Spain Orders Online Gambling Operators to Match Payment Holder to Player Account

Spain's state-licensed online gambling operators must now confirm that the holder of a player's payment method is the holder of the gaming account, under Royal Decree 813/2026, which entered into force on 28 October 2026.

The obligation applies to operators licensed by the DGOJ (Dirección General de Ordenación del Juego), Spain's gambling regulator. Players who registered before 28 October have six months to comply, which runs to 28 April 2027. During that window they cannot withdraw winnings.

What the new rule requires

The requirement sits in Article 21.2 of the Anti-Money-Laundering Regulation, Royal Decree 304/2014, which implements Law 10/2010 on money-laundering prevention. Article 5 of Royal Decree 813/2026 rewrites Article 21 of that Regulation. Under the new paragraph 2, identity verification for online gambling operators, on top of the general conditions, requires checking that the person holding the payment method used for deposits and withdrawals is the person holding the gaming account.

The decree's preamble says the change is meant to avoid "unwanted effects" of the current rules. It was approved by the Council of Ministers on 6 October 2026, is dated 7 October and was published in the BOE (Boletín Oficial del Estado, Spain's official gazette) on 8 October, in issue no. 250. Final provision 4 sets entry into force 20 days after publication.

The decree is issued by the Ministry of Economy, Trade and Business and was promoted by Consumo, the Ministry of Social Rights, Consumer Affairs and 2030 Agenda, which oversees the DGOJ. It is mainly a wider anti-money-laundering and financial-sector update: it has 11 articles, each amending a different royal decree, and also covers areas such as crypto ATM identification, digital national ID and changes affecting SEPBLAC, Spain's financial intelligence unit. The gambling rule is one part of that package.

Transition for existing players and operators

Transitional provision 1 gives players registered before entry into force six months to make the necessary changes. Operators get the same six months to adapt their technical systems.

During that period, affected players can keep depositing with their existing payment methods and can keep playing, but they cannot withdraw winnings. If the check is still not satisfied when the six months end, the operator must unilaterally terminate the contract, notify the DGOJ and refund the player's balances, including any unpaid winnings.

The BOE text carves out only previously registered players, so new accounts fall under the rule from entry into force. Consumo's statement, as carried by regional media, says users who register from 28 October must comply from the start. Six months from 28 October 2026 lands on 28 April 2027.

The rule covers online operators licensed at state level. It does not extend to regional or land-based gambling.

Why Consumo says it acted

Consumo says the purpose is to make it harder to use third parties' payment methods and to curb identity impersonation. Its data from 7 April 2026 shows 8,675 people filed impersonation reports in 2025, up 12% on 2024. That count is of people who reported being impersonated, not of complaints about operators.

For operators, the measure adds a payment-side test to onboarding and to the existing player base. It follows a run of Spanish compliance moves covered in Gamingo's analysis of Spain's 2026 iGaming reset, and it adds to the DGOJ's data-driven supervision tools, such as the central data registry the regulator planned to launch. Enforcement against operators outside the licensing regime has been heavy, as in the fines on 14 unlicensed operators, and sanctions on licensed operators have also been material, as with €65 million in fines in the first half of 2024.

Industry reaction and the deposit-limit timeline

Jdigital, the Spanish online gambling trade body, has asked the authorities for an interpretive guide to give operators legal certainty on how the rule applies. The request emerged around a webinar with the law firm Asensi on the decree, reported on 22 October.

The payment-holder rule is separate from the joint deposit-limit system approved by the Council of Ministers on 23 June 2026. The DGOJ says that system applies from 25 March 2027, with a test period starting six months earlier. The joint limits are defaults that players can change, apply across all operators and are managed centrally by the DGOJ. The 28 April 2027 deadline therefore falls about a month after the joint limits start.

Operators and their payment partners face both workstreams in the same window: re-verifying legacy accounts against payment-method ownership while preparing for centrally managed limits.

Status reviewed on 30 October 2026. Dates and article references come from the BOE text of Royal Decree 813/2026, and the ministry's rationale from Consumo statements carried by EFE and regional media. More regulation news and EMEA coverage.