Spain orders gambling sites to verify payment method owners

Online gambling operators licensed in Spain will have to check that the person who owns the card or account used for deposits and withdrawals is the same person who holds the gambling account, under Real Decreto 813/2026. The decree, dated 7 October, was published in the Boletín Oficial del Estado (BOE) on Thursday 8 October 2026 and enters into force on 28 October 2026, twenty days after publication.

The change sits in Spain’s anti-money-laundering regulation (Real Decreto 304/2014, which implements Ley 10/2010). The new article 21.2 says that, when operators verify a player’s identity through online channels, the check must also confirm “that the holder of the payment method used in deposits and withdrawals is the holder of the gambling account” (our translation). It binds operators licensed by Spain’s regulator, the Dirección General de Ordenación del Juego (DGOJ), and applies to Spanish players on those sites.

Six months for existing accounts

The decree’s first transitional provision deals with players who were already registered before the check became mandatory:

• They get six months from entry into force to make the changes needed for the check. Counting from 28 October, that runs to about 28 April 2027 (our calculation; the decree states six months).
• During that period they can keep depositing with the payment methods they already use and keep playing, but they cannot withdraw the winnings they have obtained.
• If the six months pass without verification, the operator must terminate the contract unilaterally and notify the DGOJ. It must then return the remaining balance, including any winnings held back during the transition, subject to its anti-money-laundering obligations.
• Operators get the same six months to adapt their technical systems.

In practice, picture a player who registered in 2025 and funds the account with a card that is in a partner’s name. Under the transitional rule, that player could keep playing after 28 October but would not be able to cash out winnings until the operator had verified a payment method in the player’s own name. Left unresolved until the end of the transition, the account would be closed and the balance returned.

New accounts

For players who open an account from 28 October, the article 21.2 check applies from entry into force. The six-month transitional rule above covers only players registered before that date.

The wider package

Real Decreto 813/2026 is a broad update of Spain’s anti-money-laundering rules. Its preamble ties the revision to the Financial Action Task Force (FATF) mutual evaluation of Spain, which begins in 2026. Alongside the gambling change, it accepts the national ID card (DNI) in physical or digital form, requires remote identification to meet the minimum standards set by Spain’s financial intelligence unit (Sepblac), and extends identity checks to transactions at crypto ATMs. That last change concerns crypto cash machines, not casino cashiers. Separately, SBC News reports that the DGOJ reopened its consultation on a common model for detecting risky play on 13 October.

For a related cashier story, see Polymarket US’s stolen-card fraud case. In Spain, the check is written into the anti-money-laundering rules, with a fixed deadline and a set consequence. For another regulator stepping into the cashier, see the Dutch KSA’s rebuke of 711 over wagering on deposits, and for the wider risk picture, FATF’s report on money-laundering risks in gambling.

What this means for players

If you play on a Spanish-licensed site, deposit and withdraw only with a card, bank account or e-wallet in your own name, and expect your operator to ask you to confirm it. If you already use a method in someone else’s name, change it before the transition ends, or winnings stay locked and the account can be closed. The rule applies to DGOJ-licensed operators; it does not change the terms at sites licensed elsewhere.

18+. Gambling can be addictive. If it stops being fun, see our responsible gambling page.