UK warned over crypto casinos sidestepping GamStop safeguards
Across Britain, gamblers who believed they had closed the book on betting are returning via crypto-only casinos that sit outside GamStop. Since its launch in 2018, GamStop has been a pillar of the UK’s responsible gambling regime. Yet unlicensed offshore operators continue to exploit gaps, tempting vulnerable players with anonymous access. Campaigners and industry specialists are warning that unless action is taken to close the “crypto casinos GamStop loophole,” the scheme risks losing its protective power.
GamStop’s limited reach
GamStop is mandatory for all operators licensed by the UK Gambling Commission (UKGC). Once registered, a player cannot access any UK-licensed gambling site or app for their chosen exclusion period.
The scheme now has nearly 600,000 active registrations, according to 2025 figures, with a 31 percent year-on-year increase in under-25s during the second half of 2024, followed by a sharp 44 percent rise in the first half of 2025. This underlines why the crypto casino loophole is particularly dangerous for younger players. The UKGC recently published detailed data on player restrictions, including self-exclusion and deposit limit trends, which underline the scale of demand for these protections.
The scheme reaches only as far as the UK’s borders. Offshore crypto casinos, including those registered in Curaçao and other light-touch jurisdictions, have no obligation to join GamStop.
They operate in a legal grey area, accessible to UK players but not formally permitted under the Gambling Act. By accepting UK traffic while operating outside UKGC oversight, these platforms sidestep GamStop safeguards entirely.
How blockchain anonymity enables relapse
Anonymity on the blockchain adds another layer of risk. Licensed sites require KYC, but crypto casinos often skip it, letting players fund accounts through pseudonymous wallets. That allows a player who has self-excluded via GamStop to open a new account and start betting again without their identity being flagged.
Unlike traditional payment methods, cryptocurrency wallets don’t require personal details to open. A player simply downloads a wallet app, generates an address, a long string of letters and numbers, and can send funds instantly. Because those addresses are pseudonymous rather than tied to names or verified IDs, gambling platforms cannot cross-check them against GamStop’s register. This allows self-excluded players to effectively create a new identity with each wallet they generate.
Documenting the risks
The risks are not abstract. A whistleblower report published by FinTelegram detailed how a UK player lost more than £20,000 on a crypto casino within months of self-exclusion, with no recourse for recovery. Academic studies echo the concern: analysis of 40 leading crypto-only casinos found that just 60 percent offered any form of self-exclusion tool, while none required identity verification at sign-up.
Academic research by the University of Bristol highlighted that popular crypto-only platforms, including Freshbet and Goldenbet, lacked formal self-exclusion mechanisms and conducted no identity verification at sign-up. The findings underline how crypto casinos can bypass the protections built into GamStop.
The sector’s scale is another concern: crypto gambling generated more than eighty-one billion dollars in gross gaming revenue in 2024, a fivefold increase on previous years. That commercial growth helps explain why operators show little incentive to introduce voluntary safeguards.
Several offshore crypto casinos remain outside UK oversight. For example, Rolletto accepts cryptocurrency deposits but does not appear on the UKGC’s list of licensed operators, meaning it is not required to integrate with GamStop. This means a UK player who has self-excluded through GamStop could create an account and deposit cryptocurrency without any system flagging their previous exclusion.
The result is a breakdown of responsible gambling safeguards and AML oversight alike. Payment processing adds another layer of opacity, with some providers disguising gambling transactions under unrelated merchant codes to evade detection. Researchers also point to the use of “white label” licensing structures, which allow platforms such as Rollbit to operate indirectly without oversight, further complicating enforcement.
Legal limits and enforcement pressure
A Wiggin LLP spokesperson told SiGMA News that the UKGC’s enforcement powers are subject to clear territorial limits.
“The Gambling Act has territorial limitations, which means the UKGC’s direct, extra-territorial enforcement capabilities against offshore unlicensed operators are limited.
“The regulator has taken proactive steps to tackle the market through cease-and-desist notices, disruption notices, and Google takedown requests. Its work with PSPs to address the black market is bypassed by crypto operators, of course.
“Alongside these steps, we have seen the UKGC start to target the games suppliers it licenses where it considers their content to have appeared on unlicensed sites.”
The spokesperson also stressed that while AML is vital, it cannot be expected to prevent self-excluded players from gambling.
“The AML framework is not a tool for stopping self-excluded players,” they said. “There is no loophole, per se.
