Non-GamStop Casino Licensing in 2026: Curaçao LOK, Anjouan, MGA and Gibraltar Compared
Available in US
The first time I had to explain what a Curaçao licence actually meant was around 2017, and I gave the same lazy answer that most of the industry was giving back then — “it’s the cheap one, but it exists.” That answer was sloppy in 2017. By 2026, after the LOK reform tore up the old master-licensor model and rebuilt the whole system from scratch, it is wrong in almost every clause.
I have spent the past nine years tracking how UK players move between the regulated and the offshore market, and the single biggest source of confusion I encounter — both from readers and from people who really should know better — is licensing. A logo at the foot of a casino website is treated as a stamp of approval, when in reality it is a regulatory address. It tells you which authority that operator answers to, what dispute mechanism you can use, what consumer protections apply, and, just as often, which markets the operator is explicitly forbidden from serving.
This piece is meant to do one thing properly: lay out the four licences a UK player will actually encounter on a non-GamStop site in 2026 — Curaçao under the new LOK regime, Anjouan, Malta’s MGA, and Gibraltar — and explain what each of them genuinely means once you strip away the marketing. The LOK itself was approved by the Curaçao parliament by a 13–6 vote on 17 December 2024 and entered into force on 24 December 2024, which is the date that, in regulatory terms, ended the master-licensor era for good.
What actually makes an offshore licence legitimate
A reader once forwarded me a screenshot of a casino footer with seven different “licence” badges on it. Three of them were award medals from defunct affiliate sites, one was a fake EU compliance logo, and exactly two were real gaming licences. The website looked authoritative. It was not.
A legitimate gaming licence has four properties, and if any of them is missing the badge is decorative. First, it is granted by a public authority that can be contacted, that publishes its register of licensees, and whose existence does not depend on the operator paying for its own oversight. Second, the licence number is verifiable on the regulator’s own domain, not on a mirror page the casino runs. Third, the licence carries explicit conditions — minimum capital, segregated player funds, fit-and-proper checks on directors, AML reporting obligations — and these conditions are public. Fourth, there is a procedure for player complaints that does not run exclusively through the operator’s own support desk.
The trick the industry has always played, and continues to play, is to treat the badge as the product. A site can be perfectly happy to display “Licensed by the Government of Curaçao” because the badge does the legitimising work, regardless of whether the underlying licence is still valid, whether the master licensor has had its own permit revoked, or whether the operator’s name appears anywhere in the official register at all. I have lost count of how many sub-licensed properties I have looked up and found absent from the records they claim to be in.
There is also a second category that confuses people: corporate registrations. A company being incorporated in Cyprus or in the British Virgin Islands is not a gaming licence. It is a tax address. Operators routinely list one of those corporate addresses alongside a licence logo and let the visitor’s eye blur the two. They are not the same thing, and conflating them is how a player ends up sending a dispute to a registrar of companies that has no authority over gambling whatsoever.
The shortcut I give people is this: if you cannot navigate from the casino footer to a public regulator page that names the operating company, the licence is doing brand work, not regulatory work.
The Curaçao licensing system from 2024 to 2026
Ask any compliance lawyer who has worked on Curaçao files for the past decade, and you will get the same exhausted sigh. The Curaçao system, until very recently, was an architectural fossil. It dated from 1996. It rested on something called the NOOGH — the National Ordinance on Offshore Games of Hazard — and on the strange institution of the master licensor, a private entity that held a licence from the government and then sold sub-licences onward to actual operators. There were four of them. The most famous was Curaçao eGaming, and the lawyers who set up these chains were not always advertising their craft.
The model was, by 2020, the running joke of European gambling compliance. A Curaçao licence cost less than most office rents, oversight was performed by the master, and the master was a commercial company with a financial interest in keeping its sub-licensees on the platform. Disputes routinely ended with the master refusing jurisdiction. Regulators in the UK, Germany and the Netherlands described the system, in print, with words I will paraphrase as “structurally inadequate.”
