Spain sets new rules for online gambling payments

Online gambling operators will have to verify that payment methods match account ownership.

Key takeaways:

• Spain is introducing new anti-money laundering rules for online gambling that require operators to verify that the payment method used belongs to the registered gambling account holder before deposits and withdrawals can be processed.
• Existing customers have a six-month transition period to complete payment ownership verification. During this time, they can continue gambling, but they cannot withdraw winnings until verification is completed.
• After the transition period, operators must close accounts where payment ownership remains unverified, while also implementing stricter identity verification procedures and updated compliance policies ahead of the decree taking effect on October 28 2026.

Spain.- New anti-money laundering measures have been introduced for the online gambling sector in Spain. Essentially, operators must verify that the owner of a payment method is the same person registered on a gambling account before deposits and withdrawals can be processed.

The changes approved through Royal Decree 813/2026, published in the state gazette (BOE) on October 10, amend regulations supporting Law 10/2010 on the prevention of money laundering and terrorist financing. A key provision contained in Article 21 requires operators to confirm that the payment-method holder is the owner of the gambling account. Operators must keep records of verification checks carried out on customers’ initial transactions. The requirement applies to online gambling activity conducted through electronic, computer, mobile application and other interactive channels.

Existing customers will be granted a six-month transition period to allow operators to verify payment ownership. During that time, players may continue to deposit funds and participate in gambling activities using existing payment methods. However, they will be unable to withdraw winnings until verification has been completed. According to the transitional provisions, affected customers “may not withdraw the winnings they have obtained”.

Once the six-month deadline has passed, operators will be required to terminate accounts where payment ownership remains unverified. Information on customer activations and account closures must be reported to the Directorate General for Gambling Regulation (DGOJ). Any remaining account balances, including winnings withheld during the transition period, must be returned, subject to anti-money laundering and counter-terrorist financing requirements.

Operators will also have six months to update their technical systems and procedures to accommodate the new rules, including changes to payment verification, customer identification and account management processes.

The decree introduces stricter standards for remote identity verification. Secure identification processes must comply with minimum requirements established in general authorisations issued by Sepblac, Spain’s financial intelligence authority. The legislation also recognises Spain’s National Identity Document (DNI) in both physical and digital formats. Requirements covering electronic identification methods and the retention of related data will take effect 18 months after publication.

In addition, businesses must maintain written policies addressing international financial sanctions and countermeasures as part of their broader anti-money laundering compliance frameworks. The new decree will come into force on October 28 2026, although individual obligations will be subject to separate implementation timelines.

FAQs

What does Spain’s Royal Decree 813/2026 change?
Under the decree, online gambling operators must verify that the owner of a payment method is the same person registered on the gambling account and keep records of verification checks on initial transactions.

When does Spain’s Royal Decree 813/2026 come into force?
The new decree will come into force on October 28 2026, although individual obligations will be subject to separate implementation timelines.