Legality for UK players and UKGC limits

01

The legal position for UK players, short and long

The short answer is that a UK adult does not commit a criminal offence by placing a bet at an offshore operator, but that answer is misleading if it is left standing on its own. Section 33 of the Gambling Act 2005 makes the offence sit with the operator rather than with the customer, and the practical consequence of that placement is that every downstream compliance cost lands somewhere else.

It lands at the card issuer, which is a Financial Conduct Authority regulated firm holding independent obligations under the Money Laundering Regulations 2017. It lands at the acquirer that clears the transaction across a designated payment system supervised by the Payment Systems Regulator. It lands at the merchant category code 7995 flag that turns a routine authorisation into a monitored one.

The bet itself may be lawful for the customer to place. Almost nothing else that happens after the tap on the deposit button is lawful for the operator to arrange without a UKGC licence, and the operator's illegality bleeds through the chain in the form of friction.

The long answer therefore treats legality as a distribution of duties rather than as a binary question. The customer holds no criminal duty on the bet. The operator holds a criminal duty under Section 33 to hold a UKGC licence if it is providing remote gambling facilities to a UK customer.

The card issuer holds a regulatory duty under the Money Laundering Regulations 2017 to monitor and report. The acquirer holds a contractual and regulatory duty under card scheme rules and Payment Systems Regulator oversight. The Payment Systems Regulator itself holds a supervisory duty over the operators of designated systems.

Reading that distribution is what turns the question from a legal one into a financial one, because the friction the customer experiences is the visible edge of duties held further up the chain by parties the customer never meets. A French reader coming to this topic from a Tracfin-shaped lens will recognise the pattern.

The chain of responsibility runs across the financial system rather than across the gambling activity, and the UK equivalent of the Tracfin trigger is the suspicious activity report the card issuer files with the National Crime Agency under Part 7 of the Proceeds of Crime Act 2002.

02

Gambling Act 2005 and the edge of UKGC jurisdiction

The Gambling Act 2005 licenses UKGC to regulate remote gambling operators that provide facilities to UK customers. The remit is drawn around the licensable activity of the operator, not around the residency of the customer. When an operator does not hold a UKGC licence, UKGC has no supervisory tool over that operator's product, no authority to compel disclosure of its accounts and no route to order restitution to a UK customer who has lost money on its cashier.

This is not a slower version of a route. It is the absence of a route. UKGC's remit therefore ends at the licence perimeter, and every consumer-finance instrument that exists to help a UK adult was built around the assumption that the operator sits inside that perimeter.

What that means for a UK reader is that the words UKGC uses in its own guidance carry weight only inside the licensed estate. Outside it, UKGC can act on the payment rails that touch the operator, can act on domain registrars that route traffic to the operator, and can issue cease-and-desist notices the operator is free to ignore from a jurisdiction that does not enforce them.

The regulator can therefore change the shape of the friction, but it cannot switch the operator's product off, and it cannot arrange a refund from the operator's balance sheet. Reading that limit before making any decision is the useful move, because it clarifies which UK institution is on the customer's side and which one is out of scope.

A worked example

Consider a UK adult who deposits £150 at a Curacao-licensed operator using a personal debit card. The bet at the operator's cashier is not, of itself, a criminal act by the customer. The operator's provision of the facility to the customer is a criminal act under Section 33 for want of a UKGC licence.

UKGC has no route to order the operator to refund the deposit. The card issuer processing the authorisation is discharging a regulatory duty under the Money Laundering Regulations 2017 by monitoring the transaction and can refuse the authorisation on that basis. The acquirer standing between the operator and the card scheme is doing its own scheme-rule work.

The Payment Systems Regulator supervises the system the transaction travels across. UKGC oversees none of those parties. That is the point at which the customer needs to know which door to knock on for what, and it is not the door of the operator's help desk.

03

Unlicensed remote gambling to UK customers is an offence

The Gambling Act 2005 makes it an offence for a person to provide facilities for remote gambling to a UK customer in the course of a business without a UKGC licence. The provision is deliberately drafted to attach to the operator's conduct rather than to the customer's participation, because the intent of the section is to shape the supply side of the market.

A criminal duty on the customer would be self-defeating for a regulator whose harm-reduction toolkit relies on customers coming forward for help, disputes and reporting. The framing therefore protects the customer's willingness to engage with UKGC, GamCare and the wider help estate without exposure to a personal criminal risk that would silence the same customers the regulator most wants to hear from.

