Mostbet UK Control Room
Independent review — not the official Mostbet website — 18+

Find evidence

Evidence pipeline

How we verify Mostbet claims

Prepared by
Control Room Research Desk
Reviewed
30 August 2026
Research protocolCR/4550
Evidence model4 statesSource → check → publish

Every page on this site points here to justify how a claim was checked. This is that justification: the rules a finding has to satisfy before it is published, the controls that decide whether a negative result is real, and the places where these rules have already stopped us from publishing something we wanted to say.

The method in one sentence

Every visible finding names the claim, the primary source, the country the request was made from, the date it was checked, its evidence state and who checked it — and where none of that is available, we publish the absence rather than an estimate.

The six fields behind every figure

A number on this site is not allowed to appear on its own. It carries six things, and if any of them cannot be filled in, the figure does not go up.

Field What it fixes
Claim The exact sentence being tested, not a topic. “Mostbet holds a Great Britain operating licence” is testable; “Mostbet is safe” is not.
Primary source The register, contract or API that answers it — the document itself, not somebody’s summary of it.
Country of request Where the request physically came from. This operator answers differently by location, so a result without a country attached is not a result.
Checked date The day the source was read. Not the day the page was edited.
Evidence state Verified, reference, unknown or failed. Defined below.
Reviewer Who ran it. Currently the research desk; why that is not good enough yet is on the about page.

The four evidence states

Most sites in this niche have two states: published and not published. That collapses “we checked and confirmed it” into the same visual weight as “we read it somewhere”. Four states keep them apart.

  • Verified — a primary source and a dated reproduction support the same statement. The absence of a UKGC record is verified: we downloaded the register ourselves, twice, and the search is repeatable by anyone.
  • Reference — a value exists and is attributed, but the evidence behind it is incomplete. Everything quoted from the operator’s own terms sits here: we have the wording, we have the date, and we have no way to confirm the same wording is served to a different country.
  • Unknown — no reliable source or lawful test is available. Withdrawal timings that anyone has actually experienced are unknown to us, because we hold no account and one anecdote would not be a timing anyway.
  • Failed — the claim conflicts with a register, a term or a reproducible check. The Curaçao eGaming 8048/JAZ licence printed across older affiliate pages, and on the first design of this site, is a failed claim: it belongs to the regime Curaçao ran before 2024 and does not match the current registry entry.

“Unknown” is the state that costs something. It is the reason our games page publishes no catalogue count and our app page publishes no download link, on a query where every competing result promises both.

Source hierarchy

When two sources disagree, the higher one wins and the disagreement itself gets published.

  1. Regulator and legal-entity registers. The UK Gambling Commission’s public register, the Curaçao Gaming Authority’s licence registry, company registries.
  2. The operator’s current terms, policies and authenticated product pages. Binding on the operator, so a clause here outweighs any marketing sentence elsewhere on the same site.
  3. Official app-store or provider records. Apple’s public search API, provider licence lists.
  4. Dated direct observation, where it is lawful. An HTTP status code, a response body, a redirect chain.
  5. Clearly labelled secondary reporting. Used to point at a primary source, never quoted as the finding.

The same three files, counted rather than searched for one name, produce a picture of the register as a whole — which brands run on somebody else’s licence, and which have a record that is no longer live. It is the same method at a different scale.

That order produced the sharpest thing on this site. The register says the Curaçao licence is under assessment; the operator’s own footer says it is “licensed and regulated”. Rank 1 beats rank 2, so we publish the register’s wording — and because the conflict is itself informative, we publish the operator’s wording beside it rather than quietly dropping it. The full comparison is on licence and safety.

Download the register, do not search the website

A site search returns whatever the search box decides to match today and cannot be repeated by a reader. The Commission publishes its register as three CSV files, so that is what we use: businesses, trading names and domains, downloaded whole, searched locally, with the file’s own Last-Modified header recorded. On 29 August 2026 that was 2,653 business accounts, 2,436 trading names and 2,243 domains. Anyone can download the same three files and get the same answer.

