The Gibraltar Authorisation Regime
The Gibraltar Authorisation Regime (GAR) is the permanent legal architecture that will define how Gibraltar-based financial services firms — including Banks, insurers, investment managers and other Payment Service Providers (PSPs) and E-Money Institutions (EMIs) — continue to access the UK market. Since Brexit, Gibraltar is the only jurisdiction in the world that can do this. Understanding UK market access and the GAR properly is critical for regulated firms in Gibraltar.
The transitional passporting arrangements — the post-Brexit stopgap that has kept the market open since 2020 — have been extended again, this time to 31 December 2026 via the Financial Services (Gibraltar) (Amendment) (EU Exit) Regulations 2025. The FCA has indicated that a further extension may follow to allow the permanent GAR framework to become fully operational given that continued UK market access for Gibraltar firms is the expectation for the UK and Gibraltar.
This article breaks down the GAR’s statutory framework and the practical reality for firms. It was prepared as part of my research for the recent GACO webinar: Navigating the GAR: The Reality of Financial Passporting between Gibraltar and the UK
The Legal Architecture: Where the GAR Sits
The GAR originates from Chapter 22 of the UK Financial Services Act 2021, which received Royal Assent in April 2021. Section 22 of that Act amended the Financial Services and Markets Act 2000 (FSMA) to create a bespoke authorisation regime specifically for Gibraltar-based firms operating in the UK.
Three schedules inserted into FSMA form the backbone of the regime:
- Schedule 2A (inserted by Schedule 6 of the FSA 2021) — the core provision governing Gibraltar-based persons carrying on regulated activities in the UK, including the conditions for obtaining and maintaining market access permission.
- Schedule 2B (inserted by Schedule 7 of the FSA 2021) — the reciprocal arrangement for UK-based persons carrying on corresponding activities in Gibraltar.
- Schedule 8 — minor and consequential amendments supporting the new framework.
The Three GAR Pillars
HM Treasury is the gatekeeper for the GAR. It can only designate a regulated activity as an “approved activity” for GAR market access when three cumulative conditions are – and remain- continuously satisfied:
- Objectives (Schedule 2A, Para 7): The approval must be compatible with UK regulatory objectives — protecting consumers, preventing financial crime, protecting public funds including the FSCS, and maintaining market integrity.
- Alignment (Schedule 2A, Para 8): Gibraltar’s relevant law and practice must be sufficiently aligned with the UK’s. Critically, this assessment covers not just the text of the law but also its practical effect, supervisory practices, and enforcement standards.
- Cooperation (Schedule 2A, Para 9): There must be adequate cooperation between all relevant UK entities (FCA, PRA, HMT, FSCS) and Gibraltar entities (GFSC, Government of Gibraltar), underpinned by formal MoUs and information-sharing protocols.
The alignment condition deserves particular emphasis. It represents a significant departure from the old EU passporting model. Simply replicating UK statutory text is not enough. As HM Treasury has confirmed, the assessment:
“includes both alignment as regards the effect of the law and practice and alignment of the text of the law and of any guidance or other documents relating to practice.”
In simple terms: the GFSC’s ability to supervise and enforce its regulations must be demonstrably equivalent to UK standards. The goal for both regulators is no surprises for either jurisdiction and ensuring that equivalently high standards are maintained in both.
The framework also mandates UK parliamentary oversight: HM Treasury has a statutory duty to report to Parliament every two years on the GAR’s operation, including whether all three conditions continue to be satisfied. If they are not, HM Treasury can withdraw approval for specific activities by secondary legislation.
The Dual-Designation Model and the Special Position of PSPs
The GAR operates on a dual-designation model. HM Treasury designates “Approved Activities” – UK regulated activities that Gibraltar firms may carry on in the UK – and matching “Corresponding Activities” in Gibraltar. A firm must hold GFSC permission for the relevant Corresponding Activity before it can notify to carry on the Approved Activity in the UK.
For PSPs and EMIs, this creates an important structural nuance. Traditional financial services — banking, insurance, investment services — were governed under the Financial Services and Markets Act 2000 (Gibraltar) Order 2001, which treated Gibraltar firms as if they were EEA firms and granted them deemed authorisation. The new GAR, via Schedule 2A, replaces that mechanism.
Payment services and e-money, however, are dealt with under a different legislative track. In the UK, EMIs and payment institutions are governed under the standalone Payment Services Regulations 2017 and the Electronic Money Regulations 2011. That means UK market access for Gibraltar PSPs and EMIs has relied on entirely separate transitional provisions – Schedule 7 of the UK PSRs and regulation 74A of the EMRs – which grant sector-specific temporary permission rather than deemed authorisation under FSMA.
