Crypto Casinos: What Spanish Law Actually Says in 2026

The phrase crypto casinos gets thrown around in Spanish gambling forums as if it were a category of its own, a parallel universe where licences are optional and taxes are a rumour. The reality is narrower and considerably more boring: no operator may offer games of chance in Spain using cryptocurrencies as a payment method, and the fines for trying start at €50,000.

This article walks through the dry legal and financial mechanics: what the Ley 13/2011 and the Real Decreto 1614/2011 actually require, how the DGOJ enforces them, what a compliance programme costs, and where offshore brands like 1xBet, Stake, or Gamdom sit relative to Spanish players. Myth versus reality, with numbers attached.

What Counts as a Crypto Casino Under Spanish Law?

Is a Bitcoin-only gambling site legal in Spain?

No. Spanish law defines the permitted payment methods for online gambling exhaustively: credit and debit cards issued in Spain, bank transfers, and payment institutions authorised by the Banco de España. Cryptocurrencies do not appear in that list, which means accepting Bitcoin or USDT for real-money play falls outside the licensed regime entirely.

The DGOJ's Orden ECO/1094/2001 and subsequent technical standards require operators to verify the source of funds through regulated intermediaries. A crypto wallet has no such verification layer, which is the core reason the regulator treats it as incompatible rather than merely novel.

Does holding a Curaçao licence make an operator legal here?

It does not. A Curaçao licence, a Kahnawake licence, or an Anjouan licence authorises activity only inside the issuing jurisdiction. Spanish players accessing those sites are technically breaching the domestic market rules, while the operator risks administrative fines and, in aggravated cases, criminal exposure under Article 312 of the Código Penal.

Brands commonly marketed to Spanish players under offshore licences include 1xBet casino, Stake-style operations like Gamdom, Mystake, 1win casino, 22bet casino, Megapari, 20Bet, Pinata Casino, and Lucky Block casino. None of these hold DGOJ authorisation for the Spanish market.

How does the DGOJ define an unlicensed operator?

The test is behavioural, not corporate. If a site accepts Spanish residents, offers play in Spanish, supports EUR deposits through Spanish rails, or markets via .es domains, it is treated as operating in Spain regardless of where its servers sit or which flag appears in its footer.

Since the DGOJ's blacklist mechanism began publishing in 2012, the register has grown to several thousand domains. Blocking orders are issued to Spanish ISPs under Article 64 of Ley 13/2011, and failure to comply by a telecoms provider carries its own separate penalty.

What is the difference between a crypto casino and a licensed casino with crypto features?

A licensed Spanish operator cannot offer crypto deposit or withdrawal rails at all, so the second category does not exist in Spain. What you may see is licensed brands discussing blockchain for provably fair game logic or for internal audit trails, which is a technology question rather than a payment question.

That distinction matters because marketing copy blurs it. When a brand says it is "crypto-friendly", read it as "not licensed here". The DGOJ has issued warnings to licensed operators for even hinting at alternative currencies in promotional material.

What Does a Spanish Online Gambling Licence Actually Cost?

How much does the DGOJ authorisation cost upfront?

The application fee to the DGOJ is €25,000, non-refundable, paid before the technical review begins. Add roughly €40,000 to €90,000 for the independent technical audit of the Random Number Generator and the platform, depending on the number of game categories submitted.

Then comes the bank guarantee or deposit with the Banco de España: €1,700,000 for the general modality covering all game types, reduced proportionally if the operator applies for a narrower scope. This figure alone eliminates most crypto-native startups from consideration.

What are the annual fees after launch?

The annual tax on the general online gambling modality is 20% of gross gaming revenue, with a minimum quota of €1,500,000 per year per operator. There is also an annual authorisation renewal fee of €25,000 and periodic technical re-certification costs every three years.

Compare that with Curaçao, where the total annual licence cost historically ran between €12,000 and €40,000 depending on the sub-licence holder, or Anjouan, where published tariffs sit in the low five figures. The gap explains the offshore migration, not any philosophical disagreement about fairness.

What compliance staffing does a licensed operator need?

