Since 28 October 2026, identifying a player is no longer enough. Royal Decree 813/2026 amends Article 21 of Spain’s anti-money laundering Regulation and requires online gambling operators to also check that the payment method the player uses to deposit and withdraw funds actually belongs to them.
Much has been written lately about payment method ownership. I don’t intend to repeat what the Official State Gazette (BOE) already says, but rather to explain what this change means for the KYC process of an online gambling and betting operator, from the perspective of Mobbeel, a company that has spent years implementing video identification at financial institutions that meet the criteria set by SEPBLAC, Spain’s Financial Intelligence Unit.
The new Article 21.2 of the Regulation implementing Law 10/2010 requires online gambling operators to carry out two separate checks: verify the player’s identity through one of the routes set out in Article 21.1, and verify that the holder of the payment method matches the holder of the gaming account. New accounts must comply from 28 October 2026; existing players have until 28 April 2027. And if the operator chooses video identification, SEPBLAC’s minimum requirements are exactly the same as for a bank.
What Article 21.2 of the Regulation implementing Law 10/2010 says after Royal Decree 813/2026
Royal Decree 813/2026 of 7 October was published in the BOE on 8 October and came into force on 28 October 2026. Among other rules, it amends the Regulation implementing Law 10/2010 on the prevention of money laundering and terrorist financing (Royal Decree 304/2014). Article 21 governs non-face-to-face business relationships and now has two sections.
Section 2 is what is new for gambling companies:
Article 21.2: Verification of the customer’s identity in relation to gambling operators through electronic, computer, telematic and interactive means shall, in addition to checking the circumstances set out in the previous section, require verification that the holder of the payment method used for deposits and withdrawals is the holder of the gaming account. (Unofficial translation)
Article 21.2 therefore does not replace player identification; it adds a check on the payment method holder.
The justification for this step can be found in the preamble of the Royal Decree itself, which points to the need to prevent the negative effects generated by the previous regulation. Let’s look at them.
Why now: identity fraud in online gambling
According to data from the Protocol for Impersonated Taxpayers (PACS) of Spain’s Ministry of Social Rights, Consumer Affairs and 2030 Agenda, 8,675 complaints of identity fraud in online gambling were filed in 2025, 12% more than in 2024 (CEC-España).
And gambling operators know the pattern all too well: someone obtains another person’s personal data. They open a gaming account in that person’s name. The data check comes back clean, because the data is real. Then they deposit and withdraw money with cards or e-wallets that do not belong to that person.
The victim knows nothing until the Spanish Tax Agency asks them to pay tax on winnings they never received, because whoever actually played was impersonating them.
The Ministry also stresses that identity fraudsters rely on payment methods whose ownership is hard to verify in real time, such as bank cards and e-wallets (Ministry press release).
Key takeaway: Checking that some data exists is not the same as checking that the person on the other side of the screen is its owner. Or that the money is theirs.
Two different controls: who the player is and whose money it is
For us, this is the most important point of the change, and the one causing the most confusion. Article 21.2 requires answering two different questions:
- Is this person who they claim to be? This is solved by identity verification: document, facial biometrics, liveness detection and, if chosen, video identification (which must comply with SEPBLAC).
- Does the payment method belong to them? This is solved by verifying ownership of the card, bank account, Bizum (Spain’s instant mobile payment service) or e-wallet, and depends on integrations with banks, PSPs, card schemes or Open Banking providers.
An authentic document and a perfect face match do not prove who holds a card. And a successful payment authorisation does not prove who is playing. That is why both checks are complementary.
Key takeaway: They are not interchangeable controls. They are two pieces that must be designed separately and connected to each other.
Identity verification reliably establishes the name of the gaming account holder, and payment method verification is checked against that name (it is worth noting that if the first part of the KYC is weak, the second part, validating the account holder, is compared against data that has not been properly validated).
That is why the quality of biometric KYC gains weight and comes out stronger with this regulation.
