Spain’s Online Gambling Payment-Ownership Rule Takes Effect

Spain’s Ministry of Social Rights, Consumption and Agenda 2030 announced on October 28, 2026 that a new identity-verification obligation for state-licensed online gambling operators entered into force that day. The measure requires operators to verify that the holder of a gaming account is the same person as the holder of the payment method used for deposits and withdrawals.

According to the ministry, the measure is intended to strengthen the protection of online gambling users, hinder the use of payment methods belonging to third parties and improve the security of the digital gambling environment. The ministry said identity impersonation in online gambling recorded an uptick in cases in 2025.

Royal Decree 813/2026 and the Anti-Money-Laundering Rules

The measure was introduced through Royal Decree 813/2026, which modifies several royal decrees in the financial sector. The decree was deliberated by the Council of Ministers at its meeting on October 6, 2026, dated October 7, 2026 and published in issue 250 of the Boletín Oficial del Estado, Spain’s official state gazette, on October 8, 2026. Its fourth final provision provides for entry into force 20 days after publication.

The decree states that its objective is to update Spain’s money-laundering prevention rules in response to new risks, methodologies and technological advances that have arisen in recent years, as well as new international requirements Spain must meet as a member of the Financial Action Task Force. It places the revision in the context of the task force’s mutual evaluation of Spain, which begins in 2026 and will carry out a complete review of the country’s money-laundering and terrorist-financing prevention framework. The decree also partially transposes Directive 2024/1640, the European Union directive on the mechanisms member states must establish to prevent the use of the financial system for money laundering or terrorist financing.

Article 5 of the decree amends the regulation implementing Law 10/2010 of April 28, 2010, Spain’s anti-money-laundering and counter-terrorist-financing law, approved by Royal Decree 304/2014 of May 5, 2014. The amendment rewrites Article 21 of that regulation, which sets the requirements for non-face-to-face business relationships and transactions. Under the amended article, identity accreditation for gambling operators dealing with customers through electronic, computer, telematic and interactive channels requires, in addition to the existing checks, verification that the holder of the payment method used in deposits and withdrawals is the holder of the gaming account. The decree’s explanatory memorandum says the gambling amendment is intended to avoid the undesired effects the current regulation has produced.

Identity-Theft Complaints Rose 12% in 2025

Identity-theft complaints in online gambling rose 12% in Spain in 2025, when 8,675 complaints were registered, according to data collected through PACS, an action protocol for impersonated taxpayers that the consumption ministry set up in coordination with the State Security Forces and the Tax Agency.

The data, compiled by the ministry through the Directorate General for the Regulation of Gambling, showed that impersonators resorted to payment methods whose ownership is difficult to verify in real time, such as bank cards and electronic wallets. The data also reflected that the problem extends beyond isolated cases and the private and family sphere, and can constitute an indication of activities by criminal organisations linked to money laundering, the ministry said.

Six-Month Transition and Prize-Withdrawal Rules

Newly created gaming accounts are subject to the verification requirement from October 28, 2026, while accounts already created have a six-month transition period for operators to adapt their payment methods and technical systems to the new requirements, the ministry said.

During that period, already registered players may continue making deposits with their established payment methods and playing the games offered by the operator, but they may not withdraw prizes obtained until compliance with the obligation has been verified.

If the matching of holders has not been proven once the six months have elapsed, operators must unilaterally terminate the contract and notify the DGOJ, according to the ministry. Operators must then return existing balances, including prizes not paid out during the transition period, without prejudice to the applicable obligations on the prevention of money laundering and the financing of terrorism.

The decree’s first transitional provision establishes the six-month window for both gambling operators and players to carry out the technical and operational adaptations needed to comply with the new identity-accreditation requirement introduced in Article 21.