VPN-friendly casinos in Australia: a regulatory and practical read

The phrase “VPN-friendly casino” reads, on the surface, like a privacy feature. It is, in practice, a marketing label for offshore sites that do not run the location checks an Australian-licensed wagering service is required to run — and that advertising choice is itself the point worth examining. This page looks at what the label covers in the Australian market: which bodies regulate, what is prohibited, how the ACMA’s blocking programme has accumulated, and what a player considering the route actually inherits in terms of protection, payment access and recourse. The comparison that follows is not a recommendation. Each of the eleven brands named below has been the subject of a formal warning from the Australian Communications and Media Authority; the table exists to make that visible side by side, not to choose among them.

Data current as of 28 October 2026, checked against the Australian Communications and Media Authority’s published blocking and warning registers.

Prohibition: how Australia treats online casino games

No state or territory in Australia licences online casino games, online pokies or in-play betting for a person physically present in Australia. The Interactive Gambling Act 2001, tightened by the Interactive Gambling Amendment Act 2017, makes the supply of those services to a person in Australia an offence, and the ACMA investigates, issues formal warnings and directs Australian internet service providers to block sites it has identified as offering prohibited services. What is licensable, and what the major Australian-facing bookmakers — Sportsbet, Bet365, Ladbrokes — operate under, is wagering on races and sport placed before the event, lotteries and keno; in practice those licences are administered by the Northern Territory Racing and Wagering Commission, which has no full-time staff and meets once a month in Darwin. The bookmakers are licensed in the Territory for tax reasons; the activity is wagering, not casino.

The legal target is the provider, not the individual player. A punter using an offshore casino is not at risk of prosecution under the Interactive Gambling Act, but the site they reach gives them none of the protections an Australian licence implies: no Australian complaints body, no recourse if a withdrawal is refused, no link to BetStop, and the balance a player holds can be locked up the day a blocking order lands. H2 Gambling Capital’s 2025 estimate puts Australian losses to illegal sites at roughly A$3.9 billion a year, and the share of gambling going through legal channels fell from 74% in 2021 to 64% over the same window — a market that has grown by stealth rather than by permission.

What “VPN-friendly” changes in practice

A VPN changes what an offshore site can see about where a player is connecting from. It does not change the legal status of the activity on the Australian side, and it does not give the offshore operator an Australian licence. The distinction is the substance of this page: technical reach is one thing, regulatory standing is another, and conflating them is the move the marketing copy makes.

A site that advertises as VPN-friendly is, in plain terms, one that does not run IP-based location checks that would refuse Australian traffic. That is not a privacy feature extended to the player — it is the absence of the check that the operator would otherwise have to put in place to stay on the right side of the Interactive Gambling Act. A site that genuinely does not know whether a player is in Australia cannot be prosecuted for knowingly serving one; a site that knows and serves anyway is the case the ACMA acts on. “Allows VPN use” and “doesn’t check” are, technically, the same posture, and the label tends to dress the second one up as the first.

What the ACMA’s blocking programme has accumulated

The blocking programme is the clearest signal of how the regulator treats the offshore segment. According to the ACMA as reported in June 2026, a total of 1,751 illegal gambling and affiliate marketing websites had been blocked since the first blocking request in November 2019, and more than 230 unlicensed gambling services had left the Australian market since enforcement was strengthened in 2017. In the round reported on 26 June 2026 alone, the ACMA asked Australian internet service providers to block twelve more sites: 7Signs, ChromaBet, Donbet, Duospin, Freshbet, Slots Gem, Jacks Club, Lucky Start, Pointsbetz, Spinrise, Vinyl Casino and Wildsino. The rate at which new sites are added to the register has not slowed; the size of the underlying list keeps growing.

The blocking arithmetic, framed as a band: across roughly six and a half years from the first blocking request in November 2019 to the 1,751-site total reported in June 2026, the ACMA has added sites at an average pace of roughly 250–270 per year, with the most recent round contributing twelve in a single action. The figure is a band rather than a single number because individual rounds vary in size, and what the band shows is a steady rather than tapering pipeline — fewer than ten per year would suggest the regime was working through the backlog, and the current pace suggests the opposite.

The ACMA also issues formal warnings separately from blocking actions. A warning is the regulator’s written notice that an operator has been offering a prohibited interactive gambling service to Australians; it names the operator and the brand, and it is the most concrete public record a brand carries of regulator contact. The eleven brands compared below are each named on that record, and the table below makes the warnings visible — date, operator and brand — so a reader can see the volume and the recency at a glance.

Player wellbeing around offshore casino access

The starting point for any Australian weighing offshore access is what the local framework actually offers, because it is the framework that any offshore route gives up. BetStop, the National Self-Exclusion Register, has been live since August 2023 and binds Australian-licensed online and phone wagering services; an offshore casino is not connected to it, and a self-exclusion set up with BetStop does not extend to a site accessed through a VPN. The National Gambling Helpline on 1800 858 858 is free, 24/7, with chat at Gambling Help Online. Both are reachable regardless of which site a player uses or has used.