Then in 2024, Curaçao did the unexpected thing and actually fixed it. The National Ordinance on Games of Chance — the LOK — passed parliament on 17 December 2024 by a 13–6 vote and entered into force on 24 December 2024. It abolished the master-licensor structure and replaced it with a direct licensing regime administered by the Curaçao Gaming Authority, a public agency. The transition was not instant: existing NOOGH sub-licences were given until 24 June 2025 to either migrate to a direct CGA licence or shut down. From 1 July 2025 onward, any Curaçao operator serving the public on a sub-licence that has not been migrated is operating without a valid permit, full stop. I have walked through the exact mechanics of this transition in a deeper piece on how the Curaçao LOK reform reshapes the offshore landscape for UK players, which goes into the migration timelines and the practical effect on player funds.
CGA direct licences and the old sub-licence ecosystem
The new CGA direct licence is a different animal from what the old sub-licences offered. Operators apply to the authority itself rather than to a private intermediary. They submit corporate documentation, ownership disclosures, AML procedures, and a deposit. The CGA performs its own due diligence, issues a licence number that lives on the authority’s public register, and retains supervisory authority. If the operator misbehaves, the CGA — not a commercial master — is the body that revokes the permit.
What this means in practice for a UK player landing on a Curaçao-licensed site in 2026 is that the licence number in the footer should resolve, on the CGA’s own portal, to a named licensed entity. If it does not — if the only attestation is a master-licensor seal and the company name does not appear in the CGA register — the operator is either still in the migration limbo, in which case its days are numbered, or it is operating without a valid licence at all. Both situations are reasons to be cautious about depositing.
The other thing the LOK changed is enforcement posture. The old Curaçao was a famously hands-off regulator. The new CGA has, in the first year of operation, already begun publishing supervisory notices and revocations in a way that the old gaming control board did not. This does not turn Curaçao into the UKGC — the resourcing simply is not comparable — but it does mean that “Curaçao does nothing” is no longer an accurate shorthand. I would now describe it as “Curaçao does something, slowly, and only on the new direct licences.”
Anjouan licensing and why the UK sits on the restricted list
Anjouan is the licence I get asked about most often by readers who have never heard of Anjouan. Which is the right reaction, because Anjouan is an autonomous island in the Comoros archipelago in the western Indian Ocean, with a population smaller than Portsmouth. It also happens to have spent the past few years marketing itself aggressively as the cheap, fast alternative to Curaçao, and a generation of new operators have picked up the badge because it costs less and asks fewer questions than almost anything else on the market.
The numbers tell the story. An Anjouan B2C licence costs around €17,828 per year. Since July 2025, B2B suppliers selling games into Anjouan-licensed sites must hold either a local B2B licence or an approved B2B License Recognition Certificate, with the recognition route priced at €9,500 a year. That second figure matters because it is a deliberately low compliance floor designed to make it easy for studios to plug in. The licence is, in effect, set up to be onboarded quickly. Onboarded quickly is not the same thing as supervised carefully.
The detail that almost nobody on the affiliate side mentions, and the one I want you to remember when you see an Anjouan logo, is that the licence does not authorise an operator to serve UK customers at all. The Anjouan permit explicitly excludes the United Kingdom, the United States, France, Germany, the Netherlands, Spain, Australia and Austria from the territories an operator may target. Those are the regulator’s own conditions. Any Anjouan-licensed site that allows a UK player to register, deposit and play is operating outside the terms of its own licence — not the UKGC’s rules, its own.
This is where the badge does brand work rather than regulatory work in its most distilled form. The site looks licensed. The licence is real. The licence does not cover you. If you then need to file a dispute, you are filing it about activity the licence prohibits, and the regulator has no obligation to treat you as a covered customer. I have seen this play out exactly that way in complaint files: the operator argues that the player should not have been there, the regulator agrees, and the dispute closes without resolution.
I am not saying Anjouan-licensed operators are scams as a category. Many of them run their day-to-day operations properly. I am saying that the regulatory architecture, as written, does not give a UK player the protections the badge implies. If something goes wrong, the licence will not catch you.
Malta’s MGA licence and the reality for UK players
The Malta Gaming Authority is the licence that confuses people in the opposite direction. If Anjouan over-promises and under-delivers, the MGA under-promises for UK players specifically — because most of the conversation around MGA happens in a European context where it really is a tier-one regulator, and that mental model breaks the moment you cross the Channel.
