iGaming platform for the Spain market

The Spain iGaming market is a nationally regulated online gambling market supervised by the Dirección General de Ordenación del Juego (DGOJ), operating under the Spanish Gambling Act (Law 13/2011), with the first online licences issued in 2012. The regime is open licensing with a structural twist: general licences are granted through application windows that have historically opened only periodically, so market entry is as much a question of timing as of qualification. Operating requires a general licence per category plus singular licences per game type, a Spanish-facing site on a ".es" domain, mandatory checks against the RGIAJ self-exclusion register, and an internal control system that replicates gaming data for the regulator.

Regulatory status

Spain regulated online gambling at the national level with Law 13/2011, which created a licensing framework administered by the DGOJ, a directorate under the Ministry of Consumer Affairs. The first wave of online licences was issued in 2012, and the market has operated continuously since, with casino, poker, bingo and betting all permitted online. Land-based gambling remains the competence of Spain's autonomous communities, each with its own regional regulator — the DGOJ governs the national online market.

The model is open licensing, but with a critical qualification: general licences can only be applied for when the DGOJ opens an application window, and these windows have historically opened periodically rather than on demand — confirm the current position with the DGOJ. Operators who miss a window wait for the next one or acquire an existing licensed entity, and both paths have shaped M&A activity in the market. Singular licences, by contrast, can be requested at any time once the corresponding general licence is held, which is how licensed operators add new game verticals between windows.

The other defining regulatory event is Royal Decree 958/2020 on commercial communications, which imposed some of Europe's tightest gambling advertising and promotion rules and materially changed how operators acquire customers in Spain. Its consequences run through the technical requirements below.

Operator requirements

Licence types

Spain's two-tier structure separates the right to operate a category from the right to offer a specific game:

A typical online casino therefore holds one general "other games" licence and a stack of singular licences beneath it, each with its own certification obligations. Operators planning a phased vertical roadmap should map singular licence requests against lab certification lead times, because each new game type triggers both.

Corporate and capital requirements

• Entity: a Spanish company (SA or SL), or an EEA-established operator with a Spanish representative and registration with the DGOJ
• Financial guarantees: lodged per licence to cover player balances, gambling taxes and potential sanctions — confirm current guarantee amounts with the DGOJ
• Fit and proper: disclosure of ownership and control, with solvency and probity checks on the operator and its significant shareholders
• Identity verification: player identity must be verified against DGOJ verification services, which validate documentation against national records

Servers, data and local presence

The Spanish-facing site must operate on a ".es" domain, with Spanish players directed to it. Spain does not impose blanket server localisation, but the practical anchor is the internal control system (Sistema de Control Interno, SCI): operators must capture and replicate gaming records in a format accessible to the DGOJ, with a monitoring connection available to the regulator. The SCI is an architectural requirement — it must be designed into the platform's data layer, not bolted on — and its location and accessibility conditions form part of the technical annex of the application; confirm the current SCI specifications with the DGOJ.

Review timelines

For general licences, the clock is driven by the window: applications submitted during an open window are evaluated together, with decisions typically issued within several months of the window closing; singular licence requests from an existing licensee move faster, subject mainly to certification evidence — confirm current timelines with the DGOJ. The planning consequence is blunt: an operator that wants Spain in its roadmap should prepare corporate documentation, guarantees and platform certification before a window opens, because the window itself is too short for greenfield preparation.

Taxes

Spanish online gambling is taxed on gross gaming revenue under the gambling activities tax:

• 20% of GGR for most online games, including casino and betting (as of 2026 — confirm current rates)
• Reduced rates for operators established in Ceuta and Melilla, which has made both cities notable bases for Spanish-facing operations — confirm current reduced rates
• Standard Spanish corporate income tax on profits; gambling supplies are VAT-exempt
• Administrative fees to the DGOJ apply per licence and for certain filings — confirm current fee schedule

Because the Spanish bonus regime suppresses promotional spend (see below), effective marketing cost per acquired player is weighted toward media and affiliation within the permitted windows — worth modelling explicitly, since the usual bonus-cost line in a market entry P&L largely disappears in Spain.

Technical requirements

The DGOJ regulates the platform through certification, the SCI, and the advertising decree. All three land on the technology stack.

Game and platform certification

Games and the gaming platform must be certified by DGOJ-approved laboratories before launch, and re-certified on relevant change — confirm current certification requirements with the DGOJ. Certification covers the technical regulations for each game type under its singular licence, RNG quality, and the correct behaviour of player protection controls. Each new singular licence brings its own certification scope, so a disciplined change-management pipeline matters. For a Vuch deployment, Spanish certification is scoped as part of the market entry plan; a certification roadmap is available on request.

