Spain';s gaming and iGaming market is a licensed, regulated environment governed by a dedicated national authority. Operators - whether targeting Spanish residents with online casino products, sports betting, or poker - must hold a valid licence issued by the Dirección General de Ordenación del Juego (DGOJ), the national gambling regulator. Operating without a licence exposes a business to administrative fines, domain blocking, and criminal referrals. This article maps the full regulatory landscape: the legal framework, licence categories, application mechanics, ongoing compliance duties, advertising constraints, and the practical risks that catch international operators off guard.
Spain';s primary gambling statute is the Ley de Regulación del Juego (Law 13/2011 on the Regulation of Gambling), which entered into force in 2012 and established the DGOJ as the central licensing and supervisory authority. The law applies to all forms of online gambling offered to persons physically located in Spain, regardless of where the operator is incorporated. This extraterritorial reach is one of the first points international operators underestimate.
Law 13/2011 is supplemented by a series of Royal Decrees that define technical standards, game-specific rules, and responsible gambling obligations. The most operationally significant are Royal Decree 1614/2011, which regulates the general conditions for gambling activities, and Royal Decree 1613/2011, which sets out the technical requirements for gaming systems. Both decrees have been amended multiple times, and operators must track the current consolidated versions rather than relying on the original texts.
A further layer of regulation comes from the Ley de Comunicación Audiovisual (Audiovisual Communication Law 13/2022), which significantly tightened advertising rules for gambling operators. This law, together with Royal Decree 958/2020 on commercial communications for gambling activities, restricts when, where, and how operators may advertise. The advertising regime is discussed in detail below, but the key point at the framework level is that non-compliance with advertising rules triggers the same enforcement machinery as non-compliance with licensing conditions.
Spain also applies the Ley de Prevención del Blanqueo de Capitales e Infracciones Monetarias (Law 10/2010 on the Prevention of Money Laundering and Monetary Offences) to gambling operators. Licensed operators are classified as obligated subjects, meaning they must implement full anti-money laundering (AML) programmes, appoint a compliance officer, and report suspicious transactions to the Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales (SEPBLAC). Failure to maintain an adequate AML framework is an independent ground for licence suspension, separate from any DGOJ enforcement action.
At the regional level, land-based gambling - physical casinos, bingo halls, slot arcades, and betting shops - remains regulated by the autonomous communities (comunidades autónomas). Each region has its own licensing authority and rules. An operator wishing to run both online and land-based operations must therefore deal with two separate regulatory layers: the DGOJ for online activities and the relevant regional body for physical premises. This dual-track structure is a structural feature of Spanish gambling law that has no equivalent in most other European jurisdictions.
The DGOJ issues licences in two tiers. The first tier is the general licence (licencia general), which authorises an operator to offer a specific category of gambling. The second tier is the singular licence (licencia singular), which authorises the operator to offer a specific game or product within that category. Both licences are required before an operator may accept a single bet from a Spanish resident.
The main general licence categories are:
Each general licence has a corresponding set of singular licences. For example, an operator holding a casino general licence must obtain separate singular licences for roulette, blackjack, slots, and any other casino product it wishes to offer. This granular structure means that a full-service online casino typically requires a general licence plus five to eight singular licences, each subject to its own technical certification.
General licences are issued for a period of ten years and are renewable. Singular licences are issued for the same term as the corresponding general licence. The DGOJ may open new licensing rounds at its discretion; it is not a continuous open-window process. Operators that miss a licensing round must wait for the next one, which creates a material first-mover advantage for early applicants.
Licence fees are set by regulation and vary by category. They are not trivial: the combined cost of a general licence and the associated singular licences for a full casino operation runs into the low hundreds of thousands of euros in regulatory fees alone, before accounting for legal, technical, and operational costs. Operators should budget accordingly and treat the fee structure as a sunk cost of market entry rather than a variable expense.
A common mistake among international operators is to assume that a licence from another EU member state - Malta, Gibraltar, or Cyprus - provides any form of mutual recognition in Spain. It does not. Spain operates a closed national licensing system. An operator licensed in Malta must still obtain a Spanish DGOJ licence before offering services to Spanish residents. Operating under a foreign licence while targeting Spain is treated as unlicensed operation and triggers the full range of enforcement measures.
To receive a checklist for the DGOJ licence application process in Spain, send a request to info@vlolawfirm.com
The DGOJ licence application is a structured administrative procedure governed by Law 13/2011 and the implementing regulations. The process has several distinct phases, each with its own documentation requirements and procedural deadlines.
