Spain Tightens Player Payment and Risk Controls

Spain is tightening online gambling payment checks while developing a common system to identify potentially harmful gambling behaviour. Royal Decree 813/2026 requires operators to verify payment ownership, while the Directorate General for Gambling Regulation (DGOJ) has reopened consultation on monthly player-risk assessments.

The measures affect withdrawals and the treatment of customers classified as potentially at risk.

Payment Verification Could Delay Winnings

Royal Decree 813/2026 updates Spain’s anti-money laundering framework under Law 10/2010. Published in the Official State Gazette on 10 October, it takes effect on 28 October 2026.

Under Article 21, operators must ensure deposit and withdrawal methods belong to the registered account holder. The regulation states that “payment ownership must match the gambling account. Operators must verify that payment methods used for deposits and withdrawals belong to the registered account holder.”

Existing customers have six months to complete verification. They can continue depositing and gambling during this period but cannot withdraw winnings until ownership checks are satisfied. The transitional provision states that affected players “may not withdraw the winnings they have obtained”.

Operators must terminate contracts with customers who remain unverified after the deadline, notify the DGOJ and return outstanding balances, including withheld winnings, subject to anti-money laundering obligations.

The decree also strengthens remote identification standards and recognises Spain’s national identity document in physical and digital formats. Electronic identification and information-retention requirements will apply after an 18-month adaptation period.

Monthly Risk Assessments Would Become Standardised

The DGOJ has reopened consultation on a proposal requiring state-licensed online gambling operators to run the same automated risk test monthly. The consultation runs from 14 to 22 October 2026, following revisions prompted by a Spanish Data Protection Agency report issued on 15 June.

Operators would assess the previous 183 days of activity during the first seven calendar days of each month. After excluding sporadic players, they would apply initial thresholds based on activity, net gains or losses, stakes and deposits. A machine learning model would then assess remaining accounts using 48 variables, including withdrawals, session duration, product choices and payment categories.

The model uses operator-held account data, excluding social media, browsing history, geolocation, external financial records and health data. The classification represents a regulatory category, not a clinical diagnosis.

Flagged Players Face Restrictions

Operators would have to explain classifications and their main contributing factors in plain language. Players would have 72 hours to respond; otherwise, their accounts would be suspended until they comply.

For at least six months, flagged customers would lose access to promotions, VIP services and marketing emails. They would also need payment methods registered in their own names, and credit cards would be prohibited.

Players could request an operator review before escalating complaints to the DGOJ. Restrictions would remain active during both stages.

The first consultation round attracted 18 submissions. Industry participants questioned implementation costs, model accuracy and independent auditing. The DGOJ estimates implementation at €130,000 per operator, or around €7.4 million across 57 licensed operators.

The proposed resolution would take effect two months after publication in the official gazette. Payment verification and the risk model remain separate regulatory processes.