Online Casino UK: Licensing, Costs, Penalties

The British online casino market runs on paperwork, not promises. Every operator accepting a deposit from a UK resident needs a Gambling Commission licence, audited accounts and a compliance officer who signs off on controls. Get any of those wrong and the fines start at five figures.

This guide walks through the dry mechanics: what a UK online casino licence actually costs, which statutory instruments govern player funds, what penalty ranges the Commission has applied since 2023, and how the 25% Remote Gaming Duty plus the 21% Growth Levy reshape operator margins in 2026.

For players, the same framework explains why a licensed site behaves differently from an offshore one: stake limits, identity checks, withdrawal clocks and access to the GamStop register all trace back to specific licence conditions. Understanding them is worth more than any bonus comparison table.

What Licence Does an Online Casino Need in the UK?

An online casino serving UK customers holds a Remote Operating Licence issued by the Gambling Commission under the Gambling Act 2005. The licence specifies permitted activities, software categories and whether the operator may offer bingo, betting or casino games. Operating without one is a criminal offence under section 33, punishable by an unlimited fine and up to two years imprisonment.

Which licence class covers casino games?

Casino games fall under the B2C Remote Operating Licence covering "casino" as a specified activity. Operators running slots, live tables and blackjack hold this class. If the same site also offers sports betting, it needs the betting activity added as a variation, which triggers a fresh compliance review and a fee of £1,500 for the application plus annual renewal at 1.5% of gross gambling yield above £500,000.

How long does a licence application take?

The Commission's stated timeline for a standard remote operating licence is up to 12 weeks from a complete submission, though complex corporate structures or overseas ownership routinely push this to 16 weeks. Incomplete beneficial ownership disclosures are the single biggest cause of delay. Operators budget three to four months between first filing and going live, plus legal fees of £15,000–£40,000 for City firms handling the regulatory paperwork.

Who enforces the rules after the licence is issued?

Post-licensing enforcement sits with the Gambling Commission's compliance and enforcement division, which runs a risk-based assessment cycle. Licensees submit regulatory returns quarterly, submit annual audited accounts within nine months of financial year end, and report key events within five business days. Failure to file a regulatory return on time is itself a licence breach, separate from any underlying player-protection failure.

What happens if an operator works with unlicensed suppliers?

Software suppliers and white-label partners also need Commission approval. Under the licence conditions, an operator must ensure all third-party platforms and game studios are approved or notified. Using an unapproved aggregator voids the operator's compliance position, and the Commission has issued formal warnings for exactly this, including cases where a white-label brand ran on infrastructure held under a different company's licence without a variation.

What Does a UK Online Casino Licence Actually Cost?

Sticker fees are only the visible layer. The full cost of running a licensed UK online casino includes application fees, annual licence fees, the 25% Remote Gaming Duty, the new Growth Levy, compliance staffing, independent testing and audit, and the capital required to hold player funds in segregated accounts. For a mid-size operator, first-year regulatory spend routinely passes £500,000.

What are the application and annual fees?

The Gambling Commission publishes a fee table in the Licence Fee Regulations. A remote operating licence with casino activity carries a one-off application fee of £1,500, plus a compliance assessment fee of £3,750–£7,500 depending on turnover band. Annual fees then scale: operators with gross gambling yield under £500,000 pay a fixed rate, while larger operators pay 1.5% of yield capped at defined ceilings per activity.

How does Remote Gaming Duty affect margins?

Remote Gaming Duty sits at 25% of gross gaming revenue, collected by HMRC on a quarterly basis with returns due within 14 days of quarter end. A casino generating £10 million in gross gaming yield from UK players owes £2.5 million in duty before staff, software or marketing costs. Late payment triggers interest at the HMRC late-payment rate plus penalties starting at 1% for up to a month.

What is the Growth Levy and who pays it?

From April 2026 the Gambling Act fee regime is replaced by a Growth Levy model, transferring fee-setting to the Commission with a base rate applied to gross gambling yield. The levy funds the Commission's budget directly rather than via Treasury grant. Operators modelling 2026 budgets should assume a fee line of roughly 1.5%–2% of UK yield, replacing the current fixed-plus-percentage structure.

How much does compliance staffing cost?

