To: Chief technology officers, heads of responsible gaming and compliance directors at operators licensed in Spain
From: The Gaming Boardroom
Date: 4 November 2026
Subject: Implementing a risk model you did not train and cannot tune
Key Takeaways
- Spain’s gambling risk detection algorithm is one model, trained and published by the Dirección General de Ordenación del Juego, that every operator it licenses must run. Its second public participation round closed on 22 October 2026.
- The algorithm runs in the first seven days of each month over the previous 183 days of account activity, and categorises any player scoring 0.3312868 or above.
- A categorised player triggers the Real Decreto 176/2023 risk measures in articles 26 to 30 within 24 hours and for at least six months: no promotions, no privileged service, no credit card deposits, and a suspended account after 72 hours of silence.
- The resolution takes effect two months after publication in the Boletín Oficial del Estado, and the draft is undated.
1. What does Spain’s gambling risk detection algorithm require operators to run?
It requires them to run the regulator’s trained model instead of their own, because the DGOJ risk detection mechanism is a single artefact rather than a standard to meet. The DGOJ publishes the gambling risk detection algorithm as an XGBoost decision tree ensemble in a file named model.json. Anexo I defines the 48 features it reads, F00 to F47, all drawn from activity inside the gaming relationship, with browsing history and detailed financial or health records excluded. Anexo II and Anexo III publish the parameters of every node, so the scoring is specified rather than described.
Accounts with minimal recent activity drop out first, and a linear rule then categorises some players outright: where (0.0078179 x F01) – (0.0054741 x F02) – (0.0007368 x F04) + (0.5695069 x F10) reaches 6.922979, there is no probability to calculate. The input dataset has a fixed column order, cannot contain nulls, and any mismatch invalidates the run.
2. Why does a regulator-supplied model change the engineering work?
Because the numbers are configuration rather than code, and they have already moved once. The August 2025 draft scored against 0.3160608 and described more than 60 behavioural indicators. The October 2026 text scores against 0.3312868 and defines 48. Hard code the threshold, or round a coefficient carried to seven decimal places, and the gambling risk detection algorithm categorises a different population than the regulator’s own run.
Explaining the output is harder than producing it. Apartado Tercera requires the notice to the player to give the main factors behind the categorisation in plain language, and says a score or a threshold alone is not enough. Anexo I points at SHAP values, so the model needs a pipeline around it that produces per-player attributions and delivers them in readable Spanish inside the 24 hour deadline article 25.2 of Real Decreto 176/2023 sets for the measures.
Apartado Quinta limits the remedy. An operator review can correct data and void an unwarranted categorisation, but it cannot touch a variable, a parameter or the threshold, and the measures stay in force while it runs.
3. How do Spain, Great Britain and Germany compare?
Spain is the only one of the three where the regulator supplies the model.
| Market | Who supplies the model | What the regulator fixes | Data source |
| Spain | The DGOJ, as a published XGBoost file | 48 features, the categorisation rule and a 0.3312868 threshold | Account activity only, 183 days |
| Great Britain | The operator, with credit reference agencies running the assessment | Net deposits: 5,000 pounds in 24 hours at stage one, 1,000 pounds at the final stage | Credit reference data and open banking |
| Germany | The operator, at its own cost, detail set in its licence | That the system exists, rests on scientific findings and reads account data | Account data and the Limitdatei |
4. What else is due in the same window?
Three other Spanish obligations are in flight, which makes the gambling risk detection algorithm a sequencing decision rather than a standalone project: payment instrument ownership under Real Decreto 813/2026, in force since 28 October 2026 and due for existing players by 28 April 2027, joint deposit limits from 25 March 2027, and new advertising warnings from 5 December 2026.
The collision is in payments. Article 30 restricts a categorised player to nominative instruments in their own name, bans credit card deposits and gives them 72 hours to prove ownership. Article 26 gives the same player 72 hours to respond to the interaction or lose access. Two 72 hour clocks run against one account, on the payments stack Real Decreto 813/2026 is already rewriting.
5. Recommended actions
The decisive work is model governance rather than modelling, which is where most operators are thinnest. TGB’s AI Responsible Gambling Implementation Framework covers the model and data requirements, oversight design and governance architecture the five steps below assume.
- Rebuild the feature layer against the published definitions of F00 to F47 rather than mapping them onto features your current model produces, and validate the input contract before anything is scored.
