Online Gambling Sites UK and Cash-Out Limits

Online gambling sites in the UK must hold a Gambling Commission licence, and that licence fixes the limits that matter: a £5 maximum stake per spin on online slots, a £2 cap for under-25s, no credit cards, and payout terms that cannot cap what a player takes out. Sites licensed offshore carry none of those limits.

The industry's favourite word is "choice". It is the wrong word. What separates one online gambling site in the UK from another, on the evidence, is not the size of the welcome offer — it is where the limits sit and who sets them. A British-licensed operator works inside a rulebook written by the Gambling Commission: stake caps on slots, a wagering cap of ten times on bonus funds from 19 January 2026, no credit cards since April 2020, and a fair-and-open condition that stops it putting a ceiling on withdrawals. An offshore operator works inside whatever its own terms of use happen to say, which is a different thing entirely.

This page treats limits as the subject rather than the footnote. It looks at the numbers on withdrawals, because that is where limits are felt hardest; at the standard the British licence sets and how offshore sites measure against it; at the checks that decide whether money moves at all; and at the five signs that separate a serious operation from a shopfront. Registration with GamStop — the scheme that blocks a person from every British-licensed online operator, usually typed "gamestop" — gets stated plainly, and so does the helpline. As of 13.11.2026, the picture is unusually clear: the regulator publishes the payout data itself.

The Standard the British Licence Sets

Great Britain does not license a site and then leave it alone. Since 31 March 2020 every online operator must be part of GAMSTOP as a licence condition, and since April 2020 every operator must screen its entire customer base against the register at least once every 24 hours. Two operators lost their licences in April 2020 for missing that deadline, which tells you how seriously the Commission treats a tick-box.

The consumer-facing rules are tighter than most players realise. The £5 maximum stake per game cycle on online slots came in on 9 April 2025, with £2 for 18- to 24-year-olds from 21 May 2025. Credit cards were banned from 14 April 2020. Since 31 October 2025 every operator must prompt a customer to set a financial limit before their first deposit, and must make declining that prompt an active choice. From 19 January 2026 wagering requirements on bonus funds are capped at ten times, and mixed-product promotions — bet on one thing, receive a bonus on another — are banned outright.

The Commission's reason for the ten-times cap is worth keeping. It said the limit "will take out extreme levels as some licensees currently apply up to 60 times wagering requirements". That is not a market finding. It is an admission about what operators were doing when nobody stopped them.

The benchmark of 44.2 million withdrawals from June to September 2024

For any claim about payout speed, there is one primary number. Gambling Commission data covering June to September 2024, cited in a speech delivered on 6 November 2025, records 44.2 million withdrawals by customers of large online operators. Of those, 96.3 per cent cleared automatically, 3.5 per cent cleared within 24 hours, and 0.1 per cent took up to 48 hours. Earlier Commission work, from July 2023, found some of the largest firms approved, processed and fulfilled around 99 per cent of withdrawal requests within 24 to 48 hours.

So the British-licensed machine pays, and pays quickly. It also generates complaints at a rate that should embarrass it: problems with withdrawals were the number one topic raised by consumers with the Commission's Contact Centre, and by July 2024 the Commission said it still received around 2,000 complaints a year about withdrawal delays. Complaints coded "Withdrawals and/or financial transactions" fell from 2,416 in the year to December 2022 to 1,791 in the year to December 2025 — an improvement, and still the loudest single category.

What offshore sites offer in place of that

Offshore sites that hold no Commission licence are not connected to GamStop, and the scheme's obligations apply only to British-licensed operators. That reading is stated by trade and press sources rather than a regulator page, though it follows directly from Gamstop's own terms of use [unconfirmed]. What follows from it is not a loophole but a gap in protection: no stake cap, no wagering cap, no mandatory financial limit prompt, no credit-card ban, no fair-terms condition, and no ADR provider on the Commission's approved list.

