Gibraltar has been one of the most notable early adopters and supporters of virtual currencies, ensuring that appropriate, proportionate and practical regulatory regimes arein place to manage the risks involved in such activities.
The sector has a wide range of operators, including:
Gibraltar is one the most popular crypto fund jurisdictions in the world: ‘The most common jurisdictions cited by digital asset hedge funds for domiciling their funds were the Cayman Islands (63%), Gibraltar (19%), and the US (16%)”
In addition to a funds regime that makes establishing and operating a crypto fund relatively easy to do, Gibraltar has two primary legislative frameworks that specifically apply to crypto-assets.
One is the Distributed Ledger Technology (DLT) Provider regime (see below) that requires full authorisation for certain custodians and remitters of crypto-assets.
The other is a requirement for all ‘virtual asset service providers’ to register and comply with the Proceeds of Crime Act 2015 and various anti-money laundering (AML) and counter-terrorist financing (CTF) obligations (this, inter alia, implements Financial Action Task Force (FATF) guidance in respect of Virtual Asset Service Provider (VASPs)).
The DLT Provider regime is the primary regulatory framework for crypto-asset service providers contained within the Financial Services Act 2019 (FSA).
Section 139 provides that certain DLT provider activities are regulated activities requiring authorisation by the Gibraltar Financial Services Commission (GFSC). Regulated activity is considered as any firm using DLT for storing or transmitting value belonging to others, in or from Gibraltar.
Under Section 138, DLT and value are respectively defined as:
A database system in which information is recorded and consensually shared and synchronised across a network of multiple nodes; and all copies of the database are regarded as equally authentic;
value includes assets, holdings and other forms of ownership, rights or interests, with or without related information, such as agreements or transactions for the transfer of value or its payment, clearing or settlement.
The DLT regime is intended to capture persons who are not otherwise authorised to conduct a regulated DLT provider activity.
Persons who are authorised to conduct a range of financial services activities and who use DLT to perform that regulated activity do so within the scope of their primary authorisation (e.g., banking, insurance) and not as a separately authorised DLT provider (see Section 141 of the FSA) unless the DLT activities that they undertake are not directly related to their regulated supplies of the separately authorised financial services.
It requires persons who engage in business activities involving storage (custody) and remittance (transfer) of cryptoassets on behalf of clients with authority to do so. In some cases, commercial operators will be involved in dealing with DLT assets but not as custodian or remitter on behalf of others (in those cases the wider AML regime –specified below – will, however, often be applicable).
The general expectation in respect of custodians and remitters of a requirement for authorisation is understandable, given that such activities could give rise to significant loss of value to clients if there are any issues with the provider of those services.
The GFSC also takes the view that most crypto-asset exchange service providers will inevitably be storing crypto-assets on behalf of others (even if for only a limited time) and so are likely to also be within scope of the DLT Provider regime.
Applications for authorisation are expected to take between nine and 18 months.
The initial pre-application fee is £2,100 and the full application fee is between £8,400 and £29,400 (depending on the expected complexity of regulating the DLT provider).
Annual authorisation fees vary and are constituted as follows:
Fee = base fee + trade activity fee + additional fee
DLT providers are required to undertake the new multi-staged authorisation process and demonstrate how they will comply with the 10 regulatory principles.
The process starts with an initial introductory meeting, followed by the submission of an abridged business plan and then concludes with a second meeting where the GFSC provide feedback and answer any subsequent questions or concerns.
The following are submitted for Stage 1:
On receipt of the application fee and Stage 1 documents, the GFSC will confirm the supervisor who has been assigned to assess the application for authorisation. Any missing or additional sector-specific documents or information required by the GFSC to complete Stage 1 will be communicated to the applicant during Stage 1.
Stage 1 is expected to last the following maximum periods for each sector, subject to the quality of Stage 1 information submitted and timely responses from the applicant:
Stage 2 of the authorisation process involves consideration of the business model, suitability of capital and the key individuals.
This stage covers all sectors (including banking, insurance, e-money, investments class 2 and DLT) and is expected to last a maximum of two months, subject to the quality of the Stage 2 information or documentation submitted and the timeliness of responses from the applicant.
At this point, the GFSC will then be willing to consider issuing a minded to authorise letter to the applicant, where required. This is designed to aid applicants with the raising of capital and recruitment discussions with individual candidates and outsourcing providers.
