Why Choose Gibraltar for Crypto Licensing?
Gibraltar offers a principles-based crypto framework administered by the GFSC, one of the first jurisdictions in the world to write a bespoke regime for distributed ledger technology businesses. The DLT Provider Licence has been in force since , expanded in October 2025 to cover non-custodial Virtual Asset Arrangement Providers, and sits inside a common-law system with FATF-whitelist standing and UK market alignment.
The First Bespoke DLT Framework
Gibraltar’s framework predates every European competitor. The original Distributed Ledger Technology regulations took effect on , were consolidated into the Financial Services Act 2019 architecture in January 2020, and were expanded in October 2025 to bring non-custodial Virtual Asset Arrangement Providers within Part 7 of the Act. The regime is principles-based: ten Regulatory Principles governing honesty, customer interests, financial resources, business management, customer asset protection, corporate governance, systems and security, financial crime, resilience, and market integrity. Around 13 firms hold DLT licences as of early 2026, including international groups across exchange, custody, and trading models. The current pipeline is the busiest the GFSC has reported. In practice, the GFSC sets supervisory expectations on a case-by-case basis against these principles, which gives well-prepared applicants more flexibility on novel business models than a rules-based EU regime would.
UK Market Access via the Gibraltar Authorisations Regime
Gibraltar holds a unique position outside the EU: a statutory market-access framework into the United Kingdom. The Gibraltar Authorisations Regime was established under Chapter 22 of the UK Financial Services Act 2021, and transitional passporting has been extended by statutory instrument to .[30] The regime primarily covers traditional financial services activities: banking, insurance, investment services, e-money, and payment services. As of , the regime does not yet provide full UK passporting for DLT or VAA activities specifically. The real value today is for licensed Gibraltar groups operating across regulated traditional-finance and crypto product lines.
FATF Whitelisted with MONEYVAL Top-Tier Compliance
Gibraltar was removed from the FATF increased-monitoring list on after satisfying its action plan on anti-money-laundering effectiveness.[13] The European Commission removed Gibraltar from its high-risk third-countries list on .[10] MONEYVAL’s second enhanced follow-up report, adopted in May 2024, terminated the enhanced procedure and rated Gibraltar Compliant or Largely Compliant on all 40 FATF Recommendations: one of only 11 jurisdictions globally with zero Non-Compliant ratings.[14] Unlike BVI, which remains on the FATF grey list as of , Gibraltar’s whitelist status is now a banking and counterparty advantage.
Common-Law Jurisdiction and English Judicial System
Gibraltar is a self-governing British Overseas Territory. The Gibraltar Supreme Court applies English common law, with final appeal to the Judicial Committee of the Privy Council. Gibraltar courts have produced modern decisions on the property characterisation of digital assets and on crypto-asset recovery, which gives operators legal certainty that EU civil-law jurisdictions are still developing. Companies are formed under the Companies Act 2014; corporate documentation, court process, and statutory forms are in English. For US-, UK-, and Commonwealth-domiciled groups, this lowers integration friction materially.
Regulatory Framework
The Gibraltar DLT regime is governed by the Financial Services (DLT Providers and VAA Providers) Regulations 2020 (LN 2020/012, in force ), made under the FSA 2019. The original 2018 framework was consolidated into the 2020 Regulations; an October 2025 amendment renamed the Regulations to bring in non-custodial Virtual Asset Arrangement Providers.[1][2]
What Is a DLT Provider Licence?
A Gibraltar DLT Provider Licence authorises a Gibraltar-incorporated company to carry on the regulated activity of using distributed ledger technology to store or transmit value belonging to others. The licence is issued by the Gibraltar Financial Services Commission under Part 7 of the Financial Services Act 2019 and the Financial Services (DLT Providers and VAA Providers) Regulations 2020. Licensed firms are subject to Gibraltar’s 15% corporate tax (raised from 12.5% on ); there is no VAT, no capital gains tax, and no inheritance tax.[3][4]
The Ten Regulatory Principles
Every DLT licensee must comply with the Schedule of Regulatory Principles set out in the 2020 Regulations and amended by LN 2022/102. The original nine principles were extended on to add Principle 10 on market integrity. The Principles read:[1][5]
- A DLT Provider must conduct its business with honesty and integrity.
- A DLT Provider must pay due regard to the interests and needs of each and all its customers and must communicate with them in a way that is fair, clear and not misleading.
- A DLT Provider must maintain adequate financial and non-financial resources.
- A DLT Provider must manage and control its business effectively, and conduct its business with due skill, care and diligence, including having proper regard to risks to its business and customers.
- A DLT Provider must have effective arrangements in place for the protection of customer assets and money when it is responsible for them.
- A DLT Provider must have effective corporate governance arrangements.
- A DLT Provider must ensure that all of its systems and security access protocols are maintained to appropriate high standards.
- A DLT Provider must have systems in place to prevent, detect and disclose financial crime risks such as money laundering and terrorist financing.
- A DLT Provider must be resilient and have contingency arrangements for the orderly and solvent wind down of its business.
- A DLT Provider must conduct itself in a manner which maintains or enhances the integrity of any markets in which it participates.
