where the cardholder actually is, rather than backward through a transaction that has already cleared. The first practical step is to call the National Gambling Helpline on 0808 8020 133, which is free, confidential and open twenty-four hours a day, seven days a week, and which can signpost into structured self-help, family services, treatment routes through the National Gambling Treatment Service, and money-management support. The helpline conversation does not undo the transaction, but it is the single most consequential intervention available in the same week rather than the same month.
The payments-side steps that sit alongside the helpline conversation are the practical controls a UK cardholder can apply the same day. Toggling on the gambling switch on any UK current-account card the cardholder holds is a five-minute step that removes the option of a further debit on the same card. Reviewing standing orders and direct debits against gambling-adjacent counterparties is a five-minute audit that catches subscription-style exposures that the cardholder may have forgotten. Notifying the bank that gambling activity is a concern, in a customer-service conversation, opens the option of a further account-level review, which some UK banks now offer under their vulnerable-customer frameworks. None of these steps is a substitute for treatment, but they are the payments-side moves that make treatment easier to sustain by removing the option of an unnoticed second, third or fourth debit.
Read next
- GamStop explained, the scheme, the periods, the checks
- The legal position for UK players outside GamStop
- Payments and checks, banks, cards, crypto, KYC
- Coming off GamStop, the official route
- Getting support, helplines, clinics, family, money
Sources and verification
UKGC remit, White Paper reforms, Statutory Levy commencement and 2024 to 2025 enforcement volumes underpin the payments-side risk picture set out on this page. Full statutory framing and the compliance activity report are published on the regulator's own site at gamblingcommission.gov.uk. Last checked 5 August 2026.
Frequently asked questions
What does merchant category code 7995 actually look like on my UK bank's monitoring surface?
MCC 7995 is the four-digit merchant category assigned by the card schemes to gambling transactions, and it is the field a UK issuer's transaction-monitoring engine reads when a gambling-adjacent debit is authorised. On the monitoring surface, a debit with MCC 7995 sits inside a bucket that runs separately from retail spend, and the internal rules that apply to that bucket are calibrated on value thresholds, frequency thresholds and the acquirer country. It is the reason a five-hundred-pound gambling debit to a Curaçao acquirer looks materially different, to the bank, from a five-hundred-pound grocery debit to a UK acquirer, even where the cardholder authorised both.
At what value does a UK bank typically flag an offshore gambling debit for a source-of-funds review?
There is no single published threshold that applies across UK current-account providers, and the internal figures each provider uses are risk-based rather than fixed. What is common across the sector is that a single debit, or a short-window aggregation of debits, that pushes a customer's gambling exposure past a materially different level from the baseline on their account will trigger some form of internal review. In practical terms, a four-figure debit to a gambling acquirer at a foreign location is one of the recognised trigger patterns, and a series of smaller debits under a round-figure threshold can sit inside the same trigger.
When does a UK bank actually freeze an account over offshore gambling activity, rather than just flag it?
Account freezes are a last-resort control, sit inside the bank's own terms and conditions and are not applied lightly. The pattern that most commonly leads to a freeze is the appearance of debits that the bank considers inconsistent with the customer's declared source of funds, the appearance of counterparty patterns that trip an AML rule set beyond the gambling-specific rules, or the appearance of activity that the bank suspects is on behalf of a third party. A freeze is not a punishment for gambling. It is a protective control the bank has to be able to apply under its regulatory obligations.
Why does the card gambling switch on my UK bank block the transaction before the operator's cashier even sees it?
The switch sits at the authorisation layer of the card. When the cashier at the operator's site requests authorisation from the acquirer, the acquirer forwards the request to the card scheme, and the scheme forwards it to the issuer. The switch, once toggled on, applies a decline rule at the issuer for any authorisation code that reads as a gambling merchant category. That decision sits at the issuer, before the authorisation response leaves the UK banking side, and the operator's cashier only sees the decline that comes back. The operator was never given the option to accept the transaction; the issuer never gave it one.
Is a chargeback available to a UK cardholder against an offshore operator, and what are the limits?
A chargeback under the card scheme rules is technically available for any qualifying dispute, but the grounds are narrow. A cardholder who authorised the transaction, received the service and lost the balance to normal gambling activity does not have a straightforward chargeback claim, because that is not what the chargeback mechanism was designed for. Chargebacks work where a transaction was unauthorised, where the service was not delivered as described, or where the merchant misrepresented the transaction. They do not work as an after-the-fact refund route on lost gambling stakes, and both Visa and Mastercard have tightened enforcement around gambling-related chargeback abuse under the 2025 taskforce.
Talk to someone today
The National Gambling Helpline is free, confidential and open 24 hours a day, seven days a week.