Spain Mandates Strict Payment Ownership Verification for Online Gambling Under New AML Decree

Spain Mandates Strict Payment Ownership Verification for Online Gambling Under New AML Decree

Spain has introduced tighter anti-money laundering (AML) controls for the digital gaming sector, requiring licensed operators to verify that payment methods used for deposits and withdrawals belong exclusively to the registered gambling account holder. Published in the Official State Gazette (BOE) under Royal Decree 813/2026, the updated framework amends customer due diligence standards to eliminate third-party payment processing across interactive and electronic channels.

Statutory AML Amendments and Payment Verification Protocols

Royal Decree 813/2026 amends Article 21 of the regulatory framework supporting Spain’s primary anti-money laundering law (Royal Decree 304/2014), partially incorporating provisions from EU Directive 2024/1640 into national law. Under the revised statute, online gambling operators must integrate payment ownership checks into standard Customer Due Diligence (CDD) and Know Your Customer (KYC) workflows. The regulation applies across all digital gambling services, including desktop platforms, mobile applications, and telematics services. While the decree refrains from mandating specific technical software solutions granting operators flexibility in system integration it establishes clear compliance obligations to confirm that bank accounts, payment cards, or e-wallets match the identity documentation of the registered player before processing initial financial transactions.

Operational Adaptation and Regulatory Enforcement Timeline

The decree takes effect on October 28, 2026, establishing a strict six-month transitional timeframe ending April 28, 2027, during which both active players and commercial licensees must complete all verification requirements. Throughout this grace period, existing unverified users may continue depositing and participating in games, but operators are legally prohibited from processing any withdrawals of balances or accumulated winnings until payment ownership is fully authenticated. By the April 28, 2027 deadline, operators must update their technical infrastructure, adapt payment gateways, and unilaterally terminate contracts with players whose payment verification remains incomplete. Following contract closures, operators are required to return remaining funds to the source payment method under applicable AML screening protocols and formally report all contract terminations and activations directly to Spain’s Directorate General for the Regulation of Gambling (DGOJ).