Custodial wallet / SaaS in Gibraltar

Financial Services Act 2018 – establishes the 10 key principles for DLT business operations

The DLT Regulations – govern distributed ledger technology providers

GFSC supervision ensures market integrity, but stablecoin-specific rules (e.g., 1:1 reserves) are absent from sources.

Gibraltar Financial Services Commission (GFSC): The main authority, responsible for licensing, supervising, and enforcing rules on DLT firms, virtual asset service providers (VASPs), crypto exchanges, custody services, and trading platforms. It ensures compliance with international standards like FATF, including customer verification and risk management.

Financial Services Act 2019 (FSA): Oversees virtual/digital asset activities, ensuring GFSC compliance for transfers, storage, and management.

Proceeds of Crime Act 2015 – addresses AML/CFT/CPF requirements

DLT Framework (introduced 2018): Pioneering principles-based regulations for DLT operators, covering licensing, governance, and consumer protection; developed from the 2014 Cryptocurrency Working Group.

The regime is principles-based, with 10 core principles covering governance, risk management, financial stability, data security, and customer protection; applicants must demonstrate compliance, including "mind and management" in Gibraltar (e.g., local office and employees).1 2 6

Post-licensing, firms must adhere to AML/CFT/CPF under the Proceeds of Crime Act 2015 ("POCA") and subsidiary rules, including customer due diligence (CDD), transaction monitoring, risk assessments, staff training, and appointing a compliance officer.1 2 6

No separate "crypto-only" license exists; the DLT license covers broader blockchain activities.2

The DLT Provider Licence is mandatory for any business using blockchain or DLT to store, transmit, or trade digital assets, including crypto exchanges, wallet providers, trading platforms, and custodial services; it falls under Section 8 of the FSA and ensures compliance with 9-10 DLT principles focused on transparency, risk management, AML/CFT, and governance.

No separate registration regime exists beyond this licensing; firms must be incorporated under the Companies Act 2014 (updated 2022) and comply with Proceeds of Crime Act 2015 (POCA) for AML/CFT/CPF, plus consumer protection and intellectual property rules.

Activities like ICOs and non-security token sales may require additional Virtual Asset Service Provider (VASP) registration if applicable.

Authorized capital varies by project specifics and is not fixed; applicants must demonstrate financial stability, often via business plans showing sufficient resources for operations, risk management, and substance in Gibraltar (e.g., real office, local employees, manager).

Substance mandates: Local office, local hires (including a manager), and proof of domestic operations; GFSC verifies the firm is genuinely run from Gibraltar.

Stage 1 (Initial Application): Submit form, business plan (detailing name, services, address, contact, founders/key persons), and pay non-refundable assessment fee; GFSC reviews viability against DLT principles.

Stage 2 (Full Application): Pay full fee, submit pack with policy manuals on risk management, IT/security, governance, financial crime (AML/CFT), and compliance procedures.

Stage 3 (Final Submissions): Provide conduct-of-business policies, non-financial resources info, and individual application forms for directors, shareholders, and key personnel; GFSC assesses business model, security, and substance.

Approval: GFSC grants license if criteria met, including AML/CFT protocols and financial soundness; ongoing supervision follows.

Requirements include physical presence, qualified management, transparent ownership, and annual fees (e.g., £50,000 for exchanges).

They may qualify as investments under the Specialised Investment Business Act (SIBA) framework if facts indicate security-like features (e.g., offered to the public or tied to specific investors).

Proceeds of Crime Act 2015 (POCA): Core law mandating AML/CFT/CPF obligations for DLT Firms and VASPs, including registration of the Money Laundering Reporting Officer (MLRO) with GFSC.

Financial Services Act 2019 (FSA): Regulates DLT activities (e.g., storing/transmitting value via DLT) as requiring GFSC authorization; non-DLT crypto activities fall under POCA AML regime.

RFBR Regs 2021: Requires registration for AML/CFT supervision of VASPs not otherwise regulated.

Sanctions Act 2019: Expected compliance for counter-proliferation.

GFSC issues comprehensive AML/CFT/CPF guidance; VASPs must submit policies/manuals during application.