The MGA, as a licensing authority, is genuinely serious. It conducts fit-and-proper checks, requires segregated player funds, imposes detailed technical standards on RNGs and game certification, and runs an independent player support function that will accept complaints and mediate. Those are real protections, and they distinguish MGA-licensed operators from Curaçao or Anjouan licensees in measurable ways. Inside the EU, an MGA-licensed casino is usually one of the better-supervised options on the market.
The complication for UK players is that after Brexit the MGA stopped functioning, in regulatory terms, as a passport into the UK market. An MGA licence does not authorise an operator to serve UK customers — that authorisation only comes from the UKGC, and the UKGC’s own enforcement posture has hardened sharply against unlicensed operators serving British players. Since the start of the 2024/25 financial year the Gambling Commission has issued more than 770 cease-and-desist notices to operators and advertisers, referred over 102,000 URLs to Google with 64,000 ultimately removed from search, and forced 264 sites off their domains entirely. That is roughly a tenfold increase in enforcement output compared with the year before.
So an MGA-licensed casino that accepts a UK signup is, technically, operating outside both the UKGC’s rules and the spirit of its own Maltese permit. In practice many MGA operators simply geo-block UK IPs. The ones that do not are accepting British custom on a basis that the home regulator quietly tolerates rather than actively endorses, and a UK player’s recourse to the MGA’s dispute mechanism in that situation is real but constrained — the regulator can mediate but cannot enforce against UKGC rules that the operator was never licensed to follow.
Gibraltar, Isle of Man and Kahnawake — the quieter regulators
There is a tier of licences that almost nobody asks me about, which is funny, because in regulatory quality they sit closer to the UKGC than anything else on this page. Gibraltar, the Isle of Man, and — at a different latitude entirely — Kahnawake. Each one matters for a slightly different reason, and each one is rare enough on non-GamStop sites that finding one in the footer should make you pay closer attention, not less.
Gibraltar is the most familiar of the three to British players because the territory’s licensing authority — the Gibraltar Regulatory Authority, with the Gambling Commissioner as its operating arm — has historically been a tier-one regulator with overlapping technical standards to the UKGC. Many of the household-name UK operators of the 2000s held Gibraltar permits alongside their UK ones. The Gibraltar regime is genuinely strict: capital adequacy requirements, segregated funds, mandatory technical audits, robust complaint handling. A non-GamStop operator volunteering for a Gibraltar licence is making a serious compliance investment. The catch is that, like the MGA, the licence does not authorise UK customer-facing activity — that is the UKGC’s remit — so Gibraltar-licensed offshore properties serving UK players are operating in the same grey zone the MGA crowd does.
The Isle of Man Gambling Supervision Commission is similar in tenor. It supervises a smaller pool of operators, requires meaningful AML controls, and historically has been a serious regulator on technical compliance. You will see an Isle of Man badge on a small number of offshore-facing crypto operators in particular, because the GSC was one of the earlier movers on distributed-ledger compliance frameworks. It is not, in 2026, a UK-facing licence in any official sense.
Kahnawake is the outlier. The Kahnawake Gaming Commission is a First Nations regulator based in Quebec, and its mandate sits inside the sovereignty framework of the Mohawk Council of Kahnawake. It is one of the oldest online gaming licensors in existence, predating most European regimes. The regulator’s standards are real — server hosting requirements, AML obligations, complaint procedures — and its dispute mechanism is comparatively responsive. You will encounter Kahnawake mostly on poker-heavy properties and a long-tail of crypto-facing offshore casinos. As with the others, it does not authorise UK consumer-facing operations, but a Kahnawake badge usually signals an operator that has at minimum been through a real licensing process.
How a licence actually shapes player protection
Here is the test I run on every licence I assess: imagine a player has just had a five-figure withdrawal frozen on suspicion of bonus abuse. Where does the dispute go, and how long does it take? The honest answer changes everything you think you know about a regulator.
