Spain Tightens AML Rules for Online Gambling Payments

Spain is introducing stricter anti-money laundering (AML) requirements for online gambling operators, obliging them to verify payment method ownership and strengthen controls over customer transactions. The measures update the country’s regulatory framework for combating money laundering and terrorist financing.

The changes were established under Royal Decree 813/2026, published in Spain’s official state gazette. Under the new rules, gambling companies must ensure that the person using a payment method to deposit or withdraw funds is the same individual who owns the associated gambling account.

Operators will be required to verify payment ownership when transactions are first conducted and retain records of the checks. As reported by SBC News, the requirements cover gambling services delivered through websites, mobile applications and other interactive digital channels.

Six-Month Transition Period for Operators and Players

The new framework provides a six-month adjustment period for customers and operators to meet the updated requirements. During this time, existing customers may continue depositing funds and using their current payment methods while operators carry out the necessary verification procedures.

However, customers whose payment method ownership has not been confirmed will be unable to withdraw their winnings until the checks are completed.

The transitional provisions state that affected players “may not withdraw the winnings they have obtained” before fulfilling the verification requirements.

When the six-month period ends, operators must close accounts belonging to customers whose payment methods remain unverified. They will also be required to notify the Directorate General for Gambling Regulation (DGOJ) of account openings and closures.

Any funds remaining in closed accounts, including previously withheld winnings, must be returned in accordance with applicable anti-money laundering and counter-terrorist financing obligations.

The transition period also gives gambling companies time to revise their internal systems and procedures, including payment verification, customer identification and account management.

New Requirements Take Effect on 28 October

The updated rules are scheduled to enter into force on 28 October 2026, although individual provisions may follow separate implementation schedules.

The decree also strengthens requirements for remote customer identification. Operators conducting digital identity verification must comply with security standards established by Sepblac, Spain’s financial intelligence authority.

In addition, the legislation formally recognises both physical and digital versions of Spain’s National Identity Document (DNI) for identification purposes.

Businesses will also need to maintain written policies addressing international financial sanctions and related countermeasures.

The changes come as other regulatory initiatives continue in Spain’s gambling sector. These include a DGOJ proposal to introduce a system for identifying risky gambling behaviour, using player data to detect potential harm at an earlier stage.