Spain Ties Every Gambling Withdrawal to Payment Ownership

Spain has just outlawed a common shortcut in online gambling payments, and it did it with a clause most operators will skim past. Since 28 October 2026, a verified player account is no longer enough. Under Royal Decree 813/2026, every licensed operator must prove that the person who owns each card, bank account or e-wallet used to deposit or withdraw is the same person who owns the gaming account.

For new players, the check applies now. For everyone already on your books, the clock is running. Existing players can keep depositing and playing, but they cannot withdraw winnings until the match is verified. Accounts still unmatched after six months must be closed.

Read that again. You are about to tell part of your Spanish base that they can keep giving you money but cannot take any out. If you think that will go quietly, you have never run a support desk.

What the Decree Actually Says

Royal Decree 813/2026 is dated 7 October 2026 and was published in the Boletín Oficial del Estado (BOE) no. 250 on 8 October under reference BOE-A-2026-20915. It entered into force 20 days later. The BOE lists the issuing department as the Ministerio de Economía, Comercio y Empresa, with the decree proposed by First Vice-President and Economy Minister Carlos Cuerpo Caballero.

This is not a gambling statute. It amends the regulation implementing Law 10/2010 on money laundering and terrorist financing, along with other financial-sector decrees, 11 in total by iGB's count. It partially transposes Directive (EU) 2024/1640, part of the EU AML package, and the preamble frames the reform partly around Spain's FATF (GAFI) mutual evaluation, which begins in 2026.

The clause that matters is the new Article 21.2. For gambling operators acting through electronic, computer, telematic and interactive channels, verifying a customer's identity now also means checking that "el titular del medio de pago usado en depósitos y retiradas es el titular de la cuenta de juego". The holder of the payment method used for deposits and withdrawals must be the holder of the gaming account.

According to EFE, the rule covers online operators holding a state licence. iGB puts the consequence bluntly: a verified account on its own no longer satisfies the rule. Each card, bank account or payment gateway must be shown to belong to the player.

Deposits Stay Open, Withdrawals Do Not

Transitional provision one is where this stops being a legal problem and becomes an operational one. Players registered before the obligation took effect have six months to make whatever changes are needed to pass the check. During that window they can keep depositing with their existing payment methods and keep playing. They cannot withdraw any winnings.

If the match is still not verified when the six months run out, the operator must terminate the contract unilaterally and notify the Dirección General de Ordenación del Juego (DGOJ). Existing balances, including winnings withheld during the transition, must be returned, subject to AML/CFT obligations. The decree says six months from entry into force. iGB puts that at 28 April 2027, which matches the arithmetic, though the BOE text gives no calendar date.

Operators get the same six months to adapt their technical gaming systems. That is not generous. Your system changes and your customer remediation run on one clock, and remediation cannot properly start until the system can verify anything.

iGB spells out who gets caught: players who have been using a partner's or relative's card will need to switch to one in their own name before they can cash out. Every operator knows these players exist. Few have counted them. iGB also warns that blocking withdrawals risks more complaints and support tickets at exactly the moment players most want their money. That is a polite description of a queue of angry customers convinced you are sitting on their winnings.

Why Spain Went Blanket Instead of Targeted

EFE attributes the rollout to the Ministerio de Consumo, headed by Pablo Bustinduy, and says the aim is to protect online gambling users and prevent identity impersonation. Reports differ on which ministry owns the measure, but the BOE is the authoritative record for the legal instrument.

The number behind it, according to EFE, is 8,675 identity-impersonation complaints in gambling in 2025, up 12%. EFE says the data came from a protocol for impersonated taxpayers that Consumer Affairs runs with the state security forces and the Agencia Tributaria. The same data, EFE reports, showed impersonators using payment methods whose ownership is hard to verify in real time, including bank cards and e-wallets, and suggested links to criminal organisations involved in money laundering.

Here is the part operators should sit with. According to iGB, the DGOJ had proposed the own-name payment principle only for at-risk players, through its draft risk-detection test. The decree extends it to everyone.