Terms that build in delay are the giveaway. Reverse withdrawals — the button that let a player cancel a payout and put the money back into play — were banned in Britain by RTS 14B from 31 October 2021, on the Commission's finding that the function presented a risk to engaged and vulnerable gamblers. Offshore, the operator decides whether that button exists. The same goes for the maximum cashout clause: one offshore casino's terms allow withdrawal of winnings generated with bonus funds only up to 300 per cent of the credited bonus amount, with the excess voided. In Britain a term of that kind is expressly prohibited, and the Commission's own example of a banned clause is "You may withdraw up to £50 per day and up to £500 per week". The wagering multiplier tells the same story: offshore welcome offers typically run at 25 to 40 times, against a British ceiling of ten.

How Fast the Money Comes Back, by Method

The table below compares the route the money takes, not the brand that offers it. Figures are drawn from the method providers' own published schedules and from the Commission's payout data; a time is a typical figure, not a promise.

Two things follow. First, the payment method is only half the equation, and it is the half the player usually controls; the other half is the casino's own processing, where British rules bite and offshore rules do not. Second, the quickest rails in the table carry the least consumer protection, not the most. A USDT transfer to a fresh wallet costs roughly 26 TRX and cannot be reversed by anybody, including the Commission.

What the Commission said about delays

The Commission has been unusually direct. It states it is not acceptable for operators to introduce friction when a customer tries to withdraw rather than when they deposit, or to place the operator's commercial interests above their customers', and that it does not consider it fair, transparent or necessary to delay or prevent withdrawals purely for customer-interaction purposes. Where an operator has no regulatory concerns about a customer, there is no valid reason to delay the payout.

There is also no fixed maximum number of days in which an operator must complete a withdrawal — a fact that surprises people who assume one exists. The regime relies instead on the fair-and-open condition 7.1.1, the identity-verification condition 17.1.1 and the general prohibition on unfair terms. That is a deliberate design choice, and it means a slow payout is a matter of consumer law and complaint procedure rather than a missed statutory deadline.

The Commission has used consumer law where the licence conditions did not stretch. On 21 October 2026 it announced that one operator would pay £900,000 in a regulatory settlement for failures including unnecessarily delaying consumer withdrawals. The specific faults: a term stating that customers could request only one withdrawal at a time and could not request another until the original was authorised, found unfair under the Consumer Rights Act 2015, and manual review of every fifth or tenth withdrawal for some customers, which produced fresh information demands before payouts were processed. Note the shape of it. Nothing was stolen. The money was simply made awkward to reach.

Identity Checks and the Dispute Process

If one mechanism governs whether a player sees their money, it is identity verification, and it is where the least patience is available. Over a quarter of the complaints reaching the Commission's Contact Centre concern identity verification, a concern customers raise when documents are demanded only at the point of withdrawal. The Commission's Annual Report 2024-25 says withdrawals remain the cause of most complaints it receives.

The rules are not secret. Licence Condition 17, in force since 7 May 2019, requires a licensee to obtain and verify a customer's identity before that customer is permitted to gamble. Condition 17.1.1 requires that a withdrawal request must not create a demand for additional information if the operator could reasonably have asked for it earlier — unless another legal obligation, such as anti-money-laundering rules, requires the information at that moment.

The first time and later work differently, and that difference is the whole game. On a first registration, many British operators use what the Commission calls the hybrid approach for remote casinos: identity and age are established at sign-up, and full verification may be deferred until the €2,000 threshold in the Money Laundering Regulations is triggered, either by deposits or by a withdrawal request. Databases often handle it invisibly — credit reference agencies and the electoral roll can confirm a name, address and date of birth without a single document leaving the player's possession. Passports, driving licences and household bills are what is left when that fails.

Later, checks return. Customer due diligence is ongoing, and it must be refreshed when circumstances change. A source-of-funds request can arrive after a change in deposit pattern; bank statements, an explanation of irregular income, or evidence of a house sale are the usual currency. For higher-risk accounts, source of wealth — a larger question than source of funds — may be asked. The Commission also warns that onboarding on partial or inaccurate information creates the problem: a middle name entered instead of a forename can produce a mismatch with the records held elsewhere, including GamStop, and undermine the very block that was supposed to hold.