Regulatory History
Gibraltar wrote the first bespoke DLT regime in 2017, with effect from , under what was then the Financial Services (Investment and Fiduciary Services) Act. The legislation was deliberately principles-based to accommodate business models that did not fit traditional financial-services categorisation.[1][6]
The Financial Services Act 2019 took effect on , replacing 15 previous statutes with a single consolidated framework. The DLT regime was migrated into LN 2020/012 on . Amendments since: LN 2022/067 (post-Brexit consolidation), LN 2022/102 (added Principle 10, ), and LN 2023/259 (specified regulatory decisions). The Staged Application for Authorisation Process was published in August 2023 and implemented from .[1][7]
The Financial Services (Regulated Activities) (Amendment) Regulations 2025 (LN 2025/254) came into force on . The amendment renamed LN 2020/012 to include Virtual Asset Arrangement Providers (non-custodial exchange and one-to-one virtual-asset-for-fiat services), brought VAAPs within Part 7 of the FSA 2019, and updated the GFSC’s Scope Guidance Note to distinguish the two authorisation pathways. The further Financial Services (E-Money Firms and DLT Providers etc.) (Amendment) Regulations 2026 (LN 2026/053) took effect on .[1][8]
Recent Regulatory Developments
- (LN 2026/053): Financial Services (E-Money Firms and DLT Providers etc.) (Amendment) Regulations 2026: technical updates to e-money and DLT supervisory arrangements.
- (LN 2025/254): Virtual Asset Arrangement Providers brought within Part 7 of the FSA 2019. The DLT Regulations renamed; non-custodial arrangement-only operators now require a separate VAA Provider permission.[8]
- , GFSC Updated DLT Scope Guidance Note: distinguishes DLT (custodial) and VAA (non-custodial) authorisation pathways; clarifies that Principle 5 (customer asset protection) does not apply to VAAPs and Principle 10 is unlikely to apply.[9]
- , European Commission delisting: Gibraltar removed from the EU’s list of high-risk third countries for AML purposes.[10]
- (LN 2025/040): assessment-request process streamlined; the previously separate £2,000 initial assessment fee was consolidated.[11]
- : Corporate tax rate raised from 12.5% to 15% (Income Tax (Amendment) Act 2024). DLT firm interest income reclassified as trading income from by the Insurer and DLT Tax Bill.[3][12]
- : FATF removed Gibraltar from increased monitoring list at its plenary in Paris.[13]
- , MONEYVAL 2nd Enhanced Follow-Up Report: terminated enhanced follow-up procedure; 23 Compliant and 17 Largely Compliant ratings against the 40 FATF Recommendations.[14]
- : Staged Application for Authorisation Process commenced for high-impact sectors including DLT.[15]
- (LN 2022/102): Principle 10 (market integrity) added.[5]
Regulatory Overlap
DLT and VAAP licensees commonly interact with three adjacent Gibraltar regimes. Understanding the boundary matters because the wrong starting permission triggers an authorisation refusal or, in worst cases, an enforcement action against unauthorised business.[1][16]
- E-money firms (LN 2019/200, Electronic Money Regulations). Stablecoin issuers whose tokens function as e-money may require an e-money firm authorisation in parallel with, or instead of, a DLT Provider Licence. The boundary turns on whether the token represents a claim on the issuer in fiat or a representation of value on a distributed ledger.
- Investment firms (FSA 2019 Part 7, Investment Services). Tokenised securities and crypto-derivatives trigger the investment services regime in addition to the DLT permission. A custodial exchange listing security tokens needs both authorisations.
- Proceeds of Crime Act 2015 (POCA). Token issuers selling their own native token without custody of customer assets fall outside the DLT regime but inside the POCA Schedule 9 AML/CFT registration regime supervised by the GFSC.[16]
Gibraltar courts have ruled that crypto-assets are property at common law, applying the established Tulip Trading and AA v Persons Unknown line of English authority to local proceedings.
License Types and Activities Covered
Gibraltar’s framework recognises two regulated activities since : the DLT Provider Licence for custodial business (storing or transmitting value belonging to others using distributed ledger technology) and the Virtual Asset Arrangement Provider Licence for non-custodial business (exchange of virtual assets for fiat, fiat for virtual assets, or virtual asset for virtual asset).[1][8]
Covered Activities
- Custodial exchange services (DLT). Operating a venue at which customers buy, sell, or swap virtual assets where the operator holds customer fiat or crypto pending settlement.
- Virtual asset custody (DLT). Holding private keys or virtual assets on behalf of customers, including hot wallet, warm wallet, and cold custody operations.
- Stablecoin issuance and management (DLT, often combined with e-money). Issuing and redeeming fiat-backed or asset-backed stablecoins where the issuer retains custody of the backing.
- Token issuance with custody (DLT). Sales of new tokens where the issuer holds customer fiat or crypto during the issuance window.
- Crypto-fiat on-ramp and payment services (DLT, often combined with payment-services permissions). Conversion of fiat to crypto and vice versa where the operator settles customer balances on its own ledger.
- Non-custodial arrangement services (VAAP). Exchange of one virtual asset for another or for fiat without taking custody at any point; one-to-one swap services and certain brokerage models.
- Token brokerage (VAAP). Matching buyers and sellers of virtual assets without custody.
What Does NOT Require Registration
- Pure protocol-layer DeFi without a central operator. Where no identifiable person or entity controls customer assets or arranges exchanges, the regulatory perimeter does not engage; the GFSC assesses control on a case-by-case basis.
- Token issuers selling their own native token without custody. Falls under POCA Schedule 9 AML/CFT registration with the GFSC, not the DLT regime. Different application, different supervisor, lower regulatory burden.
- Collective investment schemes and their depositaries. Excluded from the DLT regime when dealing on own account; investment-fund regime applies instead.
