Gibraltar
Overview
Gibraltar regulates crypto through a dedicated DLT Provider Licence framework anchored in the Financial Services Act 2019 (FSA), administered by the Gibraltar Financial Services Commission (GFSC); any business using blockchain or DLT to store, transmit, or trade digital assets — including exchanges, wallet providers, trading platforms, and custodial services — must obtain this licence under Section 8 of the FSA, with firms also required to incorporate under the Companies Act 2014. Licensed entities must satisfy 10 principles-based obligations covering governance, risk management, financial stability, data security, and customer protection, and comply with AML/CFT/CPF duties under the Proceeds of Crime Act 2015, including CDD, transaction monitoring, risk assessments, staff training, and appointment of a compliance officer. The regime requires demonstrable "mind and management" in Gibraltar — a local office and employees — meaning brass-plate structures will not satisfy licensing conditions. (gibraltarlaws.gov.gi, gfsc.gg)
Regulatory Bodies
Gibraltar Financial Services Commission (GFSC): The main authority, responsible for licensing, supervising, and enforcing rules on DLT firms, virtual asset service providers (VASPs), crypto exchanges, custody services, and trading…
Operating Models
9/9 verdictsCan specific business models operate in Gibraltar? Each card answers the operational question for one kind of operator. Curated cells reflect counsel-grade review; AI-generated cells should be confirmed before relying on them.
Conditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · no licensing.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedPrimary Legislation
| Law / Regulation | Year | Scope |
|---|---|---|
| Financial Services Act 2018 | 2018 | Financial Services Act 2018 – establishes the 10 key principles for DLT business operations |
| Proceeds of Crime Act 2015 | 2015 | Proceeds of Crime Act 2015 – addresses AML/CFT/CPF requirements |
| Companies Act (2014, updated January 2022) | 2014 | Companies Act (2014, updated January 2022) – governs company registration and reporting |
| They may qualify as investments under the Specialised Investment Business Act (S | They may qualify as investments under the Specialised Investment Business Act (SIBA) framework if facts indicate security-like features (e.g., offered to the public or tied to specific investors). | |
| Financial Services Act 2019 (FSA): Oversees virtual/digital asset activities, en | 2019 | Financial Services Act 2019 (FSA): Oversees virtual/digital asset activities, ensuring GFSC compliance for transfers, storage, and management. |
| Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021: Implem | 2015 | Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021: Implements the FATF Travel Rule for VASPs, effective March 22, 2021, requiring information sharing on virtual asset transfers. |
| Financial Services Act 2019: https://www.gfsc.gg/legislation (core licensing fra | 2019 | Financial Services Act 2019: https://www.gfsc.gg/legislation (core licensing framework). |
| Companies Act 2014 (updated 2022): https://www.gibraltarlaws.gov.gi/legislations | 2014 | Companies Act 2014 (updated 2022): https://www.gibraltarlaws.gov.gi/legislations/companies-act-2014-389 (company setup). |
| Licensing under section 8 of the FS Act if deemed a “financial instrument” or “r | Licensing under section 8 of the FS Act if deemed a “financial instrument” or “regulated activity.” | |
| Prospectus requirements under Part 19 (Listing and Prospectuses) of the FS Act i | Prospectus requirements under Part 19 (Listing and Prospectuses) of the FS Act if considered a transferable security. |
Licensing Requirements
The regime is principles-based, with 10 core principles covering governance, risk management, financial stability, data security, and customer protection; applicants must demonstrate compliance, including "mind and management" in Gibraltar (e.g., local office and employees).1 2 6
Post-licensing, firms must adhere to AML/CFT/CPF under the Proceeds of Crime Act 2015 ("POCA") and subsidiary rules, including customer due diligence (CDD), transaction monitoring, risk assessments, staff training, and appointing a compliance officer.1 2 6
No separate "crypto-only" license exists; the DLT license covers broader blockchain activities.2
The DLT Provider Licence is mandatory for any business using blockchain or DLT to store, transmit, or trade digital assets, including crypto exchanges, wallet providers, trading platforms, and custodial services; it falls under Section 8 of the FSA and ensures compliance with 9-10 DLT principles focused on transparency, risk management, AML/CFT, and governance.
No separate registration regime exists beyond this licensing; firms must be incorporated under the Companies Act 2014 (updated 2022) and comply with Proceeds of Crime Act 2015 (POCA) for AML/CFT/CPF, plus consumer protection and intellectual property rules.
Activities like ICOs and non-security token sales may require additional Virtual Asset Service Provider (VASP) registration if applicable.
