Cargando...
Contenido
When people ask me whether Spain takes illegal gambling seriously, I do not offer an opinion. I show them a number: 496 million euros. That is the cumulative total of fines the DGOJ has issued since 2021 across 212 sanctions targeting unlicensed gambling operators. It is not a figure that suggests a regulator going through the motions. Since 2021, the trajectory has been consistently upward — more sanctions, larger fines, broader blocking campaigns, and increasingly sophisticated detection tools. The 2025 data alone shows 58 sanctions totalling 111 million euros, making it the most aggressive enforcement year on record.
I have tracked DGOJ enforcement actions for years, cross-referencing sanctions against operator databases, domain registrations, and licensing records across jurisdictions. The picture that emerges is not of a regulator struggling to keep up — though the challenge is enormous — but of an institution methodically building capacity, refining its tools, and escalating the consequences for operators who target Spanish players without authorisation. What follows is a breakdown of how that enforcement actually works: the blocking infrastructure, the financial penalties, the behavioural detection technology, and the cross-border difficulties that make prosecuting offshore operators genuinely hard.
Portal Blocking: 229 Domains and 2,961 Web Pages in 2025
I tested a DGOJ domain block for the first time in 2022, using a Spanish IP address to access a site I knew had been listed. The browser returned a generic connection error — no explanatory page, no redirect to the DGOJ website, just a dead link. It was effective in the narrowest sense: the site was inaccessible. But it was also invisible. Unless you already knew the site had been blocked, you would have assumed it was simply offline.
In 2025, the DGOJ blocked 229 portals encompassing 2,961 individual web pages offering illegal gambling to Spanish users. The mechanism works through Spain’s telecommunications infrastructure: the DGOJ issues blocking orders to internet service providers, which implement DNS-level and IP-level blocks on the specified domains. Mikel Arana, the DGOJ’s Director General, has characterised the scale of the problem bluntly — providing illegal gambling without a licence is a «very serious» offence carrying fines between 1 million and 50 million euros, but many of these illegal operators are not Spanish and are difficult to locate.
The blocking programme operates as a rolling process rather than a one-time sweep. The DGOJ maintains a list of domains offering unlicensed gambling to Spanish players, updates it regularly, and issues new blocking orders as sites appear. When an operator’s primary domain is blocked, the same operation frequently reappears under a new domain within days. Mirror domains, subdomain variations, and redirect chains are standard tactics for circumventing blocks, and the DGOJ’s ability to respond depends on detection speed and ISP implementation timelines.
There is a technical nuance here that matters. DNS-level blocking prevents the domain name from resolving to an IP address, but it does not remove the site from the internet. A user who knows the site’s direct IP address, or who uses a DNS resolver outside Spain’s ISP infrastructure, can potentially bypass the block. VPN services that route traffic through servers in other countries circumvent the blocking mechanism entirely, because the ISP never sees the request. The DGOJ is aware of this limitation, and the public consultation on Ley 13/2011 reform may address VPN circumvention as part of the broader enforcement toolkit.
Compare this to the UK, where the Gambling Commission has reviewed over 200,000 URLs linked to unlicensed gambling and successfully removed approximately 100,000 sites. Tim Rhodes at the UKGC has acknowledged that URL removal alone is not a complete solution, but that consistent disruption places sustained financial and operational pressure on illegal operators. The Spanish approach differs in mechanism — blocking rather than takedown — but the strategic logic is the same: make it expensive and inconvenient to operate illegally, even if you cannot eliminate the activity entirely.
For players, the blocking programme creates a false sense of comprehensiveness. If a site is accessible from a Spanish IP address, many assume it must be legal — or at least tolerated. In reality, the DGOJ blocks sites reactively, and the gap between a new illegal site going live and being blocked can be weeks or months. Using a VPN to bypass blocks adds another layer of complication, which I have addressed separately.
Sanctions Breakdown: 111 Million in a Single Year
November 2025 was the month that defined the DGOJ’s enforcement posture for the year. In a single round of sanctions, the Ministry penalised 32 operators with fines totalling 33,503,000 euros. Six of those operators were foreign unlicensed entities that received fines of 5 million euros each — the kind of figure that gets attention even from operators accustomed to treating regulatory costs as a business expense.
Across the full year, the numbers were 58 sanctions and 111 million euros in fines. To put that in context: the entire estimated volume of Spain’s unregulated gambling market is 231 million euros annually. The DGOJ’s 2025 fines represented nearly half the estimated illegal market value. Whether those fines are actually collected from operators based in jurisdictions outside Spanish enforcement reach is a different question — and one I will address in the cross-border section — but the declared amounts signal regulatory intent that operators cannot ignore.