The warning signs are consistent and easy to name. Documents asked for the first time at withdrawal, when the operator could have asked at deposit. Verification "still in progress" with no stated reason. A demand that runs beyond name, address and date of birth into documents unconnected to the licence conditions. A refusal to explain, which the Commission says is owed to the customer subject only to the statutory prohibition on tipping off in money-laundering cases. And a term allowing the operator to keep a deposit balance because identity was not verified — which the Commission's guidance prohibits outright, and which the CMA's undertakings of 2018 specifically addressed.

Self-exclusion is a fact, not a lever

A GamStop registration holds for its full term — six months, one year, five years, or five years with auto-renewal — and remains in place after that term ends until the person contacts GamStop to remove it. It cannot be cancelled during the exclusion period, and removal before the chosen term ends is not available. Across 2025, 22 per cent of registrants chose the auto-renewing five-year option, and by July 2026 more than one in two of the 614,738 people on the register had opted for the maximum five-year exclusion. An offshore site is not a way round that arrangement, and anyone tempted to treat it as one should read the Commission's warning notice of 20 January 2025, which said unlicensed sites often target customers who have self-excluded through GAMSTOP and may have inadequate social responsibility and anti-money-laundering controls.

Five Signs a Site Can Be Trusted

Trust is not a mood. It is a set of things that can be checked in ten minutes, and a site that resists the checking has told you something.

1. The licence is on the public register, not just in the footer

A Gambling Commission licence is not a badge, it is a searchable entry. The Commission advises consumers to click through to the public register and confirm that the site's activities and domain names match what is listed. A logo in a footer proves nothing; a register entry that names the domain you are actually looking at proves plenty.

2. The terms state withdrawal limits, and there are none on the deposit balance

Read the withdrawal section before depositing. A maximum limit on what can be taken out of the deposit balance is prohibited in Britain, and the Commission's own example of an unfair clause is "You may withdraw up to £50 per day and up to £500 per week". A cap on bonus-derived winnings, or a one-withdrawal-at-a-time rule, is the same breed of term — one of them cost an operator £900,000 in October 2026.

3. Customer funds are held in a separate client account, and the terms say so

Client funds must be kept separate from the operator's business accounts, and the terms must state which of the three protection ratings applies — not protected, medium or high — with a "not protected" operator reminding customers every six months that their funds are not protected in the event of insolvency. Separation is not a guarantee of return; operators may hold customer money in overseas accounts. But a site that cannot say which rating it holds has not been asked the question by anyone.

4. There is a named ADR provider, free to the consumer

British licensees must let customers refer an unresolved dispute to an approved alternative dispute resolution provider, free of charge, if it is not settled within eight weeks. The approved list includes ADR Group, Pegasus ADR Service, Blexr, CEDR, eCOGRA, IBAS, ProMediate and Tattersalls Committee. IBAS handled 3,721 domestic disputes in 2024-25 and reports 100 per cent operator compliance with decisions in the consumer's favour. A site with no route beyond its own support desk has no appeal at all.

5. Cheques and credit cards are refused

A British-licensed operator must accept payment only from a method whose provider is a payment service provider under the Payment Services Regulations 2017, and credit cards were banned outright from 14 April 2020 — a ban that extends to checking that an e-wallet balance was not loaded from a credit card. An operator that still accepts a credit card deposit is advertising, in the plainest possible way, that the licence it displays is not the licence it holds.

Six Steps for Setting Limits Before Depositing

1. Find the licence entry on the Commission's public register and match the domain. Reason: the register lists the activities and domains a licence covers, and a site trading on another operator's licence or a lapsed one will not match.
2. Read the bonus terms for the wagering multiple and the cashout cap. Reason: in Britain the multiplier cannot exceed ten times, and any cap on what can be withdrawn from the deposit balance is prohibited — an offshore term of 300 per cent of the bonus amount tells you who wrote the rules.
3. Check the customer-funds rating in the terms. Reason: it tells you whether money sitting in the account is protected if the operator becomes insolvent, and an operator rated "not protected" is required to say so and to remind you of it.
4. Set a financial limit at the account level when the operator prompts for it — and use the free-text box rather than the preset buttons. Reason: the prompt is mandatory in Britain since 31 October 2025, and setting the limit as a default action is exactly what the rules intend.
5. Decide the withdrawal method before depositing, and make sure the name on the wallet or bank account matches the account name. Reason: mismatches are the most common cause of a stalled payout, and payment method choice is the one part of the chain a player fully controls.
6. Keep a note of the dates of any dispute, and go to the named ADR provider if eight weeks pass without resolution. Reason: an ADR provider will not normally take a case that has not been through the operator's own complaints procedure, and eCOGRA may refuse a dispute where the problem began more than a year earlier or where at least two weeks have not passed.