- Hold the threshold, the categorisation coefficients and the feature definitions in versioned configuration with a documented re-specification drill, because they changed between drafts and can change again.
- Run the gambling risk detection algorithm over your own last 183 days now and compare the categorised population against what your current protocols produce, so the workload is known before the rule binds.
- Build the player notice as a product rather than a template, carrying the categorisation date, the activity window, the SHAP derived factors in plain language, the measures and their duration, and the automated decision disclosure.
- Scope the appeals desk to data accuracy and script it accordingly, since no parameter is open to revision and the measures stay in force throughout a review.
6. Questions for managers
- Who owns the model artefact once the regulator publishes it, and does that person sit in engineering, compliance or data governance?
- If the DGOJ reissues model.json with new parameters, how long before we are scoring against the new file in production?
- What do we do with a high volume player the algorithm categorises and our own protocols do not?
- Which of the Spanish deadlines between December 2026 and April 2027 are competing for the same engineers, and which gives way?
Sources
1. Dirección General de Ordenación del Juego, Acuerdo de 9 de octubre de 2026 por el que se somete nuevamente a participacion publica el proyecto de resolución por la que se aprueba el mecanismo de detección de comportamientos de riesgo de las personas usuarias, ref. 1FCDGOJ/019151111, signed by Mikel Arana Echezarreta. ordenacionjuego.es
2. Dirección General de Ordenación del Juego, Proyecto de resolución por la que se aprueba el mecanismo de detección de comportamientos de riesgo de las personas usuarias, with Anexo I (Descripción del modelo, variables F00 to F47, threshold 0.3312868, direct categorisation rule, SHAP explainability), Anexo II (parámetros de los nodos intermedios) and Anexo III (parámetros de los nodos finales). Published for comment 13 October 2026. ordenacionjuego.es
3. Dirección General de Ordenación del Juego, Participación pública proyecto de resolución del mecanismo de detección de comportamientos de riesgo, consultation page listing the acuerdo, nota explicativa, proyecto de resolución, memoria and evaluación de impacto en protección de datos, 13 October 2026, comments invited until 22 October 2026, a date the DGOJ page retained although an extension to 26 October 2026 was reported in the Spanish trade press. ordenacionjuego.es/en/node/3395
4. Real Decreto 176/2023, de 14 de marzo, por el que se desarrollan entornos más seguros de juego, BOE-A-2023-6735, consolidated text: article 25.2 (measures activated within 24 hours), article 26 (interacción específica and the 72 hour suspension), article 27 (promotions), article 28 (clientela privilegiada), article 29 (comunicaciones comerciales), article 30 (nominative payment instruments, credit card ban, 72 hours to prove ownership) and disposición final tercera (two year mandate to develop the detection mechanism). boe.es
5. Gambling Commission, Commission to introduce Financial Risk Assessments in staged approach, 7 July 2026: stage one at net deposits over 5,000 pounds in a rolling 24 hours, 2,500 pounds for customers under 25, final stage at 1,000 pounds in 24 hours or 3,000 pounds in 90 days, assessments carried out by credit reference agencies. gamblingcommission.gov.uk
6. Staatsvertrag zur Neuregulierung des Glücksspielwesens in Deutschland (Glücksspielstaatsvertrag 2021), paragraph 6i(1) (operator-run automated early detection system based on scientific findings, detail set in the licence, at the operator’s own cost) and paragraph 6c (cross-operator monthly deposit limit of 1,000 euros and the central Limitdatei).
7. Real Decreto 813/2026, de 7 de octubre, amending article 21.2 of Real Decreto 304/2014, in force 28 October 2026, with existing players to be verified by 28 April 2027; Real Decreto 520/2026, de 24 de junio, joint deposit limits enforceable 25 March 2027; Resolución de la DGOJ de 18 de septiembre de 2026 on advertising warnings, published in the BOE on 6 October 2026 and applicable from 5 December 2026. Deadlines as compiled in PwC NewLaw Pulse, 27 October 2026.
8. iGaming Business, DGOJ moves to end operator-by-operator gambling risk detection under new consultation, 13 October 2026, for the DGOJ’s 130,000 euro per operator implementation estimate and the objections raised in the 2025 round. The earlier draft’s threshold of 0.3160608 and its count of more than 60 behavioural indicators are taken from PwC NewLaw Pulse, Detección de jugadores de riesgo en el juego online, analysing the August 2025 text.