All 45 Spanish standards,
organised by theme

Article 9 of Law 13/2011 creates three classes of general licence — 'apuestas' (betting), 'otros juegos' (other games, covering casino and poker) and 'concursos' (contests). Each general licence is the prerequisite for any singular licence in that category and is awarded through public tender procedures called by the Ministry of Finance.

Singular licences authorise specific products — roulette, blackjack, punto y banca, complementary games, slots, bingo, Spanish poker, cash poker tournaments, fixed-odds sports betting, mutual sports betting, cross betting, fixed-odds horse betting and mutual horse betting. They sit underneath a general licence and are granted on demand against published technical requirements.

Directors, de facto managers and shareholders holding a significant stake must demonstrate honorabilidad comercial y profesional — no relevant criminal convictions, no insolvency proceedings, no prior gambling-licence revocations and no links to unlicensed operators.

Order HAC/265/2024 and its predecessors require the DGOJ to grant a technical operating authorisation once the platform, internal-control systems and monitoring interfaces pass homologation. The licence is not effective until the operating resolution is issued.

Article 21 of Royal Decree 958/2020 introduced the cuenta de usuario registrado — a mandatory pre-contract account that must be created and fully identified before the operator may send any personalised commercial communication or allow play. The account binds the player's identity to a single operator.

Operators must identify the player using DNI, NIE or passport and verify the data through the DGOJ's identity-verification service, which cross-checks RGIAJ self-exclusion, minimum age, and previously registered duplicates. Unverified accounts cannot deposit, bet or withdraw.

Where the online identity cross-check cannot be fully confirmed, the operator has thirty calendar days to obtain documentary proof (copy of the ID, proof of address). Accounts not verified within the window must be blocked and pending balances returned.

Persons under eighteen, those entered in the RGIAJ self-exclusion register, bankrupts in proceedings, shareholders and directors of the operator itself, and sport participants betting on their own competition are all barred from opening or funding a player account.

Each verified player may hold only a single account per operator. Operators must run continuous duplicate-detection against name, date of birth, DNI/NIE, device fingerprint and payment instrument, and close duplicates as soon as they are identified.

Royal Decree 176/2023 sets mandatory default deposit limits that apply automatically to every new account — EUR 600 daily, EUR 1,500 weekly and EUR 3,000 monthly. Players may lower them immediately but may only raise them after a cooling-off period and additional identity reassessment.

Operators must identify 'participantes intensivos' — players whose activity exceeds defined deposit, loss or time thresholds — and place them under enhanced behavioural monitoring. The regime applies the strictest rules of the decree to this group.

Players aged between eighteen and twenty-five are subject to lower default deposit limits and stricter bonus eligibility rules, reflecting DGOJ research on gambling-harm prevalence in the younger cohort.

Operators must interrupt continuous play with a reality check at least every sixty minutes, showing cumulative deposits, stakes, winnings and time spent, and offering the player the option to end the session or change limits.

Where a player exhibits risk markers — rapid limit increases, chasing losses, late-night sessions, cancelled withdrawals — the operator must carry out a documented interaction before the next session, with evidence kept in the RG file.

Operators may not accept credit-card deposits, offer credit for play or enable any form of deferred payment. Debit-card deposits are permitted but must be traced to an account in the player's name.

A visible 'juego seguro' panel must let players set and reduce deposit, loss, wager and time limits, activate session reminders and enter temporary or permanent self-exclusion, without any customer-service friction.

The Registro General de Interdicciones de Acceso al Juego is the single national self-exclusion register maintained by the DGOJ. Entry on the register is an absolute bar to opening, funding or playing on any Spanish-licensed account.

Order EHA/3080/2011 sets out the procedure for entering RGIAJ — the player submits a signed application through the DGOJ's sede electrónica, by post, or through a licensed operator who forwards it. Exclusion is for a minimum period and is not revocable inside the initial window.

Beyond RGIAJ, operators must offer an internal self-exclusion covering their own platform for periods of at least one, three or six months, and permanent. Internal self-exclusion must also suspend all marketing communications across every channel.

