Spain’s DGOJ has opened a consultation on a centralised monthly risk test that all licensed online operators must run. The window stays open until 22 October 2026, and accounts flagged as at risk face a 72-hour response deadline.
DGOJ consultation on a harmonised monthly risk test is now open until 22 October 2026. Licensed online operators must run it in the first seven days of each month, covering 183 days of account activity. Accounts meeting any objective threshold are classified as at risk. The DGOJ will conduct periodic technical audits of the model.
- How the Monthly Risk Test Works
- The 72-Hour Interaction Rule
- What Operators Are Being Asked to Challenge
- Why DGOJ Moved to a Sector-Wide Model
The DGOJ says the consultation is designed to replace a patchwork of operator-defined risk models with one automated, sector-wide test. Every account on every nationally licensed online platform will be evaluated on the same schedule and the same four-stage process, removing the variation that previously let detection standards drift between operators.
The regulator runs the test centrally, and it covers the preceding 183 days. Accounts with minimal recent activity are excluded at the start. The rest are screened against roughly 48 features drawn from deposits, withdrawals, bets, session length, product mix, time of day, self-exclusion use, cancelled withdrawals and payment instrument types. A model converts those inputs into a probability score, and accounts above the threshold are classified as exhibiting risk behaviour.
How the Monthly Risk Test Works
The evaluation happens during the first seven calendar days of each month. That cadence matters: it means a player’s account is reviewed on a fixed cycle rather than only when an operator notices unusual activity. The scoring logic is deliberately simple — any single objective threshold can trigger the risk classification, without the account needing to cross a composite score.
The four variables behind the thresholds cover deposit and withdrawal patterns, betting volume and frequency, the proportion of different products played, and time-of-day activity. The DGOJ excluded external data sources such as social media, browsing history and detailed financial or health records. That exclusion is significant for vendors: the profile has to be built from account behaviour alone, which narrows the data available to the model and raises the bar on the features it uses.
AGBrief has tracked the Spanish market’s regulatory shifts over recent years.
The 72-Hour Interaction Rule
A flagged account does not simply attract a warning label. Operators must tell the player why they were flagged and explain the contributing factors, and the player has to complete an effective interaction inside 72 hours. If they do not, the gaming relationship is suspended until compliance is satisfied. Promotional activity is banned for flagged players, along with VIP services and targeted marketing communications.
This applies the existing safeguards set out in Real Decreto 176/2023, which already required operators to notify and communicate with flagged players. The consultation consolidates those duties and makes them automatic rather than discretionary. In parallel, operators must enforce the use of nominative payment methods and stop accepting credit cards. Nominative validation becomes a condition of continued access, not a separate compliance task.
What Operators Are Being Asked to Challenge
The 2025 consultation round surfaced three objections. Integration and ongoing operating costs are the largest, with operators disputing the regulator’s implementation estimate of €130,000 per operator, which converts to roughly $145,320. Several suppliers argued that a single model cannot capture skill-influenced games accurately enough, which points to poker and sports betting. Data protection was the third concern, given that the system performs large-scale automated profiling.
The DGOJ answered the profiling question by preparing a detailed GDPR Data Protection Impact Assessment. It also committed to periodic reviews based on aggregated operator data and to independent technical audits of the system, with the authority to adjust variables, thresholds and model parameters as feedback arrives.
Why DGOJ Moved to a Sector-Wide Model
Under the 2023 decree, each operator could define its own detection protocols and indicators. That created inconsistent standards across the market, so the regulator now centralises the mechanism under the DGOJ’s own authority. The goal is uniform detection and uniform protective responses for every nationally licensed platform.
This sits alongside earlier regulatory activity in Spain. In March, the DGOJ published the Safe Gambling Programme covering 2026-2030. That programme singled out loot boxes, social casino products and other hybrid features that can normalise gambling among minors and young adults, which suggests the risk test is part of a broader effort to monitor hybrid product categories rather than table games alone.
Frequently Asked Questions
When does the DGOJ consultation on the risk test close?
The public consultation opened on Tuesday and remains active until 22 October 2026. Operators, vendors and legal teams can review the draft resolution, the annexes and the GDPR Data Protection Impact Assessment within that window.
How often will operators run the risk test?
Operators licensed for state-level online gambling must run the test during the first seven calendar days of each month. Each analysis covers the account’s activity over the preceding 183 days, using about 48 behavioural features and a four-stage evaluation process.
What happens to a flagged player account?
The operator must notify the player and explain the contributing factors. The player then has 72 hours to complete an effective interaction, or the gaming relationship is suspended until compliance is met. Promotions, VIP access and targeted marketing are banned for flagged accounts.
Can players challenge a risk classification?
Yes. Players may request an operator review of data accuracy and the application of the rules. If they remain dissatisfied, they can escalate the complaint to the DGOJ. Protective measures stay in force during the review, and the 72-hour interaction deadline still applies.
Which games are affected by the new model?
The model applies to all non-excluded accounts and every product class, including cashable table games. Operators raised concerns about accuracy for skill-influenced products such as poker and sports betting. The DGOJ has not confirmed a separate protocol for those categories within this consultation.
What happens if operators dispute the cost estimate?
The 2025 round drew objections to the €130,000 per-operator implementation estimate, worth about $145,320. The DGOJ has not revised that figure in the new consultation. The mechanism itself is mandatory, so the unresolved question is how much of the integration burden each operator absorbs.
This article has been thoroughly researched and reviewed by the CasinoBait editorial team to ensure accuracy and relevance for Asian casino players.
