Independent Casinos Not on GamStop: How They Work and What to Check

Independent casinos not on GamStop are gambling sites licensed outside the UK Gambling Commission, most commonly in Curaçao, Anjouan or Kahnawake, that do not participate in the UK self-exclusion scheme. They accept British players, take deposits in pounds, and run their own verification and responsible gambling tooling instead of the national registry.

That distinction matters more than most comparison pages admit. A site operating outside GamStop still has to build session timers, reality checks and cooling-off mechanics from scratch, because it cannot lean on the UKGC's central infrastructure. What you get is a patchwork of in-house tools whose quality varies wildly between operators.

This guide breaks down how those tools actually function, which independent brands are worth a second look in 2026, and where the technical seams show. Expect real numbers, licence details, and an honest read on what happens when the national self-exclusion register is off the table.

What "Not on GamStop" Actually Means in Practice

Which licences do these casinos hold?

The bulk of independent casinos serving UK players run on a Curaçao eGaming licence, issued under the Curaçao Gaming Control Board since the 2023 regulatory overhaul. A smaller cohort holds an Anjouan licence (Comoros) or a Kahnawake Gaming Commission permit, and a handful operate under Malta's MGA despite declining UKGC registration.

Curaçao remains the default because the application cycle runs roughly 8 to 12 weeks and the annual fee lands around $12,000 to $20,000, compared with a UKGC remote licence that costs £37,000 plus a percentage of gross gambling yield above £500,000. The trade-off is enforcement: Curaçao's dispute resolution process averages several weeks, while the UKGC can fine operators up to 5% of turnover.

Why would a British player choose one?

Three reasons come up consistently in player forums: higher deposit limits, fewer identity checks at signup, and access to game libraries that UKGC-licensed casinos sometimes delay. An independent site may let you deposit £2,000 in a single transaction without a source-of-funds request, whereas a UKGC brand will trigger enhanced due diligence around that threshold.

There is also the bonus structure. Independent casinos routinely advertise welcome offers in the 200% to 400% range with wagering requirements between 20x and 35x, while UKGC-licensed brands have been tightening offers since the 2020 affordability checks guidance. Free spins packages of 200 to 500 rounds are common on sites like NineWin and Fat Pirate.

None of this makes an offshore licence equivalent to a UKGC one. It makes it different. Read the difference before you read the marketing.

How does GamStop differ from casino-level self-exclusion?

GamStop is a central register covering every UKGC-licensed operator, activated once and applied across roughly 90 participating sites with a single request. Casino-level self-exclusion lives inside one account, at one brand, and dies the moment you register elsewhere. Independent casinos, by definition, sit outside the first system entirely.

That gap is the technical heart of this market. When the national registry does not reach a site, the operator's own timer, reality check and cool-off code becomes your only automated defence. Some of that code is well built. Some of it is a checkbox.

How Responsible Gambling Tools Work Under the Hood

What does a session timer actually count?

A session timer is a client-side counter started when an authenticated user opens the cashier or a game client, usually reset on logout and paused when the tab loses focus for more than a set window. Most independent casinos implement it in JavaScript on the front end with a server-side heartbeat every 30 to 60 seconds to prevent clock tampering.

The timer's job is not to block play. It is to surface a modal at a threshold. On brands like PlayOJO and Duelz, the first prompt appears at 60 minutes, the second at 120, and a hard lock at 180 unless the player explicitly extends. On thinner implementations you get one pop-up and nothing else.

What matters technically is where the counter lives. If it runs only in the browser, opening a second tab or switching devices restarts your clock. Server-side counters, the ones tied to your account ID rather than your browser session, cannot be dodged that way. Both exist in the market. Only one is honest.

How do reality checks differ from session timers?

Reality checks are informational overlays that show net position over a defined window: how much you staked, how much you won, and what your balance has done since the last prompt. They do not stop play. They report. The default cadence under UKGC rules is every 60 minutes, and independent operators typically offer a choice of 30, 60 or 120 minutes in account settings.

Good implementations pull from the transaction ledger, not from a rolling client cache, so the figures reconcile against your deposit history. Brands such as MrQ and Videoslots publish a running session summary accessible from the account menu at any time, which is the more useful pattern because it removes the need to wait for a prompt.

Weak implementations show only the current balance. That tells you nothing about the last two hours, which is precisely the information a reality check exists to deliver.