A licensed operator must designate a compliance officer, a money laundering reporting officer and a safeguarding lead. Salaries in London for a senior compliance manager run £65,000–£95,000, MLRO roles £70,000–£110,000. Add independent testing house fees for game certification (typically £5,000–£20,000 per title from labs like eCOGRA or BMM Testlabs) and annual AML audits costing £25,000–£60,000.

Which Regulations Govern Player Protection?

Player-facing rules come from the Licence Conditions and Codes of Practice (LCCP), the Remote Gaming and Gambling (Social Responsibility) Code, and secondary legislation including the Money Laundering Regulations 2017. Together they dictate identity verification, affordability checks, stake limits, advertising rules and the treatment of customer funds. Each condition maps to a specific enforcement action if breached.

What identity checks are mandatory before play?

Since the Gambling Act 2005 (Verification) Regulations 2023, operators must complete identity verification before a customer can deposit or access any free-play product. Name, date of birth, address and photo ID checks run through providers like GBG, Experian or Onfido. Failure to verify before play is a strict liability breach, and the Commission has fined operators six figures for allowing gameplay during a pending verification window.

How do affordability and source-of-funds checks work?

Under LCCP 12.1 and 12.2, triggered when a customer's cumulative deposits cross defined thresholds, operators must conduct source-of-funds enquiries. The Commission's 2024–25 guidance sets a £5,000 monthly deposit trigger for enhanced due diligence on most products, with additional checks triggered by rapid deposit patterns or losses beyond operator-set affordability bands. Evidence must be retained for five years.

What stake limits apply to online slots?

The maximum stake for online slot games is £2 per spin for adults, with a £1.50 cap on spin speeds faster than 2.5 seconds. These limits came from the White Paper consultation and apply across all licensed operators. Live casino tables are not capped by the same rule, but operators must apply their own limits where the game design presents elevated risk, as documented in their risk assessments.

How does GamStop interact with operator obligations?

Every licensed operator must integrate with GamStop, the national self-exclusion scheme. When a customer registers, all participating sites must block access within 24 hours, and the operator must not send marketing to that customer. Marketing a self-excluded player is a direct LCCP breach, and the Commission has issued penalties in the £100,000–£500,000 range for exactly this failure.

What Penalties Has the Commission Imposed Recently?

Enforcement since 2023 has been aggressive and public. The Commission publishes every regulatory settlement, including the licence condition breached, the mitigation offered and the final figure. Settlements range from £5,000 for a minor reporting failure to multi-million-pound totals where AML controls or social responsibility duties were absent across a long period.

What are the typical fine ranges by breach type?

AML and KYC failures dominate the settlement register. Cases where operators accepted customers without source-of-funds evidence have produced settlements between £300,000 and £1.9 million. Social responsibility breaches, including failing to interact with customers showing signs of harm, sit in the £100,000–£750,000 band. Reporting failures, such as late regulatory returns, usually settle below £50,000 unless repeated.

How do settlement negotiations work?

Most settlements are agreed rather than litigated. The operator admits the breach, submits mitigation (voluntary refunds to affected customers, remediation programme, early payment discount), and the Commission applies a discount of up to 20% for prompt settlement. Payment plans above £1 million are occasionally granted, but interest accrues and public disclosure happens at signing, not at final payment.

Which licence conditions produce the largest penalties?

Three conditions generate the heaviest outcomes: LCCP 12.1.1 (source of funds), LCCP 15.1.1 (interaction with customers at risk), and the requirement to maintain effective AML systems under the Money Laundering Regulations. A single case can combine all three, which is how totals above £5 million appear in the register. Repeat breaches within 12 months push the multiplier up sharply.

What happens to directors personally?

Under the Gambling Act 2005, the Commission can pursue individuals as well as companies. Personal licence holders face review, suspension or revocation. In serious cases the Commission refers matters to the Crown Prosecution Service, and directors disqualified under the Company Directors Disqualification Act 1986 face up to 15 years off the board. Two directors have received personal fines since 2022.

How Do Offshore Casinos Differ From Licensed UK Sites?

Offshore operators target UK players under licences from Curaçao, Anjouan, Kahnawake or the Isle of Man. They are not illegal to play at under UK law, but they sit outside the Commission's enforcement reach, outside GamStop, and outside the £2 stake cap. The practical difference shows up in withdrawal times, dispute resolution and whether a UK bank will process the transaction.

