Spain’s DGOJ reopens consultation on centralized monthly gambling risk checks for all licensed online operators

Spain’s gambling regulator has reopened a public consultation on a centralized monthly test that would flag online players showing signs of increased gambling risk. For PSPs and operators, the detail that matters is not the consultation theatre but the mechanism: a mandatory, operator-by-operator profiling process with direct consequences for payments, marketing, and account access.

1. The consultation reopened on Tuesday and will remain open until 22 October 2026. The current proposal from the Spanish Directorate General for Gambling Regulation (DGOJ) would require all nationally licensed online gambling operators to run an automated test every month.
2. The test would be run during the first seven calendar days of each month and would review each player’s account activity over the previous 183 days. The mechanism uses a four-stage process on all non-excluded accounts: minimal-activity accounts are filtered out, objective thresholds are applied using four variables, and accounts that meet any threshold are immediately classified as showing “risk behaviour.”
3. For the remaining accounts, operators calculate approximately 48 features based on deposits, withdrawals, bets, session duration, product mix, time of day, use of self-exclusion tools, cancelled withdrawals and payment instrument categories. A model then assigns a probability score, and accounts above the defined threshold are flagged as “in risk behaviour.” The DGOJ says it explicitly excludes external data sources such as social media, browsing history and detailed financial or health records.
4. Once an account is classified as “in risk behaviour,” Real Decreto 176/2023 kicks in. Operators must notify the player and explain the factors behind the classification. The player then has 72 hours to complete an effective interaction; if they do not, the gaming relationship is suspended until they comply.
5. The downstream effects are commercial as much as compliance-related. Promotional activity is prohibited for flagged players, who are also excluded from VIP services and subject to restrictions on marketing communications. The rules also enforce nominative payment methods, ban credit cards, and require players to validate the payment method used.

The DGOJ said it prepared a detailed Data Protection Impact Assessment (DPIA) under the GDPR because the system amounts to large-scale automated profiling with legal consequences. Players can request a review from the operator if they believe the data or rules were applied incorrectly, and unresolved complaints can be escalated to the DGOJ. The first round of consultation in 2025 drew feedback on the included costs of the operations and the accuracy of the model.