Betting shops and online gambling operators in Spain have been required since last Wednesday, October 28, to check that the account holder matches the owner of the means of payment used to deposit or withdraw money. The new regulation, promoted by the Ministry of Social Rights, Consumption and Agenda 2030, introduces additional controls over the economic transactions carried out on these platforms with the aim of preventing a person from using bank cards, accounts, or electronic wallets belonging to third parties.
The measure is set out in the Royal Decree 813/2026, of October 7, which amends different provisions related to the financial sector and the prevention of money laundering. Its application affects online gaming operators with a state license, who must verify the identity of users and check that the payment methods associated with each account belong to the same person. The obligation applies both to deposits and to withdrawals, so it will not be enough for the player to have proven their identity through the DNI if they later use a means of payment whose holder does not match that of their gaming account.
The change responds to the increase in complaints related to identity theft in the sector. According to data collected by the General Directorate for the Regulation of Gambling (DGOJ), in 2025, 8,675 complaints were registered for this type of fraud, 12% more than during the previous year. The authorities have detected that some fraudulent operations are carried out using payment methods whose ownership is particularly difficult to verify in real time, such as certain bank cards and digital wallets.
What changes when paying in betting shops and online gaming platforms
The main new feature is that operators must explicitly check that the holder of the gaming account is also the holder of the means used to carry out money transactions. This verification is added to the identification checks they were already required to apply when a person registered on a betting platform.
In practice, a user who has a registered account in their name must use a payment method whose ownership can be proven as their own. They may not freely use a bank card belonging to another person to deposit funds, even if it is a family member, their partner, or someone who has authorized them to use it, if the requirement of coincidence established by the regulations is not met.
The obligation also affects withdrawals of money. This means that the platforms must verify that the identity of the holder of the chosen method for collecting funds matches that of the registered user. The purpose is to prevent accounts from being used to move money between different people without proper identification of who is actually involved in the transactions.
The rule does not establish that all players have to use a single payment method, but rather requires verifying the ownership of those that are used. Nor does it imply the disappearance of cards or electronic wallets as payment systems, although operators must have sufficient mechanisms to verify to whom they belong.
When the new regulation takes effect and who has to adapt
The new obligation came into force on October 28, 2026, but its application distinguishes between accounts created from that date and those that were already registered beforehand.
Users who sign up at an online betting house from October 28 onward must comply with the new requirements from the moment they begin using the gambling services. Therefore, the platform will have to verify that the payment methods used belong to the same holder listed on the account.
By contrast, players who were already registered before the entry into force have a transitional period of six months, until April 28, 2027, to make the necessary changes. During that time, operators will also have to adapt their technical systems and establish the procedures that allow identities to be correctly verified.
This difference prevents all old accounts from being subject immediately to the same contractual consequences as new ones. However, the adaptation period does not mean that users may continue withdrawing winnings without verifying the ownership of their payment methods, since the regulation introduces specific restrictions for these operations from the moment it enters into force.
What happens if you have money or prizes pending withdrawal
One of the most important consequences of the new regulation affects those who already have an open account and use payment methods that have still not been verified. During the transitional period of six months, these players may continue depositing funds with the methods they had set up and participate in the games offered by the operator, but they will not be able to withdraw the prizes obtained until the match in ownership is verified.
Therefore, although a user has obtained a prize and is entitled to collect it, the platform must first verify that the gaming account and the method used to carry out the withdrawal belong to the same person. This restriction seeks to prevent money from being transferred through financial instruments associated with different identities.
The regulation also contemplates what will happen when the adaptation period ends. If on April 28, 2027 the match in ownership has not been accredited, the operators must unilaterally terminate the user's contract and communicate this circumstance to the Dirección General de Ordenación del Juego.
However, the closing of the account does not mean that the player automatically loses the money they had deposited. The Royal Decree establishes that, in those cases, the platforms must return the existing balances, including prizes pending payment, always respecting the applicable legal obligations regarding prevention of money laundering and financing of terrorism.
Why the Government is tightening controls: more than 8,600 complaints for identity theft
The tightening of the requirements responds to the growth of fraud related to online gambling. According to the Ministry of Consumer Affairs, complaints for identity theft increased by 12% during 2025, reaching 8,675 registered cases, an evolution that has led to strengthening controls over the economic operations of the platforms.
The data come from the Protocol of Action for Impersonated Taxpayers (PACS), developed by Consumer Affairs in coordination with the State Security Forces and Corps and the Tax Agency. This system is intended to address situations in which a person discovers that their data have been used by third parties to open accounts or carry out gambling activities without their authorization.
The General Directorate for Gaming Regulation has identified that those responsible for some of these practices resort to cards and electronic wallets whose ownership is not easy to verify immediately. In addition to facilitating the fraudulent use of personal data, these operations can generate tax consequences for the victims, especially when gains or financial movements that they have not actually carried out appear associated with their identity.
The Ministry also warns that some of these behaviors may be related to activities of criminal organizations linked to money laundering. For this reason, the reform is not limited to strengthening consumer protection, but also amends the anti-money-laundering regulation to improve the traceability of the funds used in online gambling.
What users who already have a betting account should do
People who have an account on an online betting platform must check that their payment methods are associated with their own identity and respond to the verification requests that operators may make. The companies will be responsible for applying the necessary technical procedures to comply with the rule, so the specific documentation they request may vary depending on the payment method used.
If a card or account belonging to another person has previously been used, it will be necessary to regularize the situation with the operator before being able to withdraw winnings. It is also advisable to review the registered personal data, check which payment methods appear linked and contact customer service if there is any discrepancy in ownership.
For their part, the European Consumer Centre in Spain advises protecting personal and financial data, periodically reviewing account movements and reporting any suspicious operation or unauthorized use of identity. If a person detects that their data has been used without their consent, they can inform their financial institution, the corresponding platform and the competent authorities.
The new regulation does not mean the prohibition of online betting nor does it eliminate existing gaming accounts, but it introduces an additional requirement that directly affects the way of depositing and withdrawing money. Since October 28, the player’s identity and the ownership of the payment method must match, while old accounts have until April 2027 to complete the adaptation.
The main date users should keep in mind is April 28, 2027, when the six-month transitional period will end. Until then, those who have still not proven ownership will be able to continue participating in the games under the conditions provided by the regulation, but they will have to complete verification in order to collect their winnings and avoid the closure of their account.