The first phase is the submission of the application for the general licence. The applicant must be a legal entity incorporated in Spain or in another EU or EEA member state. Non-EU entities must establish a Spanish branch or subsidiary before applying. The application package includes corporate documentation (articles of association, ownership structure, ultimate beneficial owner declarations), financial statements for the preceding three years, a business plan, a description of the technical systems, and evidence of the required financial guarantee.
The financial guarantee is a cash deposit or bank guarantee lodged with the DGOJ. The amount varies by licence category and is intended to cover player funds and prize obligations. For casino and poker operations, the guarantee is typically in the range of several hundred thousand euros. The guarantee must remain in place for the duration of the licence and is not available to the operator as working capital.
The DGOJ has a statutory period of six months to resolve a general licence application from the date of submission of a complete file. In practice, the process frequently takes longer, particularly where the DGOJ requests supplementary documentation or where the applicant';s technical systems require additional certification. Operators should plan for a nine-to-twelve-month timeline from initial submission to licence grant.
Once the general licence is granted, the operator must apply for each singular licence. Each singular licence application requires technical certification of the specific game by an accredited testing laboratory. Spain maintains a list of approved testing laboratories; certification by a non-approved body is not accepted. The technical certification process adds two to four months to the timeline for each product category.
The technical requirements for gaming systems are detailed in Royal Decree 1613/2011 and the associated technical annexes. Key requirements include: the gaming server must be located in Spain or in an EU/EEA jurisdiction with an adequate data protection framework; the random number generator must be certified; the system must support real-time reporting to the DGOJ';s central system; and the operator must maintain detailed transaction logs for a minimum period of five years.
A non-obvious risk at the application stage is the treatment of corporate structure. The DGOJ scrutinises the full ownership chain, including indirect shareholders and beneficial owners. Any shareholder holding more than ten percent of the applicant must be individually vetted. If any person in the ownership chain has a criminal record, an unresolved tax debt, or a prior regulatory sanction in any jurisdiction, the application will be rejected. International operators with complex holding structures should conduct a thorough pre-application audit of their corporate chain before submitting.
In practice, it is important to consider that the DGOJ';s vetting process extends to key management personnel, not just shareholders. The CEO, CFO, and the designated responsible gambling officer must each submit personal declarations and background documentation. A change of key personnel after licence grant must be notified to the DGOJ within a defined period, and the new individual is subject to the same vetting process.
Holding a DGOJ licence is not a one-time achievement. The regulatory burden on licensed operators is continuous and multi-dimensional. Non-compliance at any point during the licence term can result in fines, suspension, or revocation.
The core ongoing obligations fall into four areas: responsible gambling, AML, technical reporting, and advertising compliance.
On responsible gambling, Royal Decree 1614/2011 requires operators to maintain a self-exclusion system linked to the RGIAJ (Registro General de Interdicciones de Acceso al Juego), the national self-exclusion register. Before accepting a registration or a deposit from any player, the operator must check the RGIAJ and refuse access to any person on the register. The check must be performed in real time. Failure to exclude a registered player is a serious infraction under Law 13/2011 and has resulted in significant fines in enforcement proceedings.
Operators must also implement deposit limits, loss limits, and session time limits, and must provide players with access to their gambling history on request. The responsible gambling programme must be documented in a formal policy, reviewed annually, and submitted to the DGOJ on request. A common mistake is to treat the responsible gambling framework as a technical checkbox rather than an operational system with real enforcement consequences.
On AML, licensed operators are obligated subjects under Law 10/2010. The practical obligations include: customer due diligence (CDD) at registration and enhanced due diligence (EDD) for high-value players; ongoing transaction monitoring; a written AML risk assessment updated at least annually; a designated AML compliance officer with direct reporting lines to senior management; and a suspicious activity reporting (SAR) process connected to SEPBLAC. The AML compliance officer must be a natural person resident in Spain or, at minimum, readily accessible to Spanish authorities.
On technical reporting, operators must transmit real-time data on all gambling transactions to the DGOJ';s central system. The data feed must comply with the technical specifications published by the DGOJ and must be available without interruption. Downtime in the data feed must be reported to the DGOJ within a defined period. Operators that experience repeated or prolonged reporting failures face administrative sanctions.
On advertising, the rules introduced by Royal Decree 958/2020 and reinforced by Law 13/2022 are among the most restrictive in Europe. Gambling advertising is prohibited between 01:00 and 05:00 on television and radio. Sponsorship of sports events is restricted. Advertising may not target minors or persons who have self-excluded. Operators may only advertise to existing registered players outside the restricted windows, with limited exceptions. Bonus and promotional offers are subject to strict conditions on presentation and wagering requirements.