At minimum: a compliance officer with gambling-specific experience, a money laundering prevention officer (obligated under Ley 10/2010), a data protection delegate under the GDPR, and a technical team maintaining the DGOJ's real-time reporting connection. Realistic payroll for this quartet in Madrid or Barcelona runs €180,000 to €260,000 per year.

On top of that sits the annual independent audit, the RGPD documentation, the responsible gambling tooling, and the periodic reporting to the Registro Central de Exclusión. Fixed compliance overhead before a single bet is placed: expect €350,000 to €500,000 annually.

Why do crypto casinos skip all of this?

Because the entire cost structure assumes a regulated fiat perimeter: Spanish-issued cards, SEPA rails, a Banco de España relationship, and a physical presence able to receive inspection. A crypto-only operation can be run from a jurisdiction with no equivalent requirements, using a stablecoin treasury and no local entity.

The trade-off is enforcement risk rather than licence cost. Spanish authorities can block the domain, fine the operator if it has any local nexus, and refer cases to tax authorities when Spanish residents fail to declare winnings. The operator's savings are the player's exposure.

What Penalties Apply to Unlicensed Gambling in Spain?

How large are the fines for operating without authorisation?

Ley 13/2011 sets the administrative penalty scale in Article 64. Operating without DGOJ authorisation is classified as a very serious infringement (infracción muy grave) when it involves significant economic volume, carrying fines from €50,001 up to €500,000. Serious infringements run €30,001 to €50,000; minor ones start at €6,000.

In practice, the DGOJ has issued penalty resolutions in the range of €60,000 to €300,000 against unlicensed operators since 2018, with repeat or aggravated cases reaching higher. Each additional month of operation is treated as a continuing infringement.

Can Spanish players be sanctioned too?

Players face no administrative fine for using an offshore site, but winnings are taxable income. The Agencia Tributaria requires declaration of gambling winnings above €2,550 per year from a single payer under the IRPF savings regime at 19% to 27% depending on the amount.

Crypto winnings add a layer: if the winnings are converted to euros later, the plusvalía from the exchange is also taxable. Failing to declare both legs is where individual cases turn from a paperwork issue into a tax inspection.

What happens to payment processors and affiliates?

Payment providers facilitating unlicensed gambling face their own penalties under Ley 10/2010 and can be removed from the Banco de España register. Affiliate networks promoting unlicensed operators to Spanish audiences have received cease-and-desist orders, and advertising of unlicensed gambling is separately sanctionable.

The DGOJ has also coordinated with Google to remove unlicensed operators from paid search results in Spain. Since 2023, that coordination has extended to social platforms, with several campaigns taken down mid-flight.

Is there criminal liability, and when does it kick in?

Yes, and the threshold is Article 312 of the Código Penal: organisation of games of chance or betting without the corresponding administrative authorisation when the activity exceeds the administrative threshold. Penalties start at fines and can include disqualification from managing gambling businesses for up to six years.

Criminal referral is rare for purely offshore operations with no local nexus, but it becomes realistic once a Spanish entity, a Spanish employee, or a Spanish marketing office is involved. Several cases since 2020 have turned on exactly that detail.

Which Operators Actually Hold Spanish Licences?

Who is on the DGOJ register right now?

The authorised list includes the familiar names: bet365 casino, William Hill casino, Bwin casino, Codere casino, Sportium casino, PokerStars casino, 888 Casino, Betfair casino, PartyCasino, LeoVegas casino, Mr Green casino, Casumo, Wanabet, GoldenPark, 888 Sport casino, and Marathonbet casino.

Others on the register: Kirolbet, Paf, Winfair24, Interwetten, PlayUZU, Botemania, YoCasino, Juegging, Enracha, Paston, Versus, Wanabet, Grupogalgo, and Reale Multimedios. None of them accept crypto deposits.

What happens when a licensed brand experiments with crypto?

Any material change to payment methods requires prior notification to the DGOJ and, in most cases, a fresh technical audit. Introducing a crypto rail would be a change of sufficient scope to trigger suspension of the existing modality until re-approval.

No licensed Spanish operator has attempted it. The economics do not justify the risk: the 20% GGR tax applies regardless of currency, so accepting crypto would add compliance exposure without reducing the tax bill.

Are there Spanish-facing brands that are offshore but well known?

