Spain now requires online gambling operators to check that payment methods belong to the account holder
From October 28, 2026, Spanish online gambling operators licensed by the state must verify that the person who holds the payment method used for deposits and withdrawals is the same person who holds the gambling account. Existing players have six months to comply and cannot withdraw winnings until the match is verified.

Overview
- A new identity check for Spanish online gambling took effect on October 28, 2026, under Royal Decree 813/2026.
- Operators with a state licence must verify that the holder of the payment method used for deposits and withdrawals is the holder of the gambling account.
- New accounts are covered from day one; existing players have six months, during which they can deposit and play but cannot withdraw winnings.
- Accounts still unverified after six months must be closed, reported to the DGOJ and their balances returned.
- Spain's Ministry of Consumer Affairs said identity theft complaints in online gambling rose 12% in 2025, to 8,675.
What the new rule says
Royal Decree 813/2026 was approved on October 7 and published in the Boletín Oficial del Estado (BOE) on October 8. It mainly updates Spain's anti-money laundering regulations and enters into force 20 days after publication.
The decree rewrites Article 21 of the regulation implementing Law 10/2010 on the prevention of money laundering and terrorist financing. Under the new Article 21.2, identifying a gambling customer through electronic or online channels requires, on top of the existing non-face-to-face identification routes, "verification that the holder of the payment method used in deposits and withdrawals is the holder of the gambling account." The text refers to payment methods in general and does not prescribe how operators must carry out the check.
Six-month transition for existing players
Players registered before the rule took effect have six months to make the changes needed for the check. During that period they can keep depositing with their existing payment methods and keep playing, but they cannot withdraw winnings.
If the match has not been verified when the six months expire, operators must terminate the contract unilaterally and notify the Directorate General for the Regulation of Gambling (DGOJ). They must then return any remaining balance, including winnings withheld during the transition, subject to their anti-money laundering obligations. Operators have the same six months to adapt their technical gaming systems.
Identity theft figures
In a statement on October 28, the Ministry of Social Rights, Consumer Affairs and 2030 Agenda said identity theft complaints in online gambling rose 12% in 2025. It said 8,675 complaints were recorded last year under PACS, a protocol for taxpayers whose identity has been used by others, which the ministry runs with the national police forces and the Tax Agency.
According to the ministry, DGOJ data showed that people using stolen identities relied on payment methods whose holders are hard to verify in real time, such as bank cards and e-wallets. The ministry said the problem is not limited to isolated or family cases and can also indicate activity by criminal organisations linked to money laundering.
The rule adds to other recent changes for Spanish licensees, including a cross-platform deposit limit now being tested. Spain's Supreme Court is also set to rule on whether bwin can close betting accounts without giving a reason.
Image rights: if you hold rights to an image used here and want it credited differently or removed, contact support@askspinner.com.
Cite This Article
Topics In This Story
Related Countries

