The risks, explained without the marketing

No UKGC oversight, what that means day to day

UKGC oversight of a licensed operator is a continuous exercise. It includes annual regulatory returns, quarterly complaint intake, targeted compliance assessments, thematic reviews on identified risk areas, sanctions where breaches are found, and public statements that name the operator and describe the finding. In the 2025 enforcement return alone, fines against UKGC licensees included Spreadex at 2.0 million pounds, AG Communications at 1.4 million pounds and Corbett Bookmakers at 686,000 pounds. Those figures are visible because the supervisory chain is public. The consumer of a licensed operator is not required to take the operator's compliance on trust, the record is on the Commission's website.

On the offshore side, the equivalent record does not exist in a form the UK consumer can read. Curacao's LOK 2024 register is more transparent than the previous master-licence structure, and the Malta Gaming Authority publishes some enforcement material, but neither approaches the depth or the regularity of the UKGC's public record. In practical day-to-day terms, this changes what a customer can find out before they deposit. On a UKGC licensee, the compliance history is searchable in a way that produces useful signal. On a non-UKGC operator, a search of the equivalent depth typically returns marketing copy and third-party review content of uncertain provenance rather than an audit trail. The absence of the supervisory record is the first, quiet risk. It is not the loudest, but it shapes every other risk on this page.

No fund segregation guarantee

Fund segregation is a formal condition of a UKGC operating licence at higher rating levels, and every UKGC licensee is required to describe the level of protection it offers to customer funds in a rating disclosure on its site. The rating scale runs from "not protected" through "medium protection" to "high protection", with the top rating requiring customer funds to be held in trust in a separate account with a legal structure that keeps them outside the operator's own insolvency estate. A meaningful share of UKGC licensees hold the medium rating and a subset hold the high rating, which means that in the event of insolvency, customer balances are treated as trust property rather than as unsecured claims against a failed company.

Non-UKGC operators are not bound by that condition. Some publish an equivalent statement voluntarily, some describe their arrangements in generic terms, and some make no statement at all. Where the operator sits in a jurisdiction whose insolvency law does not recognise the concept of segregated trust accounts for customer funds, even a voluntary statement provides limited practical assurance in the event of operator failure. This is not a hypothetical concern. The offshore market has a longer failure tail than the licensed market, in the sense that smaller unlicensed operators cease trading more frequently and with less orderly wind-down. Where that happens, stored balances tend to be lost. The fund-segregation gap is the second concrete difference between the two markets.

A closer look

Two operational details matter. First, the fund-segregation rating on a UKGC site is required to be displayed in a prominent place, typically in the site's terms of use or in a dedicated responsible-gambling page. If a UK adult can read the rating, they know where the operator sits on the scale. Second, the rating is an operator-level statement subject to regulatory oversight, so a false or misleading rating declaration is itself a licence breach and would appear in the UKGC public statement record if enforced. Neither of these mechanisms is available to a customer of a non-UKGC operator, and this is what a numerate reading of the topic really means, the difference is not a claim about honesty, it is a difference in the auditability of the claim.

No mandatory ADR body

The absence of a mandatory Alternative Dispute Resolution body is the risk most often understated in general coverage. A UKGC-licensed operator must appoint an approved ADR provider whose decisions bind the operator up to a defined monetary threshold, whose annual data is public, and which sits inside the ADR for Consumer Disputes framework in UK statutory instruments. That is not a marketing promise, it is a piece of law. It gives the consumer a defined complaint pathway, a public dataset on outcomes, and an independent adjudicator with a rulebook. The mechanism has known limits, in particular around the definition of eligible disputes and around resolution speed, but it exists and it delivers real outcomes.

The consumer of an unlicensed operator has none of that mechanism. Where a dispute arises, the operator's internal complaints process is the only route available at the operator side, and that process is not subject to independent adjudication or public reporting. The customer's remaining options are the card scheme chargeback rules if the deposit was by card and the ground of dispute is eligible, the Financial Ombudsman Service jurisdiction over UK-authorised payment intermediaries where relevant, and a civil claim in the operator's home jurisdiction where the dispute is large enough to justify it. Anecdotal complaint records on consumer forums suggest a withdrawal-dispute prevalence materially higher than in the licensed market, though those records are self-selected and cannot be treated as a representative sample.

