Spain reopens consultation on one monthly risk test for all online gambling operators
Spain's DGOJ has reopened public consultation, running to 22 October 2026, on a draft resolution that would make every nationally licensed online operator run one standard monthly test to flag players at risk. Operators currently use their own models.
Spanish rules do not cover South African players, but the proposal shows how regulators are moving towards common, auditable player protection standards. South Africa has no licensed online casino market, so players on offshore sites have no equivalent safeguard and should rely on their own limits, time-outs and self-exclusion tools.
What Spain is proposing
Spain's gambling regulator, the Dirección General de Ordenación del Juego (DGOJ), has reopened public consultation on a draft resolution that would standardise how online operators spot risky play. The regulator's notice, dated 13 October 2026, invites comments until 22 October 2026.
Today each operator licensed at national level builds its own detection models under a 2023 royal decree. The draft would replace that patchwork with one mechanism that every such operator must run.
How the monthly test would work
As described by iGaming Business, operators would run an automated test during the first seven days of every month, looking back over 183 days of account activity. Accounts with very little recent activity drop out first. Objective thresholds then flag some accounts straight away, and a scoring model built on about 48 features, such as deposits, withdrawals, bets, session length, time of day and use of self-exclusion tools, flags others.
The regulator says the model would not draw on social media, browsing history or detailed financial and health records.
What happens to a flagged player
Under the existing decree, a flagged player must be told why, and must engage with the operator within 72 hours or have the account suspended until they do. Marketing and promotions are barred for that player, and VIP services are closed to them. Players can ask the operator to review the decision and then escalate to the DGOJ. The regulator also plans independent audits and says it has prepared a data protection impact assessment, since the system is automated profiling.
Industry feedback in the first round in 2025 centred on cost, with operators disputing the DGOJ's estimate of €130,000 each, on accuracy for skill-based games such as poker, and on data protection.
Why South African readers might care
Spanish rules do not apply here, and the offshore sites open to South African players are not bound by them. The proposal still shows where regulators are heading on player protection: common standards, regular checks and consequences that bite. South African players cannot count on any of that from an offshore operator, so use the deposit limits and time-out tools yourself and treat gambling as paid entertainment with real risk.