The cumulative picture since 2021 is even more striking. Across 212 sanctions, the DGOJ has levied nearly 496 million euros in total fines. The acceleration is visible year over year: larger individual fines, more frequent sanction rounds, and an expanding scope of targeted operators. The legal framework supports this escalation — operating illegal gambling without a licence is classified as a «very serious» infraction under Ley 13/2011, with fines ranging from 1 million to 50 million euros per offence. The DGOJ has demonstrated willingness to use the upper range of that scale.
What is less visible in the headline numbers is the granularity of the sanctions. Not all fines target operators directly. Some target payment processors facilitating transactions to unlicensed sites. Others target advertising intermediaries that promote illegal operators. The DGOJ’s enforcement net extends beyond the casino operator itself, reaching into the infrastructure that makes illegal gambling possible. This multi-vector approach mirrors the strategy used by the UKGC, which received an extra 26 million pounds in government funding specifically to fight the black market following the UK’s tax hike to 40%.
The legal framework underpinning these sanctions is worth understanding. Ley 13/2011 categorises gambling offences into three severity tiers. Minor infractions — administrative non-compliance, late reporting — carry fines up to 100,000 euros. Serious infractions cover issues like advertising violations and inadequate responsible gambling measures. «Very serious» infractions — operating without a licence, facilitating unlicensed gambling, systematic fraud — sit at the top, with the 1-million to 50-million-euro range. The majority of the DGOJ’s high-profile sanctions fall into this top tier, reflecting a deliberate focus on the most egregious offenders rather than broad-based enforcement against marginal compliance failures.
For the regulated market, these sanctions serve a dual purpose. They penalise illegal operators, but they also protect the competitive position of licensed operators who pay taxes, comply with advertising restrictions, and absorb the cost of responsible gambling tools. Jorge Hinojosa, Director General of Jdigital, has framed illegal gambling as a direct threat to thousands of users who fall outside any guarantee — but it is also a threat to the licensed operators who compete against entities unburdened by compliance costs.
The Behavioural Risk Algorithm: How DGOJ Detects Problem Gambling
This is where enforcement meets technology, and where the DGOJ is doing something I have not seen from any other gambling regulator at this scale. The DGOJ has developed a behavioural risk detection algorithm based on XGBoost — a machine learning model used across industries for classification tasks — trained on data from over 500 individuals diagnosed with gambling disorder. The goal is early detection: identifying at-risk gambling behaviour before it escalates to the point of clinical intervention.
The model analyses betting patterns, deposit frequency, session duration, loss-chasing behaviour, and other behavioural markers to flag accounts that show signs of problematic gambling. According to data presented at the IGE 2026 conference in Rome, the algorithm improves detection rates by 10 percentage points compared to traditional screening methods. The DGOJ has described this as reinforcing Spain’s regulatory model «oriented toward prevention and user protection from a public health perspective, incorporating advanced technological tools.»
I find the approach genuinely interesting, and not just as a regulatory tool. The algorithm addresses a problem that self-report mechanisms — deposit limits, self-exclusion, reality checks — cannot solve: many players who are developing gambling problems do not recognise or acknowledge it themselves. A system that identifies behavioural patterns associated with diagnosed gambling disorder and triggers intervention before the player self-reports is a fundamentally different approach to player protection.
The enforcement relevance is straightforward: this technology exists only in the regulated market. Offshore casinos operating without a DGOJ licence are not required to implement any form of behavioural detection, and the vast majority do not. The approximately 4.3% of Spain’s adult population facing gambling-related problems, and the 14% of young online players showing symptoms of gambling disorder, are most exposed precisely when they are playing on platforms that lack these protections. The Safe Gambling Programme 2026-2030, which mandates risk-detection algorithms for all licensed operators, will widen this gap further between regulated and unregulated gambling.
Cross-Border Challenges: Tracing Operators Beyond Spanish Jurisdiction
The hardest part of my work is explaining why a regulator can issue a 50-million-euro fine and have it mean nothing in practice. The answer is jurisdiction. When an unlicensed operator is based in Curaçao, registered through a shell company in the British Virgin Islands, with servers in Latvia and payment processing in Cyprus, there is no single authority that can compel compliance. The DGOJ can issue the fine. Collecting it is another matter entirely.
Mikel Arana has been candid about this challenge. He has noted that the DGOJ has data on credit card payments to all gambling operators and can check whether payments were made to legal or illegal entities. The agency has also initiated strategies for monitoring Bitcoin gambling operations — a significant development, given that cryptocurrency transactions were previously considered effectively opaque to regulators. But tracing the money and tracing the operator are two different problems. The first is increasingly solvable through payment intelligence. The second depends on international cooperation between jurisdictions that may have no incentive to assist.