For players whose own gambling is causing trouble — which is a different question from the licensing one, and a more urgent one — the National Gambling Helpline is free on 0808 8020 133, 24 hours a day, every day of the year, and is run by GamCare. Gamblers Anonymous England, Wales & Ulster answers on 0330 094 0322. Citizens Advice Scotland runs a gambling support advice line on 0800 328 1131, Monday to Friday, 10am to 3pm. None of that is a limit on a game. It is a limit on the damage.

Frequently Asked Questions About Online Gambling Sites

How many online gambling sites are there in the UK?

There is no clean published total, and anyone quoting one is guessing. The useful numbers are narrower. The Commission's illegal gambling dashboard recorded 586 illegal gambling websites accessible to GB consumers in September 2026, 4 per cent more than September 2025. Among respondents who had gambled online in the previous four weeks, the Commission estimates 2.5 per cent had engaged with an illegal gambling website, with a further 1.5 per cent having done so in the past 12 months.

Which are the safest online gambling sites in the UK?

Safety here is a licensing fact rather than a brand quality. A site licensed by the Gambling Commission is bound by the £5 slot stake cap, the ten-times wagering cap, the credit-card ban, the fair-terms condition and mandatory participation in GAMSTOP. A site licensed in Curaçao, Anjouan or Kahnawà:ke is bound by none of it. The check takes a minute: confirm the domain appears on the Commission's public register.

Are new online gambling sites in the UK any less safe than established ones?

Not inherently, but a new site has less of a record. Since 31 March 2020, the licence condition requiring GAMSTOP participation applies from the moment an operator holds a licence, so age is not the test. What is worth checking on a newer site is the customer-funds protection rating and the named ADR provider — two things an operator with a thin track record cannot fake and a long-established one is sometimes careless about stating.

Can a UK player withdraw winnings from a bonus?

Yes, subject to the terms. From 19 January 2026 wagering requirements on bonus funds are capped at ten times, and the Commission's guidance requires that a player may withdraw their deposit balance at any time, including when a bonus is pending or active. Deposit and bonus balances must be displayed separately, and a term letting the operator confiscate an unstaked deposit is prohibited. Offshore, none of that applies.

What is the maximum a UK site can refuse to pay out?

It cannot impose a maximum on the amount withdrawable from a deposit balance at all. The Commission's example of a prohibited term is "You may withdraw up to £50 per day and up to £500 per week". Operators may charge a cost-reflective processing fee, disclosed before deposit, and may reasonably limit the number or size of separate withdrawals — the very term that cost an operator £900,000 in October 2026.

Do UK sites have to check identity before a withdrawal?

They must verify identity before a customer is permitted to gamble at all, under Licence Condition 17. Where an operator could reasonably have asked for information earlier, a withdrawal request must not be the moment it appears. Over a quarter of complaints to the Commission's Contact Centre concern identity verification, and a case where documents are demanded only at payout is precisely the pattern the Commission has criticised.

The Limit Is the Product

The British licence is not a guarantee of virtue — it is a guarantee of a ceiling, and the ceiling is what a player is actually buying when choosing between online gambling sites in the UK. Stake caps, a ten-times wagering cap, a ban on credit cards, terms that cannot put a lid on withdrawals, and a self-exclusion register checked every 24 hours are all limits on somebody's revenue. Offshore, the limits are written by the party that profits from removing them, and the speed of a crypto payout is no compensation for a maximum cashout clause that voids the rest. The clearest figure in the whole file remains the Commission's: of 44.2 million withdrawals by customers of large online operators between June and September 2024, 96.3 per cent cleared automatically. That is what a ceiling does when it is enforced.