Key Points
- Every online operator in Spain will have to follow the same rules every month, using a model trained by the regulator, rather than coming up with their own risk rules as they see fit.
- Players who get flagged won’t be able to get bonuses, perks, or credit cards for at least 6 months and will have 72 hours to respond. It’s a big change.
- The regulator has had to revisit the plan after the data protection agency raised some major concerns, but operators are also still fighting about how much it’s going to cost them.
Spain Gets Tough on Problem Gambling Detection
You’ve probably come across online casinos reaching different conclusions about the same player. In Spain that’s been perfectly okay, but the regulator is now saying that’s got to stop. The Dirección General de Ordenación del Juego (DGOJ) has put its mandatory risk detection mechanism back out for public comment. You have until Oct 22nd 2026 to have your say on the plan, just 7 working days.
A privacy watchdog was the one that sent the draft back, not the gambling industry itself. According to European Gaming, the Spanish Data Protection Agency (AEPD) kicked it back on June 15 2026 and one of its main concerns was that the original draft didn’t explain why each of the 48 variables in the model was actually needed. The DGOJ has since tightened up the rules on personal data and given players a bit more control over their information.
The regulator is still saying that the point and the core design of the system hasn’t changed, but it’s clear that the new rules do have a big impact on how the system works in practice, which is why they’re giving the public another look.
Inside the Monthly Check All Operators Will Have to Run
Each month operators will have to run the risk check within the first week or so. The check looks back 183 days of activity across all of a player’s accounts with that operator.
Casual players get a free pass. If a player has made fewer than 2 deposits, or fewer than 2 days of activity, they’re pretty much clear to go. The same applies to anyone who’s made fewer than 10 bets combined with fewer than 5 sessions, poker tournaments or lottery entries. Next comes a quick little formula that’s built on active days, net results, stakes, and deposits, and anyone who comes out high on this score is flagged straight away.
Everyone else gets a proper risk score from machine learning. Gaming.net has taken a look at the annexes and it seems the DGOJ has trained an XGBoost decision tree model, which they’ve shared with operators in JSON format. This 48-variable model looks at lots of different things, like deposits, withdrawals, cancelled withdrawals, session length, and product mix. Even things like self-exclusions over 4 years count, and how often a player lets their balance drop to 2 euros or less before they put in another deposit. If a player gets a score of 0.3312868 or higher then they’re marked down as a risk.
But to be clear, social media activity, browser history, location data and health records are all out, and this system is just a regulatory label, not a medical diagnosis.
The Significance of Red Flag for the Player
After being flagged, the player comes under protection mechanisms established in the Royal Decree 176/2023. An operator has to contact the player, who has to respond within 72 hours. Otherwise, the account gets blocked until the player replies.
Bonuses, VIP status, and marketing messages will be disabled for the flagged player. All payments have to be made using instruments in the player’s own name, while credit cards are forbidden. The flag remains for at least six months, and any new positive result will reset this duration.
Transparency became the biggest contribution of the AEPD to the text. Operators have to disclose the period of assessment and main reasons for the decision in an understandable form. According to iGaming Times, such reasons will come from SHAP explainability values, as the score by itself would be insufficient. A player can appeal the decision of an operator and then file complaints to DGOJ, but all protection mechanisms remain.
Commercial use of the results is strictly prohibited. Operators are not allowed to use information to promote their activities, segment customers, estimate profitability, and make decisions about credits.
Why the Same Player Might Get Contradictory Results?
Risk detection was already required in the Royal Decree 176/2023, but there was an opportunity to create their own criteria. Thus, the result was rather unpredictable.
DGOJ analysed risk detection mechanisms of 55 operating operators. Sixteen operators flagged no more than 0.1% of the accounts, and only six flagged more than 4%. The rate of flags ranged from 0 to 13.6%, while the regulator states that customer differences cannot be an explanation.
