Spain overhauls payment checks for online gambling operators
A new royal decree forces Spanish-licensed operators to confirm that deposit and withdrawal methods belong to the account holder, with winnings frozen for customers who fail to comply.
Spain has approved tighter rules governing how online gambling operators verify customers' payment methods, under amendments to the regulations that implement Law 10/2010, the country's anti-money laundering and counter-terrorist financing statute.
The change arrives through Royal Decree 813/2026, published in the Official State Gazette on 10 October, as reported by SBC News.
At its core is a requirement that the person behind a deposit or withdrawal method must be the same person who holds the gambling account. Article 21 of the amended rules obliges operators to confirm that ownership before processing transactions, and to keep records of the checks carried out on a customer's first payments.
The obligation covers gambling activity conducted through websites, apps and other electronic or interactive channels.
Customers already registered with an operator get six months to complete the verification process. During that window they can keep depositing through the payment methods already on file and keep playing as normal.
Withdrawals are treated differently. Until ownership is confirmed, the transitional rules state that affected players "may not withdraw the winnings they have obtained", meaning any winnings sit frozen rather than being paid out.
Once the six-month window closes, operators are required to end their relationship with any customer whose payment ownership has not been verified, and that termination is not optional. Details of accounts opened and closed under the new regime must be reported to the Directorate General for Gambling Regulation, Spain's gambling authority known as the DGOJ.
Closing an unverified account still means returning the customer's balance, including any winnings that were held back during the transition, though that repayment remains subject to the operator's broader anti-money laundering duties.
Operators themselves have the same six-month runway to rebuild the technical side of their compliance operations, covering payment screening, identity checks and account administration.
Remote identity verification is also being tightened. Operators will need to meet minimum standards set out in general authorisations issued by Sepblac, Spain's financial intelligence unit, and the decree formally accepts the national identity document, the DNI, in both physical and digital form. Rules on electronic identification and how long that data must be retained will not take effect until 18 months after publication, giving operators longer to prepare for that specific strand.
Firms will also need written internal policies covering international financial sanctions and countermeasures, sitting alongside their existing money-laundering controls rather than replacing them.
The decree takes legal effect on 28 October 2026, though individual obligations carry their own separate adaptation timetables.
The payment verification regime lands on top of other safer-gambling work already under way at the DGOJ. The regulator has been developing a shared algorithm, built from real player data, intended to flag risky gambling behaviour earlier, and opened a fresh public consultation on that framework on 13 October.
Operators are also waiting for clarity on a proposed central register for monitoring younger and vulnerable customers, with the regulator expected to set out how risk classifications and information-sharing would work across licensed platforms, particularly for customers aged 25 and under.