If you registered with GamStop and a UK-licensed casino still let you deposit and lose money, its mandatory controls failed, and that failure is usually the heart of a claim. GamStop is not optional. Since 31 March 2020, participation in the scheme has been a mandatory condition of holding a remote operating licence from the Gambling Commission. It is run by The National Online Self Exclusion Scheme Limited, a not-for-profit funded by the gambling industry, and by the end of 2025 more than half a million people had registered with the scheme.
A licence condition, not a courtesy
The mechanism is straightforward, and that is precisely why failures are so difficult for operators to defend. When you register with GamStop, every operator licensed by the Gambling Commission is required to check the register before letting someone open or use an account. Each one must then take all reasonable steps to prevent you from opening a new account or using an existing one for the full duration of the exclusion period you chose.
This is not a courtesy. It is a licence condition.
Behind the scenes, GamStop runs a real-time service that licensed operators integrate directly into their registration and login systems. When someone tries to open an account, the operator’s system queries the GamStop database before access is granted. For existing accounts, operators are required to have procedures that prevent anyone who has since self-excluded from continuing to gamble. The infrastructure to stop a self-excluded person gambling already exists inside every compliant operator’s platform.
So when a self-excluded player is still able to deposit and lose money on a UK-licensed site, the question is not whether something went wrong. It is why the operator’s mandatory controls did not do what the law requires.
The regulator acts on these failings
The regulator has shown it will act. Between May and December 2025 alone, the Gambling Commission took regulatory action against more than a dozen gambling operators for failings spanning anti-money laundering, social responsibility, and technical obligations. The penalties were not nominal: in this period the Commission imposed a £10 million penalty on Platinum Gaming, the Unibet operator (22 October 2025), a £650,000 settlement with NetBet (5 November 2025), a £650,000 fine on Videoslots (20 November 2025), and a £2 million settlement with Paddy Power Betfair (17 December 2025).
These figures matter because they establish a pattern the Commission itself recognises: operators do get safer-gambling and anti-money-laundering controls wrong, and there are consequences when they do. The Commission sets its penalties with reference to the scale of an operator’s business, so for larger operators the sums involved can be substantial.
Where GamStop ends
There is, however, an important boundary to understand. GamStop covers operators licensed by the Gambling Commission. It does not reach sites that operate without a Commission licence, wherever else they may be licensed. A casino licensed only offshore, in a jurisdiction such as Curaçao, falls outside GamStop’s remit entirely, which means a GamStop registration does nothing to block it. These operators often apply different identity-verification thresholds and different dispute-resolution processes from those a Commission licence demands. For a player who self-excluded in good faith and then found themselves gambling on an offshore site, this distinction is usually the heart of the matter.
What this means for your case
That is the work we do through our self-exclusion claims service: examining what protections applied to your situation, which operator the losses sat with, and whether the controls that should have been in place were. Every case turns on its own facts and its own evidence. A free eligibility check is the quickest way to find out where yours stands, and our guide on when you can get money back after gambling on GamStop covers the recovery side in detail. If your losses were on an offshore site, see how to recover money from a Curaçao casino.
The evidence chain a breach case runs on
Self-exclusion cases are unusually document-led, because the wrong being alleged is a mismatch between two dated records: proof that an exclusion existed, and proof that gambling happened anyway. The chain has three links. First, the registration confirmation, whether a GamStop confirmation email or an operator’s acknowledgement of a direct exclusion, showing the date it took effect and the period chosen. Second, deposit records falling after that date: bank statements, e-wallet exports, the operator’s own cashier records. Third, any marketing received during the exclusion, because a promotional email or free-spins text sent to an excluded customer shows the operator did not merely fail to block the account but actively invited its use. Gather the three in that order, since each link frames the next. The full collection method, including what to do when records sit behind a login you no longer have, is set out in our guide to the evidence needed to recover gambling losses.
One practical note on the third link: do not delete the marketing in disgust. The instinct to clear an inbox of casino promotions is understandable, especially for someone protecting a recovery, but each message is a dated exhibit. Move them to a separate folder instead, and if messages arrived by text, photograph the thread with the sender and dates visible before anything else happens to the phone.
The three shapes a failure takes
Breach cases arrive in three shapes, and naming yours early determines the route, because each shape points at a different duty and a different set of records to pull.
- A UK licensee let you through GamStop. The scheme was mandatory, the check was automated, and the deposit happened anyway. This is the most direct shape, and our guide to what it means when a casino lets you bet after GamStop covers it in detail.
- A direct exclusion was ignored. You excluded with one operator through its own tools rather than the national scheme, and it later reopened the door, sometimes after nothing more than a new email address. The promise broken here is the operator’s own, made to you individually, which gives the case a contractual spine alongside the regulatory one.
- An offshore sister brand re-targeted you. You excluded from one site, then found a related brand outside the Commission’s reach marketing to you as though nothing had happened. Why that structure exists, and what it means for your options, is explained in why offshore casinos slip through GamStop.
What outcomes actually look like
Some honesty about endings. In UK cases where a breach is made out, the remedy pattern is a refund of the net losses incurred during the failed exclusion: the deposits that should have been blocked, less any withdrawals paid back out. It is not compensation on top, and it is not recovery of winnings that never existed. No outcome can be promised in advance, by us or by anyone, and a firm that promises one is telling you something about itself. What can be judged in advance is the strength of the chain described above: whether the exclusion is provable, whether the deposits sit clearly inside the excluded period, and whether the operator held a licence that made blocking you its legal duty rather than a courtesy. Weighing those three questions against your documents is exactly what an assessment through our self-exclusion service is for, and it costs nothing to find out where you stand.
Sources
- Gambling Commission, enforcement action (gamblingcommission.gov.uk).
- GamStop (gamstop.co.uk).
General information, not legal advice. We are not solicitors or a law firm. We connect clients with regulated legal partners.