Spain has intensified identity verification controls in online gambling, deploying a reinforced led by the Dirección General de Ordenación del Juego anti-fraud framework (DGOJ) under the Ministerio de Derechos Sociales, Consumo y Agenda 2030, headed by Pablo Bustinduy, with regulatory execution overseen by DGOJ Director General Mikel Arana Echezarreta.
The measure, active throughout 2026, does not replace Spain’s core legal framework—anchored in the Ley 13/2011 and the Real Decreto 1614/2011—but introduces a strengthened operational layer through the PACS protocol (Protocolo de Actuación para Contribuyentes Suplantados) and the PhishingAlert system, designed to detect and prevent identity theft in gambling accounts. Implementation is executed through real-time identity validation services integrated into operator onboarding systems, mandatory cross-checks against DGOJ databases, and automated alerts triggered when a registered identity under protection is used.
Operators must ensure continuous verification of active accounts, immediate reporting of inconsistencies, and coordination with DGOJ systems for account blocking or review. The framework also introduces structured remediation flows, requiring operators to request technical evidence and allow correction periods before escalating inconsistencies, effectively embedding fraud control into daily operations.
The urgency is backed by data. In 2025, Spain recorded 8,675 identity theft complaints linked to online gambling, a 12% increase year-on-year, affecting 15,871 gambling accounts—approximately 4% of taxpayers receiving gambling-related fiscal notifications. The issue is concentrated in betting (85% of cases), while online casino fraud surged from 7% in 2024 to 18% in 2025, reflecting a shift in criminal behavior.
Pablo Bustinduy
The system now integrates multiple agencies. The DGOJ leads regulatory enforcement, while the Agencia Estatal de Administración Tributaria (AEAT) manages fiscal implications, and Spanish security forces handle criminal investigations. This cross-agency structure enables real-time identity validation, direct alerts to affected individuals, and tighter control over fraudulent activity impacting both operators and public finances.
For operators, the change raises the compliance bar. Identity verification is no longer a one-time onboarding requirement but an ongoing obligation, with increased reliance on DGOJ systems and higher exposure to sanctions. Spain has already demonstrated enforcement capacity, issuing €142.7 million in fines in 2024 and sanctioning 32 operators with over €33 million in 2025, including market bans for unlicensed activity.
The reform protects a rapidly growing market. Spain’s online gambling sector generated approximately €1.7 billion in GGR in 2025, supported by over 2.1 million active players, 4.3 million accounts, and more than €40 billion wagered, with marketing spend reaching €244 million.
Strategically, Spain is shifting from regulating operators to controlling identities and financial flows. The objective is not higher taxation but cleaner taxation, reducing fraud, improving data integrity, and strengthening institutional trust. For licensed operators, this creates a more stable and transparent ecosystem—though at the cost of higher compliance requirements. For players, it delivers stronger protection against identity theft and fiscal exposure.
The message is clear: Spain is transforming online gambling into a fully monitored digital financial environment, where identity verification, traceability, and fraud prevention define the next phase of market regulation.
