Offshore sites and consumer-law exposure

01

Absence of UKGC oversight and its practical effect

The Commission's remit runs to the perimeter of its licensed market. Inside that perimeter the Commission exercises the ordinary suite of supervisory and enforcement powers set out in sections 116 to 121 of the Gambling Act 2005, on breaches of LCCP made under sections 24 and 82.

Outside the perimeter the Commission has no direct contractual link with the operator and no supervisory grip on its day-to-day operation. A British consumer transacting with an offshore operator receives, day to day, a product that is not subject to the Commission's product-side regulation, is not subject to the Commission's customer-side social responsibility framework and is not subject to the Commission's complaints jurisdiction.

Where the product design differs from the design that would be permitted inside the perimeter, that difference is a lawful choice of the offshore operator and no route exists through the Commission by which the difference may be reversed.

The absence of Commission oversight has three practical consequences that the reader should carry through the chapters that follow. First, product features banned or constrained inside the perimeter, including online slot stake caps and specific autoplay and bonus mechanics, are typically not banned or constrained at an offshore operator, so the loss velocity available to a consumer at an offshore site is often higher than the loss velocity available on the same nominal product inside the perimeter.

Second, customer-side social responsibility measures, including affordability assessments under the White Paper 2023 reforms and single customer view checks under LCCP 3.4.3, do not follow the consumer to an offshore operator. Third, the Commission's complaints jurisdiction, which is confined to its licensees, does not extend to the offshore operator, so a dispute is not a matter the Commission can adjudicate. Each of those consequences is dealt with in more detail below.

02

No guarantee of client fund segregation in law

LCCP 4 places on each remote gambling licensee an obligation in respect of customer funds. The licensee must hold customer funds in an account separate from its trading account, must segregate the customer's money from the operator's own money, and must disclose in its terms and conditions the level of protection it applies to customer funds.

LCCP 4 recognises four levels of protection, ranging from the highest, where customer funds are held on trust in a separate insolvency-remote account, through medium, basic and no protection. The licensee's chosen level must be disclosed to the consumer at account opening and repeated in the operator's terms, so that the consumer can make an informed choice about the strength of the floor beneath her deposit.

None of that architecture follows the consumer across the licensing border. An offshore operator that has never held a Commission licence is not caught by LCCP 4 and is not required to disclose a level of protection in the terms in which a licensee would disclose it.

In practice offshore operators fall along a range. Some, in particular those licensed by the Malta Gaming Authority, are subject to segregation and player-funds protection obligations under the law of their own regulator that are broadly comparable in substance, if not identical in form, to LCCP 4.

Others, in particular some operators previously licensed under the historic Curaçao master-licence chain, have been the subject of complaint files in which withdrawals were delayed, denied or reversed on grounds that would not be permitted under LCCP 4. The consumer at an offshore operator cannot rely on the LCCP 4 floor and must consider the strength of the floor her operator's own domestic regime provides.

A worked example

A British consumer holds a balance of two thousand pounds in an account at a licensed remote gambling operator. The operator disclosed at account opening that its LCCP 4 level of protection is "high", meaning the customer's funds are held on trust in a separate account and would be protected in the event of the operator's insolvency.

The operator becomes insolvent. The customer's two thousand pounds is a trust asset, is not available to the operator's general creditors, and can be recovered by the customer through the trust account. Now suppose the same customer holds the same balance at an offshore operator whose own regulator imposes no equivalent obligation.

The operator becomes insolvent. The customer's two thousand pounds sits in the operator's general trading account, ranks alongside the operator's unsecured creditors and is exposed to the ordinary priorities of insolvency in the operator's own jurisdiction. That is the substantive difference the LCCP 4 floor makes.

03

No statutory ADR route should a dispute arise

LCCP 6.1.1 requires each Commission licensee to be a member of an approved Alternative Dispute Resolution provider. The purpose of the obligation is to remove the cost of dispute enforcement from the consumer and to place it on a resourced, structured and adversarial process that can issue determinations binding on the operator.

The Independent Betting Adjudication Service is the ADR body most familiar to British consumers in the betting space, and its awards run against Commission licensees up to a defined sterling ceiling on disputes about the operator's compliance with its own terms and with LCCP. Other approved ADR bodies operate in the casino and bingo verticals, and the Commission publishes a list of approved bodies on its own website.

The ADR obligation binds Commission licensees only. An offshore operator that has never held a Commission licence is not caught by LCCP 6.1.1 and is under no equivalent duty in this jurisdiction. Some offshore operators voluntarily accept the jurisdiction of an ADR body in their own domicile, and some display the badge of a British or European ADR body on their site, whether or not the badge is displayed with authority.

