Spain Moves Towards Centralised Gambling Risk Checks as Regulators Tighten Player Protection
Spain’s gambling regulator has reopened a public consultation on a proposed system designed to identify online gambling customers whose behaviour may indicate an increased risk of gambling-related harm. The proposal would introduce a standardised monthly assessment for operators licensed at national level, giving regulators a more consistent framework for identifying potentially harmful patterns across the market.
The Directorate General for the Regulation of Gambling, known as the DGOJ, opened the consultation on October 13. Stakeholders can submit comments until October 22, 2026. The draft would require operators to assess customer activity over a 183-day period, using a mechanism intended to identify warning signs in account behaviour.
The initiative could have significant implications for online casino and sports betting companies operating in Spain. It also reflects a broader regulatory trend in which player protection is increasingly being treated as an operational responsibility requiring systematic monitoring, rather than relying exclusively on customers to recognise and report problems themselves.
How the proposed system would work
Under the draft, licensed operators would run the assessment during the first seven calendar days of each month. The model would examine activity across the preceding 183 days, using indicators such as deposits, withdrawals, betting patterns, session duration and other account behaviour.
The aim is to identify customers whose activity suggests elevated gambling-related risk. A common mechanism could make assessments more consistent between operators, reducing the likelihood that similar patterns are treated differently simply because customers use different platforms.
According to industry reporting on the consultation, operators would be expected to notify customers identified by the system and explain the factors behind their classification. The proposal also addresses how risk-related information may be used, an important issue because behavioural data can be commercially sensitive and could otherwise be used for purposes unrelated to consumer protection.
The consultation remains a draft regulatory process. Its final requirements, implementation timetable and operational details may change following feedback from industry participants, consumer-protection organisations and other stakeholders.
What it could mean for operators
For gambling companies, a centralised risk-detection framework could require changes to data processing, compliance procedures, customer communication and internal reporting. Operators may need to ensure that their systems can collect and analyse the relevant information consistently, document the results and demonstrate that appropriate procedures are followed when potentially risky behaviour is identified.
Smaller operators could face proportionally greater implementation costs if they need to upgrade existing technology or introduce additional compliance resources. Larger companies may already have behavioural monitoring systems, but they would still need to assess whether those systems meet the regulator’s proposed methodology.
There are also practical questions about how the model will perform. A system that identifies too many customers as high risk may generate unnecessary interventions, while one that fails to identify concerning behaviour could provide a false sense of security. The quality of the indicators, the treatment of unusual but legitimate activity and the process for reviewing classifications will therefore matter.
Data protection will be another key consideration. Gambling activity can reveal sensitive information about a person’s financial behaviour and habits. Any framework using that information must operate within applicable privacy rules, with clear limits on access, retention and secondary commercial use.
A wider shift towards measurable player protection
Regulators across multiple markets have been placing greater emphasis on identifying harmful gambling behaviour earlier. The underlying challenge is that gambling-related harm rarely presents itself in the same way for every customer. Changes in spending, frequency, session length or betting patterns can be warning signs, but no single indicator necessarily establishes that a person has a gambling problem.
A centralised model could help standardise the first stage of detection, but its effectiveness will depend on what happens after a customer is flagged. Clear explanations, appropriate support options and proportionate interventions will be important if the system is to deliver meaningful protection rather than simply generate compliance records.
For operators, the direction of travel is clear: responsible-gambling measures are becoming more closely linked to data governance, product design and day-to-day business processes.
What happens next
The October 22 consultation deadline gives operators, industry groups and consumer advocates a short window to comment on the proposed framework. Their feedback could influence how the model is applied, what safeguards accompany it and how much flexibility operators retain in their own monitoring systems.
Until the regulator publishes a final decision, the proposal should not be treated as an already implemented legal requirement. Nevertheless, operators serving Spain’s nationally regulated online gambling market have reason to review their existing systems and assess what changes might be needed.
The outcome will be relevant beyond Spain, as other jurisdictions continue to consider how automated monitoring can support player protection while respecting privacy and ensuring that regulatory obligations remain workable.
