On-shore VASP in Gibraltar

Financial Services Act 2018 – establishes the 10 key principles for DLT business operations

The DLT Regulations – govern distributed ledger technology providers

Proceeds of Crime Act 2015 – addresses AML/CFT/CPF requirements

Companies Act (2014, updated January 2022) – governs company registration and reporting

Requirements include physical presence, qualified management, transparent ownership, and annual fees (e.g., £50,000 for exchanges).

Gibraltar Financial Services Commission (GFSC): The main authority, responsible for licensing, supervising, and enforcing rules on DLT firms, virtual asset service providers (VASPs), crypto exchanges, custody services, and trading platforms. It ensures compliance with international standards like FATF, including customer verification and risk management.

Financial Services Act 2019 (FSA): Oversees virtual/digital asset activities, ensuring GFSC compliance for transfers, storage, and management.

DLT Framework (introduced 2018): Pioneering principles-based regulations for DLT operators, covering licensing, governance, and consumer protection; developed from the 2014 Cryptocurrency Working Group.

The regime is principles-based, with 10 core principles covering governance, risk management, financial stability, data security, and customer protection; applicants must demonstrate compliance, including "mind and management" in Gibraltar (e.g., local office and employees).1 2 6

Post-licensing, firms must adhere to AML/CFT/CPF under the Proceeds of Crime Act 2015 ("POCA") and subsidiary rules, including customer due diligence (CDD), transaction monitoring, risk assessments, staff training, and appointing a compliance officer.1 2 6

No separate "crypto-only" license exists; the DLT license covers broader blockchain activities.2

The DLT Provider Licence is mandatory for any business using blockchain or DLT to store, transmit, or trade digital assets, including crypto exchanges, wallet providers, trading platforms, and custodial services; it falls under Section 8 of the FSA and ensures compliance with 9-10 DLT principles focused on transparency, risk management, AML/CFT, and governance.

No separate registration regime exists beyond this licensing; firms must be incorporated under the Companies Act 2014 (updated 2022) and comply with Proceeds of Crime Act 2015 (POCA) for AML/CFT/CPF, plus consumer protection and intellectual property rules.

Authorized capital varies by project specifics and is not fixed; applicants must demonstrate financial stability, often via business plans showing sufficient resources for operations, risk management, and substance in Gibraltar (e.g., real office, local employees, manager).

Substance mandates: Local office, local hires (including a manager), and proof of domestic operations; GFSC verifies the firm is genuinely run from Gibraltar.

Stage 1 (Initial Application): Submit form, business plan (detailing name, services, address, contact, founders/key persons), and pay non-refundable assessment fee; GFSC reviews viability against DLT principles.

Stage 2 (Full Application): Pay full fee, submit pack with policy manuals on risk management, IT/security, governance, financial crime (AML/CFT), and compliance procedures.

Stage 3 (Final Submissions): Provide conduct-of-business policies, non-financial resources info, and individual application forms for directors, shareholders, and key personnel; GFSC assesses business model, security, and substance.

Approval: GFSC grants license if criteria met, including AML/CFT protocols and financial soundness; ongoing supervision follows.

Proceeds of Crime Act 2015 (POCA): Core law mandating AML/CFT/CPF obligations for DLT Firms and VASPs, including registration of the Money Laundering Reporting Officer (MLRO) with GFSC.

Financial Services Act 2019 (FSA): Regulates DLT activities (e.g., storing/transmitting value via DLT) as requiring GFSC authorization; non-DLT crypto activities fall under POCA AML regime.

RFBR Regs 2021: Requires registration for AML/CFT supervision of VASPs not otherwise regulated.

Sanctions Act 2019: Expected compliance for counter-proliferation.

GFSC issues comprehensive AML/CFT/CPF guidance; VASPs must submit policies/manuals during application.

Threshold Amount: The rule applies to transfers of virtual assets valued at €1,000 or more (equivalent to EUR 1000).

Covered VASPs: All activities matching the FATF definition of Virtual Asset Service Providers (VASPs)—including exchanges, digital wallet providers, OTC trading desks, safekeeping/administration of virtual assets, and participation in virtual asset issuance/sales—are regulated and supervised by the GFSC. This covers DLT Providers authorised since 1 January 2018 under the Financial Services (DLT Providers and VAA Providers) Regulations 2020.

Technical Implementation Requirements: Originator VASPs must collect and securely transmit (before or alongside the transaction) originator and beneficiary information—such as names and account/wallet details—for transactions over the threshold involving another VASP or relevant financial business. Beneficiary VASPs must obtain and hold this data. Virtual assets are defined in the amended POCA as digital representations of value for payment/investment, excluding fiat digital representations and certain financial instruments.