Crypto ATM / kiosk operator in Gibraltar
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Gibraltar with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- AML/CFT/CPF obligations under the Proceeds of Crime Act 2015 (POCA) including mandatory CDD, transaction monitoring, risk assessments, staff training, and appointment of a GFSC-registered MLRO
- FATF Travel Rule compliance under the Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021 — information sharing on virtual asset transfers
- Customer due diligence (CDD) obligations as part of the DLT Provider Licence application and ongoing supervision
- Submission of AML/CFT policy manuals during the license application process (Stage 2)
- Ongoing compliance with GFSC AML/CFT/CPF guidance and supervision
- Sanctions compliance under the Sanctions Act 2019
Key Restrictions
- DLT Provider Licence is mandatory — no separate 'crypto-only' or lighter registration regime exists; covers any business using DLT to store, transmit, or trade digital assets
- Must be incorporated under the Companies Act 2014 (updated 2022)
- Substance requirements: local office in Gibraltar, local hires including a manager, proof of genuine domestic operations (mind & management in Gibraltar)
- Authorised capital not fixed but must demonstrate financial stability; assessed case-by-case by GFSC
- GFSC must approve directors, shareholders, and key personnel as part of the licensing process
- Physical kiosks handling cash likely trigger higher-scrutiny AML/CFT obligations under the principles-based DLT regime — no specific kiosk carve-out or exemption identified
Key Risks
- No specific crypto-ATM/kiosk regulatory framework exists — the operator must fit within the general DLT Provider Licence, creating interpretive risk as to whether cash-in/cash-out at physical kiosks is captured
- Cash-intensive business model may invite enhanced GFSC scrutiny on AML/CFT controls given the high-risk profile of cash-to-crypto conversions
- No separate registration regime exists beyond the full DLT licence, so even smaller ATM operators face the same high licensing burden as full exchanges
- GFSC principles-based regime leaves discretion; a kiosk operator could be deemed not compliant with DLT principles around governance/risk management if substance is inadequate
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Financial Services Act 2018 – establishes the 10 key principles for DLT business operations
The DLT Regulations – govern distributed ledger technology providers
The DLT Provider Licence is mandatory for any business using blockchain or DLT to store, transmit, or trade digital assets, including crypto exchanges, wallet providers, trading platforms, and custodial services; it falls under Section 8 of the FSA and ensures compliance with 9-10 DLT principles focused on transparency, risk management, AML/CFT, and governance.
No separate "crypto-only" license exists; the DLT license covers broader blockchain activities.2
Substance mandates: Local office, local hires (including a manager), and proof of domestic operations; GFSC verifies the firm is genuinely run from Gibraltar.
Authorized capital varies by project specifics and is not fixed; applicants must demonstrate financial stability, often via business plans showing sufficient resources for operations, risk management, and substance in Gibraltar (e.g., real office, local employees, manager).
Stage 1 (Initial Application): Submit form, business plan (detailing name, services, address, contact, founders/key persons), and pay non-refundable assessment fee; GFSC reviews viability against DLT principles.
Stage 2 (Full Application): Pay full fee, submit pack with policy manuals on risk management, IT/security, governance, financial crime (AML/CFT), and compliance procedures.
Stage 3 (Final Submissions): Provide conduct-of-business policies, non-financial resources info, and individual application forms for directors, shareholders, and key personnel; GFSC assesses business model, security, and substance.
Approval: GFSC grants license if criteria met, including AML/CFT protocols and financial soundness; ongoing supervision follows.
Requirements include physical presence, qualified management, transparent ownership, and annual fees (e.g., £50,000 for exchanges).
Post-licensing, firms must adhere to AML/CFT/CPF under the Proceeds of Crime Act 2015 ("POCA") and subsidiary rules, including customer due diligence (CDD), transaction monitoring, risk assessments, staff training, and appointing a compliance officer.1 2 6
Proceeds of Crime Act 2015 – addresses AML/CFT/CPF requirements
Proceeds of Crime Act 2015 (POCA): Core law mandating AML/CFT/CPF obligations for DLT Firms and VASPs, including registration of the Money Laundering Reporting Officer (MLRO) with GFSC.
Financial Services Act 2019 (FSA): Regulates DLT activities (e.g., storing/transmitting value via DLT) as requiring GFSC authorization; non-DLT crypto activities fall under POCA AML regime.
RFBR Regs 2021: Requires registration for AML/CFT supervision of VASPs not otherwise regulated.
Sanctions Act 2019: Expected compliance for counter-proliferation.
GFSC issues comprehensive AML/CFT/CPF guidance; VASPs must submit policies/manuals during application.
Proceeds of Crime Act 2015 – addresses AML/CFT/CPF requirements
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a crypto ATM/kiosk operator may operate in Gibraltar but must obtain a full DLT Provider Licence (high burden), incorporate locally, maintain substance (local office and management), and comply with POCA AML/CFT/CPF obligations; no kiosk-specific or lighter regime exists, creating interpretive risk for cash-handling activities.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?