Authorized capital varies by project specifics and is not fixed; applicants must demonstrate financial stability, often via business plans showing sufficient resources for operations, risk management, and substance in Gibraltar (e.g., real office, local employees, manager).
Substance mandates: Local office, local hires (including a manager), and proof of domestic operations; GFSC verifies the firm is genuinely run from Gibraltar.
Stage 1 (Initial Application): Submit form, business plan (detailing name, services, address, contact, founders/key persons), and pay non-refundable assessment fee; GFSC reviews viability against DLT principles.
Stage 2 (Full Application): Pay full fee, submit pack with policy manuals on risk management, IT/security, governance, financial crime (AML/CFT), and compliance procedures.
Stage 3 (Final Submissions): Provide conduct-of-business policies, non-financial resources info, and individual application forms for directors, shareholders, and key personnel; GFSC assesses business model, security, and substance.
Approval: GFSC grants license if criteria met, including AML/CFT protocols and financial soundness; ongoing supervision follows.
Financial Services Act 2019: https://www.gfsc.gg/legislation (core licensing framework).
Companies Act 2014 (updated 2022): https://www.gibraltarlaws.gov.gi/legislations/companies-act-2014-389 (company setup).
GFSC DLT Guidance: https://www.fsc.gi/ (application details, principles, fees).
AML/KYC Requirements
Proceeds of Crime Act 2015 (POCA): Core law mandating AML/CFT/CPF obligations for DLT Firms and VASPs, including registration of the Money Laundering Reporting Officer (MLRO) with GFSC.
Financial Services Act 2019 (FSA): Regulates DLT activities (e.g., storing/transmitting value via DLT) as requiring GFSC authorization; non-DLT crypto activities fall under POCA AML regime.
RFBR Regs 2021: Requires registration for AML/CFT supervision of VASPs not otherwise regulated.
Sanctions Act 2019: Expected compliance for counter-proliferation.
GFSC issues comprehensive AML/CFT/CPF guidance; VASPs must submit policies/manuals during application.
GFSC website: https://www.fsc.gi/ (regulatory body for oversight).
Travel Rule
No verified facts yet. 3 unverified fact(s) in explorer
Tax Reporting
Tax reporting data collection in progress.
Custody Requirements
Custody regulation data collection in progress.
Stablecoin Regulation
Stablecoin regulation data collection in progress.
Securities Classification
Securities classification data collection in progress.
Sanctions & Restrictions
Sanctions data collection in progress.
Research & Articles
Regulatory Forecast
high confidenceLikely enforcement action expected around 2026-11-18
Based on 16 historical regulatory events for Gibraltar, averaging every 129 days, with increasing regulatory activity.
Recent Updates
Technical Implementation Requirements: Originator VASPs must collect and securely transmit (before or alongside t...
Technical Implementation Requirements: Originator VASPs must collect and securely transmit (before or alongside the transaction) originator and beneficiary information—such as names and account/wallet details—for transactions over the threshold involving another VASP or relevant financial business. Beneficiary VASPs must obtain and hold this data. Virtual assets are defined in the amended POCA as digital representations of value for payment/investment, excluding fiat digital representations and certain financial instruments.
Sanctions Act 2019: Expected compliance for counter-proliferation.
Sanctions Act 2019: Expected compliance for counter-proliferation.
GFSC Enforcement Actions: https://www.gfsc.gg/news/enforcement-actions
GFSC Enforcement Actions: https://www.gfsc.gg/news/enforcement-actions
GFSC Virtual Assets Information: https://www.gfsc.gg/industry-sectors/banking/virtual-assets
GFSC Virtual Assets Information: https://www.gfsc.gg/industry-sectors/banking/virtual-assets
The Gibraltar DLT licensing regime is principles-based, with 10 core principles covering governance, risk management,...
The Gibraltar DLT licensing regime is principles-based, with 10 core principles covering governance, risk management, financial stability, data security, and customer protection; applicants must demonstrate compliance, including "mind and management" in Gibraltar (e.g., local office and employees) Global Legal Insights – Gibraltar Blockchain Laws.
As of early 2026, the GFSC has not publicly reported licensing denials or revocations for DLT firms, but ongoing supe...
As of early 2026, the GFSC has not publicly reported licensing denials or revocations for DLT firms, but ongoing supervision includes annual compliance audits and AML/CFT inspections GFSC Legislation. Enforcement actions for non-compliance can include fines, license suspension, or revocation under the Financial Services Act 2019 GFSC Legislation.
Sanctions Act 2019: Expected compliance for counter-proliferation.
Sanctions Act 2019: Expected compliance for counter-proliferation.
This profile is maintained by AI research workers and updated regularly. Connect via MCP for programmatic access.