Under the UKGC, the path is well-trodden: internal complaint, escalation to an approved ADR body — IBAS or eCOGRA — and ultimately the Commission itself can compel licensee behaviour through licence conditions. Under a Curaçao CGA direct licence in the new regime, there is now a formal complaint route to the authority, but resourcing means timelines run in weeks and months rather than days, and the CGA’s enforcement toolkit is narrower. Under Anjouan, the licence excludes UK consumers from the outset, so the dispute starts from a position where the regulator’s protection does not formally extend. Under MGA or Gibraltar, the player gains access to a serious regulator, but the operator’s authority to take that custom in the first place is questionable, which complicates remedies.
The pattern is that licence quality affects three things in roughly this order. First, fund segregation: how confident you can be that the operator’s day-to-day cash is not commingled with your balance. Second, fair-play certification: whether the games on offer have been tested by an independent lab. Third, dispute resolution: whether there is a human being at the regulator who will read your complaint. Curaçao under the new LOK has made progress on the first two and is still building the third. Anjouan does not consistently deliver on any of them for a UK player.
Andrew Rhodes, the UKGC chief executive, said something at IAGR 2025 that I keep coming back to: there is nothing more exploitative than the illegal market. The word “illegal” is doing a lot of lifting in that sentence — in the UK regulatory frame, any non-UKGC operator serving British customers is technically illegal — but the underlying observation is correct regardless of the licence in the footer. The further your operator sits from the regulatory regime that covers your market, the more of the dispute burden lands on you personally.
Verifying a licence yourself in five minutes
I once watched a player spend forty minutes arguing with a casino support agent about a missing licence number before I sent them the link to the regulator’s public register. The lookup took two minutes. The operator was not on the register. The argument ended.
The process to verify any of the licences on this page is roughly the same, and worth committing to memory because it costs you nothing and tells you almost everything.
Step one: find the licence claim in the footer. You are looking for a regulator name, a licence number — usually a string starting with letters indicating jurisdiction — and ideally a hyperlink. If the badge is an image with no number printed next to it and no link, that is already a red flag. Real licences are issued with reference numbers, and real operators display them.
Step two: open the regulator’s own website directly in a new tab. Type the regulator name into a search engine yourself — do not click any link from the casino footer. The link in the footer can point anywhere. For the new Curaçao regime, you want the Curaçao Gaming Authority’s portal. For MGA, the authority publishes a register of licensees. For Gibraltar, the Gambling Commissioner publishes its list. The Isle of Man and Kahnawake both maintain their own lookups.
Step three: search the register for the licence number or the operating company name. Both must match. If the licence number resolves but the operating company is different from what is listed in the casino’s terms and conditions, the badge is being used by an entity it was not issued to. If the licence number does not resolve at all, the licence is either expired, suspended, or fabricated.
Step four: cross-check the terms and conditions for the operating company name, the corporate registration jurisdiction, and the licence number all together. Mismatches between these three are common on offshore properties — the company in the T&Cs is often different from the brand on the homepage, which is normal, but it has to be the entity actually holding the licence.
Step five: if you are looking at a Curaçao site, check the date. Anything still showing an old NOOGH sub-licence number without a CGA direct-licence reference, after July 2025, is either non-compliant or in a transitional state that you cannot easily verify externally.
The four licences laid out beside each other
Strip away the marketing and lay them out next to each other, and the picture sharpens immediately. I do not think of licences in terms of “best to worst” — they serve different purposes — but I do think of them in terms of what they actually give a UK player on a non-GamStop site.
The Curaçao CGA direct licence in 2026 is the workhorse. It is the licence most non-GamStop sites will be operating under, the regulator has more teeth than it used to, and the public register makes verification straightforward. Compliance investment is moderate. Dispute timelines are slow but exist. It does not authorise UK custom in the regulatory sense the UKGC means it, but it is the most realistic supervisory framework you will find on a site that accepts British registrations.
The Anjouan licence is the riskiest because of the UK restriction baked into the licence itself. The operator is operating outside the terms of its own permit when it takes a British player. If the operation is run cleanly, day-to-day experience may be fine. If something goes wrong, the licence will not help.