Offshore licensing landscape after Curacao LOK 2024

The Landsverordening op de Kansspelen came into force on 24 December 2024 and reshaped the Curacao licensing landscape. It ended the four-master-licence structure that had operated since 1996, installed the Curacao Gaming Authority as a single-tier regulator, and introduced a public register of licensees together with published licensing conditions and an inspection remit. On paper the reform brought Curacao closer to a European-style regulatory arrangement, and it did produce a more transparent register than the pre-2024 arrangement. Six-month figures released by the CGA in early 2026 record a lower headline count of active licensees than the aggregate under the earlier master-licence system, which is consistent with the transition and does not by itself indicate operational failure.

What LOK 2024 does not do is deliver equivalence with the UKGC. The CGA's inspection capacity is smaller, its complaint handling volume is smaller, its published enforcement outcomes are fewer, and it does not operate an ADR framework of the kind the UKGC requires. Its licence conditions carry no fund-segregation trust requirement at the UKGC top rating level, no mandatory ADR appointment, no Statutory Levy participation and no CAP/BCAP-equivalent marketing code applied through an independent regulator. The reform is real and material, but it is a transparency upgrade at the licence layer. The supervisory layer that surrounds a UKGC licence, and that produces the protections listed on the licensed side, is not replicated by the current CGA capacity.

Consumer protection matrix

Anjouan, MGA, Gibraltar, how they compare

Outside Curacao the three most visible jurisdictions in the offshore-facing market are the Malta Gaming Authority, the Gibraltar Regulatory Authority and, in the newer entrant category, the Autonomous Island of Anjouan under its remote gaming licensing framework. Each has a distinct profile. The MGA runs a formal European-style register, publishes an enforcement calendar, imposes a segregation requirement and operates a player protection directorate. Gibraltar is a mature jurisdiction whose licensees have historically served the UK market under long-standing arrangements, though the post-Brexit passporting position ended dual passport arrangements and the practical operational base of many Gibraltar-licensed brands has shifted. Anjouan is the newest tier and offers a lower entry point, with a less developed supervisory record.

For the UK reader the relative ranking of the three is less important than the position of all three relative to the UKGC. None of the three matches the UKGC on the full stack of protections listed in the matrix above. Each covers a subset. Any framing that reads a jurisdiction name on a footer badge as equivalent to a UKGC licence misreads the picture. A Malta Gaming Authority licence, on any honest analysis, provides more consumer protection than an Anjouan licence, and both provide less than a UKGC licence. That is the reading the data supports. It is not a moral point about the jurisdictions, it is a supervisory-depth point.

A closer look

One useful diagnostic is to check what a jurisdiction publishes about its own enforcement activity. A regulator with a mature supervisory function publishes settlement summaries, public statements, licence-revocation records and an annual enforcement report. A regulator whose supervisory function is nominal publishes very little of that, and what it does publish is often descriptive of the licensing regime rather than of enforcement action against specific licensees. Applied to the offshore jurisdictions, this diagnostic separates the mature regulators from the developing ones with reasonable reliability. The UK reader who is doing due diligence on any offshore operator is better served by looking at the regulator's public enforcement record than at the operator's own compliance narrative.

Payment friction that is only growing

The payment side of the offshore market has become materially harder in the two years to August 2026. The 2025 joint taskforce between the Visa network, the Mastercard network and the UKGC tightened enforcement on the merchant category code 7995, which is the card scheme code for gambling transactions, and reduced the effectiveness of routing tactics that some offshore acquirers had been using through 2023 and early 2024. The five largest UK current-account providers now offer a voluntary in-app gambling switch that blocks MCC 7995 transactions on debit cards, and in the case of Monzo, Starling and Barclays on credit cards too. HSBC, Lloyds and the smaller providers have parallel arrangements. Where the switch is enabled, offshore card deposits are declined at the bank's own filter, before they reach the operator's acquirer.