Many underappreciate the cumulative effect of the advertising restrictions. An operator that relies on aggressive bonus marketing to acquire players - a standard approach in less regulated markets - will find that the Spanish framework makes this model legally and commercially difficult. The business model must be adapted before market entry, not after a regulatory warning.
To receive a checklist for ongoing compliance obligations for iGaming operators in Spain, send a request to info@vlolawfirm.com
The DGOJ has broad enforcement powers under Law 13/2011. Infringements are classified as minor (leve), serious (grave), and very serious (muy grave), with corresponding sanction ranges.
Minor infringements - such as isolated technical reporting failures or minor advertising irregularities - attract fines in the range of up to 100,000 euros. Serious infringements - such as systematic responsible gambling failures or material AML deficiencies - attract fines of up to one million euros. Very serious infringements - including operating without a licence, accepting bets from self-excluded players on a systematic basis, or facilitating money laundering - attract fines of up to fifty million euros and may result in licence suspension or revocation.
The DGOJ also has the power to order internet service providers and payment processors to block access to unlicensed gambling websites and to freeze payment flows to unlicensed operators. This blocking mechanism is used actively. Unlicensed operators targeting Spain face not only fines but also effective commercial exclusion from the market.
Enforcement proceedings follow the general administrative procedure under the Ley del Procedimiento Administrativo Común de las Administraciones Públicas (Law 39/2015 on Common Administrative Procedure). The DGOJ initiates proceedings by issuing a formal notification to the operator. The operator has a right to submit representations within a defined period, typically fifteen to thirty days. The DGOJ then issues a provisional resolution, to which the operator may again respond before a final resolution is issued.
Final DGOJ resolutions may be challenged before the Audiencia Nacional (National Court), which has jurisdiction over administrative acts of national-level bodies. The appeal must be filed within two months of notification of the final resolution. The Audiencia Nacional';s review is on the merits of the administrative decision, not a full re-hearing of the facts. Operators challenging DGOJ sanctions should be aware that the court gives significant deference to the DGOJ';s technical and regulatory judgements.
A practical scenario: an international operator holds a valid DGOJ casino licence but fails to check the RGIAJ before allowing a player to deposit. The player is on the self-exclusion register. The DGOJ opens an investigation following a player complaint. The operator submits representations explaining a technical failure in the RGIAJ integration. The DGOJ classifies the infraction as serious and imposes a fine. The operator appeals to the Audiencia Nacional, arguing that the technical failure was isolated and promptly remedied. The court upholds the fine but reduces the amount, accepting the mitigation argument. Total elapsed time from investigation opening to final court decision: approximately two to three years.
A second scenario: a startup operator launches a poker platform targeting Spanish players without a DGOJ licence, relying on a Malta Gaming Authority licence. The DGOJ identifies the operator through its monitoring of unlicensed activity, issues a blocking order to Spanish ISPs, and initiates sanction proceedings. The operator cannot contest the blocking order in real time and loses its Spanish player base. The sanction proceedings result in a very serious infraction finding and a fine in the mid-millions of euros. The operator has no Spanish legal entity and limited assets in Spain, but the fine creates a reputational and legal liability that affects its ability to obtain licences in other jurisdictions.
A third scenario: a licensed sports betting operator runs a promotional campaign that includes television advertising outside the permitted windows. A competitor files a complaint with the DGOJ. The DGOJ opens proceedings and classifies the infraction as serious. The operator argues that the advertising was placed by a media agency without its knowledge. The DGOJ rejects this argument, holding that the operator is responsible for the acts of its agents. A fine is imposed. The operator subsequently restructures its media buying process to include a compliance review at each stage.
The cost of non-specialist mistakes in Spain';s iGaming regulatory environment is high. Operators that attempt to navigate the DGOJ process without experienced local legal support routinely underestimate the documentation burden, miss procedural deadlines, and submit applications that are rejected on technical grounds. A rejected application does not automatically entitle the operator to a refund of licence fees, and the operator must wait for the next licensing round to reapply.
Spain';s advertising regime for gambling is one of the defining features of the regulatory landscape and deserves separate treatment because it directly affects the commercial viability of different business models.
Royal Decree 958/2020 introduced a comprehensive framework for gambling commercial communications. The key restrictions are:
The practical effect of these restrictions is that the standard customer acquisition playbook used in less regulated markets - television advertising, celebrity endorsements, aggressive bonus marketing - is largely unavailable in Spain. Operators must rely on search engine marketing, affiliate programmes (subject to their own compliance requirements), and direct marketing to existing players.
