Slots Not on GamStop: What Licence Actually Costs an Operator

The phrase "slots not on GamStop" gets typed thousands of times a day in the UK, usually by someone who has self-excluded and now wants a way back in. The honest answer is more boring than the search suggests: it comes down to which licence sits behind the site, what checks the operator runs, and what happens when those checks fail.

This page treats the topic from the accountability side. Rather than ranking brands by bonus size, it walks through what it takes to obtain and keep a gambling licence, how anti-money-laundering and know-your-customer duties are enforced, and where the audit trail actually leads when a regulator comes knocking.

What "not on GamStop" Really Means in Licence Terms

Which register is the UK one?

GamStop is the UK's national self-exclusion scheme, operated since 2018 and mandatory for any operator holding a licence from the Gambling Commission. If a site holds a UKGC licence, its players are in the scheme by default, whether they asked to be or not. That is the whole mechanism in one sentence.

Slots described as "not on GamStop" are, by definition, sites that do not hold a UK Gambling Commission licence. They are usually licensed elsewhere, most commonly in Curaçao, Anjouan, Kahnawake or by the Malta Gaming Authority for EU-facing operations. The licence exists; it is simply a different one, written under a different rulebook.

The practical difference matters. Under a UKGC licence, an operator must integrate with GamStop, participate in the multi-operator self-exclusion scheme, display the National Gambling Helpline (0808 8020 133) prominently, and run affordability checks at deposit thresholds. A Curaçao-licensed site has no obligation to do any of that.

Is a non-UK licence legal for a British player?

Playing on a foreign-licensed site is not illegal for the individual in the UK. The law places the obligation on the operator to hold a UK licence before advertising or transacting with British customers, not on the punter to verify licence provenance before pressing spin. Enforcement falls almost entirely on the business side.

That distinction explains why the market exists at all. Enforcement against operators without a UK licence has been slow and uneven, while demand from self-excluded players remains steady. The result is a parallel market that keeps growing despite periodic crackdowns on advertising and payment processing.

What changes for the player?

The practical differences are concrete and measurable. A UKGC-licensed casino must offer deposit limits, reality checks at intervals the player sets, and a direct link to self-exclusion tools within two clicks of the cashier. On a Curaçao site, these tools may exist as a checkbox in the account settings, or they may not exist at all.

What It Costs to Get a Licence

How much does a UK Gambling Commission licence cost?

The application fee alone runs to £3,700 for a remote casino licence, with annual fees thereafter banded by gross gambling yield. Operators with GGY under £500,000 pay around £5,000 per year; those clearing £10 million or more pay substantially more. The numbers are public, published in the Commission's fee tables, and they are only the entry price.

Behind the fee sits the real cost: the licence application itself takes 16 weeks or longer, requires a full business plan, source-of-funds evidence for every director and 25%+ shareholder, and a key-person fit-and-proper assessment. Most operators budget legal and advisory spend well into six figures before a single game goes live.

Compare that with a Curaçao master licence under the new 2023 framework. Application costs are measured in the low tens of thousands of dollars, the timeline is shorter, and the ongoing reporting burden is lighter. That gap in overhead is a large part of why the "not on GamStop" market can price bonuses more aggressively.

Which checks run before a licence is granted?

Every director, shadow director and significant controller passes a fit-and-proper test covering criminal record, financial history, and prior regulatory dealings. A single unspent conviction for fraud or a prior licence revocation in another jurisdiction will normally end the application. The Commission also reviews the proposed compliance officer and MLRO by name.

Source of funds is the other gate. If a founder made money in an unrelated business, the application needs documentary evidence of how that money was earned and how it reached the gambling operation. Bank statements, sale contracts, tax filings. Vague answers here delay applications for months, and sometimes kill them.

What does keeping a licence involve?

Once granted, the licence comes with a standing obligation to report material changes: new beneficial owners, changes of control, significant changes to the operating model, and any regulatory matter in another jurisdiction. Failing to report a change of control is itself a breach, separate from whatever the underlying change might imply.

Annual regulatory returns are due on a fixed schedule, covering gross gambling yield, customer numbers, and compliance incidents. The Commission's compliance assessments are unannounced and can cover everything from the marketing archive to the cashier's source-of-funds prompts. Operators that treat compliance as a paperwork exercise get found out quickly.

