Self-custodial wallet / non-custodial software in Gibraltar
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Gibraltar without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
Key Restrictions
- Self-custodial wallet software publishing does not involve storing, transmitting, or trading digital assets on behalf of users, so it falls outside the scope of the DLT Provider Licence (which applies to businesses using DLT to 'store, transmit, or trade digital assets, including crypto exchanges, wallet providers, trading platforms, and custodial services').
- The DLT framework targets firms that hold or control customer assets; pure non-custodial software distribution is not a regulated activity under the Financial Services Act 2019 or the DLT Regulations.
- If the software were to include any built-in swapping, staking, or other transmission/trading functionality where the publisher facilitates the transaction (rather than just providing client-side code), GFSC may reclassify the activity as a regulated DLT service.
Key Risks
- Regulatory ambiguity: GFSC has not issued explicit guidance on whether non-custodial wallet software publishers are outside scope; the principles-based regime could be interpreted broadly.
- If the wallet software generates revenue via fees embedded in on-chain transactions (e.g., swap fees), GFSC might consider the publisher to be 'transmitting' value and require licensing.
- Consumer-protection expectations could still apply under general Gibraltar law (e.g., product liability, software quality), even if financial-services regulation does not.
- The absence of a 'no-action' or safe-harbour letter from GFSC means the publisher operates without formal regulatory comfort.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
The DLT Provider Licence is mandatory for any business using blockchain or DLT to store, transmit, or trade digital assets, including crypto exchanges, wallet providers, trading platforms, and custodial services; it falls under Section 8 of the FSA and ensures compliance with 9-10 DLT principles focused on transparency, risk management, AML/CFT, and governance.
DLT Framework (introduced 2018): Pioneering principles-based regulations for DLT operators, covering licensing, governance, and consumer protection; developed from the 2014 Cryptocurrency Working Group.
The regime is principles-based, with 10 core principles covering governance, risk management, financial stability, data security, and customer protection; applicants must demonstrate compliance, including "mind and management" in Gibraltar (e.g., local office and employees).1 2 6
Financial Services Act 2019 (FSA): Oversees virtual/digital asset activities, ensuring GFSC compliance for transfers, storage, and management.
Financial Services Act 2019 (FSA): Regulates DLT activities (e.g., storing/transmitting value via DLT) as requiring GFSC authorization; non-DLT crypto activities fall under POCA AML regime.
No separate "crypto-only" license exists; the DLT license covers broader blockchain activities.2
Activities like ICOs and non-security token sales may require additional Virtual Asset Service Provider (VASP) registration if applicable.
They may qualify as investments under the Specialised Investment Business Act (SIBA) framework if facts indicate security-like features (e.g., offered to the public or tied to specific investors).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — non-custodial wallet software publishing likely does not trigger DLT Provider licensing or AML obligations because the publisher never holds, controls, or accesses user funds, making it outside the regulated scope of the DLT Provider Licence (which covers storing, transmitting, or trading digital assets on behalf of users), though this is not explicitly confirmed by GFSC guidance.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?