As the permanent GAR takes shape, HM Treasury faces a structural choice of absorbing payment and e-money activities into the main FSMA Schedule 2A architecture by designating them as approved activities, or maintaining a parallel regime under the PSR/EMR framework with tailored access arrangements. We await to see how HM Treasury wishes to resolve this question.
The Notification Process
Under the GAR, market access is obtained through a notification procedure, not a fresh UK authorisation. The process is:
- The Gibraltar firm notifies the GFSC of its intention to carry on an Approved Activity in the UK (this also represents a material change request for s.83A GFSC consent purposes).
- The GFSC transmits the notification, along with its consent, to the relevant UK regulator (FCA or PRA).
- The UK regulator has one month (services-only access) or two months (branch establishment) to respond.
- If no rejection is issued within that period — or a confirmation notice is issued earlier — the firm automatically obtains its Schedule 2A permission.
Rejection is confined to narrow grounds: an incomplete notification, the activity no longer being approved, the firm lacking the relevant GFSC permission, a prohibited senior manager, or the firm posing a serious threat to UK consumers or financial stability. That said, firms should not read those narrow grounds as a guarantee of approval. A clean supervisory record and well-evidenced compliance framework remain essential.
Gibraltar’s Legislative Mirror
On the Gibraltar side, the Financial Services Act 2019 (as amended with effect from January 2025) mirrors the UK’s GAR structure. Key provisions include:
- Schedules 3A and 3B of the FSA 2019 — governing UK-based persons operating in Gibraltar and Gibraltar-based persons operating in the UK respectively.
- Section 55C of the FSA 2019 — empowering the Gibraltar Minister to make regulations aligning Gibraltar law and practice with the UK’s.
- Section 83A of the FSA 2019 — classifying the exercise of a UK market access right as a material change requiring prior GFSC consent.
- Section 94 of the FSA 2019 — expanding fit-and-proper criteria for senior management to include past misconduct, tax non-compliance, and financial crime convictions.
The GFSC Application Process
Firms seeking to establish a PSP or EMI in Gibraltar with a view to passporting into the UK must navigate the GFSC’s structured process for Part 7 permission under the Financial Services Act 2019.
The process begins with a pre-application phase: an initial meeting with the GFSC to discuss the business model (including UK market access plans) and submission of an abridged business plan for preliminary feedback. Using this phase properly — to test the model, clarify permissions, and agree expectations on safeguarding, outsourcing, and substance — is a crucial step before committing to a full application.
The formal application involves submission for Part 7 permission, a complexity assessment (which determines both the fee and the expected timeline), and a determination date target. Incomplete applications extend the time periods.
Firms must continuously satisfy Threshold Conditions including: robust governance arrangements, effective risk management, a credible business plan (with adequate resources for the first three financial years), sufficient capital, and adequate protection of customers and safeguarding of customer funds.
Passporting as a Material Change
Under the amended Section 83A, passporting into the UK is now a material change requiring the GFSC’s prior consent. Before notifying the UK regulator, a firm must first submit a consent application to the GFSC, pay the applicable complexity-based fee, and demonstrate that it can continue to satisfy all threshold conditions with the expanded scope of UK business. For existing passport holders, this consent is effectively grandfathered into the GAR transition. New activities or significant business model changes will trigger the full review.
Financial Promotions: An Underestimated Risk
Financial promotions represent one of the most practically underestimated risk areas for Gibraltar firms operating in the UK market, and one that is often inadequately covered in firm governance frameworks.
Under FSMA, a financial promotion – any invitation or inducement to engage in investment activity – may usually only be communicated by an authorised person or approved by an authorised person before it is communicated. A Gibraltar firm is treated as an “authorised person” in the UK for its approved activities, which means that it can communicate its own financial promotions relevant to those activities. However, the scope of that permission is defined precisely by what the firm is authorised to do.
Practically, this means firms must maintain a Country Manual – a clear internal document setting out what is and is not permitted in the UK market, including what financial promotions can be made, to whom, through what channels, and subject to what disclosures.
This was a specific point raised at the recent GACO/GBA webinar: the board must be able to justify the decision to passport into the UK, and evidence of having considered the market, how services will be conducted and distributed, and what promotional activity is permissible, must exist and be documented.