A determination by a body whose jurisdiction the operator has not accepted is not binding on the operator, and a badge displayed without authority provides no route to enforcement. The consumer at an offshore operator whose dispute cannot be resolved through the operator's own complaints function is left with civil recovery in the operator's own jurisdiction, and civil recovery in a foreign jurisdiction is a substantially different proposition, both in cost and in duration, from an ADR determination inside the perimeter.

04

The regimes that authorise offshore operators: MGA, Gibraltar, Curacao LOK 2024, Anjouan

The offshore licensing landscape presents different levels of consumer-protection floor beneath different regulators. The Malta Gaming Authority operates a regime that requires segregation of player funds, player complaint procedures and structured operator supervision. It is directed at the Maltese and European Union markets rather than at British consumers, and the Maltese regime has been the subject of a legislative amendment in 2023 which, on one reading, limits the enforceability of foreign judgments against Maltese-licensed operators in respect of gambling contracts.

The Gibraltar regime under the Gambling Act 2005 (Gibraltar) is similar in substance to the historic British regime and imposes segregation and player-complaint duties on its licensees, and the Alderney Gambling Control Commission operates a comparable regime in the Bailiwick of Guernsey. The Isle of Man Gambling Supervision Commission operates a further such regime.

Curaçao, Anjouan and Kahnawake sit at the other end of the range. Curaçao has, under the Landsverordening op de Kansspelen which came into force on 24 December 2024, moved from a historic master-licence chain to a single-regulator model at the Curaçao Gaming Authority; the reform is dealt with in section 05, below.

Anjouan issues licences under the Anjouan Betting and Gaming Board, with a regulatory footprint that has attracted extensive commentary from consumer-side commentators and a public warning from the Commission of the Union of the Comoros as to the currency of some of the licences it has been reported to issue.

Kahnawake operates a licensing regime with a longer track record than Anjouan and with a formal player-complaint procedure at the Kahnawake Gaming Commission, though its enforcement in the British consumer's specific dispute is limited by the ordinary constraints of foreign administrative action. None of these regimes is a substitute for the LCCP-anchored consumer-protection floor a British adult is entitled to in the licensed market.

05

How the Curacao LOK reform shifted matters in December 2024

The Landsverordening op de Kansspelen came into force on 24 December 2024 and replaced the historic master-licence system through which one Curaçao master licence-holder could sublicence to an indefinite chain of downstream operators without formal fitness-and-propriety checks at the level of the sublicence. Under the new statute each operator holds a licence in its own name, satisfies fitness-and-propriety checks at the point of licensing, and is directly answerable to the Curaçao Gaming Authority as a single regulator.

The reform is a substantive improvement over the position it displaced. It reduces the population of operators in Curaçao that have no direct regulatory relationship with any regulator, and it introduces a route by which the Curaçao Gaming Authority can act against a specific operator without pursuing the master licence-holder first.

What the reform does not do is deliver the British consumer a route of recovery equivalent to LCCP 6.1.1 ADR or Commission supervision. The Curaçao Gaming Authority publishes a player-complaint procedure, and its decisions are properly reasoned within the framework of Curaçao domestic law, but the procedure sits within the operator's own domestic regulatory framework and its determinations are not enforceable in Great Britain in the manner of an Independent Betting Adjudication Service award against a Commission licensee.

A British consumer whose deposit is at a Curaçao-licensed operator retains the substantive exposure to the operator's own jurisdiction and to the practical cost of foreign civil recovery. The reform is real; the practical margin for the British consumer is smaller than the reform's public presentation might suggest, and the honest description of the position is worth stating in those terms.

A worked example

A British consumer holds a disputed balance of one thousand pounds at a Curaçao-licensed operator. She submits a complaint to the operator, receives no substantive response and escalates to the Curaçao Gaming Authority under the post-LOK complaint procedure. The Authority reviews the complaint, requests further information from both sides and issues a determination in the consumer's favour four months later.

The operator does not comply. The Authority applies its own supervisory sanctions to the operator, including a fine and a public warning, but the sanctions are directed at the operator's licence position in Curaçao and do not, of themselves, cause the balance to be paid.

The consumer's route to recovery, in the absence of voluntary payment, remains a civil claim in a Curaçao court, at Curaçao rates, on Curaçao procedure. That is the honest picture of the LOK-era position.

