Non UK Casinos: Licensing, AML and KYC Obligations Explained

Non UK casinos operate under regulators outside the Gambling Commission's remit, and that single fact reshapes almost every protection a player assumes they hold. This guide sets out what a licence actually requires, how anti-money laundering duties are enforced, and where the practical differences appear for a UK-registered account holder.

Between 2021 and 2025 the Commission issued penalties totalling more than £70 million against operators for failures in customer due diligence and source-of-funds checks. Those figures matter, because they show what enforcement looks like when a licence is genuinely conditional rather than a formality.

The analysis below is written for adults aged 18 and over who are weighing where to hold an account. It is not advice to gamble, and it does not endorse any operator. It sets out obligations, thresholds and dates so that a reader can judge risk on evidence.

What Counts as a Non UK Casino in 2026?

A non UK casino is any gambling site accepting British residents that does not hold a licence from the UK Gambling Commission. Most such sites hold a Curaçao licence, an Anjouan licence, a Kahnawà:ke licence or a Malta Gaming Authority licence, and each of those regimes imposes materially different obligations on the operator.

Which regulators actually license these operators?

The Malta Gaming Authority issues Class 1 and Class 4 licences covering remote table games and platform supply, with a standard application fee of €5,000 and an annual compliance levy scaled to gross gaming revenue. Gibraltar's Gambling Division charges £100,000 for a non-remote licence and requires the operator's board to be ordinarily resident in the territory.

Curaçao's new National Ordinance on Games of Chance, in force since 1 March 2024, replaced the previous sub-licence structure with direct licences issued by the Gaming Control Board.过渡期 ran to 30 June 2025, after which operators without a direct licence could no longer serve EU or UK traffic under a master-licence arrangement.

Anjouan's Autorité de Régulation des Jeux Électroniques issues licences at a reported annual cost in the region of $30,000 to $50,000, with a fixed tax on gross gaming revenue. The regime is fast, cheap and comparatively light on ongoing audit, which is precisely why it attracts operators priced out of European jurisdictions.

How does a non UK licence differ from a UK one?

A UK licence from the Gambling Commission carries statutory duties under the Gambling Act 2005 as amended by the 2023 Licence Conditions and Codes of Practice. Operators must file a returns pack every six months, submit to an annual compliance assessment, and demonstrate that customer funds are segregated or protected to a stated standard.

Most non UK licences impose no equivalent six-monthly returns requirement. In Curaçao's pre-2024 regime an operator filed an annual report; under the new ordinance, reporting is quarterly for Class A licensees. Malta requires audited accounts within nine months of financial year end, and the MGA can suspend a licence within 72 hours of a suspected breach.

The practical consequence: a UK-licensed site is audited on a fixed calendar, while a non UK site may be audited only when a complaint or a regulator's own risk assessment triggers it. Enforcement cadence, not licence existence, determines player protection.

Do offshore licences cover UK players legally?

An offshore licence does not make it illegal for a UK resident to hold an account; it makes the operator unregulated by the Commission. Section 33 of the Gambling Act 2005 makes it an offence for an operator to advertise in Great Britain without a Commission licence, which is why non UK casinos rarely buy UK broadcast or print media.

Deposit methods narrow accordingly. Non UK casinos typically cannot access UK-issued credit card gambling transactions (banned since 9 April 2020) through standard acquirers, and open-banking payment rails under the PSRs regime are harder to obtain without a UK or EEA licence.

What a player retains: the right to complain to the operator, to escalate to its regulator, and to pursue a chargeback through the card scheme. What a player loses: access to the Commission's Alternative Dispute Resolution route and to the National Gambling Helpline's casework referral service for licensed operators.

What Does It Take to Get and Keep a Licence?

Obtaining a gambling licence is a fitness-and-properness assessment, not a registration. The applicant must satisfy the regulator that every director, shareholder holding 5% or more, and key management person is of good repute, has no unspent convictions, and has demonstrable experience in the sector.

What does 'fit and proper' mean in practice?

Under the Commission's Statement of Principles for Licensing and Regulation, an applicant supplies certified identity documents, a criminal record check from the Disclosure and Barring Service, evidence of source of funds for any shareholding above 10%, and a business plan showing how compliance will be staffed and funded.

Regulators cross-check against insolvency registers, sanctions lists and litigation databases. Malta's MGA requires a police certificate for every director dated within three months of application. Gibraltar requires the entire board to be ordinarily resident in the territory, which is a genuine barrier rather than a paperwork exercise.