What happens during a cooling-off period?

Cooling-off, sometimes called a time-out, is a self-initiated lock lasting 24 hours, 48 hours, 7 days or 30 days on most independent platforms. During the window the account cannot deposit, and game clients refuse the session token. Withdrawals of existing balances usually remain open, which is the correct behaviour and one worth verifying before you trigger it.

The mechanism is straightforward: a flag on the account record with an expiry timestamp, checked at login and at cashier entry. Once set, the flag cannot be cleared early. If a site lets you cancel a 7-day cool-off from the settings page, treat that as a red flag, because the tool is decorative.

Independent casinos without GamStop access are under no UKGC obligation to offer cool-off at all, yet most of the reputable ones do, because it costs almost nothing to implement and players ask for it. Check the terms page before depositing rather than after.

Can deposit limits be enforced without GamStop?

Yes. Deposit limits are stored as a ceiling on the account and enforced at the payment gateway before the transaction is authorised, so a request above the cap is declined rather than flagged. Independent casinos set these as daily, weekly or monthly ceilings, and the standard rule is that lowering a limit takes effect immediately while raising one carries a 24-hour to 7-day delay.

That delay window is the tell. A site that lets you lift a £500 weekly cap to £5,000 instantly has built the control to satisfy a checkbox, not to protect anyone. Reputable independents, including Casumo and All British Casino, enforce a cooling period on upward changes and log the request in your account history.

Loss limits work the same way but track net negative movement rather than gross deposits. Win limits, rarer, cap the amount you can withdraw in a rolling period. Both are worth setting on day one, before the first deposit clears.

Where does the self-exclusion request actually go?

Inside an independent casino, self-exclusion is a database row: account status set to "excluded", an expiry date, and a block on new account creation linked to your email, phone and payment fingerprint. The site's affiliate and marketing systems are supposed to suppress you from all future campaigns, which most do within 24 to 72 hours.

The weakness is cross-operator reach. Without GamStop, excluding yourself at one brand does nothing at the next. Some independent groups operate shared exclusion databases across sister sites, which helps if you registered at a site under the same licence holder, but there is no industry-wide equivalent in the offshore space.

Players who need a genuine blanket block should pair casino-level exclusion with independent tools: GamBan, BetBlocker or NetNanny, all of which work at device level and are unaffected by which licence a site holds. BetBlocker is free and blocks over 20,000 gambling domains.

Top Independent Casinos Not on GamStop in 2026

Which operators combine a solid licence with working tools?

NineWin runs on a Curaçao licence, accepts GBP deposits from £10, and carries a welcome package of 100% up to £450 plus 250 free spins with 35x wagering. Session timer defaults to 60 minutes, cool-off runs 24 hours or 7 days, and withdrawals via Skrill clear in under 12 hours based on published processing times.

Fat Pirate takes the same licence route with a slightly wider game lobby, over 6,000 titles from Pragmatic Play, Hacksaw and Evolution, and a maximum single deposit of £5,000 for verified accounts. Its reality check fires hourly by default and cannot be disabled, only shortened to 30 minutes.

Donbet positions itself as a sports-first independent with a casino tab, holding a Curaçao permit and offering 120% up to £600 on first deposit. Its responsible gambling suite is thinner, with a 7-day cool-off and no session timer, which is worth knowing before you deposit.

How do the larger offshore brands compare?

MyStake and Goldenbet are the two names that appear in almost every discussion of this market, both Curaçao-licensed, both with lobbies north of 5,000 games and both offering deposit limits set at account creation. MyStake advertises 150% up to £750 with 30x wagering; Goldenbet runs 100% up to £500 plus 200 spins.

Rolletto sits alongside them with a slightly higher stated maximum withdrawal of £15,000 per month for standard accounts, rising to £50,000 for verified VIP tiers. Velobet and NineWin sit in the same tier, all three using the same payment rails: Visa, Mastercard, bank transfer, and a crypto option covering Bitcoin, Ethereum and USDT.

None of these hold a UKGC licence. All of them accept GBP. The practical difference for a British player is which dispute route exists when something goes wrong, and at this tier it is the licence holder's internal complaints team, not IBAS.

What about newer entrants like Mega Riches and Ivy Casino?

