A £4.75 million UK Gambling Commission settlement in July offered the regulated gambling industry a useful warning about where responsibility can end up.

The case in question involved Evolution Malta Holding, whose games were found on six unlicensed websites accessible to consumers in Great Britain. The Commission concluded that weaknesses in the company’s risk assessment and controls had failed to prevent its products from appearing in parts of the illegal market. Its enforcement director specifically pointed to the need for operators to understand where their products are actually accessed.

That phrase becomes considerably harder to satisfy when VPNs enter the equation. Technology designed to conceal a user’s location is increasingly intersecting with a regulatory system built around knowing customers, markets and distribution routes.

For licensed UK operators, the resulting blind spot deserves much attention.

A VPN Problem That Does Not Stay With the Player

VPN gambling is often framed as a consumer issue. Players mask their IP address, reach an offshore site unavailable in Britain, and accept the risks that come with using an unlicensed operator. On the surface, the licensed sector appears to sit outside that transaction.

Licensed businesses don’t get that clean a separation.

In a 2025 freedom of information response, the Gambling Commission noted that operators need to know where their customers are located to ensure they act legally and in compliance. It has warned software providers to monitor business relationships so their games do not become available to British consumers through illegal operators.

VPNs can therefore create a gap between the location recorded by a system and the place where gambling actually occurs. The Evolution case didn’t hinge on VPN use itself, but it showed how quickly weak supply-chain visibility can become a compliance-by-gambling issue.

The Illegal Market Is Harder to Measure Than It Looks

Gambling Commission research published in 2025 found that 26% of surveyed consumers who admitted using unlicensed gambling sites used a VPN either all the time or specifically when visiting gambling websites. Because that activity can be obscured in conventional location-based traffic data, the regulator increased its estimates of illegal-market traffic by between 24% and 51%.

By April 2026, those assumptions were under review again. VPN use had jumped around the implementation of Online Safety Act measures in July 2025, and the Commission cautioned that web traffic is more useful for reading trends than pinning down the absolute size of the illegal market.

This sort of uncertainty has a business cost. If hidden traffic makes the black market look smaller than it is, estimates of customer leakage and competitive pressure can start from the wrong baseline.

Regulated Offers and Offshore Alternatives Can Sit One Search Apart

That regulatory divide can sit inside the same search session. For example, a customer comparing the best bingo bonuses on licensed sites remains in a market where UK rules govern promotions, identity checks and complaints processes. A few searches later, an offshore operator may be advertising a larger headline offer specifically because it sits outside GAMSTOP.

Search engines are an established route into the illegal market. The Commission’s consumer research records self-excluded gamblers describing searches for sites not registered with GAMSTOP, while enforcement teams have increasingly targeted search listings and the infrastructure supporting illegal websites.

Geo-blocking is where we’ve witnessed some of the stronger results.

Commission data covering 53 domains associated with GEO IP blocking showed an average 60% drop in engagement following the disruption. The regulator added an important caveat: the block remains effective only if consumers aren’t getting around it with a VPN.

Supply-Chain Monitoring Is Moving Closer to the Centre

Software suppliers have already seen how this can move from theory to enforcement. In April 2025, the Commission warned that games developed by licensed businesses had appeared on unlicensed websites accessible to British consumers. It told operators to actively monitor commercial relationships and terminate them when illegal GB activity is identified.

The July 2026 Evolution settlement gave that warning teeth. John Pierce, the Commission’s Director of Enforcement, said in the 23 July enforcement notice that operators need to understand “who they are supplying their games to, how and where those games are being accessed in practice”. Risk assessments that look credible in a board pack still have to survive contact with the live internet.

In practice, that pushes attention beyond contracts and onboarding files. Reseller arrangements may need testing after the relationship begins, especially where traffic patterns or market intelligence suggest a product has travelled to a destination it should not. The Commission is doing much the same on the regulatory side, using test purchasing, search engine referrals and financial intelligence to disrupt illegal gambling sites.

The Blind Spot Will Not Disappear

VPNs are legitimate privacy tools, and their use does not automatically indicate wrongdoing. A licensed operator also cannot control every attempt by a consumer to disguise a location or visit an offshore website.

Even so, the direction of travel is becoming clearer. Regulators are treating visibility as something businesses need to establish and test, rather than assume from a contract or an IP address. That is a tougher standard in an illegal market that can imitate the games and user journeys of regulated brands surprisingly well.

No, a compliance team doesn’t need perfect sight of every internet session. However, it does require sufficient evidence that, when an IP address ceases to be trustworthy, the remaining controls remain trustworthy.