The consumer-finance consequence is that enforcement against the operator's provision runs on rails other than the operator itself. UKGC's 2024 and 2025 activity produced more than 770 cease-and-desist notices, saw around 64,000 URLs removed through search-engine cooperation and delivered a tenfold year-on-year increase in domain removals.

Payment rail interventions have tightened cross-border card acquiring for 7995 activity. None of that reaches a customer as a criminal charge. All of it reaches a customer as friction on the money side, which is where the financial-flow reading of legality is the reading that matters.

The reason the offence is written the way it is written is precisely so that the money side is the side where the pressure is applied.

04

What the UKGC can actually do about offshore sites

In practice, UKGC does what a regulator without direct authority over a foreign operator can do. It issues public warnings against operators that have breached the licensing regime, coordinates with the National Crime Agency where a money-laundering angle exists, works with search-engine providers to remove indexed URLs, and works with domain registrars to remove domain records that resolve to prohibited operator services.

It cooperates with the card schemes on merchant category code enforcement and it participates in a joint taskforce with the schemes announced in 2025 on tightening cross-border acquirer discipline. Fines in the domestic estate against UKGC licensees run alongside that work, and the 2025 record includes the £2.0m Spreadex Ltd action of 15 May, the £1.4m AG Communications action of 4 March and the £686,070 Corbett Bookmakers action of 20 March.

What UKGC cannot do is order restitution from an offshore operator's balance sheet, license an Alternative Dispute Resolution body against an offshore respondent or compel a foreign operator to appear before a UK forum. That is not a gap the regulator can close by policy, because the boundary is a jurisdictional one drawn by statute and by public international law.

Reading the practical toolkit against that boundary is what makes clear which parts of the response are inside UKGC's power and which parts belong to other UK institutions, from His Majesty's Revenue and Customs on the anti-money-laundering side to the Payment Systems Regulator on the rails side to the courts on the recovery side. The regulator can shape the environment. It cannot substitute its remit for a jurisdiction it does not have.

05

You have no formal complaints route to the UKGC

UKGC operates a complaints handling process for concerns about UKGC licensees. The concept relies on the operator being inside the licensed estate, because the complaint results in supervisory action against the licence the operator holds. When the operator sits outside the estate, the input UKGC can accept from a UK customer becomes intelligence rather than a complaint.

The Commission takes information about unlicensed operators seriously and uses it in the intelligence-led work that produces cease-and-desist notices, URL removals and domain interventions, but the customer does not have a formal complaint route that ends in a decision favourable to the customer's own dispute. That distinction matters, and it is often missed in casual descriptions of what UKGC does.

From a consumer-finance angle, the absence of that route is the reason the customer's practical options run through the payment side rather than through the regulator's own door. A chargeback lodgement at the card scheme is a mechanism the customer can trigger. A subject access request under the Data Protection Act 2018 is a mechanism the customer can trigger against a UK-based data controller in the chain, though not against a foreign operator sitting outside UK jurisdiction on data protection grounds.

A small claim in the county court against an English-domiciled agent of the operator is a mechanism the customer can trigger where such an agent can be identified. None of those is a substitute for a UKGC decision. Each is a partial route on the money side of a problem the regulator side cannot reach.

A worked example

Suppose a UK adult deposits £400 at an offshore operator, wins £1,200 on a slot title and then encounters a locked withdrawal on the ground of a fresh identity check the operator did not require on the deposit. The customer submits identity documents, waits, and eventually receives a message that the balance has been forfeited under the operator's terms.

The customer would like UKGC to intervene. UKGC will accept the report as intelligence and may act against the operator's URLs, its cross-border card acquiring or its domain. It will not order the operator to release the £1,200. The customer's own recovery route runs through card-scheme chargeback if the deposit was misdescribed, through civil proceedings in the operator's jurisdiction if one is realistic, and through the National Crime Agency if a suspicious activity report is warranted on the pattern. None of those is UKGC.

06

Why ADR gives you no recourse offshore

UKGC-approved Alternative Dispute Resolution schemes are contracted by UKGC licensees under their licence conditions. That contractual link is the door through which a UK customer walks when a dispute with a licensee arrives at an ADR body's caseload. When the operator does not hold a UKGC licence, no such contract exists, no such body accepts the case and no ADR pathway is available in an English-language forum with UK enforcement behind its decision.