06

Payment exposure and the rise of bank blocks

UK retail banks have moved decisively on gambling-coded card transactions through 2024 and 2025, and the trend has accelerated markedly in the first half of the 2025 financial year. HSBC, Monzo, Starling, Lloyds and Barclays each offer an in-app switch that instructs the card scheme to decline transactions coded as merchant category 7995, the code assigned to gambling merchants at the acquiring end of the payment chain.

Once the block is turned on the bank enforces a cool-off period before a request to lift the block takes effect. The cool-off runs at forty-eight hours at HSBC and at twenty-four hours at Monzo and Starling, with variations at Lloyds and Barclays. That cool-off is a further protective feature, drawn on the same clinical evidence base as the GamStop twenty-four hour post-expiry cool-off, and is designed to prevent an impulsive decision to disable the block.

Deposits from a UK card at an offshore operator may therefore be declined at the issuing bank. Where the offshore operator reroutes deposits through a payment processor coded as a digital service, remittance or an e-wallet rather than as a gambling merchant, the block may not intercept the transaction, but the routing carries its own risk.

A UK bank's AML function may flag a transaction whose economic purpose does not match its merchant category as unusual, and a suspicious activity report generated by a UK bank forms part of the customer's file with implications well beyond the specific transaction. The reader is encouraged to read the chapter on KYC, AML and payment realities for the detail on the Money Laundering Regulations 2017 duties and their effect at the UK banking layer.

07

Data exposure and the fate of KYC documents you submit

A British consumer opening an account at an offshore operator will in most cases be asked to upload identification documents at some point in the customer relationship, whether at account opening, at first withdrawal or at a defined deposit or loss threshold. Those documents typically include a passport or driving licence, a utility bill or bank statement, and in some cases a source-of-funds declaration supported by payslips or by a bank statement showing the origin of the deposit.

Where the operator is a Commission licensee, the licensee is a data controller under the UK General Data Protection Regulation and the Data Protection Act 2018, and it owes the ordinary duties of data protection to the consumer, including duties of security, of retention, of subject access and of erasure. The Information Commissioner's Office is the supervisory authority for those duties in the United Kingdom.

An offshore operator is not, by virtue of its licence, subject to the UK GDPR framework. Whether it is subject to comparable data protection duties depends on the law of its own domicile. Malta, Gibraltar and the Bailiwick of Guernsey operate data protection regimes derived from or aligned with the EU General Data Protection Regulation.

Curaçao's data protection framework is less developed and more limited in enforcement reach; Anjouan and Kahnawake operate lighter frameworks still. A British consumer uploading identification documents to an offshore operator should understand that those documents, once uploaded, are held under the operator's own domestic data protection regime and are recoverable, correctable and deletable to the extent that regime permits.

Where the operator suffers a data breach affecting British customer files, the ordinary UK GDPR breach-notification duties do not apply to the operator and the consumer's remedy runs through the operator's own domestic regime.

08

Mitigating harm where a deposit has already been made

Where a British consumer has already deposited funds at an offshore operator, the practical steps available to her fall into four rough categories. First, she should turn on the card gambling switch at her issuing bank if she has not already done so, and she should consider whether her issuing bank's cool-off period would produce a useful margin over any impulse to deposit further.

Second, where the deposit was made on a credit card and exceeded one hundred pounds, she may wish to take advice on a claim under section 75 of the Consumer Credit Act 1974, which creates a joint and several liability between the credit provider and the supplier of goods or services in defined circumstances, though the analysis is complicated by the operator's foreign domicile and by the position that gambling is not, in every analysis, a supply of goods or services within the meaning of the section.

Third, she should keep contemporaneous records of every interaction with the operator, including chat transcripts, email correspondence, deposit and withdrawal timestamps and screenshots of any freeze, denial or reversal of a balance. Those records will be indispensable if the matter proceeds to a civil claim in the operator's own jurisdiction, or to a complaint through the operator's home regulator, and they will support a report to the Commission for its enforcement pipeline against the operator.

Fourth, and most importantly, where gambling is currently causing harm the National Gambling Helpline runs free of charge on 0808 8020 133, twenty-four hours a day, every day of the year, and the specialist gambling clinics operated by the National Health Service accept self-referral without a general practitioner's involvement.

The financial loss is one part of the picture; the wellbeing of the consumer is the other, and the second is the more urgent. Structured self-help material is available at begambleaware.org and treatment routes at gamcare.org.uk.

Read next

• What GamStop is and how it actually works
• Legality for UK players and where UKGC remit ends
• KYC, AML and payment realities for UK players
• Cancelling GamStop the right way
• Help, support and where to talk to someone today

Frequently asked questions