Spanish-licensed gambling operators have been notified of a new protocol to strengthen the verification of customer identity and ensure the checking of player  tax status.

The measure has been introduced by the Ministry of Consumer Affairs, the authority responsible for federal oversight of Spain’s gambling sector, with implementation to be led by the Directorate General for Gambling Regulation (DGOJ) in coordination with the State Tax Agency (AEAT).

The protocol forms part of Spain’s response to a growing number of identity theft cases linked to online gambling, in which winnings have been falsely declared under stolen identities. 

In 2025, the DGOJ recorded 8,675 complaints relating to impersonated taxpayers, marking a 12% year-on-year increase and underlining the accelerating scale of the issue.

Regulatory concerns have been further heightened by recent changes to Spain’s tax reporting framework applied as of 2025. Spain’s tax agency lowered the disclosure threshold for gambling winnings from €1,000 (£871) to €300 for taxpayers earning above €22,000 annually. 

While intended to improve fiscal transparency, the change has increased exposure to fraudulent declarations, with even minor winnings capable of generating tax liabilities under stolen identities.

Of the reported cases, more than 7,600 involved individuals registered on Spain’s self-exclusion list, while regulators also flagged instances of minors bypassing controls through third-party identities, often within family settings.

Under the new framework, operators will be required to implement stricter verification checks and cooperate with authorities in identifying suspicious account activity. The protocol is designed to streamline the reporting process for victims and enable faster correction of fraudulent tax liabilities.

To support enforcement, the DGOJ has introduced the PACS (Automated Case Management System), alongside a dedicated online portal that provides guidance on reporting identity theft and regularising tax positions with AEAT. The system centralises coordination between regulators, law enforcement and tax authorities to accelerate investigations and case resolution.

The regulator notes that identity fraud is becoming increasingly sophisticated, with criminal networks using automation to create accounts at scale and exploit promotional incentives such as welcome bonuses. While sports betting accounts for the majority of cases, incidents within online casino verticals have risen sharply, indicating a broader spread of fraud across the market.

Authorities will continue to monitor the protocol’s effectiveness as part of Spain’s wider enforcement strategy, with further measures expected should identity misuse and associated tax risks persist across the regulated sector.