Gibraltar -- Custody Regulations Regulatory Overview

Gibraltar regulates cryptocurrency/digital asset custody primarily through the Financial Services (Distributed Ledger Technology) Regulations 2017 (DLT Regs), subsidiary to the Financial Services Act 2019, overseen by the Gibraltar Financial Services Commission (GFSC). Custody providers must obtain GFSC authorization if storing or transmitting third-party digital assets for commercial gain, with no distinct "qualified custodian" definition but coverage under the principles-based DLT Framework.[1][3][5]

Custodial License Requirements

Firms providing custody (e.g., wallet providers) fall under DLT provider licensing, requiring GFSC approval via application demonstrating compliance with 10 core DLT principles, including financial stability, risk management, data security, and transparent operations.[1][2][3] The license applies broadly to distributed ledger technology (DLT) activities involving value storage/transmission, not limited to crypto.[3][6] Applicants must also adhere to AML/CFT/CPF under the Proceeds of Crime Act 2015 (POCA).[1][3]

Segregation of Client Assets Rules

DLT Regs mandate segregation of client assets from firm assets as part of core principles, though specific implementation details are principles-based rather than prescriptive; funds handling crypto (e.g., Experienced Investor Funds) reference custody codes emphasizing separation.[1][5]

Insurance/Bonding Requirements

No explicit mandates for insurance or bonding appear in the DLT Framework; requirements focus on demonstrating internal controls and risk mitigation, with GFSC assessing firm capacity for security and stability.[1][3][5]

Cold Storage Mandates

Search results do not specify cold storage mandates; regulation emphasizes overall security and risk management under DLT principles, without detailed technical prescriptions like cold storage percentages.[1][3]

Qualified Custodian Definitions

No formal "qualified custodian" definition exists; custody falls under general DLT provider authorization for firms handling third-party digital assets.[1][5]

Pending Custody Legislation

No pending custody-specific legislation is noted in available sources as of 2026; the DLT Framework remains the active regime, with ongoing AML updates (e.g., POCA Travel Rule since 2021) but no new custody bills highlighted.[1][2][9] Funds sector references draft codes for crypto custody, valuation, and governance, but these are non-binding guidance.[5]

For official details, consult GFSC directly, as regulations are principles-based and subject to interpretive guidance. No URLs can be included per response guidelines.