Spanish online casinos have introduced stricter checks on the ownership of payment methods following regulatory changes that took effect on 28 October 2026. Under Royal Decree 813/2026, gambling operators holding a Spanish national licence must verify that the person registered on a gambling account is also the owner of the payment method used for deposits and withdrawals. The requirement applies to bank cards and other payment instruments, including electronic wallets. It aims to prevent identity theft, unauthorised transactions and the misuse of gambling accounts for financial crime. For players, this means that a successful card payment is no longer sufficient evidence that the payment method belongs to them. Understanding the new rules is particularly important for anyone using multiple cards, shared bank accounts or payment details registered under another person’s name.
The new verification requirement originates from Royal Decree 813/2026 of 7 October, published in Spain’s Official State Gazette on 8 October 2026. The legislation updates several financial regulations, including the rules implementing Law 10/2010 on preventing money laundering and terrorist financing. One of its most significant changes for the gambling industry is the amendment to Article 21 of Royal Decree 304/2014. Licensed online gambling operators must now establish that the owner of a payment method used for deposits or withdrawals is the same person who holds the gambling account. The change applies to operators licensed at the national level, rather than automatically covering every gambling activity regulated separately by Spain’s autonomous communities.
The Spanish Ministry of Social Rights, Consumer Affairs and Agenda 2030 announced that the measure became effective on 28 October 2026. Its introduction followed growing concerns about criminals using other people’s identities to register gambling accounts and move money through online gambling services. According to figures released by the ministry, Spain recorded 8,675 complaints concerning identity impersonation in 2025, representing a 12% increase compared with the previous year. These figures were collected through the authorities’ identity protection procedures and help explain why payment ownership has become a regulatory priority. The requirement is therefore connected to an identified financial security problem rather than simply a new administrative formality.
Previously, a player might successfully deposit money using a card without the casino immediately establishing whether the named cardholder and registered player were the same individual. A payment could be authorised by the bank while the gambling operator still lacked reliable evidence of ownership. This distinction matters because authorisation confirms that a transaction has been approved, not necessarily that the person operating the gambling account legally owns the payment instrument. The 2026 rules address that gap by requiring operators to verify the relationship between the account holder and the source of payments. The obligation also extends to withdrawals, ensuring that incoming and outgoing financial transactions are subject to ownership controls.
Spain’s gambling regulator, the Dirección General de Ordenación del Juego (DGOJ), oversees gambling activities conducted under national licences. The regulator’s findings highlighted the use of bank cards and electronic wallets whose ownership could be difficult to establish immediately. In identity theft cases, someone may register an account using another person’s personal information while controlling the money deposited or withdrawn. This can create consequences for the victim, particularly when financial transactions appear to have been carried out under their identity. Requiring payment ownership to match the gambling account makes such arrangements harder to maintain and gives operators an additional opportunity to detect inconsistencies before allowing withdrawals.
The authorities have also identified possible connections between identity impersonation and organised financial crime. Gambling accounts can be misused to transfer funds between payment instruments, disguise their origins or create misleading transaction records. However, using a third-party card does not automatically establish that a player has committed money laundering. A person might attempt to use a partner’s card with permission or misunderstand the conditions governing payment methods. The regulation focuses on verifiable ownership rather than treating every mismatch as proof of criminal activity. For licensed casinos, the practical obligation is to identify discrepancies and ensure that payments comply with the applicable financial rules.
Payment ownership checks form part of a wider regulatory framework rather than replacing existing player identification requirements. Spanish online casinos already operate under identity verification, anti-money-laundering and responsible gambling obligations. Royal Decree 176/2023 also introduced specific payment restrictions for certain categories of players displaying intensive or risky gambling behaviour. The October 2026 amendment strengthens ownership controls across gambling accounts more broadly, irrespective of whether an individual has been classified as a higher-risk player. It is therefore important to distinguish the new general verification requirement from separate restrictions, including those governing credit card deposits for particular player categories.
Under the updated rules, the essential question is whether the registered player’s identity matches the legal owner of the payment method. Consider an account opened under the name María García. If María deposits using a bank card issued in her name, the ownership requirement can be satisfied once the casino has verified the relevant information. If she uses a card belonging exclusively to her partner, the payment method does not meet the same-owner requirement simply because her partner has given permission. The rules do not establish an exception allowing players to use someone else’s card with their consent. The same principle applies when the gambling account and payment instrument are held by family members living at the same address.
The legislation establishes what operators must verify but does not prescribe one universal procedure that every casino must use for every card. Depending on the payment provider and available information, verification may involve confirmation of the account holder’s name, supporting documentation or other reliable ownership checks. A casino might request evidence from the player’s bank when an ownership match cannot otherwise be established. Players should follow the instructions issued through the operator’s official account or support channels and avoid sending sensitive financial information through unsolicited messages. Verification of card ownership should not be confused with routine payment authentication, such as approving a transaction through a banking application.