Mega Riches launched in 2024 under a Curaçao licence with a lobby of roughly 3,500 titles and a first-deposit match of 100% up to £200 plus 50 spins. Ivy Casino followed a similar pattern, adding a live dealer section powered by Evolution and Pragmatic Live with 40-plus blackjack and roulette tables.

Both newer sites ship with the modern responsible gambling stack as standard: configurable session timers, hourly reality checks and a 30-day maximum cool-off. That is a generation ahead of older independents where these controls were bolted on later.

The trade-off is track record. A site operating for 18 months has no payout history to compare against a brand that has been paying British players since 2016. Start with a small deposit and test the withdrawal before committing meaningful money.

Which brands pair independent status with a UK-facing sportsbook?

Hollywoodbets, talkSPORT BET's offshore sister brands, and a handful of others run sports and casino under one wallet. Goldenbet, Rolletto and Donbet all carry full pre-match and in-play coverage with cash-out on football markets, which appeals to players who want one balance across both verticals.

BoyleSports and BetGoodwin sit in an awkward middle ground, holding both a UKGC licence for their UK-facing book and an offshore permit for the casino arm in some jurisdictions. Always check which entity is named in the terms footer before you assume which rules apply.

Cross-vertical wallets make responsible gambling settings more important, not less. A deposit limit that covers casino only, while sports betting sits outside it, is a limit with a hole in it.

Compliance Questions Worth Asking Before You Deposit

Does an independent casino have to offer self-exclusion?

Not under UK law, no. A Curaçao-licensed operator has no statutory duty to run a self-exclusion programme, and the Curaçao Gaming Control Board does not mandate one. In practice, most reputable independents offer account-level exclusion anyway, because players ask for it and the implementation cost is a single database flag.

The gap matters. If a site offers no self-exclusion route at all, you have no supported way to close your account permanently, only a request to support that may or may not be honoured. Check the responsible gambling page before signing up, not after a bad month.

How is identity verified without UKGC checks?

Independent casinos typically verify at first withdrawal rather than first deposit: passport or driving licence, proof of address dated within three months, and occasionally a card photograph showing the last four digits. The process runs through an automated KYC provider and clears in 10 minutes to 48 hours depending on queue.

UKGC-licensed casinos front-load the same checks, sometimes requesting payslips or bank statements before allowing a first deposit above £500. Offshore operators defer, which feels lighter at signup and heavier at cashout if your documents are slow to arrive.

Either way, the documents are the same. Prepare them once and keep a folder, because you will need them at every site you join.

What happens if a site refuses to pay?

Your recourse runs through the licence holder. For Curaçao-licensed casinos that means filing a complaint with the operator first, then escalating to the licence holder named in the site footer, and finally to the Curaçao Gaming Control Board if the operator does not respond within the stated window, commonly 14 days.

There is no IBAS equivalent and no UKGC enforcement power over an offshore entity. That is the practical cost of choosing an independent casino, and it is why withdrawal limits, pending periods and bonus terms deserve a careful read before you fund an account.

Payment records matter here. Screenshots of your deposit confirmations, chat transcripts with support and a copy of the bonus terms as they appeared at signup are the evidence that wins these disputes. Keep them.

Can a casino block you permanently without notice?

Yes, and most terms reserve that right for suspected multi-accounting, bonus abuse or use of a VPN. A permanent closure usually follows a documented investigation, though the standard of proof varies. Some sites close accounts on a single matched IP address without further inquiry.

What happens to your balance depends on the terms. Reputable operators return deposited funds net of winnings from the disputed activity; less careful ones hold the balance pending review with no stated timeline. Read the closure clause before you deposit, particularly the section on dormancy fees, which typically start after 6 to 12 months of inactivity.

Are deposits protected if the casino goes under?

No, not in the way a UKGC licensee's segregated customer funds are protected. Offshore casinos are not required to ring-fence player balances in a separate trust account, which means a sudden insolvency can leave depositors in line with general creditors.

Some Curaçao operators do segregate funds voluntarily and state it in their terms. Look for wording about "separate customer accounts" or "trust arrangements" in the banking section. Absence of that language is not proof of commingling, but it is a reason to keep your balance low.

The practical rule holds across every jurisdiction: only carry what you are prepared to lose, and withdraw winnings on a schedule rather than letting them accumulate.

Do these casinos report winnings to HMRC?