Yes, and the list is long enough to matter. SolCasino, Golden Bull casino, SpeedyBet, Betify, Quick Win, Magius, Bruno Casino, Gransino, Powbet, BetLabel, Favbet, and Sportaza all market to Spanish-speaking players while operating under non-Spanish licences.

Some of these accept crypto directly; others use third-party processors that settle in stablecoins behind the scenes. Either way, the Spanish player has no domestic recourse beyond the operator's own dispute channel.

How does a player verify a licence in 30 seconds?

Open the DGOJ's public register of authorised gambling operators, search the brand name, and check that the authorisation number matches what appears in the site's footer. If the footer shows a Curaçao seal and no DGOJ number, the answer is settled.

A second check: the site must offer a Spanish-language self-exclusion route through the Registro Central de Exclusión and display the responsible gambling warning with the DGOJ's contact information. Absence of both is a reliable red flag.

How Do Crypto Casinos Handle Player Protection?

What responsible gambling tools are mandatory in Spain?

Licensed operators must offer deposit limits (daily, weekly, monthly), loss limits, session time limits, reality checks, self-exclusion via the Registro Central de Exclusión, and a voluntary exclusion mechanism inside the account settings. All of these are verified during the technical audit.

The exclusion register, operational since 2012, allows a player to block themselves from all licensed operators simultaneously for a minimum period of six months, extendable indefinitely. It is the single most effective tool in the Spanish system.

Do offshore crypto casinos offer equivalent protection?

Some advertise self-exclusion tools, but they are account-level, not system-level, and they do not sync with the Spanish register. A player excluded from a licensed operator remains fully able to deposit at an offshore site the same afternoon.

Crypto casinos also rarely implement affordability checks. Without a bank relationship, there is no natural point at which a spending pattern triggers a review. The absence of that checkpoint is not a feature; it is a structural gap.

What about game fairness and RNG certification?

Spanish-licensed operators must certify their RNG through an accredited laboratory approved by the DGOJ, with periodic re-testing. Studios supplying the Spanish market, including Pragmatic Play, NetEnt, Evolution, Microgaming, and Hacksaw Gaming, hold these certifications for their Spanish-facing titles.

Offshore sites may publish "provably fair" hashes instead, which allows a player to verify a single round but says nothing about the long-run return-to-player configuration. Different assurance models, different failure modes.

Is there any player recourse if an offshore site refuses a withdrawal?

Practically, very little. The Spanish consumer protection route (OMIC) has no jurisdiction over a company without Spanish establishment. Players can report the site to the DGOJ for blacklist consideration, but that does not recover funds.

Crypto transactions compound the problem: once a transfer is confirmed on-chain, it is not reversible. With a card chargeback, the issuer can intervene; with USDT sent to an external wallet, the trail ends there.

What Does Compliance Cost in Practice?

Can a small operator realistically enter the Spanish market?

The minimum viable budget, covering licence deposit, audit, first-year tax minimum, and staffing, lands around €2.2 million to €2.8 million in year one. The €1.5 million annual tax floor applies even if revenue is modest, which makes Spain a poor first market for a startup.

Established groups use Spain as a regulated market alongside Italy, France, and the Netherlands, spreading fixed compliance costs across multiple jurisdictions. Solo operators rarely attempt it.

What are the ongoing reporting obligations?

Monthly statistical returns to the DGOJ, real-time connection of bet data where required, annual financial statements, and immediate notification of any change in beneficial ownership, payment providers, or game suppliers. Missing a reporting deadline triggers minor infringement fines starting at €6,000.

Data retention runs five years for transaction records and ten years for identification documents under Ley 10/2010. Storage must be within the EEA or under an adequacy decision, which rules out some crypto-native infrastructure choices.

How do crypto casinos fund themselves without a banking relationship?

Typically through a corporate structure in a jurisdiction like Curaçao, Estonia, or the Isle of Man, with a treasury held in stablecoins and a payment aggregator handling fiat on-ramps in restricted markets. Overhead is a fraction of a Spanish-licensed operation.

The trade-off is counterparty risk. Aggregators get de-banked, stablecoin issuers freeze addresses, and the whole arrangement can seize up overnight. Several operators discovered this in 2023 when major processors withdrew from grey-market gambling.

What is the realistic payback period for a Spanish licence?