Article 13 prohibits the use of celebrities, athletes, persons of public relevance, or any figure likely to attract minors, in any form of gambling advertising — including audiovisual, digital, print, outdoor and in-venue.

Gambling advertising on television, radio and video-sharing services is confined to the 1:00–5:00 a.m. window. Sponsorship of sporting teams and competitions is banned, with only limited exceptions during the permitted hours.

Welcome bonuses and other inducements aimed at new unregistered users are prohibited. Operators may still offer promotions to users who have completed verification and who are not in the protected intensive-player or young-adult cohorts.

Communications on social media, via influencers, and in closed channels such as private messaging are treated as advertising and must comply with the same prohibitions. Influencer contracts must bind the individual to the legal regime.

All gambling advertising, and every licensed site, must display the 'Juego Seguro' / Jugar Bien seal and a prominent safer-gambling message. The seal links to the DGOJ's public safer-gambling microsite.

Operators remain legally responsible for the commercial communications issued by their affiliates. Every affiliate relationship must be contracted, logged and auditable, with the operator able to enforce take-downs on demand.

The technical resolutions require every operator to implement a Sistema Técnico de Juego covering the gaming platform, RNG, player account module, payments interface and monitoring feeds. The system must be certified by a DGOJ-accredited laboratory before launch and re-certified after every material change.

The RNG used for every game must be certified for statistical randomness, unpredictability, non-regeneration and tamper-resistance, with results published at least annually and available on request.

Operators must maintain real-time data feeds to the DGOJ's monitoring platform covering registrations, deposits, stakes, wins, withdrawals and responsible-gambling events. Downtime on the feed must be logged and reported.

Material incidents — outages, payment failures, RNG interruptions, cyber events, feed disconnections — must be notified to the DGOJ within the statutory window, with a full post-incident report and remediation plan to follow.

Before a player wagers on a game the operator must display the game rules, the return-to-player percentage and any bet limits in accessible language, with the rules stored in the game's regulatory file.

Licensed online gambling operators are listed as obliged entities under article 2 of Law 10/2010 and must implement the full AML/CTF regime — customer due diligence, record-keeping, reporting, training and an internal control body.

CDD must be performed at onboarding and refreshed during the relationship. For online gambling, CDD is triggered before any cumulative movement of funds equal to or above EUR 2,000 and at any suspicious threshold set by the operator.

Enhanced due diligence applies to high-risk players, politically exposed persons and any situation where the standard measures do not give adequate assurance. Source-of-funds evidence is required before further activity continues.

Where knowledge or reasonable suspicion of money laundering or terrorist financing arises, the operator must report to SEPBLAC without delay and must not tip off the customer. Reporting is protected from civil and contractual liability.

Player balances must be segregated from operating funds and backed by the licensee's deposited guarantee. Shortfalls in segregation trigger immediate reporting to DGOJ and corrective top-ups.

Deposits and withdrawals must use payment instruments in the player's verified name, and withdrawals are preferentially returned through the original deposit route to mitigate laundering and fraud.

Operators may not impose withdrawal friction designed to discourage cashing out — no bonus-clawback on withdrawal, no forced reverse-withdraw pop-ups and no 'pending' window that resets after a player re-logs in.

The gambling-activities tax under article 48 of Law 13/2011 applies 20% of gross gaming revenue to state-wide online activities (casino, poker, contests), with bespoke rates for mutual betting and variations for licensed activities run from the autonomous communities of Navarra, País Vasco and the Canary Islands.

Modelo 763 is the monthly self-assessment return for the gambling-activities tax, filed through the AEAT portal within twenty calendar days of the following month's start.

Ley 13/2011 classifies infractions as muy graves, graves and leves. Very serious infractions — unlicensed operation, breach of minors rules, fraudulent games — attract fines of up to EUR 50 million and licence revocation.

The DGOJ may order ISPs to block unlicensed sites, instruct payment processors and banks to refuse transactions with unlicensed operators, and require search and advertising platforms to remove listings.