- Pure-collectible NFTs without financial features. Fractionalised, yield-bearing, or financialised NFTs may engage the regime; the question is functionality, not the NFT label.[9]
Activity Restrictions
The GFSC publishes no closed list of restricted activities. Principle 10 (market integrity) restricts manipulative trading practices, front-running, and undisclosed proprietary trading against customers. Activities with strong consumer-protection implications, such as retail crypto-derivatives offered to non-professional clients, may require additional investment-firm permission and conduct obligations imposed by the May 2024 Core Principles and Consumer Duty Regulations.[17]
Requirements
Gibraltar imposes no single statutory minimum capital, no fixed director count, and no mandatory local share-ownership; the framework is principles-based. The make-or-break elements are mind-and-management from Gibraltar (Principle 6), board fitness and propriety, capital adequacy calibrated to activity (Principle 3), and a fully-built AML/CFT framework matching POCA and GFSC guidance.[1][18]
Requirements Table
| Requirement | Specification |
|---|---|
| Entity type | Gibraltar private company limited by shares (Companies Act 2014) |
| Minimum directors | No statutory minimum; market practice is at least two, both Gibraltar-resident, applying the four-eyes principle |
| Foreign ownership | 100% permitted; no nationality restriction on shareholders or directors |
| Minimum capital | Risk-based; no statutory floor; market practice £100,000–£250,000+ for low-complexity firms, £1m+ for full custodial exchanges |
| Local director(s) | Yes, at least two Gibraltar-resident directors (market practice; not statutory) |
| Local office | Yes, physical office in Gibraltar required |
| Compliance Officer / MLRO | Mandatory; preferably Gibraltar-resident; can be outsourced subject to GFSC outsourcing guidance and retained accountability |
| Internal/external audit | Annual financial-statements audit by an approved Gibraltar auditor required under the FSA 2019 |
| Professional indemnity insurance | Expected commensurate with activity; no prescribed minimum |
| AML/CFT framework | POCA Schedule 9 plus GFSC Guidance Note 8 (Financial Crime); Business-Wide Risk Assessment mandatory |
| Travel Rule | Mandatory from for virtual asset transfers ≥ €1,000 (Transfer of Virtual Assets Regulations 2021) |
| Wind-down plan | Mandatory under Principle 9; orderly and solvent wind-down arrangements documented at authorisation |
Fit-and-Proper Assessment
The GFSC’s fit-and-proper test applies to directors, senior managers, controllers (≥10% holders and persons with significant influence), and beneficial owners. The Commission assesses integrity (criminal record, regulatory enforcement, financial probity), competence (relevant experience, professional qualifications), and financial soundness (personal finances, history of insolvency proceedings). Each individual completes the GFSC Personal Questionnaire and submits regulatory references where they have previously held senior or controlled-function roles. The common mistake is treating fit-and-proper as a tick-box exercise: experienced applicants sequence references and prior-regulator clearances early because gaps in employment history or unresolved historic regulatory matters often cause Stage 2 delays rather than refusals.[18][19]
Local Presence and Mind-and-Management
Gibraltar’s local-substance test reads through Principle 6 (corporate governance). What it means in practice: a Gibraltar office that is not a serviced address; board meetings physically held in Gibraltar at the cadence specified by the firm’s governance arrangements; key decisions made and minuted in Gibraltar; senior management with substantive responsibilities resident in Gibraltar. The HEPSS and Category 2 personal-tax routes (covered in Section 9) exist specifically to make senior relocation viable. What the GFSC’s published guidance does not address is how it treats nominee directors and pure non-executive boards: in practice, applications relying heavily on non-executive Gibraltar residents while the executive team operates elsewhere face significantly slower assessment timelines.
AML/CFT and Travel Rule
Gibraltar’s primary AML/CFT statute is the Proceeds of Crime Act 2015, supplemented by the GFSC’s Guidance Note 8 (Financial Crime) and the revised AML/CFT/CPF Guidance Notes effective 2024. DLT and VAA licensees are obliged entities under POCA Schedule 9: Business-Wide Risk Assessment, customer risk assessment, customer due diligence and enhanced due diligence, ongoing monitoring, transaction monitoring, sanctions screening against the UK, EU, UN, and OFAC lists, politically exposed person screening, and suspicious activity reporting to the Gibraltar Financial Intelligence Unit. Travel Rule obligations apply to virtual asset transfers of €1,000 or more, in force from under the Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021.[20][21]
Application Process
The GFSC operates a Staged Application for Authorisation Process for DLT applicants. Stage 1 carries a five-month maximum assessment commitment, with Stages 2 and 3 adding up to four further months; total target nine months from complete Stage 1 submission. An optional Mobilisation Stage 4 is available for high-impact sectors.[15][22]
Application language: All documents in English. No certified translations required for English-language source material.
Pre-application engagement: Not mandatory but strongly recommended; in practice virtually all applicants engage the GFSC DLT team for an initial scoping meeting before formal submission.
Pre-Application
Forming a Gibraltar entity is the first step. See the full Gibraltar company formation guide → With the Gibraltar private company limited by shares incorporated, applicants engage the GFSC DLT supervisory team to scope the business model, confirm whether DLT or VAA permission applies, agree fee category, and identify documentation gaps. This stage runs in parallel with corporate banking applications, which themselves take 4–12 weeks. The pre-application meeting is virtual or in-person; the GFSC provides written feedback within 2–4 weeks.
Stage 1 GFSC Submission and Assessment
The Stage 1 submission comprises the Comprehensive Business Plan, board and senior-management Personal Questionnaires, group structure, fit-and-proper documentation, AML/CFT framework summary, financial projections, and capital plan. The GFSC reviews against the ten Regulatory Principles. The five-month maximum applies from the date the submission is complete; expect 2–3 rounds of written queries during this window with response targets of 10 business days each.