At the 20% GGR tax with a €1.5 million floor, an operator needs meaningful volume before the licence stops being a net cash drain. Modelling a blended GGR margin of 8% on player deposits, breaking even on the tax floor alone requires roughly €18.75 million in annual deposits.

That figure, divided across a market of about 4 million registered online gambling accounts in Spain, gives a sense of the scale required. The licence is a scale play, not a side project.

Myth Versus Reality: Common Claims About Crypto Casinos

Myth: crypto casinos are anonymous, so Spanish tax rules do not apply

Reality: on-ramps and off-ramps in Spain require KYC through a regulated exchange or payment provider. Binance, Kraken, and Bit2Me all report to Spanish tax authorities as obliged entities, and the AEAT has been cross-referencing exchange records with IRPF filings since 2021.

Wallet-level privacy does not equal fiscal invisibility. The moment euros enter a Spanish bank account, the trail is visible, and unreported gambling income carries surcharges of 50% to 150% on top of the unpaid tax.

Myth: accepting crypto is just an extra payment option

Reality: under Spanish law it is a change of operating regime. Payment methods are part of the authorised scope; adding an unapproved method is treated as operating outside the authorisation, with the corresponding infringement classification.

This is why no licensed operator has quietly added a Bitcoin deposit button. The downside risk is losing a licence worth millions in sunk compliance cost, and no marketing gain offsets that.

Myth: offshore brands are safe because many are well known

Reality: brand recognition and regulatory standing are separate axes. Betsson, Casino Barcelona, Casino GranMadrid Online, Casino GranVia, and AdmiralBet are known in Spain precisely because they hold licences; 1xBet casino, Stake-style brands, and Mystake are known through marketing spend and affiliate networks.

Being widely advertised does not create legal protection for the player. If an operator is not on the DGOJ register, the domestic complaint routes simply do not exist.

Myth: blockchain makes these casinos more transparent

Reality: on-chain settlement makes the transaction visible, but the game logic, the RTP configuration, and the corporate ownership behind the site are usually off-chain and unaudited. Transparency of movement is not transparency of odds.

Licensed Spanish operators publish theoretical RTP ranges per game category and submit their RNG to third-party testing. That disclosure is contractual and enforceable; a blockchain hash is not.

Myth: the DGOJ cannot reach operators outside Spain

Reality: blocking orders, advertising sanctions, payment cut-offs, and coordination with foreign regulators cover most practical cases. The DGOJ has issued joint actions with counterparts in Malta, Curaçao, and Gibraltar since 2020.

Direct fining power over a foreign entity is limited without local assets, but the combination of domain blocking and payment restriction achieves the same market outcome. Enforcement does not need to be perfect to be effective.

Which Licensed Brands Offer the Strongest Value in 2026?

What should a Spanish player compare before depositing?

Four variables matter: the welcome bonus terms and wagering requirement, the withdrawal processing time, the range of game providers, and the depth of the responsible gambling toolset. Everything else is marketing.

Bonus offers in the Spanish market typically run between €100 and €500 matched, with wagering requirements between 20x and 40x. A 40x requirement on a €300 bonus means €12,000 of turnover before withdrawal, which changes the arithmetic considerably.

Which providers dominate the Spanish-licensed catalogue?

Pragmatic Play, NetEnt, Evolution for live tables, Microgaming, Play'n GO, and Hacksaw Gaming supply the bulk of titles available through licensed operators. Their Spanish-certified versions carry the DGOJ-approved RTP figures.

Offshore crypto casinos often carry the same studios plus additional provably-fair in-house titles from providers like Betsoft or proprietary studios. The catalogue may be wider; the certification trail is thinner.

How fast are withdrawals in each model?

Licensed Spanish operators using SEPA or card refunds typically settle within 24 to 72 hours after KYC is complete, with some processing same-day for verified accounts. Crypto withdrawals on offshore platforms are often faster in raw transfer time: minutes to a few hours.

The speed difference is real. What it buys you is speed, not recourse. A delayed SEPA payment can be chased with the operator's compliance team and, if needed, the DGOJ; a stuck on-chain transfer has no equivalent escalation path.

What about the smaller licensed brands?

