The European Consumer Centre in Spain (ECC-Spain) informs that, as of 28 October 2026, a new measure has entered into force aimed at strengthening the protection of users of online gambling services and preventing cases of identity theft. This initiative has been promoted by the Ministry of Social Rights, Consumer Affairs and Agenda 2030 and introduced through Royal Decree 813/2026.
As a result, online gambling operators holding a state licence will be required to verify that the holder of the gambling account is the same person as the holder of the payment method used for that account, both for making payments (deposits) and for withdrawals.
According to the information published by the Ministry, this obligation aims to strengthen the protection of users and make it more difficult to use payment methods belonging to third parties, thereby reducing security risks in the digital environment, particularly identity theft.
The measure seeks to address the increase in this type of fraud detected in Spain. According to data collected through the Protocol for Action for Impersonated Taxpayers (PACS Protocol), launched by the Ministry of Social Rights, Consumer Affairs and Agenda 2030 in coordination with the State Security Forces and Bodies and the Tax Agency, reports of identity theft in online gambling increased by 12% during 2025, reaching a total of 8,675 registered complaints.
Likewise, information gathered by the Directorate-General for Gambling Regulation (DGOJ) has shown that individuals engaging in identity theft were using payment methods whose ownership is difficult to verify in real time, such as bank cards and electronic wallets. Similarly, the analyses carried out also indicate that, in some cases, these practices may be linked to activities associated with money laundering.
Six months to adapt to the new rules
The new obligation will apply immediately to new user accounts created from 28 October 2026 onwards (the date on which the measure enters into force). As regards accounts already existing before that date, a transitional period of six months has been established to allow operators to adapt their payment methods and systems to the new requirements.
During this six-month period, users who are already registered will be able to continue making deposits and participating in the games offered by operators. However, they will not be able to withdraw any winnings until it has been verified that the gambling account holder and the payment method holder are the same person.
Once this transitional period has ended, if such a match has not been verified, operators will be required to terminate the contract unilaterally, notify the DGOJ of this circumstance and proceed with the reimbursement of existing balances, including any winnings yet to be paid, without prejudice to the obligations established in relation to anti-money laundering and counter-terrorist financing measures.
Recommendations for users
ECC-Spain reminds users of the importance of protecting their personal and financial data, regularly reviewing activity on their accounts and immediately reporting any unauthorised use or suspicion of identity theft to their financial institution, the relevant gambling operator and the competent authorities.
Source of information: Ministry of Social Rights, Consumer Affairs and Agenda 2030.