Spain Cuts Gambling Risk Model Lead-In to Two Months

The Directorate General for Gambling Regulation (DGOJ) reopened public consultation on October 13. Comments are accepted until October 22, 2026. The proposal requires licensed operators to assess player activity each month using a model supplied by the regulator.

From Four Months to Two

The August 2025 draft stated that the resolution would enter into force the day after its publication in Spain’s official gazette, the BOE. A later text, notified to the European Commission on December 12, 2025, provided four months.

The October 2026 version cuts the transition period to two months, giving operators two fewer months to prepare than under the December proposal. The countdown would begin after publication of the final resolution in the BOE, not after the October consultation closes.

Risk Data Must Stay Outside Commercial Scoring

A second change concerns what gambling companies can do with the information generated by the model. The DGOJ revised the proposal following a June 15, 2026 report from the Spanish Data Protection Agency (AEPD). Its explanatory note identifies additional safeguards for personal data.

Under the revised text, information processed through the detection mechanism, calculated variables and risk classifications cannot be reused for:

• Advertising and promotional purposes;
• Customer segmentation;
• Player profitability assessments;
• Solvency or commercial-risk scoring.

Operators must also maintain functional and logical separation between this processing and other uses of customer data. Access is limited to authorised personnel involved in applying safer gambling measures.

The December 2025 text already limited the purpose of processing to risk detection and player protection. The October version is more explicit about prohibited business uses and the separation required.

Monthly Checks Still Cover 183 Days

The core detection mechanism remains in place. Under the October draft, nationally licensed operators would examine the previous 183 days of player activity during the first seven calendar days of each month.

The mechanism uses a DGOJ-provided model. Less active players can be excluded from further assessment, while certain activity patterns lead directly to a risk classification.

Restrictions and Review Rights for Flagged Players

Classified players would receive the protective measures established by Royal Decree 176/2023, including restrictions on promotions, VIP services and payment methods.

Operators must explain the main factors behind a player’s classification. Players can request a review of the data and calculations and subsequently complain to the DGOJ.

For now, the new requirements remain proposals. No final BOE publication date has been announced.