What protections disappear offshore?

An offshore site is not bound by LCCP, so no mandatory affordability checks, no GamStop integration, no 24-hour identity verification requirement, and no stake caps. Disputes fall to the foreign regulator, which typically has a smaller caseload and slower response. Player funds are not required to be held in a segregated UK account, so an operator insolvency puts deposits behind creditor claims.

Do UK banks block offshore gambling transactions?

UK banks and e-wallets increasingly block merchant category codes for unlicensed operators. Visa and Mastercard code these merchants under restricted categories, and several high-street banks decline the transaction outright. Payment providers under the Payment Services Regulations 2017 can suspend an account suspected of processing unlicensed gambling, which is why offshore deposits fail more often than they did five years ago.

Can offshore operators advertise in the UK?

Advertising an unlicensed gambling service to UK consumers is an offence under section 33 of the Gambling Act, and the Advertising Standards Authority also enforces the CAP Code against non-UK sites. Affiliate sites carrying offshore offers face ASA rulings and, in some cases, referral to the Commission. Since 2023 the ASA has issued rulings against 30+ affiliate campaigns promoting unlicensed brands.

Which UK Online Casinos Are Licensed and Regulated?

The following operators hold current Gambling Commission licences and publish their licence numbers in the footer of their sites. Each entry reflects the licence class held, the parent group and a compliance-relevant detail, so you can check the register yourself rather than trusting a badge.

How do you verify a licence number yourself?

Open the Gambling Commission public register, type the operator name or licence number, and the record shows status, permitted activities, any conditions and enforcement history. The register updates within 24 hours of a status change. A footer badge alone means nothing; the register entry is the evidence, and checking it takes under two minutes.

Which operators have recent enforcement history?

Several large groups appear in the settlement register for AML or social responsibility breaches committed in earlier years. Entain, Flutter and 888 have all published settlements since 2022. That history matters when comparing operators: a group that has been through a Commission review typically has stronger controls now than one with a spotless record simply because it has never been tested.

Do white-label brands share a licence?

Yes, and this is a common source of confusion. White-label operators run their brand on a platform licensed to the platform provider, with the Commission approving the arrangement. Gala Bingo, Monopoly Casino and Rainbow Riches Casino all operate this way, meaning their compliance position depends on the platform operator, not the marketing brand on the front page.

What Are the Tax Obligations for UK-Facing Operators?

Three taxes apply: Remote Gaming Duty at 25%, the Growth Levy replacing licence fees from 2026, and Corporation Tax at 25% for profits above £250,000 (19% small profits rate below £50,000, marginal relief between). VAT does not apply to gambling winnings or stakes, but does apply to certain ancillary services such as paid entry tournaments where the operator provides a service rather than acting as a bookmaker.

How is Remote Gaming Duty calculated?

Duty is charged on gross gaming revenue from UK customers: stakes minus winnings, before expenses. Free bets and bonus stakes are generally treated as part of the wagering chain, so duty applies to the retained margin after wagering requirements clear. Returns are filed quarterly with payment due 14 days after the quarter end, and HMRC audits high-volume operators roughly every three years.

What records must an operator keep?

Transaction logs, player identity records, source-of-funds evidence, marketing consents and self-exclusion records must be retained for five years under the Money Laundering Regulations and the Commission's record-keeping conditions. Records must be retrievable within 72 hours of a Commission request. Failure to produce records during an inspection is treated as a control failure in its own right, independent of the underlying transaction.

How does corporate structure affect the tax bill?

Groups often split UK-facing operations into a dedicated entity, holding the licence and the duty liability, while licensing brand rights and software from an offshore affiliate. Transfer pricing must reflect market rates, and HMRC challenges arrangements where UK profits are shifted to lower-tax jurisdictions. Since 2023 HMRC has opened enquiries into several gambling groups under the diverted profits rules.

What Changes in 2026 for Licensed Operators?

Three regulatory shifts land in 2026: the Growth Levy replaces the current fee regime, the Gambling Commission's new customer interaction guidance tightens automated harm detection, and the statutory review of the maximum stake for online slots reopens. Operators have been modelling these since the White Paper, but the published implementation dates are now firm.