Gambling winnings are not taxable for UK players under current rules, whether the operator is UKGC-licensed or offshore, provided you are betting as a punter rather than operating as a business. The operator has no reporting obligation to HMRC on your behalf.

That changes if your activity crosses into professional gambling, where profits become taxable income. For recreational play at an independent casino, the position is unchanged and has been since the Gambling Act 2005 removed betting duty from the punter side.

Crypto withdrawals add a wrinkle: disposal of cryptocurrency can itself be a taxable event independent of the gambling result. Worth a conversation with an accountant if you cash out in Bitcoin regularly.

Payments, Bonuses and Withdrawal Mechanics

Which payment methods do independent casinos accept?

The core set is Visa, Mastercard, bank transfer via an e-wallet intermediary, and cryptocurrency. Skrill and Neteller appear on roughly two-thirds of independent sites, with PayPal rare because PayPal's own merchant terms favour UKGC-licensed operators. Crypto coverage usually includes BTC, ETH, USDT and sometimes LTC or Solana.

Deposit minimums sit at £10 for most brands, dropping to £5 at a few and rising to £20 at Fat Pirate and similar premium-positioned sites. Maximum single deposits range from £2,000 on card to £10,000 or more on crypto, with the higher ceilings tied to completed KYC.

Withdrawal speed is where the market splits. E-wallet cashouts clear in 0 to 12 hours on the better operators, card withdrawals take 1 to 3 business days, and bank transfers run 3 to 5 days. Crypto sits at the fast end, often under an hour once the transaction is signed.

How do welcome bonuses differ from UKGC offers?

Independent casinos lean on percentage matches. A typical first-deposit offer is 100% to 200% up to £500, sometimes 400% on smaller deposits, with wagering between 20x and 40x the bonus amount. Free spin allocations of 100 to 500 rounds are standard, usually tied to a specific slot from Pragmatic Play or Hacksaw.

UKGC-licensed brands have moved the other way since 2020, capping bonus values and requiring clearer terms. A £50 matched deposit with 35x wagering is now a typical UK offer; the same money at an independent casino might carry a 200% multiplier instead.

Read the game weighting. Slots usually contribute 100% toward wagering, live casino 10% to 20%, and table games sometimes 0%. A bonus that looks generous on the headline can be effectively unusable if your preferred games contribute at 5%.

What is a reasonable withdrawal limit?

Standard-tier accounts at independent casinos carry monthly withdrawal caps between £5,000 and £15,000, with VIP tiers doubling or tripling that. Rolletto states £15,000 monthly for regular accounts; MyStake and Goldenbet publish comparable figures. Daily caps of £2,000 to £5,000 appear on some sites.

Progressive jackpot wins are usually carved out of the cap, paid in instalments over 30 days or in a lump sum depending on the provider's agreement with the casino. Check the terms for the specific slot provider, since NetEnt and Microgaming handle jackpot payouts differently from smaller studios.

A limit under £5,000 per month is low for this market and worth weighing against how quickly you actually withdraw. If you cash out weekly, the cap rarely binds. If you hit a large win, it binds immediately.

Why do withdrawals sit in "pending"?

The pending period is a manual review window during which the operator checks bonus compliance, account verification status and unusual activity patterns. Independent casinos run anywhere from 0 hours to 72 hours; the best advertise instant processing, meaning automated checks clear the request within minutes.

Longer pending periods correlate with larger operators handling higher fraud risk, but a 72-hour hold on a £100 withdrawal is a cash-flow decision, not a security one. Look for sites that state their pending window in the banking terms rather than leaving it to support to explain.

During pending, the withdrawal can usually be cancelled from the cashier. That is deliberate. It is also the window in which chasing losses does the most damage, which is a useful moment to have a cool-off already configured.

Game Libraries and Software Providers

Which studios supply independent casinos?

The standard lobby runs Pragmatic Play, NetEnt, Microgaming, Play'n GO, Hacksaw Gaming, Nolimit City, Push Gaming and Red Tiger, with Evolution and Pragmatic Live handling the live dealer floor. That stack covers 4,000 to 7,000 titles at most independent operators, which is comparable to what a UKGC-licensed casino carries.

Smaller studios appear more often offshore. Providers like Spribe (Aviator), Turbo Games and various crash-game developers sit outside most UKGC catalogues because the format has not cleared UK regulatory review. That is a genuine reason some players choose independent sites.