How do audits actually work?

Remote casino licence holders must commission an annual independent audit of their random number generator and the return-to-player percentages advertised on each game. The audit report goes to the Commission. If a slot advertises 96% RTP and delivers 94% over a statistically valid sample, that is a reportable discrepancy, not a rounding error.

Anti-money-laundering audits run separately. An external reviewer samples customer files, tests whether enhanced due diligence was applied when it should have been, and traces the escalation path from the first red flag to the MLRO's decision. A file that shows a £40,000 deposit with no source-of-funds note is a finding, and findings get reported.

Suppose a hypothetical operator sees a customer deposit £5,000 in a single transaction, then another £8,000 three days later, all from a newly opened bank account. Under UK rules, that pattern triggers a source-of-funds request before further play. If the customer cannot explain where the money came from, the account is frozen and a suspicious activity report follows.

AML and KYC: The Rules Behind the Checkbox

What does KYC require at signup?

Know-your-customer obligations under the Money Laundering Regulations 2017 require identity verification before a customer can place a bet or spin. Name, date of birth, residential address, and a document check. For remote onboarding, operators typically use an electronic identity check against credit reference or electoral roll data, backed by document upload when the electronic check fails.

The standard is risk-based, not one-size-fits-all. A customer depositing £10 from a UK address with a clean electronic check passes quickly. A customer using a VPN, a prepaid card, and an address in a higher-risk jurisdiction gets the full enhanced due diligence treatment: source of wealth, occupation, additional documents, senior sign-off.

When does enhanced due diligence kick in?

Enhanced due diligence applies when the risk assessment says it should: politically exposed persons, customers from higher-risk countries, unusual transaction patterns, or any relationship the operator's own systems flag as anomalous. The obligation is to understand the source of the money, not merely to hold a copy of a passport.

Consider a hypothetical case. A customer lists occupation as self-employed, deposits £25,000 over two weeks from three different accounts, and asks for a withdrawal to a fourth account in another name. Under UK rules, play stops, questions start, and the MLRO reviews the file personally. Answering those questions late or badly is how operators end up in enforcement notices.

What triggers a suspicious activity report?

A SAR goes to the National Crime Agency when an operator knows or suspects that a transaction relates to criminal property, or when it has reasonable grounds for that suspicion. The threshold is deliberately low. Reporting in good faith protects the operator; failing to report when the signs are obvious is a criminal offence under the Proceeds of Crime Act 2002.

Operators keep a internal SAR log with dates, decision rationale, and the identity of the person who made the call. When the Commission audits, that log is one of the first documents requested. A log with no entries at all over a year is itself a red flag: either the operator is unusually clean, or its detection systems are not working.

How do payment processors fit in?

Card schemes and e-wallet providers run their own risk models on top of the operator's. A site with a high chargeback rate, a pattern of disputed transactions, or an unusually high share of third-party deposits will lose its merchant account, licence or not. Several UK-facing operators have lost card processing overnight for exactly this reason.

Crypto rails change the picture. On a Curaçao-licensed site accepting Bitcoin or USDT, the operator still has KYC duties under Curaçao's 2023 decree, but the traceability of funds depends on blockchain analytics rather than bank records. Operators serious about compliance run wallet-screening tools; those that do not are effectively passing the risk downstream to whoever accepts their withdrawal.

Top Operators and Where Their Licences Sit

Which major UK brands hold a UKGC licence?

The household names on the British high street and online all sit under the Gambling Commission. Bet365 casino, William Hill casino, Ladbrokes casino, Coral casino and Sky Bet casino are UKGC-licensed, which means GamStop applies to every one of them by default. The same holds for Paddy Power casino, Betfred casino, and Gala Bingo.

That list extends well past the big five. Sky Vegas casino, Betfair casino, Virgin Games casino, Betway casino, JackpotJoy casino and 888 Casino all operate under UK licences with full self-exclusion integration. A player registered with GamStop cannot open an account at any of them, and any attempt to do so is blocked at the identity check stage.

Further down the same list: Foxy Bingo, Admiral casino, 32Red casino, BetVictor casino, PartyCasino, Monopoly Casino, Grosvenor Casinos, Unibet casino, Sun Bingo, MrQ casino, Double Bubble Bingo and Heart Bingo. All UKGC-licensed. Rainbow Riches Casino, Midnite casino, Lottoland, BetMGM casino, PlayOJO and LottoGo follow the same pattern.