PlayUZU, Botemania, YoCasino, Juegging, Enracha, Paston, and Versus cater to the domestic market with narrower catalogues and lower bonus ceilings, often in the €50 to €150 range. Their appeal is familiarity and local payment support rather than volume.

For a player who values the Registro Central de Exclusión and Spanish-language support over catalogue breadth, these brands do the job without the offshore caveats.

What Should a Player Actually Do?

Is it worth using a crypto casino from Spain?

Only if you accept three conditions: no domestic complaint route, no sync with the national self-exclusion register, and full personal responsibility for tax declaration on both the gambling winnings and any crypto gains. For most players, that trade is worse than it looks from the marketing page.

If speed of withdrawal and a wider game catalogue are the draw, weigh those against the fact that a licensed operator's failures are documented and sanctionable, while an offshore operator's are not. Convenience is not a protection.

What is the practical checklist before depositing anywhere?

1. Confirm the DGOJ authorisation number in the footer against the public register.
2. Check that deposit methods are Spanish-issued cards, SEPA, or authorised payment institutions.
3. Verify the presence of the Registro Central de Exclusión link and the responsible gambling warning.
4. Read the wagering requirement and convert it into required turnover before accepting any bonus.
5. Confirm the RTP disclosure for the specific titles you plan to play.

How should crypto winnings be declared?

Declare the gambling win as income under the IRPF savings regime once converted to euros, and declare any capital gain on the crypto disposal separately. Keep exchange records from the moment of acquisition; the AEAT will ask for the cost basis.

Where the original win was in crypto and never converted, the obligation still exists at the point of disposal. Reporting is triggered by the disposal, not by the moment of winning.

What changes should operators expect in 2026?

The DGOJ has signalled tighter scrutiny of affiliate marketing and of payment flows that touch grey-market operators. Expect more enforcement against intermediaries rather than only against the operators themselves, and expect the blacklist to keep growing.

For licensed brands, the compliance cost curve is flat to slightly upward: more frequent audit cycles, stricter reporting on responsible gambling metrics, and continued pressure on bonus advertising. The licence remains expensive; it also remains the only defensible way to operate in Spain.

Frequently asked questions

Are crypto casinos legal in Spain?

No. Spanish law does not permit cryptocurrency as a payment method for real-money gambling. Only Spanish-issued cards, SEPA transfers, and payment institutions authorised by the Banco de España are allowed, so any site accepting Bitcoin or USDT from Spanish players is operating outside the licensed regime.

What is the fine for running an unlicensed casino in Spain?

Very serious infringements under Ley 13/2011 carry administrative fines from €50,001 to €500,000. In practice, DGOJ resolutions against unlicensed operators since 2018 have landed between €60,000 and €300,000, with continuing infringements accruing additional monthly amounts.

Do Spanish players get in trouble for using offshore crypto casinos?

Players face no administrative sanction, but all winnings are taxable. Amounts above €2,550 per year from a single payer must be declared under the IRPF savings regime at 19% to 27%, and undeclared amounts attract surcharges of 50% to 150%.

How much does a Spanish online gambling licence cost?

The application fee is €25,000, the Banco de España deposit is €1,700,000 for the general modality, and the annual tax on gross gaming revenue is 20% with a minimum quota of €1,500,000. First-year total outlay realistically reaches €2.2 million to €2.8 million.

Can I exclude myself from crypto casinos in Spain?

The Registro Central de Exclusión blocks access to all DGOJ-licensed operators at once, for a minimum of six months. Offshore crypto casinos are not connected to that register, so self-exclusion there only applies to the individual account on that specific site.

Which Spanish-licensed casinos accept crypto?

None. Brands such as bet365 casino, Codere casino, PokerStars casino, William Hill casino, Sportium casino, bwin casino, and 888 Casino operate under DGOJ authorisation and offer only approved fiat payment methods. Any site offering crypto deposits from Spain is unlicensed locally.

The legal position in Spain is unambiguous: crypto casinos operate outside the licensed market, the penalties for doing so start at €50,001, and the compliance cost of doing it properly runs into seven figures. Players who value domestic recourse, self-exclusion sync, and enforceable RTP disclosure will find all three only with a DGOJ-licensed operator, and everyone else is trading those protections for speed.