Failure at this stage is common. In the year to 31 March 2025 the Commission determined 116 applications, granting 61 and refusing or withdrawing 55 — a success rate of roughly 53%.

How much capital must an operator hold?

The Commission requires initial guaranteed funds of £40,000 for a remote betting intermediary, rising to £100,000 for a casino operating licence, with additional amounts calculated against expected monthly turnover. These are not theoretical floors; the Commission can require top-ups at any time if projected revenue exceeds the declared band.

Malta's MGA sets a minimum share capital of €40,000 for a Type 1 remote gaming licence, and Gibraltar requires £2 million in issued share capital for a remote operator licence. Curaçao's 2024 ordinance sets a lower threshold, reported at approximately $100,000 in share capital plus a required local management presence.

The spread is wide. A licensee in Gibraltar must show roughly 20 times the paid-up capital of one in Curaçao, and that gap maps directly onto how much a regulator can claw back if the business fails. Capital adequacy is the first filter separating regimes.

Which ongoing audits must a licensee pass?

UK licensees submit to an annual compliance assessment under LCCP 25.1.1, a remote technical audit of the random number generator, and periodic testing of the player account management system. Game suppliers need a separate approved-gaming-supplier status.

Malta requires an annual audit by a registered auditor, plus an RTP verification exercise for each game title before it goes live. Gibraltar requires a technical standards audit every 12 months covering the platform, the wallet, and the self-exclusion interface.

Offshore regimes vary sharply. Curaçao's ordinance requires periodic reporting but does not, at the time of writing, mandate an independent annual technical audit of the RNG. Anjouan's framework requires a certificate of fairness from an accredited lab, but the frequency of renewal is left to the operator.

What happens when an operator breaches its licence?

The Commission's penalty ladder begins with a licence review under section 116 of the Gambling Act 2005, which can be triggered by a change in circumstances or by information suggesting a breach. A review may result in a variation of conditions, a formal warning, or revocation.

Between 1 April 2024 and 31 March 2025 the Commission concluded 17 penalty package settlements totalling £63.9 million. The largest single settlement in that period was £19,057,000 against an operator for systemic failures in customer due diligence over a four-year window.

Malta's MGA can suspend a licence within 72 hours and has issued 11 suspension notices since January 2024. Gibraltar's regulator publishes no equivalent enforcement register, which makes its actions harder for a player to research before depositing.

How long does a licence application take?

The Commission's stated service standard for a new operating licence application is 8 weeks from a complete submission, though complex applications involving multiple jurisdictions routinely run to 12 weeks. Applicants pay an application fee of £350 to £5,000 depending on licence type, non-refundable if the application is withdrawn.

Malta's MGA quotes 10 to 12 weeks for a Type 1 remote licence, with a €5,000 application fee and a further €5,000 on grant. Gibraltar's Gambling Division quotes 6 to 8 weeks but requires the applicant to establish a locally resident board first, which adds 4 to 8 weeks of company formation.

Curaçao's post-2024 process runs to approximately 8 weeks for a Class A licence, provided the applicant holds a local entity and a designated compliance officer. Anjouan advertises 2 to 4 weeks, the fastest of any regime reviewed here.

How Are AML and KYC Duties Enforced?

Anti-money laundering obligations for gambling operators derive from the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 for UK-facing business, and from equivalent national transpositions of the EU's 6th Directive for European licensees. The core duty is customer due diligence before a transaction exceeds a defined threshold.

What triggers KYC checks on a non UK account?

UK-facing operators must complete standard customer due diligence when a customer deposits £15,000 or more in a single transaction, or when cumulative transactions reach £15,000, or when there is suspicion of money laundering regardless of amount. Enhanced due diligence applies where the customer is a politically exposed person.

Non UK casinos operating under Curaçao or Anjouan licences commonly set their own thresholds. Industry practice places identity verification at first withdrawal above €2,000 to €5,000, with source-of-funds evidence requested at cumulative withdrawals above €10,000. These thresholds are operator-set, not regulator-set, in the lighter regimes.

The practical difference for a player: on a UK-licensed site, identity checks typically occur before the first deposit. On many non UK sites they occur after play has begun, which is why withdrawal delays are more frequently reported there.

Which documents does an operator have to collect?

Standard KYC packs include a photographic identity document (passport or national ID card), proof of address dated within three months (utility bill or bank statement), and, for higher-risk profiles, evidence of source of wealth such as payslips, tax returns or sale contracts. Documents are checked against sanctions lists and, in the UK, against the Commission's own register of self-excluded individuals.