One thing those files do not tell you, and we said it wrongly for a fortnight. The businesses file carries two columns — account number and account name — with no status and no dates. An account remains in it after the licence behind it has gone: TGP Europe surrendered all four of its licences on 15 May 2025 and still appears in the file we downloaded on 29 August 2026. So that count is a count of accounts, not of businesses currently licensed, and we now describe it that way. It also means a register that says nothing is not the same as a fact nobody knows — the Commission publishes enforcement decisions and per-account licence status separately, and a check that reads only the download will miss both.

Every negative result needs a control

“We searched and found nothing” has two explanations, and only one of them is about the operator. The other is that the search was broken. So a nil result is not published until the same method finds something it should find.

The control here is bet365, an operator that certainly holds a Great Britain licence. Searching the businesses file for bet365 returns zero — which is exactly the trap. The licences are held by Hillside (UK Gaming) ENC and Hillside (UK Sports) ENC, so the brand appears three times in trading names and twice in domains instead. A checker that searched only the businesses file would have reported that bet365 is unlicensed in Britain.

That is why all three files are searched, and why the nil result for mostbet, bizbon and mostbet.com across all three means what it says: not filed under a parent company, not filed under a trading name, absent.

When the control fails, the method failed — not the subject

On 16 August, Apple’s public search API against the GB storefront returned four results for mostbet, none of them the operator, while the bet365 control returned the real app from Hillside Technology Limited. On 17 August we tried to repeat it and Apple answered 403 with an empty body — to the Mostbet query and to the control.

The tempting move is to record “still no app, 17 August”. It would even be true. But the check did not run, so we left the 16 August result standing with its own date attached rather than restating it as current. A date on this site means a source was read that day.

Geography is part of the measurement

Our checking connection exits in Latvia. The server hosting this site is in the United States. Neither is in Great Britain, and this operator’s front door depends on which of them knocks.

Date From Latvia From the United States
16–17 August 2026 451 Unavailable For Legal Reasons not tested
21 August 2026 200 — full site, 190 KB 204 — empty body
23 August 2026 451 again, every path tried

Two vantage points, two answers, in the same minute. This supports exactly one statement: the operator decides what to serve by location. It supports nothing at all about what a visitor in Britain would see, because we have no British vantage point — so that line stays empty. Everything we quote from the operator’s pages therefore carries the country it was served to, and none of it may be read as universal.

An earlier version of this site described these checks as coming “from a UK-facing connection”. That was wrong, it was ours, and it is logged as a correction rather than edited away.

Read the body, not just the status code

mostbet.co.uk is not the operator’s domain — it is parked for sale. On 16 August it said so with a 307 redirect to GoDaddy. By 17 August it returned HTTP 200 with a 114-byte body containing one line of JavaScript that forwards to the same sale lander. Nothing changed except the mechanism, but an automated checker reading status codes alone would have flipped that domain from “parked” to “live”. We record response bodies and redirect chains for this reason.

Reproducibility, in practice

A method is only worth publishing if a stranger can run it. Three habits carry most of that weight.

  • Cite the file, not the page. The Curaçao Authority renders its download links with JavaScript, so a plain fetch of the register page returns nothing usable. Each edition is cited by its dated CDN filename and its Last-Modified header instead — and the filename pattern is not stable between editions, so probing one variant silently misses newer ones.
  • Record what moves and what does not. Bizbon N.V. has been entry 336, 337, 338, 337 and 338 across five editions since May. Entry numbers move as licences are added and removed above them; the licence number, holder, dates and status have not changed once. Reporting the entry number alone would look like change where there is none.
  • Prove the source is maintained before reading a still entry as neglect. Between the 14 and 20 August editions, two licences moved into Revoked. The registry is being worked on. A row that does not move in a register that does is a state, not an oversight.