Stage 2 Documentation Build-Out
Detailed policies, procedures, and operational readiness materials: full AML/CFT policy suite, BWRA, sanctions screening procedures, transaction monitoring rule library, Travel Rule implementation, custody and key management procedures (DLT only), wind-down plan, cybersecurity architecture, outsourcing agreements, and conflicts-of-interest framework. Most material rejection causes at this stage relate to documentation that does not reference Gibraltar-specific regulatory expectations or that has been adapted from another jurisdiction without revision.
Stage 3 Final Assessment and Authorisation
GFSC presentation to senior decision-makers, final on-site or video readiness review, decision on authorisation. In-principle approval is followed by final licence issuance once any conditions precedent are met (typically capital injection confirmation and final operational readiness).
Mobilisation
For DLT applicants, the GFSC may issue a Mobilisation permission allowing limited operations in a controlled environment while the firm completes operational build-out. Mobilisation is most useful for new-build operations where systems and staffing cannot be fully proven until live transactions occur. Not used for groups with existing operational maturity in other jurisdictions.
Jagelski & Partners’ specialist compliance partners draft Gibraltar-specific AML/CFT policy manuals, Business-Wide Risk Assessments, Travel Rule implementations, and Stage 1 Comprehensive Business Plans as part of the DLT and VAAP licensing engagement. The compliance documentation is the most time-intensive component of any Gibraltar application: 8–12 weeks of specialist work that cannot be shortcut with generic templates. The GFSC scrutinises every policy against the ten Regulatory Principles and rejects submissions adapted from EU MiCA or BVI VASP frameworks. Book a Licensing Assessment →
Required Documents
The GFSC’s published Guidance Notes set out documentation expectations across five categories. Each document must be bespoke to the applicant’s business model and Gibraltar-specific; submissions adapted from other jurisdictions are a leading cause of Stage 2 delays.[23]
Corporate Documents
Certificate of Incorporation and Memorandum and Articles of Association under the Companies Act 2014; group structure chart showing the path from ultimate beneficial owners to the applicant entity; resolutions appointing directors, the MLRO, and the Compliance Officer; share register; registered office confirmation; corporate banking confirmation (if banking is in place by Stage 1) or banking-application status report.
Personal Documents (Directors, Officers, UBOs, Qualifying Shareholders)
For every director, senior manager, controller, qualifying shareholder, and ultimate beneficial owner: certified copy passport; second proof of identity; original or certified utility bill issued within the last 3 months; full CV with chronological employment history; criminal-record certificate from country of residence and any country of substantive residence in the prior 10 years; regulatory references from previous regulated employers; bankruptcy and litigation searches; completed GFSC Personal Questionnaire; declaration of interests.
Compliance Documentation
The compliance documentation is the most heavily scrutinised component of any Gibraltar DLT application. Jagelski & Partners’ specialist compliance partners draft each of these documents as part of the licensing engagement: bespoke and Gibraltar-specific, not templates adapted from other jurisdictions. Each document must reflect the applicant’s specific business model, risk profile, and operational structure, and reference the GFSC’s Guidance Notes by number where applicable.
Must articulate the applicant’s customer-acceptance policy, due-diligence tiers, source-of-funds standards, ongoing monitoring rules, and reporting workflows in Gibraltar-specific terms. The GFSC rejects policies that reference EU MLD6 or UK MLRs without proper localisation. Cross-references to the Business-Wide Risk Assessment and Sanctions Screening Procedures must be explicit.
The GFSC expects the BWRA to drive the rest of the AML framework. Vague risk taxonomies and generic risk ratings are the most common rejection cause. Must reference Gibraltar’s specific exposure profile (cross-border crypto flows, gaming-sector adjacency, UK/Spanish border traffic) and the FATF/MONEYVAL findings on Gibraltar.
Mandatory in practice for DLT applicants because the GFSC tests proportionality of controls against stated appetite during fit-and-proper and Principle 4 (business management) review. Quantitative thresholds (volume caps, geographic exclusions, customer-type limits) are expected, not aspirational language.
Gibraltar applies UK and UN sanctions regimes directly under the Sanctions Act 2019 (Gibraltar) and equivalent UK extensions. Procedures must name screening vendors, escalation criteria, false-positive disposition protocols, and refresh cadence for the customer base. Static one-time screening at onboarding fails Principle 8.
Must reflect FATF black and grey lists, EU AML high-risk third countries, UK and US sanctions geographies, and the applicant’s own enhanced-risk classification. Standalone matrix preferred over inline references; the GFSC reviews it as a discrete document.
DLT-specific scenarios required: on-chain analytics provider integration, mixer and tumbler exposure rules, peeling-chain detection, sanctioned-address screening (post-Tornado Cash), and unhosted-wallet handling. The framework must specify whether monitoring is rule-based, behavioural, or hybrid, and document model governance.
Applies to transfers of virtual assets of €1,000 or more, in force since . Implementation must address originator and beneficiary data collection, transmission protocol (IVMS 101, TRP, OpenVASP), counterparty VASP due diligence, and sunrise-issue handling where the counterparty has not yet implemented Travel Rule.
The GFIU is the receiving authority for SARs in Gibraltar. Procedures must specify the trigger conditions, internal escalation timeline, MLRO sign-off, tipping-off prohibitions, and post-submission file retention. Average DLT-firm SAR volume varies sharply by business model; the procedure must include a calibration mechanism rather than rely on a fixed expected volume.
