Spain Tightens Gambling Rules: Six-Month Deadline for Payment Verification

Spain is introducing a new level of regulatory scrutiny for online gambling enthusiasts. With the enactment of Royal Decree 813/2026 on October 28, 2026, the identification of payment methods becomes an absolute requirement. Until now, many players could use their accounts without providing seamless proof of ownership for every deposit method. That era has ended. The Spanish government has set a hard six-month deadline for operators and customers to synchronize existing account data with the payment accounts used. Those who fail to meet this requirement will lose access to their winnings, even if gambling activities remain permitted for the time being.

The regulation is particularly critical for existing customers. While new customers already undergo stricter controls, the law allows a transition period for previously registered users. During this time, deposits and wagers can still be made, but the withdrawal function remains disabled until proof is provided that the bank account or e-wallet actually belongs to the registered player. This blockage of winnings is intended to increase pressure on users to submit their documents promptly. At the end of the six months, the final consequence follows: operators are legally obliged to close any account where the ownership of the payment method remains unverified. Remaining balances must then be refunded in compliance with anti-money laundering guidelines.

Numbers and facts

Decree 813/2026 is a significant amendment to Law 10/2010, which governs the prevention of money laundering and terrorist financing. The Spanish gambling authority DGOJ (Dirección General de Ordenación del Juego) takes on the central monitoring role. Operators must report every account activation and closure directly to the DGOJ. Additionally, there is a further timeline: requirements for electronic identification methods and the storage of related data will only fully take effect 18 months after the publication of the decree. This gives the industry some breathing room for complex technical transitions but does not change the immediate withdrawal block for unverified customers.

Article 21 of the decree stipulates that operators must maintain records of all verification checks made on initial transactions. This applies to all channels, from computers to mobile apps and other interactive routes. The Spanish financial intelligence authority Sepblac sets the minimum standards for remote identity verification. The Spanish National Identity Document (DNI) is recognized in both physical and digital formats. Companies must also maintain written policies regarding international financial sanctions.

Background

Spanish regulation aims to protect market integrity. The DGOJ operates under the Ministry of Social Rights and Consumer Affairs. In Spain, gambling is divided into a state monopoly (SELAE and ONCE) and a licensed private sector. The new regulation primarily affects the online sector, which is under state supervision, while land-based gambling is regulated by the 17 autonomous regions. The tightening of identity verification is a direct response to increasing demands for player protection and financial security within the European Union.

Why it matters for German players

For German players registered with operators licensed by the Joint Gambling Authority of the States (GGL), such strict verifications are nothing new. The German Interstate Treaty on Gambling 2021 (GlüStV 2021) has required player identities to be verified within 72 hours of registration since its inception if they wish to deposit over 100 euros or withdraw winnings. In Germany, linking the payment account to the account holder is already advanced through the LUGAS system and strict KYC (Know Your Customer) processes. Deposits in Germany are capped at 1,000 euros per month across all providers, and stakes per spin on virtual slots are limited to 1 euro.

Spain is approaching the German level of security with Decree 813/2026. Anyone in Germany playing at an illegal MGA or Curacao casino risks having payments blocked without a clear legal basis. GGL-licensed casinos, on the other hand, offer legal certainty, even if verification processes are sometimes perceived as tedious. They serve to protect against identity theft and ensure that winnings flow legally and safely into one's own account.

What it means for GGL-licensed casinos

German operators can view the Spanish development as confirmation of their own path. The GGL whitelist ensures that only providers with the highest security standards operate. The technical hurdles that Spain is now building over the next 18 months are already largely standard in Germany through interfaces with credit agencies and modern identification procedures. For international providers, the new Spanish regulation represents a significant technical effort to meet the requirements of Sepblac and DGOJ.

"Operators must establish that the person who owns a payment method is also the person registered to the gambling account." - Extract from Article 21 of Royal Decree 813/2026