Crypto rails are frequently marketed as an anonymous alternative, and they are not. Fifth Money Laundering Directive obligations in the UK, together with the Financial Conduct Authority's cryptoasset registration regime, mean that a UK-facing exchange applies Know Your Customer checks at the fiat on-ramp and off-ramp. The identity capture happens at the exchange, not at the operator, so from a UK legal and payments-friction perspective the transaction is still identifiable and still auditable. Add the AML delay window that some UK banks apply to first-time gambling-related outbound transfers, twenty-four to seventy-two hours in practice, and the practical experience of an offshore deposit is slower, more visible and more frequently blocked than the marketing tends to imply.

What happens to your ID documents

ID documents shared with an offshore operator sit in a data-protection regime that is often not equivalent to UK GDPR. Where the operator sits inside the European Economic Area, GDPR-equivalent obligations apply and the Information Commissioner's Office maintains co-operation arrangements with the national supervisory authority. Where the operator sits outside the EEA, the data-protection regime is defined by the operator's home jurisdiction and can vary widely. A Curacao-based operator, an Anjouan-based operator and a Panama-based operator all have different national frameworks, and the practical consequences for data subject rights, breach notification obligations and cross-border transfer restrictions are correspondingly different.

The specific risks on ID document handling are two. First, the retention period may be longer than the equivalent period at a UKGC-licensed operator, because the operator's home law defines the retention requirement rather than UK law. Second, in the event that the operator ceases trading, the fate of the retained ID data depends on the receiver, if any, appointed in the operator's home jurisdiction. UK GDPR breach-notification obligations do not automatically travel with the data, and a UK data subject may find that a breach affecting their documents is neither notified to them nor reported to the Information Commissioner's Office in the way UK data protection law would require of a UK-established data controller. Verification friction and data-protection friction sit close together in the offshore experience.

Practical harm-reduction if a deposit has already gone

The starting point, if a deposit has already been placed and the person is worried, is the National Gambling Helpline on 0808 8020 133. It is free, it is confidential and it is open every hour of every day. A trained adviser can talk through the situation, refer into a structured brief conversation, refer to a specialist counsellor within the National Gambling Support Network, refer to the National Health Service specialist clinic pathway or refer to a family-focused pathway through GamAnon. There is no requirement to have decided in advance which of those routes is right for the person. The call itself is the first step of the decision, and it does not have to lead anywhere the caller is not ready to go.

A second step, particularly for readers whose worry has been building over several deposits rather than a single one, is a written baseline. A short handwritten record of the deposit dates, amounts, operator names, payment methods used and any communications received produces a defensible reference for later conversations with the helpline, with a general practitioner, with a debt-advice charity such as StepChange or National Debtline, or with an NHS specialist clinic if a referral becomes appropriate. It also produces the record a household member or partner needs if the person is choosing to bring somebody else into the picture. The record does not have to be complete, it does not have to be pretty, and it does not have to be shared. It only has to exist. Practitioners who work in this field consistently describe the moment a person moves from remembered figures to written ones as the point at which the money layer becomes tractable. That step is not by itself a treatment, but it removes a friction that otherwise slows every other step, and it costs nothing.

On the money side, the immediate steps are practical rather than dramatic. Contact the card issuer within the scheme chargeback window if the deposit is disputed on eligible grounds. Consider enabling the voluntary card gambling switch at the bank if it is not already enabled, which applies within minutes on any of the five largest UK current-account providers. Where an electronic money issuer was used, contact the issuer through its regulated complaints process. Where a bank has declined a transfer or has raised a Suspicious Activity Report, wait for the process to complete rather than attempting workarounds. None of these steps guarantees recovery, and this page does not present them as a recovery pathway. They are the reasonable, defensible actions available to a UK adult who has decided that this deposit was not what they intended.

Read next

• GamStop explained, the scheme, the periods, the checks
• The legal position for UK players outside GamStop
• Payments and checks, banks, cards, crypto, KYC
• Coming off GamStop, the official route
• Getting support, helplines, clinics, family, money

Frequently asked questions