It is worth mentioning how the algorithm learned the risk factors. The DGOJ cooperated with associations of former gambling addicts FEJAR and AZAJER and Bellvitge University Hospital. Such cooperation gave 394 valid player profiles, while the algorithm used a randomly selected sample of 3,456 accounts.
Lawyers predicted the advantage for operators a long time ago. In September 2025, the partner of DLA Piper Elisa Lorenzo mentioned the higher predictability in courts after the adoption of unified standards.
Industry Riled Up and a Bill That’s Causing Headaches
The consultation that kicked off on August 28 and wrapped up on September 25, 2025, brought in a total of 18 submissions from parties like JDigital, the association representing bettors AEJAD, and detection firms Mindway and OpenBet Neccton.
Most of the respondents basically wanted the DGOJ to take charge of detection themselves and let operators get on with implementing the measures. Of course, other complaints were also flying in about the number of variables in the system, the need for independent audits, giving room for human judgment and the time given to get up to speed.
The whole bill has still got people steamed up, and it’s looking like it’s the point of greatest contention. The DGOJ is putting the tab for adapting to all this at €129,442 per operator, which would come in at a whopping €7.4 million across the 57 licensees they have. JDigital took issue with this in their submission, claiming it would cost a whopping €170,000 per operator and they’d have to deal with 62 variables; that’s now been revised, but still. Meanwhile AEJAD’s got a whole different view, saying that their new model failed to spot a player with €69,060 in net losses over 183 days, a pretty big failure in anyone’s book.
Lottery products, on the other hand, have been left right out of this, a glaring weakness that critics were pointing out from the get-go. SBC News picked up on how state operators SELAE and ONCE were being left out, despite the lottery being the most popular form of gambling in Spain, which is a pretty big deal. Just two months earlier, at the Gaming in Spain Conference in Madrid back in July 2025, director general Mikel Arana was telling delegates that this was still something the DGOJ were dead serious about.
From Consultation to Enforcement, The Wait Begins
It’s going to be a couple of months before this all actually starts getting implemented, with the go-ahead due to appear in the Official State Gazette, or Boletín Oficial del Estado for short. Meanwhile, the DGOJ is going to be using the same calculation to monitor things and bringing in an outside consultancy to see how it all plays out.
On top of all this, operators are going to have to deal with a whole lot of other new duties that are kicking in at the same time, not to mention the ones that came in back in June when cross-operator deposit limits were approved. And come October 28, Royal Decree 813/2026 is also going to be requiring operators to confirm that the payment methods being used belong to the actual account holder, with a six-month transition period for existing customers to get up to speed. Focus Gaming News reports on the cross-operator deposit limits and payment method requirements.
Expert Take: Spain Built a New Risk By Fixing the Wrong Incentive
Let’s cut to the chase: I don’t think a spread going from 0% to 13.6% just happens by accident. A player’s flagged and then loses out on all those vip perks and marketing benefits, so every single one of those missed flags means a whole lot of revenue is up for grabs. The DGOJ’s own impact report basically admitted that operators might just relax their detection to get ahead of the competition. So, for me, it’s pretty clear that one binding model is the only honest way to go.
Now, our support ends at the principle, that’s because the model learned risk from a total of just 394 identified people and now has to make a call on a market of more than two million active players. Plus, it scores each operator separately, which means it can’t actually see when a player is just spreading their losses across a whole bunch of different sites. And that’s why AEJAD’s €69,060 case has been totally brushed under the carpet by the regulator; I think a proper explanation from them is way overdue.
Responsibility is being quietly kicked under the rug in this whole setup. Operators will be the ones dealing with all the fallout when the model gets it wrong and there’s nothing they can do about it. They pay around €130,000 to install it in the first place, and then they’re left to pick up the tab for the damage to their reputation.
Publishing the model’s parameters is only half the job done; until the DGOJ comes clean with those false positive and false negative rates, players are going to have to just take it on faith that this thing’s actually working.
Share
3 views