The MGA licence is the highest-quality regulatory framework on the list, but a UK player accessing an MGA-licensed offshore property is doing so on a basis the Maltese regulator did not design the licence to support. Protections are real but constrained.
The Gibraltar licence is similar in tenor to MGA — serious regulator, not a UK-facing authority — and rare enough on non-GamStop sites that finding one is itself a signal of compliance posture.
Set against all of this is the UKGC’s own enforcement output, which in 2024/25 produced more than 770 cease-and-desist notices and over 100,000 URL referrals to Google — a tenfold escalation that frames the entire offshore landscape as one the home regulator is actively pushing back against.
Questions readers keep sending me
Three or four questions come up so consistently in my inbox that I will answer them here rather than wait for the next one.
One thread I want to flag before the FAQ itself: Ismail Vali of Yield Sec made a point in an iGamingBusiness interview last year that has stuck with me — if you set up a scheme like GamStop and you tell vulnerable customers they are safe, surely you should make them safe. The licensing question is downstream of that. A player who has chosen to play outside GamStop is also, by definition, outside the safety mechanism that brought them inside the regulated market in the first place. The licence in the footer becomes the only structural protection they have. Picking carefully is not paranoia. It is the rational response to that geometry.
Reading a licence stamp without being fooled by it
If there is one habit I would like a reader to take away from a piece like this, it is the two-minute verification I described earlier. Not because it will catch every problem operator — it will not — but because it changes the way you see a casino footer. A licence badge stops looking like an endorsement and starts looking like a claim that you can either confirm or fail to confirm.
Of the four licences I have walked through, Curaçao under the LOK is the one whose meaning has shifted most in the past eighteen months, and that shift is still propagating through the operator market. Anjouan is the licence whose UK exclusion is the most under-communicated. MGA and Gibraltar are higher-quality regulators whose protections do not extend cleanly to a UK player on a non-GamStop site. None of these licences offers what a UKGC permit offers, because none of them were designed to.
Reading the stamp without being fooled by it means treating it as one input among several — alongside the operator’s track record, the clarity of its terms and conditions, and the responsiveness of its support — rather than as a settled answer. The badge tells you which authority an operator has chosen to register with. It does not tell you what that authority will do for you if things go wrong.
What changed when Curaçao introduced the LOK in December 2024?
The LOK abolished the master-licensor structure that had defined Curaçao licensing since the 1990s and replaced it with direct supervision by the Curaçao Gaming Authority. The ordinance passed parliament on 17 December 2024 by 13 votes to 6 and entered into force on 24 December. Existing NOOGH sub-licences had until 24 June 2025 to migrate to a direct CGA licence. From 1 July 2025 onward, any operator still trading on an unmigrated sub-licence is operating without a valid permit.
Why does the Anjouan licence not cover UK players?
The Anjouan permit, as written by the issuing authority, explicitly excludes the United Kingdom alongside the United States, France, Germany, the Netherlands, Spain, Australia and Austria from the territories an operator may target. An Anjouan-licensed site accepting UK registrations is operating outside the terms of its own licence, which means the regulator has no obligation to treat a UK player as a covered customer if a dispute arises.
Is an MGA-licensed casino safer than a Curaçao-licensed one for UK players?
In regulatory terms the MGA is a more rigorous supervisor than Curaçao, even under the new LOK regime. However, neither licence authorises UK consumer-facing operations in the way a UKGC permit does. The practical safety advantage of MGA over Curaçao on a non-GamStop site is real for technical standards and fund segregation but narrower than the brand difference suggests for dispute resolution affecting UK players.
Can I check a non-GamStop casino’s licence number myself?
Yes, and it takes about two minutes per licence. Find the licence number in the casino footer, navigate to the regulator’s own public register by typing the regulator’s name into a search engine rather than clicking the footer link, and search for the number or the operating company name. The number must resolve and the company must match what appears in the casino’s terms and conditions. If either fails, the badge is doing brand work rather than regulatory work.
This material was created by the OFFSTAKE team.
Related posts
The Curaçao LOK Reform Explained: What 2024–2026 Changes Mean for UK Players
Bingo Sites Not on GamStop: Room Structures, Chat-Host Models and Offshore Bingo Economics
