Spain Makes Online Operators Match Payment Methods to the Gambling Account Holder

A royal decree amending Spain's anti-money laundering regulation now requires licensed online operators to check that whoever holds the payment method used to deposit and withdraw is the person who holds the gambling account. Existing players get six months to comply and, on the decree's wording, cannot withdraw winnings in the meantime.

• Royal Decree 813/2026, signed on 7 October and published in the Boletín Oficial del Estado (BOE) on 8 October, rewrites Article 21 of the regulation implementing Law 10/2010 on money laundering and terrorist financing, and enters into force on 28 October
• For online gambling, verifying a customer's identity will now also require checking that the holder of the payment method used for deposits and withdrawals is the holder of the gambling account
• Players registered before the rule applies have six months to make the changes needed; in that period they can keep depositing and playing but, under the decree's wording, may not withdraw their winnings
• Accounts still unverified after six months must be terminated, reported to the Directorate General for the Regulation of Gambling (DGOJ) and their balances returned, subject to anti-money laundering obligations
• It is a third compliance programme for Spanish licensees alongside the DGOJ's mandatory risk-detection algorithm and the joint deposit limits due on 25 March 2027

A Financial-Sector Omnibus Decree Rewrites the Gambling Identity Rule

Royal Decree 813/2026 is a financial-sector omnibus that amends 11 royal decrees. Its Article 5 amends the anti-money laundering regulation approved by Royal Decree 304/2014, and the gambling provisions sit there. The decree was countersigned by First Vice-President and Economy Minister Carlos Cuerpo and enters into force 20 days after publication, on 28 October.

The new Article 21.2 says that identifying a customer of a gambling operator through electronic, computer, telematic and interactive means requires, in addition to one of the routes for non-face-to-face customers in Article 21.1, "la comprobación de que el titular del medio de pago usado en depósitos y retiradas es el titular de la cuenta de juego": a check that the holder of the payment method used for deposits and withdrawals is the holder of the gambling account. The text speaks of payment methods generally, not only bank cards, and does not prescribe how the check is done.

Until now, Article 21.2 left the identification criteria for operators licensed under the Gambling Act, Law 13/2011, to be set by the DGOJ in the licensing process, after a favourable report from Sepblac, Spain's financial intelligence unit. The decree's preamble says the change is meant to avoid "los efectos indeseados que la actual regulación ha traído aparejados", the unwanted effects of the current rules. It does not say what those effects were.

The draft put out for consultation in March would also have removed the option of accepting a non-face-to-face customer whose first deposit comes from an account in their own name at a bank in Spain, the EU or an equivalent country, according to Focus Gaming News. The final text keeps that route in Article 21.1(c). Other remote identification procedures must now meet minimum requirements in general authorisations published by Sepblac.

Six Months, No Withdrawals, Then Termination

The first transitional provision gives players registered before the rule applies six months from its entry into force to make the changes that allow the check, which by our count runs to 28 April 2027. During that time they may keep depositing with their existing payment methods and keep playing, "pero no podrán retirar los premios que hubieran obtenido", but may not withdraw the winnings they have obtained. Operators get the same six months to adapt their technical systems.

If the check has not been completed by then, operators must terminate the contract unilaterally and notify the DGOJ. They must return the balance, including winnings withheld during the period, without prejudice to their money laundering and terrorist financing obligations. The decree creates no new penalties of its own.

Elsewhere the decree leaves the gambling thresholds in Article 4 unchanged: identity checks on occasional transactions of €1,000 or more, and on lottery and gambling prizes of €2,500 or more. It recognises the digital version of Spain's national identity document (DNI), with that change and the retention of electronic identification data applying 18 months after publication, and requires written policies on international financial sanctions and countermeasures. The preamble ties the reform to the Financial Action Task Force (FATF) mutual evaluation of Spain that begins in 2026, and the decree partially transposes the EU's sixth anti-money laundering directive, Directive 2024/1640.

The Withdrawal Bar Is the Part Operators Will Have to Explain

The rule itself is not exotic: the Dutch regulator told operators only last week that initials are not enough to verify a player's bank account. What is unusual is the transition. The provision says existing players "may not withdraw" winnings for six months; it does not expressly say that a player who completes the check in week one can withdraw in week two, though that is the natural reading. Operators will want the DGOJ to confirm it: a licensed site that takes deposits but holds winnings is exactly what sends players to unlicensed ones.

Spain Is Writing National Rules a Year Before Brussels Takes Over

From 10 July 2027 the EU Anti-Money Laundering Regulation, Regulation 2024/1624, applies directly. It requires gambling providers to apply customer due diligence on winnings collected or stakes wagered of €2,000 or more, single or linked, and it lets member states exempt low-risk gambling but not casinos or most online gambling and betting providers. Spain's €2,500 prize threshold sits above that figure. The regulation's gambling provisions contain no payment-ownership test, so Spain's rule is a national addition, set ahead of the FATF evaluation rather than left for Brussels.

The obligation lands on the same licensees that must prepare for deposit limits in March and a regulator-trained risk model whose consultation closes on 22 October. Each rule is defensible on its own; the test is whether the DGOJ sequences them so that verified players are not the ones who feel them most.