Rankings and figures

A ranking names one primary metric, its population, its time window, its source and its update date. Popularity, quality, RTP, bonus compatibility and editorial opinion are five different measurements and are never averaged into one score. No data means no ranking — which is why this site publishes no operator score, no star rating and no AggregateRating markup. Inventing that markup is the fastest way to a manual action in this niche and the most common thing done here.

Payment figures are stored in two separate columns: what the operator claims, and what we have observed. The second column is currently empty, and the first is quoted with its clause. A processing time is only a processing time when it names the method, the currency, the KYC stage, the sample size and the date range. One withdrawal is never called an average — and the operator’s own terms call its timings “indicative” and start the clock when the company accepts a request rather than when the customer submits one, which is precisely the kind of detail a single anecdote would erase. The detail is on payments and withdrawals.

What this method refuses to do

  • No APK. The only Android route is the operator’s own site, and hosting or mirroring the file would make us the distributor of software we cannot verify.
  • No invented bonus code. Codes are the highest-traffic query in the bonus cluster and the easiest thing in the world to make up.
  • No catalogue count. We have not counted the games, and the pages that would let us were gated when we looked.
  • No recommendation. Our review ends without one, because the evidence we hold does not support one in either direction.
  • No fake review markup. No Review or AggregateRating structured data appears anywhere on this site.

Update cadence

Licence and legal-entity identity are rechecked after any material change and at least quarterly. Terms and payment records are reviewed monthly whenever lawful access exists — a gate that has closed on us twice already, and when it is shut the last capture stands with its own date. Product and popularity figures display their own snapshot date rather than the page’s.

Every page shows the date its evidence was last reviewed, and that date is also what the structured data reports. Those were once two separate strings and they drifted three days apart, which meant a reader saw one date and Google was told another. They now read from a single source, because a rule that depends on somebody remembering to update two places is not a rule.

Corrections

A material correction records the previous claim, the revised wording, the date and the reason. It is published, not edited away — the point of a dated record is that it can be checked against what it used to say. Routine style edits are not presented as evidence updates. One correction has been published so far, and it was ours: the site described its access checks as coming from a UK-facing connection when they came from Latvia. It is on the log with its date, above the finding it corrects, rather than removed. How to send us the next one is on the corrections page, and the standards these rules serve are set out in our editorial policy.

Common questions

How do you know Mostbet is not licensed in the UK?

Because we downloaded the Gambling Commission’s own register rather than searching its website: three CSV files covering 2,653 business accounts, 2,436 trading names and 2,243 domains on 29 August 2026. Mostbet, Bizbon N.V. and mostbet.com return zero matches in all three. The same search finds a known licensee under its parent company’s name, so the nil result is a real one and not a broken query.

Why do you publish “unknown” instead of an estimate?

Because an estimate on a page about whether someone will get their money back is indistinguishable, to a reader, from a measurement. We hold no Mostbet account and the operator’s site has refused our requests on more days than it has answered them, so the honest state for a withdrawal time is that we have not observed one. Everything we have not measured is listed as unmeasured rather than filled in.

Who actually checks this?

The Control Room research desk, which is currently not a named individual — and on a gambling site that is a real weakness rather than a style choice. We are engaging an external reviewer whose identity can be verified by a stranger, and until that name exists we say so plainly instead of inventing a byline. The current state is set out on the about page.

How often are the checks repeated?

Licence and entity checks at least quarterly and after any material change; terms and payment records monthly when the operator’s site is reachable from where we check. Where a recheck was attempted and failed, the earlier result stays on the page with its original date rather than being restated as current.

Can I reproduce your checks myself?

That is the design goal. The UKGC register is a public download, the Curaçao registry is a dated PDF cited by its exact filename, the App Store check is a public API call, and the access observations are single HTTP requests. Where a source needs a trick to reach — the Curaçao download links only render with JavaScript, and the filename pattern changes between editions — the trick is written down here rather than left as tacit knowledge.

Primary sources