“Licensed operators have to observe GamStop; unlicensed operators don’t. The regulators’ community is really struggling to manage this issue due to the offshore establishment of such operators.
“One clear step would be to prevent the advertising of the ‘Not-On-Gamstop’ sites, somewhat remarkably still easy to find with a Google search. The platforms must do more here.”
The numbers paint it clearly. The UKGC has fired off 287 notices since last spring, but crypto casinos keep ducking the net.
Regulator limits and player impact
Even the industry knows the bind. Regulators can only stretch so far. Offshore casinos sit outside the UKGC’s net, banks can’t see the money moving through crypto wallets, and blocking tools like Gamban only work if people actually install them. Too many don’t even know they exist.
Responsible gambling specialists warn that the human toll is equally pressing.
“There’s a danger that many of the crypto casinos could be unregulated and therefore won’t be engaging in any messaging or association with GamStop or any of the other self-exclusion services which exist,” said Adrian Sladdin, Director at Ethical Gambling Forum.
“From some research I’ve been carrying out recently, a lot of illegal gambling sites are very hard to tell from the real thing, so there’s an inherent risk that a player who wishes to self-exclude will just get sucked back in again to gambling, if they aren’t careful.”
Sladdin added: “This can be akin to the flood-gates reopening through no fault of the player. If there’s been a pent-up frustration, then removing a barrier to gambling can lead to problematic behaviour, which in turn can lead to dramatic financial losses. Clearly, these have an effect on not just the player but on the close family circle as well.”
He also noted that while blocking tools such as Gamban are effective against regulated sites, they cannot cover the full spectrum of gambling available online.
“The player really has to want to stop gambling for these to work,” he said. According to Sladdin, many self-excluded players discover unregulated crypto casinos through the dark web. “It really doesn’t take long to find what you’re looking for with regard to these gambling websites.”
Can technology close the gap?
There is, however, some optimism that technology could help bridge the gap. Some blockchain advocates argue that the same technology driving anonymous gambling could also tighten safeguards in the future. Early trials of decentralised identity (DID) frameworks, digital credentials stored on the blockchain rather than with individual companies, suggest a possible route.
In practice, a player could hold a single, cryptographically secure ID that proves they are over 18 or registered with GamStop, without disclosing personal details to every operator. Instead of sharing names or passport scans, the system would issue a zero-knowledge proof confirming status.
If linked to a national self-exclusion register, such a credential could automatically block access to crypto casinos at the wallet level. Unlike current systems, where each casino maintains a separate player database, a DID system would create a universal digital credential that works across all platforms.
Recent trials by companies such as Sedicii show that zero-knowledge proof (ZKP) age verification is already moving into practice, proving a player’s age without disclosing any additional information. Advocates argue that ZKP could provide a near-term safeguard, although its adoption in the gambling industry remains limited.
The challenge is adoption. No regulator currently mandates DID in gambling, and offshore operators are unlikely to implement solutions that restrict their customer base voluntarily. That leaves blockchain identity tools as a long-term prospect rather than a short-term fix — promising on paper, but, as experts agree, years away and no replacement for immediate regulatory reform.
Policy responses under review
Pressure is mounting on policymakers. UK consultations on “high-stakes gambling in the digital age” flagged crypto casinos as a rising concern and called for modernised self-exclusion protections. On the table are stronger tools such as default blocking software and wider GamStop obligations. Added to that is tougher scrutiny of crypto gambling payments.
Alongside these proposals, the UKGC will roll out new rules on 31 October 2025, including mandatory deposit limits and enhanced transparency requirements. While these measures do not directly tackle crypto casinos, they show regulators are moving towards stronger player protections.
Globally, regulators are facing the same challenge. In Australia, voluntary national blocking tools have struggled with low uptake. In contrast, the Netherlands has tightened its rules, requiring all operators, including those in the crypto sector, to register with the CRUKS exclusion scheme, thereby closing loopholes left open in the UK.
As of July 2025, CRUKS had passed one hundred thousand self-exclusions, with all operators tied into DigiD verification, creating a universal, mandatory exclusion system that the UK could look to replicate.
Unless reforms move forward, campaigners warn that crypto casinos will keep drawing in the very players GamStop was built to protect. Without swift action to force crypto casinos into GamStop and roll out universal blocking, the UK’s progress on self-exclusion could unravel. That would leave vulnerable players exposed to predatory offshore operators.