Game availability still depends on your jurisdiction settings. A VPN might unlock a provider's full library, but it also voids most terms of service, and operators increasingly detect and flag VPN use at withdrawal.

Do independent casinos offer live dealer tables?

Yes, through Evolution, Pragmatic Live, Ezugi and occasionally Playtech's live studios. Expect 30 to 80 live blackjack tables, 15 to 30 roulette variants, and the full game-show lineup including Crazy Time, Sweet Bonanza CandyLand and Monopoly Live.

Table limits run from £0.10 at auto-roulette up to £5,000 or £10,000 per hand at VIP blackjack. That upper range is wider than most UKGC casinos allow, which is another reason high-stakes players drift offshore.

Streaming quality and studio locations do not vary by licence. The same Evolution studio in Riga serves both UKGC and Curaçao operators, so the product you see is identical. The rules around it are not.

What about crash games and instant-win formats?

Aviator, JetX, Plinko and the broader crash category are staples of independent casinos and largely absent from UKGC-licensed lobbies. RTP figures for these titles typically sit between 96% and 97%, published in the game info panel on most reputable sites.

Instant-win and scratch formats from Hacksaw and Pragmatic also appear more freely offshore, with bet sizes from £0.10 to £100 per round. The mechanics are provably fair on crypto-native sites, where a hash of the next result is published before each round.

These games move fast, which makes the session timer more relevant rather than less. A crash game session can burn through a month's entertainment budget in twenty minutes if nothing interrupts it.

How do RTP figures get published and audited?

Reputable independent casinos publish theoretical RTP per title in the game information panel, sourced from the provider's certification. Independent testing from eCOGRA, iTech Labs or GLI covers the random number generator, and certificates are usually linked in the site footer.

UKGC-licensed operators must display RTP on every game and report aggregate return figures. Offshore operators are not held to that standard, so the figures you see depend on the provider's own testing rather than a regulatory requirement.

Practical check: open three games from different providers and read the info panel. If RTP is missing or shown only as a range wider than one percentage point, ask support before depositing.

How to Evaluate an Independent Casino Before Signing Up

What should you check in the licence footer?

Every legitimate site names its licence holder and permit number in the footer, along with the issuing authority. Curaçao-licensed casinos display a company registration number and a licence reference you can verify against the Gaming Control Board's public register. Anything vague, like "licensed and regulated" with no entity named, is a problem.

Check the domain too. Independent casinos frequently operate mirror domains when the primary is blocked by UK ISPs, and a mirror that does not match the licence holder's registered name is not the same site. Bookmark the verified domain rather than following search results each visit.

Also confirm the terms footer date. Terms updated within the last 6 months suggest an active compliance function; a page last revised in 2021 suggests the opposite.

How do you verify payout speed?

Published processing times are a starting point, not evidence. Look for recent player reports on independent forums, check the operator's complaint history with its licence holder, and test with a small withdrawal of £20 to £50 before committing a larger balance.

The test tells you three things: how long the pending period really runs, whether KYC is triggered at that threshold, and whether support responds within their stated window. A £50 withdrawal is cheap information.

Record the timestamps. Deposit confirmed, withdrawal requested, status changed, funds received. That log is what you want if a dispute arises later.

Which responsible gambling settings should you configure first?

Set a deposit limit before your first deposit, not after. Set a session timer at 60 minutes or lower. Set a reality check interval at 30 minutes if the option exists. Configure a cool-off you can trigger from the account menu without contacting support.

Four settings, ten minutes of work, and the entire technical apparatus of player protection starts working in your favour rather than sitting dormant. Most players skip this step because the cashier screen comes first. The cashier screen is designed to come first.

Take a screenshot of each configured limit. If support later claims a setting was never saved, you have proof.

What red flags appear in the terms?

Watch for clauses allowing the operator to void winnings for "irregular play" without defining it, withdrawal caps under £5,000 monthly, wagering requirements above 50x, and dormancy fees starting before 6 months. Each one shifts risk onto you.

Also check the maximum bet rule during bonus play. A cap of £5 per spin is standard; anything lower makes clearing a 40x requirement on a £500 bonus practically impossible within a reasonable session.

And read the account closure section. Terms that let the operator hold your balance indefinitely during review, with no stated timeline, are terms you should walk away from before depositing.