Stage 3 of the authorisation process is expected to last the following maximum periods for each sector, subject to the quality of the Stage 3 information and documentation submitted and timeliness of responses from the applicant:
When the GFSC is satisfied with the Stage 3 responses and information, the application will move to a GFSC decision for authorisation.
For those sectors where a mobilisation stage is required, authorisation will be subject to the requirement to complete the mobilisation stage to the satisfaction of the GFSC.
Prior to entering the mobilisation stage below, an applicant would submit (during Stage 3) a Mobilisation Plan setting out the actions and time frames the applicant is working towards to become fully operational.
Mobilisation is a stage entered into by applicants in e-money, banking, investments class 2 and DLT sectors for the purpose of enabling the GFSC to test the firm’s systems and controls. This route allows an applicant to obtain a permission and operate within a controlled environment, allowing it time to develop its operational capability.
The time frame for the mobilisation stage will vary on a case-by-case basis; however, it is expected that this will normally range from three to six months.
The following are examples of areas that firms will usually be focused on actioning during mobilisation:
Gibraltar Financial Services Commission (GFSC) Guidance Note: Scope of the DLT Framework
This newly published GFSC Guidance Note clarifies the scope of Gibraltar’s Distributed Ledger Technology (DLT) Framework, which consists of the Financial Services Act 2019 and the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 which provides a regulatory framework for businesses using DLT for storing or transmitting value belonging to others, known as DLT Providers.
The Guidance Note seeks to provide further clarity on activities that are likely to be in-scope or out of scope of the DLT Provider Regime and notes that many activities that may be out of scope will still fall within the POCA AML/CTF regime requiring registration with the GFSC. The key issue is whether a firm takes control of crypto-assets belonging to others at any point in the service provision. Where they do not an assessment should still be made as to whether the service falls within the AML/CTF regime (e.g. for arranging/intermediating deals in crypto-assets).
Examples include:
On the issue of decentralisation the GFSC note:
“DApps may not be fully decentralised, and may retain elements of centralisation by virtue of which they fall in scope of the DLT Framework, so it remains for the GFSC to determine whether any identifiable owners/ operators/ administrators exert control or sufficient influence to bring them within scope of the DLT Framework. “
Activities that are likely to fall outside of the scope include:
The primary areas of financial services laws (other than in respect of crypto-assets) are similar to those within the United Kingdom and the European Union (notwithstanding that the United Kingdom and Gibraltar exited the European Union in 2020).
Over time we may see more regulatory divergence between, on the one hand, the European Union and, on the other hand, the United Kingdom and Gibraltar. Gibraltar is also able to diverge from the United Kingdom to some extent; however, the ability to continue to passport financial services from Gibraltar to the United Kingdom makes significant divergences unlikely in key areas of regulation and supervision.
Similarly to the United Kingdom, the Gibraltar financial services regime operates with a general prohibition against undertaking specified regulated financial service activities unless authorised or exempt (Section 4 of the FSA). The list of specified activities is contained in Schedule 2 of the FSA and includes various activities such as banking, e-money and payment services, as well as insurance. The more specific securities-related laws are as follows.
The EU Markets in Financial Instruments Directive (MiFID) covers much of the regulated investment activities related to ‘financial instruments’ and is still largely applicable in Gibraltar pursuant to the FSA and associated legislation.
This area of law is the closest equivalent to the US concept of a ‘security’ and includes transferable securities (tradable on capital markets), money market instruments, units in collective investment undertakings and other specified regulated instruments (including a range of derivatives products). Activities related to such financial instruments include:
Most funds (including crypto-related funds) are primarily covered by the local implementing regulations of the Alternative Investment Fund Manager Directive (AIFMD), which applies to fund managers (other than in respect of Undertakings for Collective Investment in Transferable Securities (UCITS) or publicly tradable closed-ended collective investment schemes; these are also within the prospectus regime for public or listed offerings of transferable securities).
Gibraltar recently implemented a dual funds regime that enables fund managers to opt out of some of the requirements of AIFMD if they are not soliciting an EU investor base rather than an EU one. This is particularly helpful for crypto fund managers where many of the requirements of AIFMD are not fit for purpose in the crypto-asset space (such as the depositary obligations).
A prospectus regime (as implemented by local regulation) covers listed or publicly offered transferable securities.
Currently in Gibraltar, in most cases, the provision of virtual currency services is being carried out by businesses that are not already regulated for financial services and securities-related activities. In addition, the current e-money and payment regulations could conceivably be applicable for very specific virtual currency offerings (such as, for example, a GBP stablecoin offering backed by funds) but, as yet, this has not been taken up by local e-money issuers.
