Spain’s DGOJ proposes a single monthly risk-detection test for online gambling operators

Spain’s Dirección General de Ordenación del Juego (DGOJ) has reopened a public consultation on a unified system for detecting risky gambling behaviour for state-licensed online operators. For PSPs and payment teams in high-risk gambling, the interesting bit is not the consultation itself but the mechanics: the model explicitly uses payment-method data and can trigger account restrictions, including card bans and payment validation.

1. The consultation runs until 22 October 2026. During this period, operators, providers and legal specialists can review the draft resolution, its annexes and the Data Protection Impact Assessment (EIPD).
2. Under the proposal, all state-licensed online gambling operators in Spain would run the test during the first seven calendar days of each month. Each run would look back at account activity over the previous 183 days.
3. The process has four stages. First, accounts with minimal recent activity are excluded. Then objective thresholds based on four variables are applied, and any account meeting one of them is immediately classified as showing “risk behaviour”.
4. Next, operators calculate around 48 features from deposits, withdrawals, bets, session duration, product mix, time of day, use of self-exclusion tools, cancelled withdrawals and types of payment methods. A model turns those data into a probability score, and accounts above the defined threshold are flagged. The DGOJ says it will not use external sources such as social media, browsing history or detailed financial and health records.
5. Once a player is flagged, the measures in Royal Decree 176/2023 apply. The operator must inform the player and explain the factors involved. The player has 72 hours to interact effectively; if they do not, the gambling relationship is suspended until they comply. Flagged players do not receive promotions, are excluded from VIP services, face limits on marketing communications, cannot use credit cards and must validate the payment method they use.

Players can ask the operator to review the accuracy of the data and the application of the rules. If they still disagree, they can escalate to the DGOJ. The protective measures stay in place during the review, and operators must respect the 72-hour deadline.

The DGOJ also plans periodic assessments using aggregated data and operator reports, and it may adjust variables, thresholds or model parameters when needed. Independent technical audits are also planned. Because the analysis is automated, large-scale and has legal consequences, the regulator has prepared the EIPD under the GDPR.