Spain’s gambling regulator is consulting on a common system for identifying risky gambling behaviour across nationally regulated operators. The proposal would standardize how accounts are assessed and trigger existing player protections; it is not yet in force.
Published October 13, 2026.
The Dirección General de Ordenación del Juego, or DGOJ, opened a new round of public consultation on October 13. Interested individuals and organizations can submit comments until October 22, 2026.
For players, the consequences could be noticeable: a risk classification can mean losing access to bonuses, receiving a message from the operator’s responsible gambling team, or facing restrictions on payment methods. Those protections already exist in Spanish law. The proposed change concerns how operators decide who falls into that category.
Why Spain Wants a Common Assessment
Spanish operators already have to detect risky gambling behaviour. Under Real Decreto 176/2023, they must use indicators such as the amount, frequency, and variation of gambling activity and deposits.
However, companies have developed different detection systems. The DGOJ’s supporting assessment argues that this can produce uneven protection and give operators with less demanding criteria a competitive advantage.
Consider two people with similar betting patterns using different websites. If one company flags the behaviour while another does not, only one person may receive the associated protections. A shared assessment is intended to reduce that inconsistency.
It would not remove operators’ ability to use additional safeguards. It would give them a common mechanism they must apply alongside any complementary checks.
How the Monthly Check Would Work
Each operator would run the assessment during the first seven calendar days of every month, using activity from the preceding 183 days. For customers with a shorter history, it would use the available records.
The process has four stages:
- Identify occasional players: Accounts meeting the draft’s low-activity conditions are excluded from further assessment under this mechanism.
- Check direct-risk criteria: Some players would be classified through a defined calculation without going through the full predictive model.
- Calculate account variables: Operators would prepare the required measurements for the remaining players.
- Apply the common model: The system would determine whether the result crosses the risk threshold.
The assessment would cover a player’s accounts within that operator. It is not described as a single profile combining activity from every gambling website.
For example, someone using two separate operators would be assessed using the records each company holds. Consistent rules do not give either company a complete picture of that person’s gambling elsewhere.
What Information Would Be Used?
The technical annex sets out 48 variables derived from account activity. These cover matters such as deposits, withdrawals, gambling results, activity levels, and cancelled withdrawals.
The proposed model uses XGBoost, a method based on decision trees. Operators would apply the DGOJ’s supplied model rather than choose their own replacement.
The revised documentation also limits where information can come from. The explanatory note excludes external sources, clinical data, questionnaires, and personal communications from the common assessment.
That distinction matters. A system checking gambling records has a narrower purpose than one trying to infer a person’s health or financial circumstances from unrelated information.
What Happens When a Player Is Flagged?
A risk classification is not a clinical diagnosis of gambling addiction. It is a regulatory category used to activate safer gambling measures.
Under the existing Spanish framework, the operator’s responsible gambling team must contact the player and explain the situation. The communication includes information about recent activity and spending, available control tools, and the restrictions that apply.
The protections include:
- No promotional offers.
- Exclusion from VIP services.
- Restrictions on commercial messages sent by email or equivalent channels.
- Use of payment methods belonging to the player.
- A prohibition on credit-card deposits.
The operator must obtain an active response to its contact. An automated email read receipt is insufficient. If effective interaction is not established within 72 hours of sending the communication, the operator must suspend gambling until that interaction occurs.
Being flagged therefore does not automatically mean an immediate permanent account ban. The response depends on the applicable protections and whether the required interaction takes place.
Can Players Challenge the Result?
Under the draft, players could ask the operator to review the data, calculations, application of the mechanism, and resulting measures. Errors would have to be corrected, with the classification removed where it was unjustified.
A player who disagrees with the review could complain to the DGOJ. Requesting a review would not itself suspend the protections.
The proposed classification would ordinarily last at least six months. After that period, a new assessment finding no risk would allow it to be lifted. A further risk finding would restart the minimum period. Correction of an erroneous classification is a separate issue.
Privacy Rules Would Restrict Commercial Use
The updated proposal follows a Spanish data protection authority report issued on June 15, 2026. The accompanying explanatory note describes stronger safeguards around the use of personal information.
Data, calculated variables, and risk classifications could not be reused for advertising, customer segmentation, profitability assessments, or commercial risk decisions. Operators would have to separate this processing from other uses and restrict access to authorized staff.
Players would also need a clear explanation of the factors contributing to the result. Simply sending a score would not explain why their account had been flagged.
What Operators Would Need to Prepare
The DGOJ’s supporting assessment estimates adaptation costs at roughly €130,000 per operator. This is a regulatory estimate, not a fixed fee.
The work would extend beyond installing a model. Companies would need reliable account records, staff able to explain classifications, and a process for reviewing disputed results.
For instance, a cancelled withdrawal recorded incorrectly could affect an input. A useful review must check the underlying transaction as well as whether the model ran correctly.
When Could the Rules Take Effect?
The consultation deadline is October 22, 2026. The draft proposes that the resolution take effect two months after publication in Spain’s official gazette, the BOE.
That does not establish a launch date. The text remains a proposal and may change before adoption.
For players, the next document to watch is the final resolution: it will determine which assessment rules operators must use, when they must start, and how customers can understand and challenge the results.
I’m Alex Mercer, a senior gaming and esports writer at GamingImba. I’ve been involved in gaming for as long as I can remember, and for more than a decade I’ve been writing about competitive play, industry trends, and the culture that grows around games.
My work focuses on esports, online gaming platforms, and how technology continues to shape the way people play, compete, and connect. I’m especially interested in meta shifts, balance changes, and the business decisions that influence modern games behind the scenes.
At GamingImba, I aim to break down complex topics in a way that’s clear, honest, and useful—whether that means analyzing a major tournament, exploring new gaming platforms, or looking at how player behavior evolves over time.
I follow global esports scenes closely, experiment with different games and mods in my free time, and enjoy digging into the details that most players notice but rarely stop to question.