The Australian banks layer in additional friction. Westpac’s gambling block works at card level: it refuses authorisation of transactions registered under the merchant category code for betting and casino gambling on eligible personal credit and debit cards. ANZ’s gambling transaction block, activated in the ANZ app, also blocks gambling transactions made through a digital wallet such as Apple Pay on an eligible card, and once a customer turns the block on, removing it again requires a 48-hour waiting period — though both banks warn that not every gambling transaction will be blocked and some non-gambling transactions might be blocked in error. Commonwealth Bank lets customers apply a gambling lock to eligible cards via the CommBank app, with the same caveat that the bank cannot guarantee every gambling-related purchase will be stopped. These blocks were introduced because the banks, like the regulator, treat the category as one that warrants a default-off posture rather than a default-on one.

What an offshore casino does not provide

The things an Australian licence implies — complaints handling, dispute resolution, the BetStop link, the credit-card ban, the bank’s gambling block cooperating with the site’s merchant code — are precisely what an offshore casino sits outside. A player using a VPN to reach a blocked site is, in regulatory terms, an end-customer of an unlicensed service, and the protections that follow from licensing simply do not attach. The arithmetic in the H2 Gambling Capital estimate — A$3.9 billion a year to illegal sites — is the same point seen from the other side: a market that size is the gap between what licensed wagering serves and what licensed wagering does not cover.

Payment routes that work, and ones that don’t

The payment side carries its own story. Under the Interactive Gambling Act as amended in 2023, Australian-licensed online wagering services cannot accept payment by credit card or other credit-related products, a restriction that also constrains gambling use of linked digital wallets like Apple Pay, given that the wallet’s funding source on an Australian card is, by default, a credit facility. Credit card and crypto are banned as payment for licensed online wagering since 11 June 2024, with penalties up to A$247,500 for operators that breach. The legal deposit routes for licensed wagering are debit card, bank transfer, PayID and Osko, and BPAY.

What the offshore casino asks for is a different question. Credit card, debit card and several cryptocurrencies are routinely accepted by the brands listed below; PayID, BPAY and Osko, which depend on Australian banks participating on the receiving end, are not. A PayID-based instant transfer to a participating Australian financial institution arrives in under a minute, 24/7, and shows the name of the account holder before the transfer is sent — Australian Payments Plus warns that being asked to transfer money to a PayID on an illegal gambling site almost certainly means a scam site, which is the regulator’s way of flagging that the payment infrastructure has been built to expose, not to facilitate, this category of transaction. Osko and BPAY sit on the same rails. The point is structural: Australian instant payments were designed to make the counterparty visible, and an offshore operator does not present a counterparty the system is willing to name.

Apple Pay, Google Pay and Samsung Pay collectively account for around 45% of all card payments in Australia by number at the end of 2025, which makes the wallet layer the one most Australian players actually touch. Apple does not charge fees to consumers for using Apple Pay, but transaction limits and PIN requirements are set by the card issuer or merchant, and the issuer-side gambling block is what governs whether the transaction is declined at the card level rather than at the wallet. Where a card has the gambling block active, the wallet transaction is declined with it; where it does not, the wallet transaction clears with it. The wallet is a presentation layer over the same card rails the bank is filtering on.

American Express sits slightly outside this picture. Unlike Visa or Mastercard’s four-party network, Amex traditionally issues cards and processes transactions itself as a three-party scheme, and the Reserve Bank of Australia’s July 2025 review proposes removing surcharges only on eftpos, Mastercard and Visa card transactions, explicitly leaving American Express outside the scope of the proposed surcharge ban. For the gambling block question, the difference is technical rather than substantive: the merchant category code that triggers the block is the same, and the block works or does not work for the same reason.

The eleven brands the ACMA has warned

Each brand below is one the ACMA has formally warned under the Interactive Gambling Act 2001. The list is not a ranking and not a recommendation; it is the public record the regulator has published, ordered chronologically by the most recent warning that names each brand. The “Subject support” column records what third-party listings carry about a payment method, a coin, a game, a provider or a licence for the brand in question — a confirmation that a listing exists, not an endorsement of it. Online casino games cannot be licensed anywhere in Australia, whatever licence the site displays.

The table does what a list of brands tends not to: it puts the regulator’s own naming beside the brand, so the reader can see whether the operator behind the site is the same one named in earlier rounds. Dama N.V. appears four times across this set — Level Up Casino (May 2022), Woo Casino (March 2025), Spirit Casino (May 2025) and RocketPlay in its earlier incarnation — which is the kind of recurrence that suggests the operator, not the brand, is the unit the ACMA is tracking. Bizzo Casino carries the same pattern in a different shape: a 2022 warning to TechSolutions and a 2025 warning to Consolutetish S.R.L. for what reads, on the public record, as the same service under successive operators. The practical takeaway is that brand turnover inside an operator group is high, and the operator identity is the more durable thread.