Which operators run outside GamStop?

Several names on the wider market list operate under licences other than the UKGC, which is what places them outside GamStop. Mystake casino, Goldenbet casino, Donbet casino, Fat Pirate, NineWin casino, NYSpins casino, Rolletto casino and Velobet casino all fall into this category, typically under Curaçao or Anjouan authorisation.

These are offshore operations. Saying so plainly matters more than dressing it up. They hold a licence, they are subject to that licensor's rules, and they are not subject to the UK Gambling Commission's rules. For a player, the practical consequence is that UK dispute routes, UK affordability checks, and UK self-exclusion tools do not apply.

Some brands straddle both worlds. Betway casino, Unibet casino and 888 Casino hold UK licences for British customers and separate MGA or other licences for markets where the UKGC has no reach. The same brand name can therefore lead to a different regulatory experience depending on which domain a player lands on.

What about sports-first brands with casino products?

Sports-led operators often carry casino products under the same licence. talkSPORT BET, LiveScore Bet, QuinnBet, Sportingbet, Smarkets and BetGoodwin all run casino sections under their UK licences, meaning GamStop covers their slot offerings too. The brand may be known for football odds, but the regulatory treatment of its slots is identical to a pure casino.

Others on the list sit in a similar position: Tote casino, The Pools, PricedUp casino, DragonBet, BetWright, Kwiff and 7bet casino. Each holds a UK licence covering its casino product, each participates in self-exclusion, and each is subject to the same audit cycle described earlier. Brand identity does not change licence obligations.

Which bingo and slingo brands are UKGC-licensed?

Gala Bingo, Sun Bingo, Double Bubble Bingo, Heart Bingo, Fabulous Bingo, Lucky Pants bingo and Foxy Bingo all operate under UK licences with GamStop integration. Slingo casino sits in the same group. For players, this means a self-exclusion registered at GamStop covers bingo and slingo play across these brands automatically.

The picture for non-UK bingo brands mirrors the casino market. A bingo room licensed in Curaçao carries the same offshore characteristics as a Curaçao casino: no GamStop, no UK affordability triggers, and dispute resolution routed through the licensor rather than a UK ADR body.

What Happens When Operators Get It Wrong

How large are UK enforcement penalties?

The Gambling Commission publishes every fine. Recent years have produced penalties in the millions: £19.2 million against Entain in 2023 for AML and social responsibility failures, £17.1 million against William Hill in 2022 for systemic responsible-gambling breaches, and £13.4 million against 888 in 2023 covering both AML and social responsibility failings.

Those numbers are not outliers. They reflect a pattern where the Commission has moved from four-figure penalties to sums that affect group-level reporting. For an operator running on a thin licence-cost budget, a single seven-figure fine wipes out years of margin from a product line.

What kinds of failures get flagged?

Common findings include allowing self-excluded customers to continue playing, failing to act on obvious affordability signals, accepting deposits without source-of-funds evidence, and marketing to customers who had asked not to be contacted. Each category maps to a specific rule in the Licence Conditions and Codes of Practice.

A hypothetical but representative case: a customer who had self-excluded through GamStop opens a new account using a different email address but the same card. If the operator's systems do not match the card against the exclusion list, play continues until either the customer complains or an audit catches it. Both outcomes end in a regulatory finding.

Do offshore operators face consequences?

Consequences for non-UK-licensed operators come from a different direction. Payment providers cut ties, advertising platforms refuse placements, and internet service providers can be asked to block access under the Gambling Act. The licensor may also act, though enforcement quality varies sharply between jurisdictions.

Curaçao's 2023 overhaul introduced a clearer framework and a central regulator with actual sanction powers, replacing a system where master licence holders largely policed themselves. Anjouan and Kahnawake remain lighter-touch. A player assessing a non-GamStop site should therefore check not just which licence it holds, but which enforcement regime that licence sits under.

What recourse does a player actually have?

Under a UK licence, a disputed withdrawal goes to an approved alternative dispute resolution body first, then to the Gambling Commission if unresolved. The route is documented, time-bound, and free to the consumer. Under most offshore licences, the route is the licensor's complaints process, with no independent body in between.