The GFSC expects tiered onboarding by risk category, with documentary, biometric, and electronic verification options specified. KYB procedures must cover beneficial-ownership identification to the 10% threshold under Gibraltar’s POCA framework. Onboarding documentation must reference the GFSC’s expected use of CDD measures.
Independent of internal audit. The CMP tests the operation of policies and procedures against the ten Regulatory Principles. The GFSC reviews CMP outputs during supervisory engagement and thematic reviews.
Principle 5 (customer asset protection) is the operative principle. Procedures must specify hot, warm, and cold-wallet segregation, multi-party computation or multi-signature thresholds, hardware security module use, geographic distribution of key shards, business continuity arrangements, and the response plan to private-key compromise. Cold-storage architecture is reviewed in detail at Stage 3.
Business Plan and Financial Projections
Three-year financial projections in the GFSC’s expected format: revenue model with assumption transparency, operating cost build, headcount plan, capital requirement calculation, regulatory capital buffer, and wind-down cost reserve under Principle 9. Stress tests against revenue downside, market downturn, and operational-incident scenarios. The plan must be coherent with the operational AML and IT designs: a plan projecting 10x growth without matching compliance-team scale fails Principle 3 immediately.
Technology and Operational Documentation
Technical architecture diagrams, infrastructure design, security architecture (network, application, identity), cybersecurity policy, penetration testing programme, business continuity plan, disaster recovery plan, vendor and outsourcing register, critical-third-party risk assessment, and incident response plan. GFSC Guidance Note 4 on Cybersecurity and Guidance Note 5 on Technology Governance set the expectations. For custodial DLT operations, the GFSC reviews custody architecture in detail and expects evidence of independent third-party security review.
Costs and Pricing
The Financial Services (Fees) Regulations 2020 (as amended) set out the GFSC fee structure. DLT application fees start at £2,100; annual supervision fees comprise a £11,330 base, plus a 0.1% trading-volume component capped at £60,000, a £3,000 AML supervision fee, and a discretionary supplementary fee of up to £22,660 for higher-intensity supervision.[24]
Government Fees (GFSC)
| Fee Type | Amount (GBP) | Notes |
|---|---|---|
| Application fee (initial) | From £2,100 | Per GFSC schedule as of June 2026; complexity-banded variant up to £30,000+ for full custodial exchanges |
| Annual supervision fee, base | £11,330 | Mandatory baseline; payable annually |
| Annual trading-volume fee | 0.1% of reported trading volume, capped at £60,000 | Cap doubled from £30,000 to £60,000 on |
| Annual AML supervision fee | £3,000 | Mandatory for all DLT Providers |
| GFSC supplementary fee | Up to £22,660 | Discretionary; applied where GFSC determines higher-intensity supervision is required |
| Intensive supervision uplift | Up to 40% | Applied under regulation 4A of the Fees Regulations where applicable |
Total Cost Summary
| Item | Year 1 (GBP) | Annual ongoing (GBP) |
|---|---|---|
| GFSC fees (application + Year 1 supervision) | 16,000–60,000+ | 14,000–60,000+ (no application fee) |
| Company formation (Gibraltar private company limited by shares) | 3,000–6,000 | n/a |
| Legal advisory (Gibraltar counsel) | 60,000–180,000 | 20,000–40,000 |
| Compliance documentation (AML/CFT policy suite, BWRA, Travel Rule, sanctions framework) | 80,000–180,000 | 25,000–60,000 |
| Local representative / company secretary / registered office | 8,000–15,000 | 8,000–15,000 |
| Compliance Officer / MLRO (in-house or outsourced) | 60,000–180,000 | 60,000–180,000 |
| Audit | 25,000–60,000 | 25,000–60,000 |
| Office and operational setup | 30,000–80,000 | 30,000–80,000 |
| Total Year 1 | £250,000–£800,000+ | £190,000–£500,000+ |
Regulatory capital is excluded from the table. Authorised capital is set by the GFSC on a risk-based basis under Principle 3 and held separately (see Requirements for the market-practice figures).
Timeline
Realistic total project timeline is 9–12 months from initial engagement to issued licence, plus optional Mobilisation. The GFSC’s published nine-month maximum applies from complete Stage 1 submission across Stages 1–3 combined. Pre-application engagement and Stage 1 documentation build add 1–3 months before the regulatory clock starts.[15][22]
| Stage | Duration | Cumulative |
|---|---|---|
| Pre-application engagement and documentation build | 4–8 weeks | 1–2 months |
| Stage 1 GFSC assessment (maximum) | Up to 5 months | 6–7 months |
| Stage 2 documentation build-out | 8–12 weeks | 8–10 months |
| Stage 3 final assessment and authorisation | 4–8 weeks | 9–12 months |
| Total to licence | 9–12 months | 9–12 months |
| Mobilisation (optional, for new-build operations) | Up to 12 months | n/a |
The GFSC publishes a five-month maximum Stage 1 assessment commitment for DLT applicants, with up to four further months across Stages 2 and 3. In practice, the regulator processes Stage 1 within 4 months for complete, well-prepared submissions and closes incomplete applications after 12 months of inactivity. Around 13 DLT licences are in force as of early 2026, with the GFSC reporting record application volumes; pre-application engagement is now particularly valuable for queue management.