Regulators specify retention periods. The 2017 Regulations require records to be kept for five years after the end of the business relationship. Malta's equivalent requires six years from the end of the relationship. Curaçao's ordinance sets a five-year period aligned with FATF Recommendation 10.

Where an operator fails to collect, it fails at audit. In 2024 a European licensee was fined €1.2 million for accepting a customer whose declared occupation was inconsistent with deposit patterns totalling €340,000 over eleven months.

How do source-of-funds checks actually work?

Source-of-funds verification asks a different question from source of wealth. Funds evidence answers "where did this specific deposit come from?" — a bank statement showing an incoming transfer, a payslip, a sale receipt. Wealth evidence answers "how did the customer accumulate their overall assets?" and is required only for high-risk or PEP customers.

Operators apply a risk-based approach under Regulation 18 of the 2017 Regulations: customer, product, delivery channel and geography each carry a risk weight. A customer depositing by open banking from a UK high-street bank carries lower residual risk than one funding an account by cryptocurrency from an unhosted wallet.

Crypto deposits complicate the picture. Non UK casinos that accept BTC, ETH or USDT must still evidence the origin of the fiat off-ramp, and most rely on a chain-analytics provider to flag mixer usage or sanctioned addresses. On-chain tracing is now a routine part of the compliance stack.

What record-keeping periods apply?

Under the 2017 Regulations, transaction records must be retained for five years from the date of the transaction, and customer due diligence records for five years from the end of the business relationship. Records must be capable of being produced to the Commission within 72 hours of request.

Malta's Gaming Compliance and Enforcement Regulations require six-year retention, and the MGA's compliance manual specifies that internal audit reports must be available for inspection for the same period. Curaçao's ordinance requires three years for transaction records, though the underlying FATF standard is five.

For a player, retention matters in disputes. A five-year trail means a chargeback or complaint can be reconstructed; a three-year trail means older activity may simply not exist in retrievable form.

Which regulators publish enforcement outcomes?

The UK Gambling Commission publishes every penalty package, licence review and revocation with a reasoned decision, searchable by operator name. Malta's MGA publishes a register of licence holders and a separate enforcement page listing suspensions and fines with dates.

Gibraltar publishes licence holders but not individual enforcement decisions. Curaçao's Gaming Control Board has committed to publishing enforcement actions under the 2024 ordinance, though the register was still being populated at the time of writing. Anjouan publishes no enforcement data at all.

That asymmetry has a direct consequence: a player researching a brand can verify its regulatory record in the UK or Malta in minutes, and may find nothing at all for an Anjouan-licensed operator — not because it is clean, but because nothing is published.

Which Non UK Casinos Are Worth Examining?

The brands below are widely available to British residents and operate under licences outside the Gambling Commission's jurisdiction. Each entry notes the licence, the regulator, and the practical implication for a UK account holder. Nothing here is a recommendation to open an account.

Which operators hold Curaçao licences?

MyStake, GoldenBet, Donbet and NineWin all operate under Curaçao licences issued or re-issued under the 2024 ordinance. Their shared characteristics: crypto accepted, no GamStop integration, and withdrawal processing typically quoted at 24 to 72 hours subject to KYC clearance.

Fat Pirate and Velobet sit in the same group, with minimum deposits commonly set at €10 to €20 and maximum monthly withdrawals in the €5,000 to €15,000 band. Roobet, also Curaçao-licensed, publishes its RTP figures by game studio, which is more transparency than the regime strictly requires.

PlayOJO, notably, holds a UK Gambling Commission licence and is listed here only for contrast: its no-wagering bonus model exists because UK rules cap bonus wagering requirements in practice through affordability and fairness reviews.

Which operators hold Maltese or Gibraltar licences?

Unibet, LeoVegas and Casumo hold Malta Gaming Authority licences and serve UK residents through white-label or sister-brand arrangements where a UK licence is absent. Betway's casino arm historically operated under MGA and Gibraltar licences for European traffic before consolidating UK operations under a Commission licence.

Gibraltar-licensed operators include bwin and, historically, partypoker's European ring-fenced platform. The territory's 2023 Gambling (Amendment) Act modernised the framework and imposed an annual compliance fee scaled to revenue, which pushed several smaller operators toward Malta.

For a UK player the distinction matters at withdrawal: a Maltese licensee falls under the EU's PSD2 reimbursement rules for disputed payment transactions, while a Curaçao licensee does not.

Which brands operate under Anjouan or Kahnawà:ke?