That gap in recourse is the quiet cost of playing outside the UK system. It rarely shows up in a welcome bonus comparison, but it decides what happens the day a withdrawal is held for "additional verification" with no clear timeline attached.

Where does affordability checking stand in 2026?

The UK's approach has tightened progressively: customer care assessments at deposit thresholds, evidence requests for higher-value accounts, and a shift from reactive to proactive monitoring. Operators must be able to show what they knew about a customer's financial situation and when they knew it. Records of those assessments are auditable.

Offshore operators have no equivalent duty. A player depositing £5,000 a week on a Curaçao-licensed site will not be asked for payslips. For some players that is precisely the appeal. For anyone who has self-excluded because of harm, it is the exact mechanism they were trying to escape.

Frequently Asked Questions

Is it legal to play slots not on GamStop from the UK?

Yes, the individual player commits no offence by playing on a foreign-licensed site. The obligation to hold a UK licence sits with the operator, not the customer. What changes is your protection: no GamStop coverage, no UK affordability checks, and dispute resolution routed through a foreign licensor instead of a UK body.

How do I know if a casino is licensed outside the UK?

Check the footer for the licence number and click through to the regulator's public register. A UKGC licence begins with a specific number format and appears on the Gambling Commission's own licensee search. Curaçao, MGA and Anjouan licences each have their own verifiable registers; an unverifiable licence claim is a stop sign.

What happens to my GamStop registration if I play offshore?

Your GamStop registration stays active and still blocks every UKGC-licensed operator. Playing offshore does not cancel it, does not shorten the exclusion period, and does not count as a breach. When the exclusion ends, your UK accounts remain blocked until you contact each operator separately to request reinstatement.

Do non-GamStop casinos pay winnings?

Reputable ones do, though withdrawal times and verification standards vary widely. The difference is the recourse if they do not: no UK ADR body, no Gambling Commission escalation. Reading the operator's own withdrawal terms before depositing, particularly the maximum withdrawal limits and pending periods, saves arguments later.

Which licence is strongest outside the UK?

The Malta Gaming Authority carries the most weight among non-UK options, with published enforcement decisions, mandatory player-fund segregation, and a formal ADR process. Curaçao's reformed framework is improving but still younger. Kahnawake and Anjouan sit further down in terms of visible enforcement activity.

Can a UK bank block payments to these sites?

Yes. UK banks and card issuers can decline transactions to gambling merchants under their own policies and under the Gambling Act's advertising and transaction restrictions. Some banks block all gambling transactions by default, which applies regardless of whether the operator holds a UK licence or not.

What should I check before depositing on a non-GamStop site?

Four things: the licence number and its entry in the regulator's register, the stated withdrawal limits and pending period, the availability of deposit limits and self-exclusion tools in the account settings, and the identity of the company behind the site. A missing company name or a hidden licence number is the fastest red flag there is.

Do these sites offer games from Pragmatic, NetEnt and Evolution?

Many do, because game studios supply operators across multiple jurisdictions. Pragmatic Play, NetEnt, Microgaming, Evolution and Hacksaw all license titles to UKGC and non-UKGC operators alike. The studio behind a slot does not change the licence framework around it, so identical games can sit under two entirely different sets of player protections.

How does the operator's licence affect RTP?

Both UKGC and MGA licences require independent testing of random number generators and advertised return-to-player figures. Curaçao's requirements here are less detailed in practice. The audit obligation described earlier applies strictly under UK rules, with annual reports filed and discrepancies treated as compliance matters.

Is there a way to play slots while still excluded?

Not through any UKGC-licensed operator, and that is by design. The exclusion exists to hold for its full term. Anyone looking for a way around it should instead use the National Gambling Helpline on 0808 8020 133, which operates 24 hours a day and can discuss the underlying reasons behind the exclusion request.

Responsible Gambling

Gambling is for adults aged 18 and over in the United Kingdom. If gambling is causing harm to you or someone close to you, contact the National Gambling Helpline on 0808 8020 133, free and available 24 hours a day, every day of the year.

GamStop (gamstop.co.uk) lets you self-exclude from all UK-licensed gambling sites for six months, one year, or five years, and the exclusion cannot be reversed once registered. Gamban and BetBlocker are additional tools that restrict access across devices, and independent support is available through GamCare and the Gordon Moody Association.

Setting a deposit limit before your first wager costs nothing and takes under a minute.