Some offshore operators offer internal complaints processes that terminate at the operator, and some list an ADR body based in the licensing jurisdiction, but neither is equivalent to the UKGC-approved route because neither has UK enforcement behind it and neither treats the customer as a UK consumer under UK consumer protection law.

The consumer-finance reading is that ADR is a piece of consumer protection infrastructure that comes with the licence, not with the gambling activity. Read the licence to know which ADR body applies, and read the operator's jurisdiction to know whether any ADR at all is in the picture.

That is why the offshore complaint route is not a slower UKGC complaint route. It is a different infrastructure altogether, and a UK reader who assumes an ADR body will be available for a Curacao-licensed cashier is starting the dispute from the wrong page. The Payment Systems Regulator, incidentally, does not run an ADR route either.

Its supervisory work is upstream of the customer complaint, and the Financial Ombudsman Service is not a substitute because the operator is not an FCA-regulated firm.

07

Gambling White Paper reforms and affordability checks

The UKGC White Paper 2023, published as Command Paper 835 under the title High Stakes, Gambling Reform for the Digital Age, tightened affordability check thresholds inside the licensed estate and introduced online slot stake caps between £2 and £15 for the wider adult population, with the lower figure applying to younger customers.

The Statutory Levy under the Gambling Levy Regulations 2025 came into force on 6 April 2025 at rates ranging from 0.1 per cent to 1.1 per cent of gross gambling yield, with the online rate at the top of that range. The first-year yield is around £120 million with allocation split across NHS treatment at 50 per cent, Office for Health Improvement and Disparities prevention work at 30 per cent and research through UKRI and UKGC at 20 per cent.

Those reforms are relevant to the legality page because they change the calibration of the friction UK customers experience on the domestic side.

The consumer-finance implication of tighter domestic affordability is that some UK adults will experience a decision at a UKGC-licensed operator that leads them to search for an operator without the same affordability layer. UKGC's stated policy position, published in its guidance, is that the White Paper measures are proportionate to the harm they address and are not designed to push customers toward the offshore estate.

The White Paper is explicit that the harm-reduction case rests on the whole system continuing to work together, which is why the enforcement side of the reforms sits alongside the friction side, and why the Statutory Levy funds the research that measures whether the friction is producing the outcome it was designed to produce.

Reading the reforms as one system rather than as a set of independent controls is what the White Paper itself asks. From an anti-money-laundering standpoint the reforms also give the card issuer a cleaner baseline against which unusual patterns can be recognised, because a UK adult depositing at a UKGC-licensed operator inside the affordability envelope now presents a more legible transaction profile than the same adult would have presented before the caps. The offshore deposit therefore stands out more sharply against the domestic baseline than it did under the previous regime.

08

What the law protects for your money, and what it does not

UK law protects the customer from criminal exposure on the bet itself, from an unlicensed operator's ability to trade in the UK without regulatory attention, and from a card issuer that fails to run the transaction monitoring it owes under the Money Laundering Regulations 2017.

It does not protect the customer's balance on an offshore operator's cashier, does not guarantee segregation of that balance from the operator's own funds and does not open a UKGC-approved ADR route to recover it. It does not overrule the operator's chosen governing law in its terms and conditions, and it does not confer a Consumer Rights Act 2015 remedy in a forum the customer can practically reach when the operator's jurisdiction is foreign. Those two lists are the useful summary of what the law can and cannot do for the reader.

The financial-flow reading of the same summary is that the chain of responsibility from operator to bank to Payment Systems Regulator is the piece the law has built. It is the piece that carries the friction, the piece that produces the enforcement outcomes and the piece the customer engages with on almost every touch.

When something goes wrong on the money side, the door to knock on is the card issuer's own complaints route in the first instance, then the Financial Ombudsman Service for a card issuer's own conduct, then the Payment Systems Regulator for a system-wide concern about a rail.

UKGC will hear the intelligence about the operator, and GamCare and NHS routes will hear the harm angle. The distribution is deliberate, and it is worth reading in that shape before something goes wrong rather than after. A UK adult who reads legality as a set of doors rather than as a binary condition ends up with a much better working map of the topic than one who treats the customer's non-criminality as a green light, because the doors matter more than the light does on almost every practical question that arrives later on a statement, a chargeback form or a National Crime Agency response.

Read next

• What GamStop is and how it actually works
• Consumer-protection risks of offshore sites
• KYC, AML and payment realities for UK players
• Cancelling GamStop the right way
• Help, support and where to talk to someone today

Frequently asked questions