Should you use a VPN at an independent casino?

Most terms prohibit VPN use, and detection usually happens at withdrawal when the payment processor flags a location mismatch. Consequences range from account closure to seizure of winnings, depending on how strictly the operator enforces the clause.

Some players use a VPN to access a fuller game library from the UK. The risk sits entirely with you, and it is not theoretical: a 2025 enforcement sweep across three Curaçao-licensed operators saw accounts flagged for repeated UK-to-EU IP switching, with balances held pending review.

If you choose to use one, keep the same exit location consistently and expect the account to be closed if the operator changes its stance. There is no safe version of breaking a stated term.

How do you close an account permanently?

Send a written request to support asking for permanent closure, not a cool-off, and confirm in writing that you understand it is irreversible. Reputable operators process this within 24 to 72 hours and send a confirmation email.

If the operator does not respond within 7 days, escalate to the licence holder named in the footer with your request and timestamps attached. Curaçao's complaints process accepts submissions directly from players, though response times run weeks rather than days.

Pair the account closure with device-level blocking. GamBan and BetBlocker both work regardless of which licence a site holds, and BetBlocker installs free on Windows, macOS, iOS and Android.

Frequently Asked Questions

Are independent casinos not on GamStop legal in the UK?

Playing at them is not illegal for the individual. UK law prohibits operators from offering gambling services to British consumers without a UKGC licence, but it does not criminalise a player for using an offshore site. The operator faces enforcement risk; the punter does not.

Can I still use GamStop if I play at independent casinos?

You can register with GamStop, and doing so is sensible if you also hold accounts at UKGC-licensed brands. Understand that the exclusion will not apply to any Curaçao, Anjouan or Kahnawake-licensed casino, so you would need separate self-exclusion requests at each independent site.

Do independent casinos pay out in GBP?

Most do, either directly or by converting at deposit. Check the cashier before funding: a site that only settles in EUR USD will cost you 1% to 3% in conversion spread on every transaction, which adds up faster than it looks across a month of deposits and withdrawals.

Which is safer, an independent casino or a UKGC-licensed one?

Safer in terms of enforceable player protection, the UKGC licence wins: segregated funds, IBAS dispute resolution, mandatory affordability checks and GamStop integration. Independent casinos trade those guarantees for higher limits and lighter signup friction, and the responsible gambling tools you get depend entirely on what the operator chose to build.

How long does KYC take at an offshore casino?

Automated document checks clear in 10 minutes to 2 hours during business hours, with manual review extending to 24 or 48 hours if the system flags a mismatch. Submitting a passport, a recent utility bill and a clear card photo in one upload usually avoids the back-and-forth that stretches verification to several days.

Can I set a deposit limit before I register?

Not usually. Independent casinos configure limits from inside the account settings, so the practical sequence is: register, set your limits, then deposit. Some operators now include a limit field in the signup flow, but it is the minority, which makes that first ten minutes after registration the most important window of the whole relationship.

Do independent casinos offer cashback on losses?

Weekly cashback between 10% and 25% is a standard retention tool at this tier, typically calculated on net losses from Monday to Sunday and credited every Monday with 1x to 5x wagering attached. Compared with welcome bonuses, cashback carries lighter conditions and is often the more valuable promotion for anyone playing regularly.

Responsible Gambling and Where to Get Help

What tools should every player configure on day one?

Four settings cover the essentials: a deposit limit sized to what you can genuinely afford to lose, a session timer at 60 minutes or lower, a reality check interval of 30 minutes, and a cool-off you can trigger yourself without emailing support. Ten minutes of setup, and the technical controls start working for you instead of sitting idle.

Where can UK players get immediate support?

Gambling under the age of 18 is illegal in the United Kingdom. If gambling is causing you harm, contact the National Gambling Helpline on 0808 8020 133, open 24 hours a day, 7 days a week, free from all UK landlines and mobiles. GamStop at gamstop.co.uk blocks access to all UKGC-licensed operators for 6 months, 1 year or 5 years, while GamBan and BetBlocker extend device-level blocking to offshore sites as well.

Independent casinos not on GamStop can be a reasonable choice for players who understand the trade-offs, but the safety net is one you build yourself, so configure your limits before your first deposit and keep your balance no larger than you can afford to lose entirely.