Spain Reopens Consultation on the 48-Variable Algorithm Every Operator Would Have to Run to Flag At-Risk Players

Spain's gambling regulator has put its common risk-detection model back out for comment until 22 October after a data protection review. Once in force, one model trained on clinically diagnosed players would decide who every licensed operator treats as at risk, in place of in-house systems that flag from 0% to 13.6% of accounts.

• Spain's Directorate General for the Regulation of Gambling (DGOJ) opened a second public participation round on 13 October on its draft resolution approving a mandatory mechanism for detecting at-risk online players, with comments accepted until 22 October
• Every operator would run a DGOJ-trained machine-learning model on 48 variables from each player's last 183 days of activity in the first seven days of each month; a score of 0.3312868 or more means at risk for at least six months
• Classification triggers the existing protections of Royal Decree 176/2023 within 24 hours: an active contact within 72 hours or play is suspended, no promotions, no VIP service, no marketing, and only named payment methods with no credit cards
• Revisions after a June 2026 data protection report ban any commercial use of the data, require operators to explain the main factors behind each classification, and add a review and complaint route
• Unlike France's optional benchmark, which identified 8.7% of account-based players as probably excessive, Spain's model would be binding, and it would apply alongside the joint deposit limits that survived the snap election

Spain's Regulator Wants One Model, Not 55, to Decide Who Is at Risk

The DGOJ published the consolidated draft on 13 October with an agreement signed on 9 October by director general Mikel Arana, an impact report and a data protection impact assessment. A first round ran from 28 August to 25 September 2025, the text was notified to the European Commission under the TRIS procedure (reference 2025/0747/ES), and the Spanish Data Protection Agency (AEPD) issued report 015/2026 on 15 June 2026. Because the changes affect how the mechanism is applied, the agreement says, comment reopens for seven working days.

Royal Decree 176/2023 on safer gambling environments told the regulator to develop, within two years of its entry into force, a mechanism all operators must use. Until now, Article 24 has left operators to build their own. The impact report says that produced severe disparities: of 55 active operators, 36 (65.45%) flagged fewer than 1% of accounts as at risk, only six flagged more than 4%, and results ranged from 0% to 13.6%. When the model was unveiled in November 2025, the ministry put average detection at about 3% of players and said the tool could raise it by up to 10 points, according to The Objective.

How the Mechanism Works

Each month, operators would take a player's activity across all their accounts over the 183 days to the end of the previous month. Sporadic players are exempt: fewer than two deposits, fewer than two active days, or fewer than 10 bets plus fewer than five sessions, tournaments or lottery entries. A linear formula on active days and per-day net result, stakes and deposits flags "direct risk" players automatically. Everyone else is scored.

The scorer is an XGBoost decision-tree model the DGOJ trained and will publish as a JSON file, with its parameters in the annexes. Its 48 variables, F00 to F47, include losses and stakes per active day, deposit frequency, cancelled withdrawals, payment method types, self-exclusions over four years, how often a balance drops below €2 and how fast the player redeposits, time of day, live betting share, and how play shifts between the two halves of the period. The DGOJ says it trained it on 394 people diagnosed with a gambling disorder, obtained through the rehabilitated gamblers' federation FEJAR, the Aragonese association AZAJER and Bellvitge University Hospital, against a random sample of 3,456 players. The resolution calls the result a regulatory category, not a clinical diagnosis.

Operators may add their own systems but not substitute them. A flagged player must be told the period assessed, the measures and their duration, and the main factors behind the result, using SHAP explainability values; the score alone is not enough. Players can ask the operator for a review, then complain to the DGOJ, though neither step suspends the measures. The data and classification may not be used for marketing, segmentation, profitability or solvency decisions.

The resolution takes effect two months after publication in the Boletín Oficial del Estado. The DGOJ will run the same calculation in its own monthly monitoring, according to the impact report, which puts each operator's adaptation cost at €129,442.

Operators and Bettors Pushed Back

The impact report summarises TRIS submissions. The trade body Jdigital called a single mandatory model disproportionate, said it would weigh hardest on smaller operators and warned of false positives among high-spending, low-risk players; its submission cited 62 variables and €170,000 per operator, figures that differ from the consolidated text. AEJAD, which speaks for sports bettors, said it had rebuilt the model and found a possible false negative with €69,060 of net losses over 183 days, and asked for models by game type and a multi-operator view.

A Mandatory Model Removes the Incentive to Under-Detect

The most consequential fact in the file is the spread from 0% to 13.6%. At-risk players lose promotions, VIP treatment and marketing, so an operator that flags fewer keeps more revenue, in a market where, the impact report notes, 15% of online players account for 88.4% of losses. The report itself warns that operators could relax detection for competitive advantage and that low detection rates may be a sign of it. A single model ends that race, but moves liability: operators will answer complaints about a model they cannot change. France chose differently: the ANJ offered its algorithm as an optional benchmark and uses it as a supervisory lens, tracking where its excessive bettors place their stakes. Spain is making the model the rule.

The Weak Point Is Method, Not Principle

A training set of 394 diagnosed patients is small for a market of more than two million active players, and per-operator scoring cannot see a player who spreads losses across several sites, as AEJAD argues. The Dutch regulator funded an open-source model that drew on the DGOJ's work and kept it voluntary. The DGOJ's answer is periodic evaluation and published parameters anyone can test, stronger than a proprietary operator model, provided error rates are published too.

Spain has turned a vague duty into a specification an outsider can check. Whether the threshold catches the right players will only be known once the regulator publishes what the model finds.