Several newer entrants, including Fat Pirate at certain white-label configurations and a number of sports-first brands, hold Anjouan licences. The regime's speed and low cost explain its growth: licence grants rose sharply through 2024 and 2025 as Curaçao's transition closed the door on master-licence structures.

Kahnawà:ke's Mohawk Internet Technologies has licensed operators since 1999, and the jurisdiction's Interactive Gaming Council sets technical standards that are audited annually. Brands under this licence are fewer but tend to be long-established.

Lottoland, Smarkets and Betdaq operate under a mix of regimes depending on product: fixed-odds betting exchanges in the UK under Commission licence, lottery-betting products under separate arrangements. Product-level licensing is easy to miss when reading a single brand page.

What should a player check before depositing?

Four checks cover most of the risk. Confirm the licence number on the regulator's own register, not the operator's footer. Check whether the operator publishes an RTP certificate for its game library. Verify the complaint route, including whether an independent alternative dispute resolution body is named. Read the withdrawal policy for maximum monthly limits and pending periods.

Providers matter too. A library built on NetEnt, Pragmatic Play, Evolution, Microgaming or Hacksaw Gaming titles carries independent testing from eCOGRA or iTech Labs; a library of unbranded in-house games may not. Studio provenance is a proxy for testing discipline.

Finally, confirm whether the operator participates in a self-exclusion scheme. UK-licensed sites integrate with GamStop; most non UK sites do not, and a player relying on self-exclusion should treat that as a material difference.

What Protection Does a UK Player Actually Retain?

Holding an account at a non UK casino does not extinguish statutory rights, but it relocates them. Contract law, card-scheme rules and the operator's own regulator become the operative framework, replacing the Gambling Act 2005 and the Commission's complaints route.

How does a dispute get resolved?

UK-licensed operators must offer alternative dispute resolution through a body approved by the Commission — currently IBAS for betting and eCOGRA for casino products — at no cost to the consumer. ADR decisions are not binding on the player but are binding on the operator in most cases.

Non UK operators typically name their own internal complaints team as the first and final internal stage, with escalation to the licensing regulator. Malta's MGA operates a player complaints portal with a published median resolution time of 21 days; Curaçao's process is handled by the operator's compliance officer with no published service level.

Where a card deposit was made, a chargeback through Visa or Mastercard remains available within 120 days of the transaction for services not rendered as described. That route is often faster than a regulatory complaint.

Is player money protected if the operator fails?

The Commission requires Category A remote casino licensees to hold customer funds in a segregated trust account or to hold an equivalent insurance-backed arrangement, disclosed under LCCP 4.2.1. If the operator becomes insolvent, trust-held funds are returned to customers ahead of general creditors.

Malta requires segregation for Category 1 licence holders. Gibraltar requires it for all remote licensees. Curaçao's 2024 ordinance does not mandate segregation, and Anjouan does not either, which means a player's balance at those operators sits in the operator's operating account alongside its own funds.

That is the sharpest financial difference in this guide. Segregation is the difference between a refund and a claim in insolvency.

What self-exclusion options exist outside GamStop?

GamStop covers operators licensed by the Gambling Commission and is mandatory for them. A self-exclusion registered there has no effect on a Curaçao- or Malta-licensed site serving UK residents under a separate brand.

Non UK casinos commonly offer an account-level self-exclusion or cool-off period set by the player: 24 hours, 7 days, 30 days, or a custom duration. These are enforced at operator level only and do not carry across to other brands.

For a player seeking a hard stop, the National Gambling Helpline on 0808 8020 133 can arrange multi-operator exclusion, and commercial blocking software such as Gamban or BetBlocker can be installed across devices regardless of which sites are licensed where.

Which taxes apply to winnings?

In the United Kingdom, gambling winnings from betting and gaming are not subject to income tax or capital gains tax for the player, under Section 1 of the Betting and Gaming Duties framework as applied to individual bettors. This is unchanged whether the operator is UK-licensed or not.

Operators, not players, pay the relevant duties. A non UK operator serving UK customers without a Commission licence does not remotely contribute to General Betting Duty, which is a fiscal argument the Treasury has raised in successive consultation documents.

For players resident elsewhere, the position varies: some jurisdictions tax gambling winnings above an annual threshold, and a non UK operator may issue a withholding certificate on request. Players should confirm with a local adviser rather than assume the UK position travels.

Responsible Gambling and Where to Get Help

Gambling is restricted to persons aged 18 and over in the United Kingdom, and identity verification at UK-licensed operators is designed to confirm age before any deposit is processed. Underage gambling is a criminal offence under section 48 of the Gambling Act 2005.