To the extent that a token represents a financial instrument, including a transferable security (such as shares or debt instruments negotiable on capital markets), a unit in a UCITS or a collective investment scheme, a deposit, an insurance contract or electronic money, then the same laws that apply to activities by any commercial operators in those fields apply to that activity mediated with a token. Notably, in some cases, the laws applicable to such activities (including wider laws such as companies’ laws) are drafted in a manner that does not envisage a cryptographic token as the medium of contract, exchange, value or ownership and this can give rise to issues requiring workarounds in meeting the applicable obligations for these activities.
Given the close legal and regulatory relationship between the United Kingdom and Gibraltar, guidance from UK regulators and decisions of UK courts are very influential when considering whether a crypto-asset falls within the definition of e-money or of a financial instrument.
The most significant and difficult question to answer about the application of financial services laws to crypto-asset products often arises with respect to the regulation of derivatives. The definition of derivatives within the EU MiFID regime (which is still largely implemented in the United Kingdom and Gibraltar) is conceivably wide enough to definitely cover some cash-settled crypto-asset derivative products; however, in practice, most crypto-asset derivative products are not cash-settled (being settled in crypto-assets).
The MiFID II regime wording taken from the EU directive is now hopelessly out of date as well as being notoriously difficult to interpret and apply to crypto-asset products. If the Gibraltar regulator considers a crypto derivative product to be structured in a way that is within its scope, then the issuer and various other intermediaries could be subject to authorisation and compliance requirements.
The AML Business Registration regulations requires the registration of all businesses (that are not subject to supervision by a relevant supervisory authority) for the following:
“4.(1) (c) undertakings that receive, whether on their own account or on behalf of another person, proceeds in any form from the sale of tokenised digital assets involving the use of DLT or a similar means of recording a digital representation of an asset; or
(d) persons that, by way of business, exchange, or arrange to make arrangements with a view to the exchange of
(i) virtual assets for money;
(ii) money for virtual assets; or
(iii) one virtual asset for another.“
Registrants must ensure that they can meet the legal obligations in Proceeds of Crime Act 2015 (POCA) and any other applicable legislation and that they can provide confidence to the GFSC that they have adequate policies and procedures to fulfil local anti-money laundering and counter terrorist financing obligations, including, inter alia, appointing a locally resident Money Laundering Reporting Officer (MLRO), meeting the local requirements including know your customer/know your business, source of wealth, sanctions checks, adverse publicity monitoring of clients and suspicious activity monitoring and reporting.
Controllers of applicants and the MLRO must be approved by the GFSC as being fit and proper persons to carry out their functions and obligations.
This regime applies to token issuers, other VASPs and any other person who is undertaking crypto-asset sale or exchange activities that are not authorised under Gibraltar financial services laws (including the DLT provider regime) pursuant to the FSA and associated legislation or otherwise regulated by a specified regulator.
The Gibraltar AML regime represents a high standard of compliance while reflecting the jurisdiction’s significant experience in the practical application of AML and CTF principles and obligations to the crypto-asset sector. The use of automated electronic onboarding, monitoring and reporting tools are a recognised and accepted part of the various procedures that are needed to protect operators and the jurisdiction from financial crime, terrorist financing and money laundering.
In October 2022, the GFSC issued a Scope Guidance Note on the VASP Registration Framework. The VASP Guidance Note confirmed that in order for a firm to be registered, it must:
As with all other regulated sectors in Gibraltar, the MLRO must be a permanent, full-time employee of the firm seeking registration. The exception to this is in the case of firms that are solely carrying on activities under Regulation 4(c) (token sales, discussed below), where some flexibility can be afforded in respect of individuals who are in other full-time employment.
In respect of OTC operators, the Guidance Note confirms that they do not need to be authorised as a DLT provider as they do not act as custodians:
The primary business model that falls within scope of Regulation 4(d) is an over-the-counter (OTC) exchange or brokerage desk. Firms carrying out this activity will typically arrange for the buying and selling of virtual assets for other virtual assets or fiat, between clients or between clients and the firm itself or third party liquidity providers. It is important to note that in order for a firm undertaking this activity to fall within the definition of a VASP, rather than that of a DLT Provider, and therefore be subject to the VASP Registration Framework, rather than the DLT Framework, it must not at any point take custody of, or otherwise store or transmit virtual assets belonging to other transacting parties.