Cross-border enforcement in gambling regulation remains fragmented across Europe. Unlike financial services, where frameworks like the European Markets Infrastructure Regulation create cross-border enforcement mechanisms, gambling regulation is almost entirely national. The EGBA has advocated for greater coordination, and collaborative efforts like the European markers of harm standard represent steps toward shared frameworks. Maarten Haijer, EGBA’s Secretary General, has described this kind of collaboration as exactly the approach needed — bringing together stakeholders to share knowledge and create something for the common good. But in practice, when the DGOJ identifies an illegal operator based outside Spain, its enforcement options are limited to blocking access, sanctioning the entity on paper, and requesting cooperation from the operator’s licensing jurisdiction — if one exists.
The operators know this. Sophisticated illegal operators structure their corporate presence specifically to create enforcement gaps: incorporate in one jurisdiction, host in another, process payments through a third, and market to players in a fourth. Each layer adds cost for the regulator and distance from accountability. It is not a loophole in the system — it is the system, and changing it requires the kind of international regulatory cooperation that moves at diplomatic speed rather than market speed.
The DGOJ’s approach to this problem has evolved. Early enforcement focused primarily on domain blocking — a reactive, surface-level measure. More recent strategies target the financial infrastructure: monitoring credit card payments to all gambling operators, tracking cryptocurrency flows, and cooperating with payment processors to disrupt the revenue streams that make illegal operations profitable. If the operator cannot process deposits, the domain is worthless. This financial disruption approach is more effective than domain blocking alone, though it requires sophisticated payment intelligence capabilities that the DGOJ is still building. For details on the reform that could formalise these new enforcement tools, see my coverage of the Ley 13/2011 public consultation.
Enforcement Trajectory: What 2021-2026 Trends Suggest
Five years of data tell a clear story. The DGOJ has escalated enforcement consistently since 2021: more sanctions per year, larger average fine amounts, broader blocking campaigns, and new technological capabilities. The 212 cumulative sanctions and 496 million euros in fines represent a trajectory, not a plateau.
Several factors suggest this trajectory will continue. The public consultation on amending Ley 13/2011, open until 22 June 2026, is expected to address enforcement gaps including cross-border cooperation mechanisms and potentially new tools for restricting payment flows to unlicensed operators. The Safe Gambling Programme 2026-2030 introduces mandatory behavioural detection for all licensed operators, which will generate data that further distinguishes regulated from unregulated platforms. And the regulated market itself is growing — GGR reached 1,700.55 million euros in 2025, a 17% increase over 2024 — which means the economic stakes of enforcement are rising for both regulators and the industry.
Operator marketing spend in the regulated market hit 664.40 million euros in 2025, over 25% more than the previous year and equivalent to 39% of total GGR. That spending represents a regulated industry investing heavily in market share — an industry that has every incentive to support aggressive enforcement against unlicensed competitors who advertise without restrictions and operate without compliance costs. The political economy of enforcement favours escalation: regulators protect consumers, licensed operators support enforcement that eliminates unfair competition, and the government collects tax revenue that the unregulated market diverts.
Mikel Arana himself has stated that illegal gambling remains a «direct threat to the credibility of the regulated market, consumer protection, and fair competition.» That language, coming from the regulator at ICE Barcelona 2026, signals institutional commitment rather than routine procedure. Whether enforcement can keep pace with the speed at which new illegal operations appear is the open question — but the direction is unambiguous.
How does the DGOJ technically block access to unlicensed gambling sites?
The DGOJ issues blocking orders to Spanish internet service providers, which implement DNS-level and IP-level restrictions on specified domains. When a user on a Spanish ISP tries to access a blocked domain, the connection fails — typically showing a generic connection error rather than an explanatory page. The process is rolling: the DGOJ maintains and updates a list of illegal gambling domains and issues new blocking orders as sites are identified.
What is the maximum fine for operating an illegal gambling site in Spain?
Under Ley 13/2011, operating illegal gambling without a licence is classified as a very serious offence carrying fines between 1 million and 50 million euros per infraction. In November 2025, six foreign unlicensed operators received individual fines of 5 million euros each. The DGOJ has demonstrated willingness to use the upper range of the penalty scale, particularly against repeat offenders and operators actively targeting Spanish players.
How does the DGOJ’s XGBoost algorithm detect at-risk gambling behaviour?
The algorithm was trained on data from over 500 individuals diagnosed with gambling disorder. It analyses behavioural patterns including deposit frequency, session duration, loss-chasing behaviour, and betting pattern changes to flag accounts showing signs of problematic gambling. The system improves detection rates by 10 percentage points compared to traditional screening methods and operates as an early-intervention tool within the regulated market.
Can the DGOJ sanction foreign operators who have no legal presence in Spain?
The DGOJ can issue fines and blocking orders against any operator targeting Spanish players without authorisation, regardless of where the operator is based. However, collecting fines from operators incorporated in jurisdictions outside Spanish enforcement reach is a practical challenge. The DGOJ addresses this through payment monitoring, domain blocking, and international cooperation requests, but enforcement against operators structured across multiple jurisdictions remains difficult.