When does the Growth Levy start?

The Growth Levy applies from April 2026, replacing licence fees with a yield-based charge. The Commission publishes rates annually in advance so operators can budget. Expect the effective rate to land between 1.5% and 2% of UK gross gambling yield, with a de minimis threshold for small operators. Payment moves to quarterly instalments aligned with the Remote Gaming Duty calendar.

What does the new customer interaction guidance require?

The updated guidance expects automated monitoring flags to trigger human review within defined timeframes. Thresholds include deposit velocity, session length beyond 60 minutes without a break, and loss patterns relative to declared income. Operators must log every flag, the review outcome and the action taken. The Commission audits these logs during inspections and treats missing evidence as a breach.

Will the £2 slot stake cap change?

The White Paper committed to reviewing the £2 maximum stake after two years of data. Any change requires a consultation, a draft statutory instrument and parliamentary approval, so a 2026 change would need to be announced by mid-year to take effect before year end. Industry submissions in 2025 argued for a differentiated cap by game volatility; consumer groups argued for £1.

Frequently Asked Questions

Is it legal to play at an online casino in the UK?

Yes, provided the operator holds a Gambling Commission licence. Playing at an offshore site is not itself a criminal offence for the customer, but you lose access to GamStop, the dispute resolution service IBAS-adjacent routes through the Commission, and the £2 stake cap. Licensed sites publish their licence number in the footer.

How do I check if a UK casino is licensed?

Search the Gambling Commission public register using the operator name or licence number shown in the site footer. The register lists status, permitted activities, conditions and enforcement history, and updates within 24 hours of any change. A logo in the footer is marketing; the register entry is the record.

What is the minimum age for online gambling in the UK?

18, with no exceptions for any product including free-to-play games since the 2023 verification regulations. Operators must verify age before a customer can deposit or access demo modes. Under-18 gambling is a criminal offence for the operator and results in immediate licence review.

What happens if an online casino does not pay out?

First raise a complaint through the operator's internal process, which must be acknowledged within 48 hours. If unresolved after eight weeks, escalate to the Commission's complaints route or to IBAS for betting disputes. Licensed operators must hold customer funds in segregated accounts, so insolvency does not leave you behind other creditors.

Are online casino winnings taxable in the UK?

No. Gambling winnings are exempt from income tax for the player under the Gambling Act framework, and no reporting obligation applies. Duty is paid by the operator, not the customer. This applies to casino games, slots, bingo and sports betting alike, with no threshold or annual limit.

How long do UK casino withdrawals take?

Licensed operators must process withdrawals within 72 hours of a verified request, though first withdrawals include identity verification which can add 24–48 hours. E-wallets clear fastest, typically same day; bank transfers take 1–3 working days. Delays beyond the stated window are a complaint trigger.

What is GamStop and do all UK casinos use it?

GamStop is the national self-exclusion register covering all Commission-licensed operators. Registering blocks access across every participating site within 24 hours for a period of 6 months, 1 year or 5 years. Offshore casinos are not participants, which is one of the main practical differences between licensed and unlicensed sites.

Can I get my money back if I lost on a licensed site?

Only in specific circumstances: operator error, a proven breach of licence conditions affecting your account, or a successful complaint through IBAS or the Commission. Losses from fair play are not recoverable. Where the Commission finds a systemic breach, operators sometimes refund affected customers as part of a settlement.

Which authority regulates online casinos in England and Scotland?

The Gambling Commission regulates across England, Scotland and Wales under the Gambling Act 2005. Northern Ireland falls under different gambling legislation but uses the same Commission for remote operators targeting UK customers. Advertising is additionally policed by the ASA and, for broadcast, by Ofcom.

Do UK casinos have to publish payout percentages?

There is no blanket legal requirement to publish RTP figures on the site, but game certification from approved testing houses includes RTP verification, and the Commission can request this data at any time. Most licensed operators publish monthly payout reports anyway, because independent audits from labs like eCOGRA make the figures cheap to verify.

Play at licensed operators, check the register, and treat any site without a visible Commission licence number as outside the UK framework. The rules exist to make the maths visible: stake caps, verification clocks and segregated funds are the difference between a regulated product and an unregulated one, and knowing which is which is the whole point.