Taxation
Gibraltar is a 15% headline corporate tax jurisdiction since , but with no VAT, no capital gains tax, no inheritance tax, and no withholding tax on dividends, interest, or royalties paid to non-residents. DLT firm interest income has been reclassified as taxable trading income from .[3][4][12]
| Tax | Rate | Application to Crypto Activities |
|---|---|---|
| Corporate income tax | 15% (from 1 July 2024) | All trading profits accrued in or derived from Gibraltar by licensed DLT/VAA firms |
| Higher rate (utilities, dominant-market-position, fuel) | 20% | Not generally applicable to DLT firms |
| Personal income tax (top marginal) | Up to 39% (Allowance-Based System) or progressive 26% top under Gross Income Based System | Senior staff salaries; HEPSS and Cat 2 routes available |
| Capital gains tax | 0% | None at corporate or personal level |
| Value added tax | None | No VAT in Gibraltar |
| Withholding tax (dividends, interest, royalties) | 0% to non-residents | Cross-border crypto-fee payments |
| Stamp duty | Nominal (£10 on share transfers) | Corporate restructurings |
| Pillar Two QDMTT | 15% (from 31 December 2023 financial years) | Multinational groups with consolidated revenue ≥ €750m |
All rates as of .
Pillar Two (Global Minimum Tax)
Gibraltar’s Global Minimum Tax Act 2024 (enacted ) implements OECD Pillar Two via a Qualifying Domestic Minimum Top-Up Tax and an IIR. The QDMTT applies for fiscal years beginning on or after ; the IIR applies for fiscal years beginning on or after . No Under Tax Profits Rule has been implemented. Pillar Two affects multinational groups with consolidated revenue of €750 million or more; standalone Gibraltar-domiciled DLT firms are typically below that threshold.[25]
CRS and CARF Reporting
Gibraltar implements the OECD Common Reporting Standard (CRS) and is committed to CARF implementation. CARF rules align to the OECD’s October 2022 framework and the 2023 multilateral competent authority agreement. Implementing legislation is expected to take effect in 2026, with first reporting in 2027 for the 2026 reporting year. DLT licensees should expect CARF obligations alongside existing CRS reporting where they hold financial accounts for non-residents.
HEPSS and Category 2 Personal Tax Status
Two personal-tax statuses make senior relocation to Gibraltar viable. HEPSS (Higher Executive Possessing Specialist Skills) caps gross assessable employment income at £160,000, giving an effective annual liability around £39,940. Applicants must possess skills not available in Gibraltar, hold approved residential accommodation, and have been non-resident for the previous three years. Category 2 status is designed for high-net-worth individuals with net wealth ≥ £2m: assessable income capped at £118,000, with annual tax of £37,000–£42,380. Restrictions apply on local employment.[26][27]
Ongoing Compliance & Post-Registration
A Gibraltar DLT or VAAP licence is an indefinite authorisation, but the supervisory engagement is continuous. Annual financial statements, supervision fees, regulatory returns, board attestations, and notifications of material change are mandatory; thematic reviews and on-site inspections are routine. Realistic annual ongoing compliance cost runs £190,000–£500,000+ across documentation, audit, MLRO function, and supervisory engagement.[18][24]
Annual Reporting Obligations
Audited annual financial statements filed with the GFSC and the Income Tax Office (deadline 9 months from financial year-end). Annual return covering business activity, customer numbers, transaction volumes, regulatory capital position, and material incidents. Compliance Officer’s annual report to the board with a copy submitted to the GFSC under the Core Principles and Consumer Duty Regulations 2024 where retail customers are served. Continuous reporting via the GFSC Digital Portal; material changes (control, senior staff, business model, IT) require pre-notification under Section 83A of the FSA 2019.
Renewal Fees and Supervision Fees
The Gibraltar licence does not require renewal. It is an indefinite authorisation supervised under continuous fees. Annual supervision fee structure: £11,330 base plus 0.1% trading-volume fee capped at £60,000, plus £3,000 AML supervision fee, plus discretionary supplementary fee up to £22,660. Recurring operational costs: registered office (£3,000–£6,000), company secretary (£5,000–£10,000), audit (£25,000–£60,000), MLRO/Compliance Officer (£60,000–£180,000), accounting (£15,000–£35,000), legal advisory retainer (£20,000–£40,000).
Regulatory Inspections
GFSC supervisory engagement combines scheduled annual reviews, thematic reviews on cross-sector issues, and unannounced on-site visits where supervisory concerns warrant. Recent GFSC thematic focus areas include Consumer Duty Board Reports (March 2025 thematic review found industry-wide gaps), client asset segregation, and Travel Rule implementation across DLT licensees. Documentation requirements at inspection include the BWRA, transaction monitoring outputs, sanctions screening alert disposition, MLRO reports, and board meeting minutes. Experienced applicants prepare a standing inspection pack updated quarterly rather than scrambling at notification.
Enforcement
The GFSC’s enforcement toolkit includes private warning, public statement, financial penalty, condition imposition, and revocation. The Commission has historically favoured supervisory remediation over public enforcement. The most prominent DLT enforcement action to date is the 2024 Regulatory Settlement Agreement with TAP Global Limited: a £21,000 financial penalty for executing a change of control without GFSC consent, breaching 2 of the 10 DLT Principles. No DLT licences have been publicly revoked through June 2026. Unauthorised DLT business carries criminal liability under Section 30 of the FSA 2019, with maximum penalty of unlimited fine and 7 years imprisonment.[28]
Banking
Banking for Gibraltar DLT licensees is workable but demanding. The Gibraltar banking sector is small, traditional banks require fully-built compliance frameworks before opening operating accounts, and correspondent banking capacity for crypto activity is limited. Most licensees combine a Gibraltar operating account with international EMI and crypto-friendly payment-institution relationships.
