DeFi protocol frontend in Gibraltar
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Gibraltar with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- The DLT Provider Licence under the Financial Services Act 2019 (FSA) is mandatory for any business using DLT to store, transmit, or trade digital assets — a DeFi frontend interacting with smart contracts on behalf of users likely falls within scope if it transmits value or facilitates trading.
- AML/CFT/CPF obligations under the Proceeds of Crime Act 2015 (POCA) apply, including customer due diligence (CDD), transaction monitoring, risk assessments, staff training, and appointment of a compliance officer/MLRO.
- The Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021 implements the FATF Travel Rule for VASPs, requiring information sharing on virtual asset transfers (effective March 22, 2021).
- RFBR Regs 2021 requires registration for AML/CFT supervision of VASPs not otherwise regulated.
- Sanctions Act 2019 requires compliance for counter-proliferation sanctions screening.
- Firms must submit comprehensive AML/CFT/CPF policies and manuals during the licensing application process.
Key Restrictions
- Must obtain a DLT Provider Licence, which requires a full licensing process with three stages (initial application, full application with policy manuals, final submissions with conduct-of-business policies).
- Strict substance requirements: local office in Gibraltar, local hires (including a manager), and proof the firm is genuinely run from Gibraltar.
- Authorized capital is not fixed but must be demonstrated via a business plan showing sufficient financial resources for operations, risk management, and local substance.
- The regime requires 'mind and management' in Gibraltar — a local physical presence with employees is mandatory.
- Fee-taking by the frontend (e.g., fees, commissions, or revenue from user transactions) likely strengthens the case that the activity is regulated and requires licensing.
- If the tokens/interactions involve security-like features, additional obligations under the Specialised Investment Business Act (SIBA) framework may apply.
Key Risks
- Regulatory ambiguity: The DLT framework was designed for operators that 'control' the blockchain activity — a purely non-custodial frontend that merely provides an interface to permissionless contracts may argue it does not 'store, transmit, or trade' assets itself, creating borderline interpretation risk.
- GFSC has not issued definitive guidance on whether a fully decentralized protocol frontend with no fee-taking and no custody falls outside the DLT licensing perimeter; enforcement posture on pure UI/aggregator interfaces is unclear.
- If the GFSC determines the frontend is an unlicensed VASP or DLT provider, penalties could include enforcement action, fines, or criminal liability under the Financial Services Act 2019 and POCA.
- The substance and local-presence requirements (office, employees, manager) represent a high fixed-cost burden for what may be a thin-margin or open-source-oriented DeFi frontend.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
The DLT Provider Licence is mandatory for any business using blockchain or DLT to store, transmit, or trade digital assets, including crypto exchanges, wallet providers, trading platforms, and custodial services; it falls under Section 8 of the FSA and ensures compliance with 9-10 DLT principles focused on transparency, risk management, AML/CFT, and governance.
Financial Services Act 2018 – establishes the 10 key principles for DLT business operations
The DLT Regulations – govern distributed ledger technology providers
Proceeds of Crime Act 2015 – addresses AML/CFT/CPF requirements
They may qualify as investments under the Specialised Investment Business Act (SIBA) framework if facts indicate security-like features (e.g., offered to the public or tied to specific investors).
Requirements include physical presence, qualified management, transparent ownership, and annual fees (e.g., £50,000 for exchanges).
GFSC supervision ensures market integrity, but stablecoin-specific rules (e.g., 1:1 reserves) are absent from sources.
Gibraltar Financial Services Commission (GFSC): The main authority, responsible for licensing, supervising, and enforcing rules on DLT firms, virtual asset service providers (VASPs), crypto exchanges, custody services, and trading platforms. It ensures compliance with international standards like FATF, including customer verification and risk management.
Financial Services Act 2019 (FSA): Oversees virtual/digital asset activities, ensuring GFSC compliance for transfers, storage, and management.
DLT Framework (introduced 2018): Pioneering principles-based regulations for DLT operators, covering licensing, governance, and consumer protection; developed from the 2014 Cryptocurrency Working Group.
The regime is principles-based, with 10 core principles covering governance, risk management, financial stability, data security, and customer protection; applicants must demonstrate compliance, including "mind and management" in Gibraltar (e.g., local office and employees).1 2 6
Post-licensing, firms must adhere to AML/CFT/CPF under the Proceeds of Crime Act 2015 ("POCA") and subsidiary rules, including customer due diligence (CDD), transaction monitoring, risk assessments, staff training, and appointing a compliance officer.1 2 6
No separate "crypto-only" license exists; the DLT license covers broader blockchain activities.2
No separate registration regime exists beyond this licensing; firms must be incorporated under the Companies Act 2014 (updated 2022) and comply with Proceeds of Crime Act 2015 (POCA) for AML/CFT/CPF, plus consumer protection and intellectual property rules.
Authorized capital varies by project specifics and is not fixed; applicants must demonstrate financial stability, often via business plans showing sufficient resources for operations, risk management, and substance in Gibraltar (e.g., real office, local employees, manager).
Substance mandates: Local office, local hires (including a manager), and proof of domestic operations; GFSC verifies the firm is genuinely run from Gibraltar.
Stage 1 (Initial Application): Submit form, business plan (detailing name, services, address, contact, founders/key persons), and pay non-refundable assessment fee; GFSC reviews viability against DLT principles.
Stage 2 (Full Application): Pay full fee, submit pack with policy manuals on risk management, IT/security, governance, financial crime (AML/CFT), and compliance procedures.
Stage 3 (Final Submissions): Provide conduct-of-business policies, non-financial resources info, and individual application forms for directors, shareholders, and key personnel; GFSC assesses business model, security, and substance.
Approval: GFSC grants license if criteria met, including AML/CFT protocols and financial soundness; ongoing supervision follows.
Proceeds of Crime Act 2015 (POCA): Core law mandating AML/CFT/CPF obligations for DLT Firms and VASPs, including registration of the Money Laundering Reporting Officer (MLRO) with GFSC.
Financial Services Act 2019 (FSA): Regulates DLT activities (e.g., storing/transmitting value via DLT) as requiring GFSC authorization; non-DLT crypto activities fall under POCA AML regime.
RFBR Regs 2021: Requires registration for AML/CFT supervision of VASPs not otherwise regulated.
Sanctions Act 2019: Expected compliance for counter-proliferation.
GFSC issues comprehensive AML/CFT/CPF guidance; VASPs must submit policies/manuals during application.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a DeFi protocol frontend that transmits or trades digital assets on behalf of users is likely regulated as a DLT Provider under Gibraltar's FSA 2019, requiring a full DLT Provider Licence, local substance (office + employees), comprehensive AML/CFT/CPF compliance including FATF Travel Rule obligations, and a three-stage licensing process; pure non-custodial interface operators face borderline interpretation risk if they argue they do not 'store, transmit, or trade' value.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?