Spain tightens iGaming payment checks under Royal Decree 813/2026

Spain has sanctioned new rules that force online gambling operators to verify that the payment method used for deposits and withdrawals belongs to the same person as the gambling account. For PSPs and acquirers serving iGaming, this is a straightforward compliance problem with messy operational consequences: payment ownership now has to line up with account ownership, and withdrawals get blocked until it does.

1. The changes were published in the Official State Gazette (BOE) on 10 October through Royal Decree 813/2026, which updates the regulations supporting Law 10/2010, Spain’s Federal Law on “Preventing Money Laundering & Terrorist Financing Activities.” The decree strengthens player identification and verification of financial transactions on online gambling platforms.
2. The core rule is explicit: “payment ownership must match the gambling account.” Operators must verify that payment methods used for deposits and withdrawals belong to the registered account holder, and Article 21 now requires them to establish that the payment-method holder “is the owner of the gambling account.” Initial transaction verification records must be kept.
3. The rule applies to online gambling transactions conducted through electronic, computer, app and interactive channels. That means the compliance scope is not limited to one payment rail or device type; it covers the full online stack used by iGaming operators and their payment partners.
4. Existing customers get a six-month transition period to complete the checks. During that window, they can keep depositing through their established payment methods and continue playing, but withdrawals of winnings are restricted until payment ownership is verified. The transitional text says affected players “may not withdraw the winnings they have obtained.”
5. After the six-month deadline, operators must unilaterally terminate contracts with customers whose payment ownership is still unverified. They must also submit records of customer activations and terminations to the Directorate General for Gambling Regulation (DGOJ). When accounts are closed, outstanding balances — including winnings withheld during the transition period — must be returned, subject to applicable anti-money laundering and terrorist financing obligations.

Operators also have the same six-month period to adapt their technical systems. In practice, that means payment checks, customer identification and account management logic all need updating at once, which is exactly the kind of change that can expose weak onboarding flows and sloppy payout controls.