Regulator reporting and the SCI

The Sistema de Control Interno is Spain's distinctive supervision mechanism: the operator must capture gaming operations and replicate them into a data store accessible to the DGOJ, with a monitoring connection that lets the regulator inspect activity. On top of the SCI, operators submit periodic reports to the DGOJ covering gaming activity, financials and responsible gambling metrics — confirm current SCI and reporting specifications with the DGOJ. The Vuch admin back office provides regulator-reporting tooling — reports and exports with a full audit trail; implementing the SCI capture and replication to the DGOJ's specifications is deployment scope for a Spanish launch.

RGIAJ — national self-exclusion and interdiction register

The RGIAJ (Registro General de Interdicciones de Acceso al Juego) is Spain's national register of individuals barred from gambling, whether by self-exclusion or judicial/administrative interdiction. Integration is mandatory: the platform must check the register at registration and before allowing play, block registered individuals, and keep them out of marketing audiences. The check runs against DGOJ services alongside identity verification, which means the registration flow must be sequenced correctly — verify identity, check RGIAJ, then open play. The Vuch platform provides self-exclusion integration capability; the RGIAJ connection and the sequencing of the Spanish registration flow are implemented and certified as part of each Spanish deployment, alongside operator-level self-exclusion and time-out controls.

Bonus, deposit and limit restrictions

Royal Decree 958/2020 reshaped Spanish acquisition economics:

• Acquisition bonuses are effectively banned: promotions may not be used to attract new customers, and bonuses may only be offered to fully verified customers whose accounts are at least 30 days old — confirm the current decree provisions
• Advertising windows are tight: broadcast gambling advertising is confined to narrow overnight windows, with heavy restrictions on sponsorship and influencer marketing — confirm current restrictions
• Deposit limits by default: players are subject to default limits of approximately €600 per day, €1,500 per week and €3,000 per month, raisable only after the operator performs the prescribed checks — confirm current limits
• Mandatory self-limitation, time-out and self-exclusion tools, with responsible gambling messaging requirements in Spanish

For an operator, the consequence is that Spain runs on retention and brand rather than sign-up offers: SEO, product depth and CRM to the verified base do the work that welcome bonuses do elsewhere. The platform must enforce the 30-day-and-verified gate on every bonus, apply the deposit-limit ladder with its escalation checks, and keep promotional content out of acquisition surfaces. Promotional restrictions of this kind need to be enforced at platform level through configuration — on the Vuch platform this is part of the jurisdiction mapping phase of a deployment, with configuration changes logged in a full audit trail.

What a Spanish licence does not cover

A DGOJ licence covers Spain's national online market only. It grants no rights in the land-based sector, which is licensed region by region through the autonomous communities, and no rights in Portugal, Italy or any other jurisdiction — see the Italy market page for the nearest southern-European comparison and its very different concession model. Spanish lab certification does not transfer automatically to other regulators, although approved laboratories can often extend test evidence across jurisdictions at reduced cost. Nor does the licence relax Royal Decree 958/2020: advertising restrictions bind licensed operators precisely because they are licensed, and enforcement actions for promotional breaches are a regular feature of DGOJ sanction lists.

What Vuch provides for the Spain market

• Modular platform: prediction markets, casino (30,000+ games via provider integrations), or the full stack on a unified wallet with an AMM liquidity core
• Certification roadmap: Vuch holds no DGOJ certification today; certification with DGOJ-approved laboratories is scoped as part of deployment, with a certification roadmap and due-diligence pack available on request
• Self-exclusion capability: RGIAJ registry integration — identity verification and interdiction checks sequenced into the registration flow — is implemented and certified per deployment
• Jurisdiction configuration: bonus gating, default deposit limits with escalation checks and ".es" domain setup are enforced through platform configuration during the jurisdiction mapping phase; risk-engine thresholds are tunable for Spanish requirements
• Regulator-reporting tooling: reports and exports generated from the admin back office with a full audit trail; the SCI implementation and DGOJ reporting formats are deployment scope
• Payments: current rails are USDT deposits and withdrawals; a fiat payment layer is on the roadmap. For a fiat-first market like Spain, local fiat payment integration is a gating item and part of the deployment conversation
• Deployment timeline: white-label deployment typically takes 4–8 weeks depending on integrations and jurisdiction

Spain punishes improvisation and rewards preparation: windows are rare, certification is granular, and the advertising decree removes the shortcuts. Operators who prepare the corporate file and the technical stack in advance convert the next window; those who start when it opens usually miss it. See the turnkey casino solution for a full launch scope, or the compliance suite for how Spanish controls are enforced and evidenced — and the UK market page for how the same platform carries a very different rule set.