The Guidance Note also makes clear that the GFSC will refuse to register the following businesses on the basis of the higher AML and CTF risk involved with them:
Gibraltar has also implemented the ‘travel rules’ in the Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021 that require VASPs to obtain additional specific information on their customers transactions when there is a transaction value equal or in excess of €1,000.
Notably, the generally applicable AML and CTF obligations in Gibraltar are substantially the same as in the United Kingdom and the European Union. Note: Presently the laws in the United Kingdom and the European Union still derive from the various EU AML Directives notwithstanding that both jurisdictions (and other EU jurisdictions) do not always transpose directives in an identical manner.
It is also however notable that Gibraltar decided to implement the travel rules for VASPs and, in some respects, for all ‘relevant financial business[es]” which goes much further than other regimes (including the UK).
Under s.4 of POCA Regs where an obliged entity sends a virtual asset transfer to another VASP/obliged entity, the sending obliged entity must obtain the following information and submit it immediately and by secure means :
Under s.5 of POCA Regs, where an obliged entity receives a virtual asset transfer, the obliged entity must ensure that it has received the same information as is required under s.4 above and it also must ensure that the information is consistent with its own records in respect of the payee’s name, and where applicable, the payee’s account number.
Under section 5 of the POCA Regs where an obliged person receives a virtual asset transfer from a person that is not a VASP it must ensure that it obtains from the payee:
Before an obliged person executes a virtual asset transfer received from any person, it must ensure it has effective risk based policies and procedures in place to determine whether any info is missing or incomplete or inconsistent with its own records and where default is identified determine whether to execute, reject or suspend the virtual asset transfer and determine the follow up actions.
The VASP AML Registration requirememnts make reference to non-fungible tokens (NFTs) and whether they are in scope as ‘virtual assets’, where a case-by-case approach will be taken by the GFSC and legal advice should be sought:
“Virtual assets may have a variety of utilities and functionalities, but as long as they are captured by the above definition, they will fall within scope of the Regulations. It should also be noted that, in line with the FATF Guidance, non-fungible tokens (NFTs) are likely to be considered virtual assets for the purposes of the Regulations if they are used for payment or investment purposes. This extends to any form of NFT which may be used for these purposes, including those tokens which represent digital art or collectibles. The GFSC will consider sales of NFTs on a case-by-case basis.”
In the event of a breach of regulatory principles, the GFSC has various information-gathering and investigatory powers (Part 10, FSA) as well as sanctioning powers (Part 11, FSA), including administrative penalties.
Under Part 10, the GFSC can, in respect of persons carrying out authorised activities:
An offence will also be committed if a person:
Under Part 11 of the FSA, the GFSC can exercise sanctioning powers against a person if the person contravened a regulatory requirement and, at the relevant time, was an authorised or regulated individual. Sanctioning powers include:
Ultimately the GFSC can also vary a firm’s authorised permissions or entirely remove the firm’s authorisation in extreme cases.
Additionally, further to Part 13 of the FSA, the GFSC can apply to the Supreme Court and seek:
With respect to collective investment schemes (which may involve crypto-assets), the GFSC has further powers under Part 18 of the FSA if certain grounds apply. These powers include:
In practice, the GFSC tends to reach Regulatory Settlement Agreements with authorised firms that are in breach of the Financial Services Act or the AML/CTF obligations of POCA and issue Decision Notices for firms that are only registered for AML/CTF but that are not conducting authorised activities (pursuant to the powers granted to the GFSC in the Supervisory Bodies (Powers etc.) Regulations 2017).
Cryptoasset Theft Without Conversion: Rethinking Litigation Strategy After Ping Fai Yuen v Fun Yung Li Steven de Lara Head of Litigation, Trusts and Financial…
Weekly AI intelligence for lawyers, investors, and regulators.
Primary-source analysis of frontier models, AI law, regulatory
shifts, and investment signals. No noise — just signal.
The Gibraltar Authorisation Regime (GAR) represents the permanent legislative framework enabling Gibraltar-based financial services firms, including payment service providers (PSPs) and e-money institutions (EMIs), to access the UK market following Brexit. It requires transparency and careful management by Gibraltar firms benefiting from UK market access.
Operational resilience is no longer a technology function but a primary board responsibility, inextricable from solvency, business continuity, and market conduct.
Mandatory VAT Defences:Mastering the Two-Item Rule and managing the Fixed Establishment Trap.
Overview of current UK approach to systemic stablecoins and comparison with how MiCAR regulates important (significant) stablecoins