Locally-licensed Gibraltar credit institutions number in single digits. Operating account onboarding for DLT licensees requires the full compliance package: GFSC supervisory approval (or evidence of advanced authorisation), the AML/CFT framework, board and senior-management screening, and detailed source-of-funds and source-of-wealth documentation. Banks rely on UK and EU correspondent relationships and inherit the risk appetite of their correspondents; banking-side timelines extend by 4–8 weeks beyond regulatory authorisation in most cases.
Payment institutions and electronic money institutions operating into Gibraltar typically include EU-domiciled EMIs licensed in Lithuania, Cyprus, and Malta, UK-licensed EMIs operating into Gibraltar under transitional arrangements, and a smaller number of Caribbean-domiciled neobanks. Cross-currency rails (GBP, EUR, USD) are achievable in 4–8 weeks for well-prepared applicants. Crypto-fiat settlement rails (USDC, USDT, EURC) typically require a separate stablecoin-friendly EMI relationship distinct from operating banking.
Jagelski & Partners’ banking partner network includes 90+ institutions across Europe, the UK, the Channel Islands, and offshore jurisdictions, with active relationships into Gibraltar covering operating, treasury, and crypto-fiat settlement requirements. A licence without banking access is a certificate on the wall: learn about our Banking service →
Operating, safeguarding, EMI redundancy, and specialist acquirer layers planned together, across more than 90 institutions in the EEA, UK, Switzerland, and selected offshore corridors.
Explore Banking SolutionsFATF Status & International Standing
Gibraltar is FATF-clear (see Why Gibraltar for the headline dates); this section sets out the substance behind that standing, the grey-listing remediation and the MONEYVAL ratings detail.[13][14][29]
The June 2022 grey-listing identified gaps in the supervision of designated non-financial businesses, in the use of confiscation powers, and in the effective application of asset-recovery measures. Gibraltar’s response, coordinated by HM Government of Gibraltar, the GFSC, and the Royal Gibraltar Police, addressed each recommended action item within 20 months. The FATF’s February 2024 plenary statement confirmed completion. The EU’s July 2025 delisting followed the Commission’s third attempt at adoption, after the European Parliament’s April 2024 vote against an earlier version and a June 2025 Delegated Regulation that passed non-opposition in July 2025.[10][13]
MONEYVAL’s 2nd Enhanced Follow-Up Report rates Gibraltar Compliant on 23 of the 40 FATF Recommendations and Largely Compliant on the remaining 17. No recommendation is rated Non-Compliant. As of 2026, Gibraltar is one of only 11 jurisdictions globally with that profile, alongside Israel, Italy, Liechtenstein, and the United Kingdom. The effectiveness ratings under MONEYVAL’s earlier methodology placed Gibraltar Moderate or Substantial on all eleven Immediate Outcomes.[14][29]
EU Market Access
A Gibraltar DLT or VAAP licence does not confer EU passporting rights. The Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) contains no third-country equivalence regime: there is no mechanism for the European Commission to recognise a Gibraltar licence as equivalent to a CASP authorisation issued under MiCA. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative. ESMA’s guidelines on reverse solicitation (published , applicable from ) interpret this restrictively: any form of EU-targeted marketing, EU-language website content, geo-targeted advertising, app store availability, or use of EU-based influencers constitutes solicitation that voids the exemption. The exemption is designed for isolated contacts, not systematic EU market access. For a detailed analysis of what constitutes solicitation and the documentation requirements, see Reverse Solicitation Under MiCA →
Advantages and Limitations
Gibraltar’s advantages cluster around regulatory pedigree, common-law certainty, and FATF standing; the limitations cluster around cost, the absence of EU passporting, and the practical constraints of a small jurisdiction. The trade-offs favour serious, well-capitalised operators over early-stage projects.
- First bespoke DLT regime, in force since 1 January 2018. Eight years of supervisory experience and around 13 licensed firms set the supervisory bar.
- FATF-clear and MONEYVAL top-tier. One of 11 jurisdictions globally with zero Non-Compliant ratings against the 40 FATF Recommendations.
- Common-law jurisdiction with UK alignment. English judicial system, modern crypto-property case law, and Gibraltar Authorisations Regime access to the UK market (currently scope-limited to traditional FS).
- No VAT, no CGT, no inheritance tax. Headline 15% corporate tax, plus HEPSS and Category 2 personal tax statuses for senior relocation.
- No EU passporting. Gibraltar is non-EU; MiCA does not apply. Mitigation: Operators targeting EU clients can obtain a separate CASP authorisation in an EU member state (full market access via passporting) or, for isolated genuinely unsolicited contacts only, may fall within the narrow reverse solicitation exemption under MiCA Article 61.
- Higher regulatory cost than offshore registration regimes. Realistic Year 1 cost £250,000–£800,000+ before regulatory capital. Mitigation: For operators where regulatory depth and reputation drive banking and counterparty access, the cost differential against BVI/Cayman/IoM registration regimes is recovered in banking and partnership quality. Project finances accordingly.
- Substance requirements demand real Gibraltar presence. Mind and management from Gibraltar; two-director-resident market practice; onshore MLRO. Mitigation: HEPSS and Category 2 personal-tax statuses are designed for senior relocation; Gibraltar’s professional services market (Big-4 + tier-1 law firms) supports outsourced specialist functions where retained accountability is preserved.