What the “Subject support” column actually shows

The column is a record of what third-party listings carry, not a record of what the brand offers. A reference in a Westpac or PayID page means that listing exists in that directory; it does not mean the brand holds an account there, that the brand has been verified by that listing’s owner, or that any transaction between an Australian customer and the brand will be honoured. The same applies to AUSTRAC, BetStop, gamblinginsider and ecoPayz references — each is a name on a page, not an endorsement. The brands whose row carries an em dash rather than a listing reference have no third-party listing the research was able to locate; the absence is not a finding about the brand, and it is not an endorsement either. What the column is for, on a page that is not going to recommend any brand, is to make the underlying information asymmetry visible: the listings a reader might trust in other contexts are not making a statement about these brands in this one.

How the warnings break down over time

The eleven warnings above sit across a four-year window. The earliest is the September 2022 warning to Hollycorn N.V. over Sky Crown. The 2022 round also covered Level Up Casino, RocketPlay (under Dama N.V.), Cobra Casinos, Wild Tornado, Dazard and Bambet, all under the same Dama N.V. umbrella. The 2025 round was the busiest: Woo Casino, Spirit Casino, Instant Casino, Casino Intense, National Casino, Bizzo Casino and Ignition Casino, each with its own operator. The 2026 round so far has added RocketPlay (under a fresh operator, Pulsup Ltd) and Jackbit. The volume per year is what makes the case that the ACMA’s enforcement is sustained rather than symbolic — a single warning would read as a one-off, and the pattern over 2022, 2025 and 2026 does not.

What the dates also show is the gap between offence and action. Some of the brands in the table have been the subject of regulator contact for years, in successive warnings to successive operators. A reader looking at a brand with a 2022 warning on its record is not looking at a brand that has been told once; they are looking at a brand whose public record of regulator contact has lengthened over time. The opposite pattern — a single, recent warning — is not necessarily better, because a recent warning is a more recent confirmed breach.

Reading the comparison without choosing

The “VPN-friendly” label is the marketing wrapper; the public record is the ACMA’s. Choosing between the brands is not the work this page is doing, because none of them sits inside the regime an Australian player has recourse to. The thing the table lets a reader do is compare the warnings — operator identity, recency, repetition — which is the comparison that holds up under Australian conditions, because it is the comparison the regulator has already made.

A reader who arrives at this page looking for a recommended operator will not find one, and the absence is the substance of the page. A reader who arrives looking for the regulatory shape of the offshore segment — what is prohibited, what is blocked, what is warned, what protection is missing, what payment route is structurally exposed — has the material to make a decision on those terms, which is the only kind of decision an Australian reader can make on the evidence the page carries.

Frequently asked questions

Why would a casino advertise itself as VPN-friendly in the first place?

Because the operator has chosen not to run the IP-based location check that would refuse Australian traffic. The label dresses that absence up as a feature, but the underlying posture is one the regulator treats as evidence the operator is not taking reasonable steps to avoid serving a prohibited market. An Australian-licensed wagering service must run those checks; an offshore casino that advertises VPN use is, by the advertising itself, advertising the absence of the check.

Does using a VPN change whether the activity is legal?

No. The Interactive Gambling Act 2001 prohibits the supply of online casino games, online pokies and in-play betting to a person in Australia, and it does so regardless of how the person reaches the site. A VPN changes what the offshore operator can see about the player’s location; it does not change the player’s location, and it does not give the offshore operator an Australian licence. The legal status of the activity for the player remains the same as it was before the VPN was turned on.

How does a VPN change what an offshore casino sees?

It substitutes the IP address and, in some configurations, the DNS footprint that the casino site reads for an endpoint in another country. From the site’s perspective the connection looks like it is coming from somewhere it is willing to serve; from the player’s perspective the connection still terminates in Australia. The site cannot, on the basis of the VPN alone, tell that the player is in Australia, but that is the operator’s problem rather than the player’s protection — the operator is relying on the absence of the check, not on a finding that the player is elsewhere.

What risk does a player take on by reaching a casino the ACMA has warned before?

The site sits on the ACMA’s blocking list, which means Australian internet service providers are under direction to make it harder to reach. A balance held on the site at the time of a blocking round can be locked up. There is no Australian complaints body to escalate to if a withdrawal is refused, no BetStop link to enforce a self-exclusion, and no Australian consumer-protection regime in the background. The site’s own terms apply, and they apply without the layer an Australian licence implies.

Is a casino that allows VPN use technically different from one that does not check?

No. The two postures are the same posture described two ways. A site that has explicitly turned off its location check is a site that does not check; a site that does not check is a site that does not know whether the player is in Australia. The “allows VPN” framing is a marketing choice about how to describe that posture; the technical content is identical, and the regulatory content — that the operator cannot be said to know — is the same in both cases.

What should someone consider before treating VPN access as a safe workaround?

That the legal prohibition sits with the supply, not the access, and that an Australian-licensed wagering service is the only route that carries Australian consumer protection, the BetStop link, the credit-card ban and the bank’s gambling block cooperating with the site’s merchant code. A VPN does not add any of those things; it removes the friction the operator would otherwise have to put in place to stay on the right side of the Interactive Gambling Act. The framework that an Australian player has recourse to is the framework the offshore route gives up.