Affiliate marketing is a particular area of risk. The DGOJ holds the licensed operator responsible for the advertising conduct of its affiliates. An affiliate that runs non-compliant advertising - for example, by promoting bonuses to the general public or advertising outside permitted windows - exposes the operator to regulatory sanctions. Operators must therefore implement robust affiliate compliance programmes, including contractual obligations, monitoring, and termination rights for non-compliant affiliates.
The responsible gambling framework is also evolving. The DGOJ has indicated its intention to strengthen requirements around player protection, including more granular deposit limit controls, mandatory affordability checks for high-value players, and enhanced requirements for the detection of problem gambling behaviour. Operators should treat the current framework as a minimum baseline and build systems capable of accommodating tighter requirements without significant re-engineering.
A non-obvious risk in the advertising space is the interaction between the DGOJ';s rules and the general consumer protection framework administered by the Agencia Española de Consumo, Seguridad Alimentaria y Nutrición (AECOSAN). Misleading advertising that also violates consumer protection law can trigger parallel enforcement by AECOSAN, resulting in a second set of sanctions on top of any DGOJ fine. Operators that run promotional campaigns should have them reviewed for compliance with both regulatory frameworks before publication.
The evolving regulatory environment also affects corporate transactions. An acquisition of a DGOJ-licensed operator requires prior notification to the DGOJ if the transaction results in a change of control. The DGOJ has a period to review the transaction and may impose conditions or, in exceptional cases, refuse to recognise the change of control. Buyers in M&A transactions involving Spanish-licensed operators must factor this regulatory approval into their transaction timeline and structure their conditions precedent accordingly.
We can help build a strategy for market entry or regulatory compliance in Spain';s iGaming sector. Contact info@vlolawfirm.com to discuss your specific situation.
What is the most significant practical risk for an international operator entering the Spanish iGaming market?
The most significant risk is underestimating the closed nature of the Spanish licensing system. A licence from Malta, Gibraltar, or any other jurisdiction provides no right to offer services to Spanish residents. Operators that launch in Spain under a foreign licence face immediate blocking of their domains, loss of their player base, and substantial fines. The second major risk is the complexity of the ongoing compliance framework: the RGIAJ self-exclusion check, real-time data reporting, and AML obligations all require operational infrastructure that must be in place before the first bet is accepted. Building this infrastructure after launch is significantly more expensive and disruptive than building it correctly from the start.
How long does the DGOJ licensing process take, and what does it cost at a general level?
The statutory resolution period for a general licence application is six months from submission of a complete file, but the practical timeline is typically nine to twelve months. Adding the technical certification of individual game products for singular licences extends the total timeline to twelve to eighteen months for a full-service online casino. Regulatory fees for a complete casino licence package run into the low hundreds of thousands of euros. Legal, technical certification, and operational setup costs add further to this figure. The financial guarantee required by the DGOJ - which must be maintained throughout the licence term - represents an additional capital commitment in the range of several hundred thousand euros, depending on the licence category.
When should an operator consider challenging a DGOJ enforcement decision rather than accepting the sanction?
A challenge before the Audiencia Nacional is worth considering when the sanction is in the serious or very serious range, when there are genuine procedural defects in the DGOJ';s proceedings, or when the factual basis of the infraction finding is disputed. The Audiencia Nacional gives deference to the DGOJ';s regulatory judgements but does review procedural compliance and proportionality of sanctions. A challenge is less viable when the infraction is clear and the operator';s main argument is mitigation: in those cases, submitting strong representations during the administrative phase - before the final resolution - is more effective than litigation. The cost of Audiencia Nacional proceedings is not trivial, and operators should weigh the legal costs against the sanction amount and the reputational implications of a public court record.
---
Spain';s gaming and iGaming regulatory framework is comprehensive, technically demanding, and actively enforced. The DGOJ licensing system is closed to foreign licences, the ongoing compliance obligations are multi-layered, and the advertising restrictions fundamentally shape the commercial model available to operators. Operators that approach the Spanish market with the same assumptions they apply in less regulated jurisdictions consistently encounter avoidable problems. The investment required to enter and remain compliant in Spain is substantial, but so is the market opportunity for operators that build their operations on a sound regulatory foundation.
To receive a checklist for assessing your readiness to apply for a DGOJ licence in Spain, send a request to info@vlolawfirm.com
Our law firm VLO Law Firms has experience supporting clients in Spain on gaming and iGaming regulatory matters. We can assist with DGOJ licence applications, ongoing compliance programme design, advertising compliance reviews, AML framework implementation, and regulatory enforcement defence. To receive a consultation, contact: info@vlolawfirm.com