That is what happens when a regulator stops believing the industry can target its own controls. A risk-based approach is a privilege, not a right. It survives only as long as supervisors trust that operators are finding the risky accounts themselves. When impersonation numbers keep climbing, the targeted rule becomes a universal one, and the cost lands on every operator, including the ones who were already doing it properly.

Your Payment Stack Is Now Part of Your KYC

iGB says the most immediate task is technical: platforms need a reliable way to confirm the name behind every card, bank account and e-wallet a player uses, for deposits and withdrawals alike. That sounds simple until you check what your providers actually send you.

The decree does not specify verification methods. No official DGOJ or Sepblac guidance on acceptable approaches, whether card-name checks, account-ownership lookups or e-wallet attestations, has surfaced in the reporting. iGB, citing Sector del Juego, reports that the association Jdigital has asked the authorities for an interpretive guide to provide legal certainty, and says operators are working without detailed guidance. None of the sources address instruments without a named holder, such as prepaid vouchers.

Yogonet reports that operators must keep records of the verification checks on initial transactions. The decree also tightens remote onboarding: where identity is proven through other secure remote procedures, those must meet the minimum requirements in general authorisations published by Sepblac, Spain's financial intelligence unit.

The practical reading is uncomfortable. If a payment method in your cashier cannot return verifiable holder data, it is a liability in Spain. Your PSPs and wallet providers are now links in your identity verification chain, and if they cannot evidence ownership, you carry the gap in front of the regulator. Waiting for a guide that may not arrive before the deadline is not a plan. Build to the strictest reasonable reading and loosen later if guidance allows.

The Rest of the Pile Landing at the Same Time

The payment-ownership rule does not arrive alone. The same decree requires every obliged entity to approve in writing, and apply, policies and procedures on international financial sanctions and countermeasures, with a structured sanctions procedure added to internal controls under new letter o of Article 33.1. The identification threshold for lottery and gambling prize payouts stays at €2,500. Provisions on the digital DNI and on keeping information obtained through electronic identification apply 18 months after publication.

Then there is the DGOJ's own agenda. Yogonet reports that the regulator opened another public consultation on its common risky-gambling detection algorithm framework on 13 October 2026. Zona de Azar reports that the DGOJ intends to launch its centralised cross-operator deposit limit system on 25 March 2027, roughly a month before the existing-account deadline. Reported figures for the cap vary and have not been confirmed against an official text.

Zona de Azar names CIRSA and Codere among the companies that must comply for their digital operations. If the domestic heavyweights are in scope, nobody gets a quiet exemption.

For operators elsewhere in Europe, the lesson is bigger than Spain. This decree partially transposes an EU directive. Whether other member states copy Article 21.2 is unknown. But a regulator facing FATF evaluation has just shown how easily a payment-ownership rule can ride inside a general AML update, and other supervisors will have noticed.

What to Do Before the Deadline

You have less time than six months suggests, because remediation needs a working system and players need warning before they need to act. Work through it in this order:

1. Count the exposure. Flag every existing Spanish account where payment method holder data is missing or does not match the account name. That number is your support load and your churn risk.
2. Interrogate your PSPs. Ask each provider, in writing, what holder data they return for cards, bank transfers and e-wallets. Any method that cannot evidence ownership needs a fix or a replacement.
3. Lock down new accounts first. The obligation already applies to new players. If they can still add unverified methods, you are exposed today.
4. Warn existing players now. Explain the rule, the withdrawal block and the deadline before they discover it at the cashout screen.
5. Script the closures. Decide how you will terminate, notify the DGOJ and return balances, including withheld winnings, within your AML/CFT obligations.
6. Log every check. When guidance arrives, you want evidence, not assurances.

The operators who struggle with this will not be the ones who misread the law. They will be the ones who filed it as a compliance memo and left it with legal. This is a payments project with a regulatory deadline. Put your payments lead in charge of it this week, and give them the authority to switch off any payment method that cannot prove who owns it.