GamStop and Mastercard in the UK: What the Register Does to Your Card's Reach

The tool that outlived the ban

GamStop was set up before the UK’s 2020 credit-card gambling ban and has quietly outlasted it as the most consistent piece of harm-reduction infrastructure British bettors actually use. A reader in Leeds told me recently that he had registered with GamStop three years ago during a rough stretch, let the registration lapse, and now finds the reflex to check the register before opening any new operator account is permanently embedded in his routine. That kind of durability is unusual for a voluntary tool, and it says something about how the framework has been designed.

For a UK Mastercard user, GamStop sits alongside the credit-card ban, the 2025 statutory levy, and bank-side gambling blocks as one of the layers of consumer protection around the cashier. Each layer does something specific. This piece walks through what GamStop actually is, how a registered Mastercard behaves when it hits a UKGC-licensed cashier, how GamStop compares with issuer-level gambling blocks, what the minimum and maximum registration periods look like, and where the register’s reach stops — including the offshore corridor that operators cannot police.

What GamStop actually is

GamStop is the UK’s national online self-exclusion service. It is operated by The National Online Self-Exclusion Scheme Limited, a non-profit body funded by the industry and formally required under UK Gambling Commission licence conditions. Every UKGC-licensed operator — every regulated UK online betting site, casino, bingo platform and lottery product — is required to participate. That universal participation is the foundation of the register’s effectiveness.

Registration takes a few minutes on the GamStop site. A user provides identifying details — name, date of birth, address, email, mobile number — and chooses a duration: six months, twelve months or five years. The registration takes effect within 24 hours and propagates to every licensed operator through a standard data connection that each operator is required to check before creating or unfreezing accounts and, in most flows, before processing deposits.

The scale is hard to publish precisely because the register does not publish granular active-member counts, but industry estimates put current active GamStop registrations in the hundreds of thousands. That is a meaningful share of the UK online gambling population, which numbered roughly 10.5 million in the pre-2020 estimates used when the credit-card ban was designed.

What GamStop does not do is as important as what it does. It does not touch the Mastercard network. It does not speak to your issuer. It does not block physical-retail gambling venues, which sit under different self-exclusion schemes. And it does not police offshore operators, which are structurally outside its reach.

How a Mastercard behaves when you are registered

Walk through what happens when a GamStop-registered bettor attempts to deposit at a UKGC-licensed operator. The cashier runs its standard KYC and identity checks as part of the deposit flow. One of those checks queries GamStop against the account holder’s verified identity. The query returns “person is registered”, and the deposit path terminates before the Mastercard authorisation is ever attempted.

The interesting part is the layered effect. A UK bettor using a credit Mastercard at a licensed operator is already blocked by the 2020 credit-card ban — the card type alone refuses the deposit. A registered bettor on GamStop using a debit Mastercard at the same operator is blocked by the GamStop match. Two different tools refusing at two different points in the flow, and either one independently is enough.

The research behind why the overlap matters runs deep. An independent evaluation following the UK credit-card ban found that roughly 24 percent of online card-using players met the problem-gambler criteria, compared with about 11 percent among users of alternative payment methods — a pattern that tells you why tools targeting card users specifically have such an outsized effect on harm reduction. GamStop complements the card-level restrictions by adding an identity-level layer that catches behaviour the card-type check alone cannot.

For a registered bettor, the practical effect is simple. No UKGC-licensed operator will accept any deposit from any payment instrument in that individual’s name for the duration of the registration. The Mastercard itself is not listed or flagged; it continues to work everywhere else in the retail economy. Only the licensed gambling cashier refuses it.

GamStop versus the bank-side gambling block

UK banks have been offering opt-in gambling blocks on their debit Mastercards for several years, and the framework now covers most major issuers. A gambling block toggle in the banking app instructs the issuer to decline any transaction flagged with a gambling MCC — specifically MCC 7995 and, for jurisdictions that use it, MCC 7801. The mechanism is identical at every major UK bank that offers the feature, though branding and cooling-off details vary.

GamStop and an issuer block do different jobs. GamStop sits at the operator’s cashier and refuses the deposit by identity. The issuer block sits at the bank’s authorisation engine and refuses the transaction by MCC. For a registered bettor who has also toggled an issuer block, both checks fire — the deposit would fail at the operator regardless of the card, and would fail at the bank regardless of the identity.

The overlap provides redundancy, which matters because each tool has a gap the other can cover. GamStop does not cover offshore operators; an issuer block typically does, because the block fires on MCC regardless of operator jurisdiction. An issuer block can be toggled off by the bettor in a moment of weakness (subject to a cooling-off period); GamStop cannot be reversed within its period. Used together they produce a more resilient safety net than either alone.

The cooling-off periods are where the engineering philosophy diverges. GamStop treats the registration as a commitment and enforces the full chosen duration without exception. Issuer blocks treat the toggle as a soft lever and typically require 24 to 48 hours from the moment of toggling off before a gambling transaction can succeed — enough friction to interrupt an impulse, not enough to replicate a full self-exclusion. Which framing is right depends entirely on the bettor’s situation. A detailed comparison of how UK banks approach this specific feature sits in this piece on opt-in Mastercard gambling blocks across Monzo, Starling, Barclays and beyond.

Minimum and maximum periods

GamStop offers three registration durations: six months, twelve months and five years. The choice is consequential and not easily reversible.

Six months is the minimum. Unlike some comparable frameworks in other jurisdictions, there is no three-month option — GamStop’s architects took the view that shorter periods provided insufficient behavioural disruption to be worth the administrative cost. The six-month floor is therefore a deliberate design decision, not an arbitrary number.

Twelve months is the middle option and the most common choice among registrants, based on publicly available framework commentary. It represents a substantial commitment but leaves the door open to return after a year of distance from the habit.

Five years is the maximum single registration and is the longest voluntary period available. A bettor who wants a longer exclusion can re-register at the end of the five-year period, and many do. The five-year option is frequently chosen by registrants who have tried shorter periods and concluded they need more distance.

No option is fully reversible within its chosen period. A six-month registration cannot be shortened to four months, and a five-year registration cannot be cut to three years. The registrant can extend, but not contract. This inflexibility is, again, the point. Self-exclusion works when it holds through the period of regret; it fails when it can be unwound mid-way.

What GamStop does not cover

The register’s reach stops at the UKGC-licensed perimeter, and understanding what sits outside that perimeter matters for anyone designing a personal safety net.

Offshore online operators without UK licences are outside GamStop’s reach. A registered bettor attempting to deposit at an unlicensed offshore site will not be blocked by the register. This is where the layered approach shows its value: the credit-card ban covers credit Mastercards at unlicensed sites indirectly (through issuer-side declines on gambling MCCs), and an issuer gambling block covers debit Mastercards at offshore sites (again by MCC), but GamStop itself does not.

Physical retail gambling — betting shops, casinos, bingo halls — is outside GamStop’s remit. Those premises operate under separate self-exclusion schemes administered by industry bodies, and a GamStop registration does not automatically enrol a person in the retail schemes. A complete self-exclusion from all UK gambling requires both GamStop registration and retail-scheme enrolment, and the two processes are deliberately separate.

Non-gambling gambling-adjacent products — such as some prediction markets, financial spread-betting platforms, and crypto-denominated speculation — sit outside GamStop’s scope regardless of whether they functionally resemble gambling. The regulatory framing of these products is unsettled, and the register does not extend to them.

Finally, the register does not cover family members. A registered individual’s partner or housemate can continue to use a shared household Mastercard at licensed operators — provided the cardholder is themselves the account holder and not on the register. GamStop is a personal commitment, not a household intervention.