Withdrawals are particularly important because the new rules create consequences for players who have not established ownership of their payment methods. A casino may be unable to release winnings while the required match remains unverified, even when the gambling account contains a positive balance. This does not mean every verification delay amounts to confiscation of winnings. The legislation specifically addresses how operators must handle balances and outstanding prizes during the transitional arrangements. Players should distinguish between money being temporarily unavailable pending checks and the permanent loss of funds. The operator’s obligations regarding account closure, repayments and financial crime controls remain relevant if verification cannot be completed.
Players who registered before 28 October 2026 are covered by a six-month transitional period, running towards the end of April 2027. During this period, operators can adapt their payment arrangements and technical systems, while existing customers can take steps to establish ownership of their registered payment instruments. The law permits these players to continue depositing money through payment methods already established on their accounts and to participate in the games offered by the operator. However, withdrawals of winnings cannot proceed until the casino verifies that the owner of the relevant payment method and the registered gambling account are the same person. This restriction makes it sensible to complete verification before accumulating funds that may become temporarily inaccessible.
New customers registering from 28 October 2026 do not benefit from the same transitional arrangement. The ownership verification obligation applies to their accounts immediately. Consequently, someone opening a new account should expect the casino to require a payment method registered in their own name and to establish the ownership match as part of the applicable checks. Providing accurate personal details at registration is particularly important because differences between identity records and payment information may prevent successful verification. The specific documents requested and the time taken to complete the process can vary between operators; the royal decree does not impose a single document checklist or a universal processing time for every customer.
Once the six-month transitional period expires, an existing account that still fails to satisfy the ownership requirement faces more serious consequences. Royal Decree 813/2026 requires the operator to terminate the gambling contract unilaterally and notify the DGOJ if the required identity match has not been established. The operator must also return the remaining account balance, including winnings that could not be paid during the transitional period, subject to applicable anti-money-laundering and counter-terrorist financing obligations. The legislation therefore does not authorise casinos to retain all unverified balances as a penalty. Nevertheless, repayment may remain subject to the checks required by financial law, so affected players should contact customer support promptly and preserve their account and transaction records.
The most useful first step is to review the payment methods saved to an online casino account and compare their ownership details with the name registered on the gambling profile. Cards issued exclusively to another person should not be relied upon for future transactions, even if they have worked previously. Players using supplementary cards, joint bank accounts or shared financial arrangements should ask the casino what evidence it accepts to establish ownership of the specific payment instrument. A jointly held bank account does not automatically prove that every card linked to it is issued in both account holders’ names. What matters is whether the operator can demonstrate that the gambling account holder also owns the payment method used.
Players should also check whether their personal information is accurate and consistent. A change of surname, differences in the order of family names or outdated identification details can complicate verification even when the card legitimately belongs to the registered player. The appropriate response is to update records through the casino’s official procedures and provide supporting evidence where requested. Attempting to create a second account or use another person’s identity to overcome a mismatch can introduce further compliance problems. If a card has expired, been replaced or changed following a bank transfer, the player should confirm how the operator treats the replacement rather than assume that verification of the previous card automatically covers the new one.
Security remains important when providing financial documents. Casino operators may need sufficient evidence to confirm ownership, but customers should verify that any request comes from a legitimate, licensed business before sharing information. Full card security codes, online banking passwords and one-time authentication codes should never be disclosed to someone claiming to perform a routine ownership check. If a casino asks for documentation, players can enquire about the approved upload method, required details and handling of personal data. A verification request should explain what information is needed and why. Anyone who receives a suspicious email or message should access the casino independently rather than follow an unfamiliar payment verification link.
If a payment method fails ownership verification, the first step is to establish the reason. The casino may have insufficient information, the name on the payment record may differ from the registered identity, or the instrument may genuinely belong to a third party. Players should ask support to identify the issue and explain which documents or alternative payment methods can resolve it. Where a card is registered in another person’s name, providing that person’s consent is not a substitute for satisfying the statutory ownership requirement. If verification cannot be completed, the player may need to use a payment instrument they personally own, subject to the casino’s procedures and applicable financial rules.
Where winnings remain unavailable during the transitional period, players should retain copies of withdrawal requests, correspondence, account statements and any confirmation that documents were submitted. It is useful to request a written explanation identifying whether the delay relates specifically to payment ownership or to another verification obligation. If an operator does not explain its decision adequately, the customer can use its formal complaints procedure and, where appropriate, consult the DGOJ’s information about complaints involving nationally licensed gambling operators. The regulator’s involvement does not guarantee an immediate payment or mean that every individual financial dispute will be resolved in the player’s favour. Clear documentation nevertheless helps establish the sequence of events and the nature of the disagreement.
The October 2026 changes establish a straightforward principle with significant practical consequences: the person who registers and controls a Spanish online gambling account must also be the verified owner of the payment methods used for deposits and withdrawals. For new accounts, this requirement is already effective; for older accounts, the six-month transitional arrangements create a defined opportunity to correct discrepancies before mandatory account termination becomes relevant. Players who review their cards, resolve identity differences and complete checks through official channels are better placed to avoid interruptions when requesting withdrawals. The authoritative legal text is Royal Decree 813/2026, available through Spain’s Official State Gazette at https://www.boe.es/buscar/doc.php?id=BOE-A-2026-20915.