The four non-face-to-face identification routes in Article 21.1 applied to gambling
Operators are not required to use video identification. They can verify the player’s identity through any of the four routes in Article 21.1, and in all of them they will have to add the payment method ownership check.
There is a nuance in the new wording of letter d) that should not be overlooked. It now explicitly links secure procedures to the minimum requirements of the general authorisations published by SEPBLAC. The preamble presents this as a strengthening of legal certainty and of the reliability of these procedures, with consistent levels of security.
In other words: it is no longer enough for a solution to capture a document, read its data and compare a face. The entire flow has to be analysed.
Video identification in online gambling: SEPBLAC requirements
If an operator opts for video identification, the question online gambling and betting operators ask us most is whether that process must meet the same standards as a bank. The short answer is yes.
SEPBLAC’s authorisation of video identification procedures (unassisted, 2017) does not distinguish between sectors. There is no light version for gambling. The risk-based approach allows measures to be added, never lowered. These are its minimum requirements, in summary:
There is a direct consequence for the onboarding experience. In the unassisted mode, the player cannot deposit or bet until their recording has been reviewed.
This is where previous experience makes the difference. At Mobbeel we have spent years implementing remote identification and video identification processes in line with SEPBLAC criteria at financial institutions.
We have supported those institutions in adapting their processes to AML/CFT requirements, and that same technology is what we now offer to gambling operators.
A single video, from start to finish
There is one detail of the process that, for us, makes the difference and is rarely explained well. In many solutions on the market, video identification is really a sequence of pieces: a photo of the document, then a selfie, then a short liveness video. Sometimes even at different moments. Every break is a security gap in the process where something can change without being recorded.
At Mobbeel we approach it differently. The entire identification process takes place in a single, continuous, uninterrupted video session, from the moment the user starts until they finish.
This approach fits SEPBLAC’s requirements more precisely: a single device, image and sound transmitted live and unaltered, and an immediate recording that attests to the entire process. And it provides guarantees that a sequence of separate captures cannot offer:
- Continuity: there is no gap between steps to switch person, document or device.
- Evidence integrity: the reviewer sees one complete recording, with date and time, without having to reconstruct the process from fragments.
- Smaller attack surface: every interruption is an opportunity to inject manipulated content. Without interruptions, that opportunity for fraud disappears.
Key takeaway: A video that is never interrupted is a video that cannot be pieced back together.
There is no need to reinvent the wheel. What is needed is to apply to gambling what banking has already solved.
What a gambling operator needs to change in its KYC process
With the text of the Royal Decree in hand and what we see in remote identification projects, these are the changes we recommend reviewing:
- Design the two controls separately and connect them. The identity verification result should serve as the reference for the account holder, and each payment method check should be compared against it, with traceability of both results.
- Choose and document the Article 21.1 route. If it is letter d), the entire flow must be checked against the relevant SEPBLAC general authorisation, not just the capture technology.
- Review the document catalogue. Only valid identity documents that are in force: Spanish DNI, TIE, passport and EU/EEA identity documents. A foreigner identification number (NIE) without a document bearing a photograph does not qualify.
- Strengthen biometric fraud detection. If the verified identity is the reference against which the payment method is compared, liveness detection must withstand both presentation attacks (photos, videos, masks) and injection attacks.
- Prepare name matching. Accents, second surnames, compound names or transliterations from foreign documents will cause false rejections if the comparison is literal. It is advisable to define rules and a manual review path.
- Map what each payment method can verify. Cards, Bizum, IBAN via Open Banking and wallets such as Apple Pay or Google Pay do not provide the same information about the holder. It depends on the PSP, the issuer and the services available. Ask your PSP what it can return today. At Mobbeel we focus on identity verification: payment method verification is handled by the operator’s PSP, checked against the identity we have verified.
- Plan the migration of the player base. Existing players can keep depositing and playing, but cannot withdraw winnings until the match is proven. Communicating this clearly and early reduces friction and complaints.
