Spain has approved new rules on the authorization and mandatory monitoring of gambling transactions, which require online gambling operators to confirm that the payment methods players use belong to the holders of the gambling accounts.
The changes amend the regulations that implement Law 10/2010 on the prevention of money laundering and terrorist financing.
The government set out the measures in Royal Decree 813/2026, which tightens requirements for player identification and for the verification of financial transactions on online gambling platforms.
Matching the payer to the player
The central requirement is that “payment ownership must match the gambling account. Operators must verify that payment methods used for deposits and withdrawals belong to the registered account holder.”
Under new provisions in Article 21, operators must establish that the holder of the payment method “is the owner of the gambling account.” Operators must also keep records of the verification processes for initial transactions.
The rule covers online gambling transactions carried out through electronic, computer, app, and interactive channels.
What happens to existing accounts
Current customers have a six-month transition period to complete the adjustments necessary for operators to verify payment ownership. Players may keep depositing through their existing payment methods and continue to play during that time, but they cannot withdraw winnings until the verification requirement is met.
According to the transitional provision, affected players “may not withdraw the winnings they have obtained.”
When the six-month period ends, operators must unilaterally terminate contracts with customers whose payment ownership remains unverified. Records of customer activations and terminations must be submitted to the Directorate General for Gambling Regulation (DGOJ).
Account closure will require the return of outstanding balances, including winnings withheld during the transition, subject to applicable anti-money laundering and counter-terrorist financing obligations.
The same six-month window applies to operators’ technical systems. Companies will need to update payment checks, customer identification processes and account management procedures.
New standards for remote identification
The decree also raises the bar for remote identification. Secure verification procedures must meet the minimum requirements set in general authorizations published by Sepblac, Spain’s financial intelligence authority.
Other amendments formally recognize Spain’s National Identity Document (DNI) in both physical and digital formats. Provisions on electronic identification and on the retention of information gathered through those procedures will take effect 18 months after publication.
In addition, businesses must maintain written policies on international financial sanctions and countermeasures, and these will sit alongside their existing anti-money laundering controls.
The decree enters into force on October 28, 2026, while individual obligations carry their own adaptation periods.
A crowded compliance calendar for license holders
For operators licensed in Spain, payment verification adds another implementation project to a list of pending safer gambling initiatives. One of these is the DGOJ’s common algorithm for detecting risky gambling behavior, which was developed using real player data to improve early identification and intervention. The regulator opened another public consultation on its proposed framework on October 13.
Operators are also waiting for clarity on centralized monitoring of younger and vulnerable customers, which includes the proposed central register. Implementing that system will require clear rules on information sharing, risk classifications, and protective action across licensed platforms, with particular attention to customers aged 25 and under.