Spain Strengthens Identity Theft Controls for Online Gambling
Spain.- 29 October 2026 | www.zonadeazar.com The Spanish Government, through the Ministry of Social Rights, Consumer Affairs and the 2030 Agenda, has introduced new measures to combat identity theft across online betting and gaming platforms.
The reform, established through Royal Decree 813/2026, requires licensed operators to verify that the registered holder of a gambling account matches the owner of the payment methods used.
The initiative follows an increase in fraudulent identity complaints and forms part of the Directorate General for Gambling Regulation’s (DGOJ) wider strategy to strengthen security and oversight within Spain’s regulated market.
Identity Theft Complaints Rise by 12%
During 2025, Spanish authorities recorded 8,675 complaints involving identity impersonation in the gambling sector, representing a 12% year-on-year increase.
The practice involves using another person’s personal information to open gambling accounts, place bets and conduct financial transactions without authorisation.
Authorities have also identified cases where stolen identities were used to declare gambling winnings under another individual’s name.
Such activities can create financial and tax consequences for victims.
Mandatory Verification of Payment Methods
One of the principal changes introduced by Royal Decree 813/2026 is the requirement to verify that payment methods belong to the registered account holder.
Operators must confirm the relationship between:
- The customer’s identity.
- Gambling account registration information.
- Ownership of payment instruments used for deposits.
- Information associated with transactions and withdrawals.
The objective is to prevent individuals from using another person’s identity while conducting financial transactions through their own or third-party payment instruments.
The measure is intended to improve transaction traceability across the licensed market.
New Accounts Must Comply Immediately
Online gambling platforms must incorporate the verification requirements into their account registration procedures.
New customers must establish ownership of their payment methods in accordance with the applicable rules.
The requirement seeks to identify potential irregularities before financial transactions can be conducted through fraudulent accounts.
Operators will need to adapt their technology systems to incorporate these controls into existing customer identification processes.
Six-Month Transition Period for Existing Accounts
The legislation establishes a six-month transition period for customers whose accounts were registered before the new rules came into effect.
During this period, operators must verify ownership of the payment methods associated with existing accounts.
Customers may continue making deposits and participating in gambling activities while verification procedures are completed.
However, they will not be permitted to withdraw winnings until the registered account holder has been confirmed as the owner of the relevant payment method.
This restriction is intended to prevent funds from being withdrawn through accounts whose financial ownership remains unverified.
Accounts Failing Verification Must Be Closed
Once the six-month transition period expires, operators must take action against accounts that do not satisfy the new requirements.
Where payment ownership cannot be established, operators must:
- Terminate the customer contract.
- Close the relevant gambling account.
- Notify the DGOJ.
- Return outstanding balances and unpaid winnings in accordance with applicable regulations.
The return of funds must comply with anti-money laundering and counter-terrorist financing obligations.
The measure therefore establishes specific consequences for customers who do not complete the required identification procedures.
Links to Money Laundering and Organised Crime
The DGOJ has warned that identity impersonation is increasingly associated with organised criminal activities and potential money laundering.
Among the practices identified is the use of payment instruments whose ownership cannot easily be verified in real time.
These methods can make it more difficult to identify the individuals responsible for financial transactions.
The new regulations therefore aim to strengthen preventive controls and improve operators’ ability to detect potentially suspicious activity.
Additional Technology Requirements for Operators
Implementing Royal Decree 813/2026 will require licensed businesses to update their internal procedures.
Key areas include:
- Updating customer identification systems.
- Verifying payment method ownership.
- Recording verification procedures.
- Restricting withdrawals where required.
- Establishing reporting mechanisms for the DGOJ.
Operators have specific transition periods to implement the new obligations.
The reform also strengthens certain remote identification requirements and measures relating to financial crime prevention.
Spain Prepares Centralised Deposit Monitoring
The new identity verification requirements form part of a wider regulatory agenda focused on player protection.
The DGOJ intends to implement its centralised deposit limit system on 25 March 2027.
The mechanism is designed to coordinate deposit limits across licensed gambling platforms rather than assessing deposits separately at each operator.
This project is being developed alongside tools intended to identify potentially risky gambling behaviour at an earlier stage.
Both initiatives reflect the regulator’s emphasis on technology-driven oversight and consumer protection.
Gambling Operators Face New Compliance Requirements
The reform will affect licensed businesses offering online sports betting and casino gaming in Spain.
Companies such as CIRSA and Codere will be required to comply with the obligations applicable to their digital operations.
Additional controls will require technology investment, reviews of account registration procedures and changes to payment systems.
At the same time, the measures aim to improve customer confidence and reduce fraudulent activity across regulated gambling platforms.
Industry Impact and Next Steps
The new provisions, which entered into force on 28 October 2026, establish additional obligations for Spain’s licensed gambling operators.
Over the following six months, businesses must complete the necessary system adaptations and verify existing customer accounts.
The DGOJ will continue monitoring implementation while advancing its other player protection initiatives.
With 8,675 identity theft complaints recorded in 2025, Spain is strengthening oversight of online gambling transactions and establishing mandatory payment ownership verification as a tool to prevent fraud and financial crime.
Edited by: @fonta
