Spain has approved Royal Decree 813/2026, tightening authorisation and mandatory monitoring of gambling transactions. Online operators must now confirm that the payment method a player uses belongs to the holder of the gambling account. The decree amends the regulations implementing Law 10/2010 on the prevention of money laundering and terrorist financing.
The core requirement is a match between the payment instrument's owner and the account holder. Article 21 obliges operators to establish that the holder of the payment method is the account owner and to keep records of the checks on first transactions. The rule covers online transactions through electronic channels, computers, apps and interactive platforms.
Existing customers get six months to adapt. Deposits and play are allowed during that window; withdrawals are not until the check is passed. Once the six months expire, operators must unilaterally terminate contracts with customers whose payment ownership cannot be confirmed. Data on activations and terminations goes to the DGOJ. Closing an account will require returning balances, including winnings withheld during the transition, subject to AML/CFT obligations. The same six months apply to technical systems: payment checks, customer identification and account management procedures all need updating.
Identification and rollout
Remote identification requirements are rising. Secure procedures must meet the minimum set out in Sepblac's general authorisations, Spain's financial intelligence unit. The amendments formally recognise the Spanish DNI in paper and digital form. Rules on electronic identification and on storing collected information take effect 18 months after publication. Businesses must hold written policies on international financial sanctions and countermeasures.
The decree enters into force on 28 October 2026, with separate adaptation deadlines for individual obligations. For operators licensed in Spain it is one more implementation project. They are waiting for clarity on the DGOJ's common algorithm for spotting risky player behaviour: the regulator opened a public consultation on its concept on 13 October. Centralised monitoring of young and vulnerable customers, including a proposed central registry, remains unresolved. For the 25-and-under audience, clear rules are needed on information sharing, risk classification and safeguards.