- Secure the evidence. Recordings, the results of each check and information obtained through electronic identification means must be kept for ten years from the end of the relationship.
- Submit the procedure for review. The external expert’s report must assess the adequacy and effectiveness of the non-face-to-face identification procedure.
Key takeaway: Identity technology and payment technology have to talk to each other. That is the real adaptation project.
Royal Decree 813/2026 compliance timeline for online gambling
Accounts opened since 28 October 2026 must already comply with Article 21.2. Players registered before that date and operators’ technical systems have six months from entry into force; by contrast, the 18-month period for the digital DNI and for retaining electronic identification information runs from publication in the BOE.
Frequently asked questions about Royal Decree 813/2026 and KYC in online gambling
What does Article 21.2 require of online gambling operators?
It requires that, in addition to verifying the player’s identity through one of the routes in Article 21.1, the operator checks that the holder of the payment method used for deposits and withdrawals is the holder of the gaming account.
Since when is it mandatory?
Since 28 October 2026 for new accounts. Players registered before that date and operators’ technical systems have a six-month transitional period, until 28 April 2027.
What happens to a player who cannot prove ownership of their payment method?
During the transitional period they can keep depositing and playing, but cannot withdraw winnings. If verification has not been completed when the period ends, the operator must terminate the contract, notify the DGOJ (Spain’s Directorate General for the Regulation of Gambling) and return the balances, including any pending winnings.
Is video identification mandatory in online gambling?
No. The operator can use any of the routes in Article 21.1. But if it chooses video identification, it must meet the minimum requirements of SEPBLAC’s general authorisations, the same that apply to a financial institution.
Why does it matter that video identification is done in a single continuous video?
Because a single, uninterrupted video session prevents the person, document or device from being swapped between steps and leaves one complete recording as evidence. It fits SEPBLAC’s requirements of a single device, live unaltered transmission and immediate recording more precisely. This is the approach Mobbeel applies in its video identification processes.
Can biometric verification be used to check payment method ownership?
Not on its own. Biometrics and document verification prove who the player is. Payment method ownership requires integrations with banks, PSPs, card schemes or Open Banking. They are complementary controls and must be connected.
Is it enough for the first deposit to come from an account in the player’s name?
In our reading, not for gambling. Route c) of Article 21.1 only looks at the first deposit, whereas Article 21.2 refers to the payment methods used for deposits and withdrawals.
Does Royal Decree 813/2026 affect other sectors?
Yes. Article 21.2 applies only to gambling, but the Royal Decree also affects all obliged entities with regard to non-face-to-face identification, the digital DNI, evidence retention and financial sanctions procedures.
How does it relate to the European AMLR?
Regulation (EU) 2024/1624 (AMLR) will apply from 10 July 2027 and will harmonise customer due diligence across the EU, including gambling service providers. The two are complementary, with different timelines.
Conclusion: identity and payment, one single process
In reality, Royal Decree 813/2026 does not create a new KYC regime for gambling, but it does require the player’s identity and the origin and destination of their money to be fully aligned.
Operators that treat Article 21.2 as a simple patch on the payment gateway will fall short. Those that use it to review their entire identification process will reach 28 April 2027 with onboarding that is more robust against identity fraud.
For us, there is nothing new on the horizon: banking has already been through this.
This article is for information purposes only and does not constitute legal advice.
Sources: BOE-A-2026-20915, Royal Decree 813/2026 · SEPBLAC, authorisation of video identification procedures · Ministry of Social Rights, Consumer Affairs and 2030 Agenda · CEC-España
Get in touch if you want to find out how our technology can help you adapt your identification process to the new regulation. Talk to our team →
I’m a Software Engineer with a passion for Marketing, Communication, and helping companies expand internationally—areas I’m currently focused on as CMO at Mobbeel. I’m a mix of many things, some good, some not so much… perfectly imperfect.