Note payment firms in multi-party arrangements – BIN sponsorship, program management models – face additional exposure. Where an unregulated brand partner is communicating to UK retail customers on behalf of a Gibraltar firm, responsibility for ensuring those communications comply with financial promotions rules (if applicable depending on the product) and Consumer Duty regime obligations sits with the authorised firm. The brand partner’s promotional activity must be reviewed and approved by the Gibraltar firm, and the contractual framework must make this clear. Failure to have these controls in place is not merely a compliance gap – it is a Consumer Duty failure, a potential financial promotions breach, and the kind of issue that can attract own-initiative intervention from the FCA.
Substance Is Not Optional
The most persistently underestimated requirement is demonstrating genuine economic substance and governance autonomy in Gibraltar. Regulators on both sides are actively scrutinising letterbox arrangements or those with inadequate local management and control structures. Substance means:
- Physical office: functioning, permanent, and staffed.
- Mind and management: key strategic, risk, and operational decisions demonstrably made in Gibraltar, evidenced through board minutes, management agreements, and decision records.
- The Four Eyes Principle: at least two designated individuals resident in Gibraltar who actively review all aspects of the business, with appropriate skills and empowerment.
- Technical expertise: resident directors must have demonstrable sector expertise. This must be evidenced in their actual interactions with the board and the firm.
Failure here creates a cascade of risks: regulatory challenge from the GFSC, questions from UK regulators about the authenticity of the Gibraltar base, and potential HMRC complications if the firm is deemed effectively managed from the UK.
UK Market Access Risks
Under the GAR whilst the GFSC is the home regulator, the FCA also retains its own-initiative intervention powers if necessary. This means that if the FCA perceives a risk to UK consumers or financial stability that the GFSC has not addressed, the FCA can vary or cancel a firm’s Schedule 2A permission. Firms must therefore understand and proactively meet FCA standards working openly and transparently with the GFSC – firms cannot rely on GFSC supervision as a compliance tool.
Consumer Duty Failures
The GFSC’s March 2025 thematic review of Consumer Duty Board Reports identified widespread shortcomings: vague reporting, insufficient data to measure outcomes, failure to follow up on identified issues, and boards that did not challenge management or propose remedial steps.
The four outcomes — products/services, price/value, consumer understanding, and consumer support — require continuous monitoring and genuine board-level ownership. This is not a one-time compliance exercise. The GFSC has signalled it will expand the Consumer Duty scope to cover all retail customers (not just UK customers) in 2026–2027, so forward planning is essential.
AML/CFT and Moneyval
Gibraltar’s AML/CFT compliance record directly affects the GAR’s alignment condition — not just individual firms but the entire jurisdiction’s market access. Gibraltar was removed from the FATF Grey List in February 2024 after demonstrating improved supervisory effectiveness, but the next Moneyval evaluation is scheduled for 2027 under revised, more demanding FATF Standards.
The GFSC is under pressure to demonstrate robust, risk-based supervision across the whole regulated financial services industry. Firms should assume enhanced scrutiny and ensure their customer due diligence, transaction monitoring, suspicious activity reporting, and business-wide risk assessments are not only compliant but demonstrably effective. Any compliance gap in this space risks jeopardising the alignment assessment — and by extension, market access for all Gibraltar firms.
Financial Ombudsman Service (FOS)
The GFSC has confirmed that UK consumers dealing with Gibraltar-authorised firms will have the same access to the Financial Ombudsman Service or the Financial Services Compensation Scheme as they would with a UK-authorised firm.
The Bottom Line
The GAR is a new permanent structure for passporting between the UK and Gibraltar. Over 90% of Gibraltar’s financial services business is directed at the UK market. For PSPs and EMIs, that proportion is likely even higher. UK market access and the UK passporting route from Gibraltar is therefore a Gibraltar privilege & responsibility and a commercial necessity.
Firms that will navigate this transition successfully are those that:
- Build real operational and governance substance in Gibraltar
- Meet UK-equivalent standards
- Maintain exemplary AML/CFT compliance
- Understand UK financial promotions and Consumer Duty obligations
- Maintain an open and collaborative relationship with the GFSC
The guiding principle of the GAR — no surprises for either the UK or Gibraltar regulator — is also the best practical principle for how to run a Gibraltar-based financial services firm in 2026.
See also:
New Safeguarding Rules for Payment & E‑Money Firms
The Ever Expanding Regulatory Perimeter: Outsourcing, Resilience & Supply Chains
Ramparts European Payments & E-money Regulatory Update and Outlook – July 2025
Consumer Duty Compliance for Gibraltar and UK Payment Service Providers
This article is for general information purposes only and does not constitute legal advice. Firms should seek specific legal advice on their individual circumstances.