Who can you call if gambling stops being manageable?

The National Gambling Helpline is 0808 8020 133, operated by GamCare and available 24 hours a day, 7 days a week, free from UK landlines and mobiles. Trained advisers can arrange self-exclusion, discuss financial pressures, and refer to local support services.

GamCare also runs the Young People's Gambling Harm programme for 11 to 18 year-olds, and Gordon Moody provides residential treatment for gambling addiction with places typically allocated within 4 to 6 weeks of referral.

Self-exclusion registers: GamStop covers all Gambling Commission licensees for periods of 6 months, 1 year or 5 years, while SENSE covers land-based casinos and the Betting and Gaming Council's members operate additional deposit-limit tools.

What practical limits should be set before playing?

Deposit limits, loss limits and session time reminders are available at most operators regardless of licence. Setting a monthly deposit limit at the point of registration, rather than after a losing run, is the single most effective behavioural control available to a player.

Reality checks that interrupt play at fixed intervals, and cool-off periods that lock the account for 24 hours or more, are mandated at UK-licensed operators and offered voluntarily elsewhere. Their value depends entirely on the player setting them in advance.

Blocking software such as Gamban or BetBlocker installs at operating-system level and prevents access to gambling domains across all browsers and apps. BetBlocker is free; Gamban is typically charged at around £2.49 per month with no minimum term.

Where can you verify an operator's licence?

The Gambling Commission's public register lists every UK licence holder with status, licence conditions and any enforcement history, updated daily. Malta's MGA maintains a searchable register of licence holders with class and status.

Curaçao's Gaming Control Board register is available under the 2024 ordinance, and Gibraltar's Gambling Division publishes its licensee list. Anjouan's register is published by the ARJEL but is updated less frequently, so a licence shown there should be re-checked before depositing.

Cross-checking the licence number against the regulator's register — not against the operator's own website — takes under a minute and remains the most reliable single check available to a player.

Frequently Asked Questions

Is it legal for a UK resident to play at a non UK casino?

Yes. The Gambling Act 2005 creates offences for operators who advertise or provide gambling in Great Britain without a Commission licence; it does not criminalise a UK resident for holding an account offshore. Players retain contractual rights and card-scheme chargeback rights, but lose access to Commission-led complaints and GamStop enforcement.

How do I know if a non UK casino is properly licensed?

Check the licence number against the regulator's own public register rather than the operator's website footer. Malta, Gibraltar, Curaçao and the UK all publish searchable registers updated on a regular cycle. Anjouan publishes a register too, but with a longer update lag, so re-verify shortly before depositing.

What happens to my money if a non UK casino goes bust?

It depends on whether customer funds are segregated. Malta, Gibraltar and the UK require segregation or an equivalent protection; Curaçao and Anjouan do not mandate it. Where segregation applies, trust-held balances are returned ahead of other creditors; where it does not, you become an unsecured creditor of the operator.

Do non UK casinos pay tax on my winnings?

UK players pay no income tax or capital gains tax on gambling winnings, whichever operator they use. Tax is levied on operators, not players, in the UK framework. Players resident in other jurisdictions should check local rules, as some countries tax winnings above an annual threshold.

Can I use GamStop if I only play at offshore sites?

No. GamStop applies to operators licensed by the Gambling Commission, so a Curaçao- or Malta-licensed brand serving UK residents is outside its scope. Use the operator's own self-exclusion tool, install blocking software such as Gamban or BetBlocker, and call the National Gambling Helpline on 0808 8020 133 for a coordinated exclusion plan.

Which is safer, a Curaçao licence or a Malta licence?

Malta imposes higher capital requirements, mandatory segregation for certain categories, annual audited accounts and a published enforcement register. Curaçao's 2024 ordinance is an improvement on the previous sub-licence system but does not mandate fund segregation or an independent annual technical audit. On the evidence, Malta carries more procedural weight.

How long do KYC checks take at a non UK casino?

At UK-licensed operators verification usually completes before the first deposit, often within minutes using an electronic ID check. At many non UK casinos verification happens at first withdrawal, with document review taking 24 to 72 hours and, where source-of-funds evidence is requested, up to 5 working days.

Non UK casinos sit outside the Gambling Commission's direct control, and the protections a UK player takes for granted do not travel with them. Check the licence on the regulator's register, confirm whether customer funds are segregated, verify the complaint route, and set deposit limits before the first deposit rather than after the first bad month. Gambling involves risk and is intended for adults aged 18 and over; if it stops being manageable, the National Gambling Helpline on 0808 8020 133 is open around the clock.