Crypto-funded debit card in Gibraltar
A card program where customer fiat balances are funded from crypto holdings, typically through an off-ramp at point of sale or top-up.
Crypto debit card is conditionally permitted in Gibraltar with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- POCA 2015 mandates full AML/CFT/CPF compliance including CDD, transaction monitoring, risk assessments, staff training, and appointment of a GFSC-registered MLRO
- FSA 2019 requires GFSC authorization for DLT activities including storing/transmitting value via DLT
- FATF Travel Rule applies to VASPs under the Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021, requiring information sharing on virtual asset transfers
- GFSC AML/CFT/CPF guidance applies; policies and procedures must be submitted during licensing application
- Sanctions Act 2019 compliance required for counter-proliferation
- Ongoing supervision by GFSC with compliance reporting obligations
Key Restrictions
- Crypto-to-fiat conversion must be conducted by a GFSC-licensed entity under the DLT Provider Licence (Section 8, FSA 2019)
- Operator must be incorporated under the Companies Act 2014 and maintain physical presence in Gibraltar (local office, local hires, local manager)
- E-money or payment services likely require a separate authorization or fall within scope of a regulated e-money institution; the DLT licence alone may not cover fiat card issuance
- The operating model requires a partner-bank or BIN-sponsor arrangement, which introduces fiat regulated entity dependency
- No separate crypto-only license exists — DLT licence is mandatory for any blockchain/DLT business activity
Key Risks
- Gibraltar's DLT framework is principles-based and GFSC has broad discretion — this creates regulatory uncertainty for novel models like crypto-funded debit cards
- Stablecoin-specific rules (e.g., 1:1 reserve requirements) are absent from available sources, creating ambiguity for the crypto-to-fiat off-ramp
- The GFSC requires substance (local office + local hires) in a small jurisdiction, which may be difficult to scale or cost-prohibitive for card programs
- Partner-bank/BIN-sponsor may itself require GFSC or UK/EU authorization for the fiat leg, adding complexity and regulatory risk
- Dual licensing risk: crypto/DLT licence for the crypto leg + e-money/payment licence for the fiat card leg, with no clear guidance on the interaction
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Financial Services Act 2018 – establishes the 10 key principles for DLT business operations
The DLT Regulations – govern distributed ledger technology providers
Proceeds of Crime Act 2015 – addresses AML/CFT/CPF requirements
Gibraltar Financial Services Commission (GFSC): The main authority, responsible for licensing, supervising, and enforcing rules on DLT firms, virtual asset service providers (VASPs), crypto exchanges, custody services, and trading platforms. It ensures compliance with international standards like FATF, including customer verification and risk management.
Financial Services Act 2019 (FSA): Oversees virtual/digital asset activities, ensuring GFSC compliance for transfers, storage, and management.
DLT Framework (introduced 2018): Pioneering principles-based regulations for DLT operators, covering licensing, governance, and consumer protection; developed from the 2014 Cryptocurrency Working Group.
The regime is principles-based, with 10 core principles covering governance, risk management, financial stability, data security, and customer protection; applicants must demonstrate compliance, including "mind and management" in Gibraltar (e.g., local office and employees).1 2 6
Post-licensing, firms must adhere to AML/CFT/CPF under the Proceeds of Crime Act 2015 ("POCA") and subsidiary rules, including customer due diligence (CDD), transaction monitoring, risk assessments, staff training, and appointing a compliance officer.1 2 6
No separate "crypto-only" license exists; the DLT license covers broader blockchain activities.2
The DLT Provider Licence is mandatory for any business using blockchain or DLT to store, transmit, or trade digital assets, including crypto exchanges, wallet providers, trading platforms, and custodial services; it falls under Section 8 of the FSA and ensures compliance with 9-10 DLT principles focused on transparency, risk management, AML/CFT, and governance.
Substance mandates: Local office, local hires (including a manager), and proof of domestic operations; GFSC verifies the firm is genuinely run from Gibraltar.
Stage 1 (Initial Application): Submit form, business plan (detailing name, services, address, contact, founders/key persons), and pay non-refundable assessment fee; GFSC reviews viability against DLT principles.
Stage 2 (Full Application): Pay full fee, submit pack with policy manuals on risk management, IT/security, governance, financial crime (AML/CFT), and compliance procedures.
Stage 3 (Final Submissions): Provide conduct-of-business policies, non-financial resources info, and individual application forms for directors, shareholders, and key personnel; GFSC assesses business model, security, and substance.
Approval: GFSC grants license if criteria met, including AML/CFT protocols and financial soundness; ongoing supervision follows.
Requirements include physical presence, qualified management, transparent ownership, and annual fees (e.g., £50,000 for exchanges).
Authorized capital varies by project specifics and is not fixed; applicants must demonstrate financial stability, often via business plans showing sufficient resources for operations, risk management, and substance in Gibraltar (e.g., real office, local employees, manager).
Proceeds of Crime Act 2015 (POCA): Core law mandating AML/CFT/CPF obligations for DLT Firms and VASPs, including registration of the Money Laundering Reporting Officer (MLRO) with GFSC.
Financial Services Act 2019 (FSA): Regulates DLT activities (e.g., storing/transmitting value via DLT) as requiring GFSC authorization; non-DLT crypto activities fall under POCA AML regime.
RFBR Regs 2021: Requires registration for AML/CFT supervision of VASPs not otherwise regulated.
Sanctions Act 2019: Expected compliance for counter-proliferation.
GFSC issues comprehensive AML/CFT/CPF guidance; VASPs must submit policies/manuals during application.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a crypto-funded debit card program can operate in Gibraltar but requires a DLT Provider Licence (high burden, GFSC), local incorporation and substance, full POCA AML/CFT compliance, and likely a separate e-money/payment licence or partnership with a regulated fiat institution for the card-issuance leg, with no clear guidance on how the dual licensing regime interacts.
Questions this verdict aims to answer
- What e-money / payment-institution license is required?
- How is the crypto-to-fiat conversion regulated?
- What KYC and AML obligations apply to cardholders?
- What partner-bank or BIN-sponsor arrangements are required?