- Small banking sector and limited correspondent capacity. Banking onboarding takes 4–12 weeks and frequently requires multi-institution architecture. Mitigation: Plan banking applications in parallel with regulatory authorisation, not sequentially; combine a Gibraltar operating account with EU-domiciled EMI and stablecoin-friendly payment-institution relationships.
How Gibraltar Compares
Gibraltar competes most directly with Malta and Cyprus inside the cluster of established EU/EEA crypto centres, with Estonia as the cost-leader alternative outside the established-centre tier. The trade-off is regulatory pedigree, tax position, and UK market adjacency against EU passporting: Gibraltar offers the former; Malta, Cyprus, and Estonia offer the latter at varying cost.
| Factor | Gibraltar | Malta | Cyprus | Estonia |
|---|---|---|---|---|
| Licence Type | DLT Provider / VAAP (FSA 2019) | MiCA CASP | MiCA CASP | MiCA CASP |
| Regulator | GFSC | MFSA | CySEC | FSA (Finantsinspektsioon) |
| Regime Track Record | First bespoke DLT regime (2018); ~13 licensed firms | MiCA from 2024; 7-year VFA track record | MiCA from 2024; 8 CASPs authorised in 2025 | MiCA from 2024; FIU-era reputation legacy |
| Timeline | 9–12 months total (6–9 from complete Stage 1) | 9–18 months | 8–14 months | 6–12 months |
| Min. Capital | No fixed statutory minimum; risk-based ~£100k–£1m+ | €50,000–€150,000 | €50,000–€150,000 | €50,000–€150,000 |
| Total Year 1 Cost | £250,000–£800,000+ | €350,000–€900,000 | €350,000–€700,000 | €80,000–€220,000 |
| Corporate Tax | 15%; no VAT, no CGT | 35% nominal, effective ~5% after refund | 15% (raised from 12.5% in 2026) | 22% (deferred on undistributed profits) |
| Local Presence | Office + 2 resident directors + onshore MLRO | Office + key function holders | Office + local presence | Office + local director or MLRO |
| Banking Access | 4–12 weeks; multi-institution architecture typical | 4–8 months; enhanced due diligence at every institution | Selective but workable; 8–14 weeks to live account | Selective; multi-institution architecture typical |
| EU Passporting | No | Yes (MiCA) | Yes (MiCA) | Yes (MiCA) |
| UK Market Access | Gibraltar Authorisations Regime route (traditional FS scope to date) | None | None | None |
| FATF Status | Clear (whitelisted Feb 2024) | Clear | Clear | Clear |
| Best For | Well-capitalised custodial exchanges, custodians, and stablecoin issuers serving UK and global non-EU customers | Mid-to-large CASPs wanting EU passporting with 5% effective tax | Retail and institutional CASPs wanting MiFID-grade EU supervision in English | Cost-sensitive EU-focused operators committed to real Estonian substance |
Compare every crypto jurisdiction side by side →
For operators whose end customers are predominantly EU-based, Gibraltar’s absence of MiCA passporting is structurally decisive: Malta, Cyprus, and Estonia all provide direct passporting to the 30 EEA states via a single authorisation. For operators serving UK, Commonwealth, US, and global customer bases, Gibraltar’s common-law system, FATF whitelist status, and UK alignment outweigh the EU passporting absence in most operational contexts.
On total cost, Estonia is the lowest-cost MiCA jurisdiction in this peer group by a clear margin; Malta, Cyprus, and Gibraltar occupy a similar higher band. The cost premium for the established centres correlates with crypto-supervision experience and broader institutional credibility; Estonia offers a lower-cost MiCA pathway suited to early-stage or cost-sensitive operators. Choose by where the customers and counterparties are: the cost difference is recovered or lost in banking and partnership conversations.
When Gibraltar Is the Right Choice
Choose Gibraltar if...
- You serve UK, Commonwealth, US, or global customers (not predominantly EU retail).
- You need a common-law, English-language regulatory environment with modern crypto case law.
- You operate a custodial business (exchange, custodian, stablecoin issuer) where regulatory depth drives banking and counterparty quality.
- You have £500,000+ of working capital available for Year 1 regulatory and operational build.
Consider alternatives if...
- Your end customers are predominantly EU retail: choose Malta, Cyprus, or Estonia for MiCA passporting.
- Your business is non-custodial or arrangement-only and capital is constrained: Estonia’s MiCA CASP is materially cheaper.
- Your model is early-stage with under €1m of seed capital: BVI or Cayman registration regimes offer faster, lower-cost market entry.
- You require regulatory parity with EU established crypto centres: Cyprus offers MiFID-grade MiCA supervision in English at a broadly comparable cost.
Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.
Common Mistakes in Gibraltar Applications
The GFSC’s published expectations are explicit: bespoke documentation, real Gibraltar substance, and capital adequacy calibrated to activity. The Commission rejects, delays, or withdraws applications where applicants substitute templates for original work or where pre-application engagement was skipped. The mistakes below recur across published enforcement decisions, GFSC supervisory statements, and law-firm commentary on the application pipeline.[18]
- Submitting Stage 1 with an incomplete fit-and-proper package. The five-month assessment clock starts when the GFSC accepts the submission as complete: not when it is filed. Missing regulatory references, unresolved historic regulatory matters, or incomplete CVs trigger formal RFI cycles that add 6–12 weeks before the clock starts.
- Adapting AML/CFT policies from another jurisdiction without proper localisation. MiCA, UK MLR 2017, and BVI VASP-framework adaptations are obvious to the GFSC. The Commission expects POCA 2015 references, GFSC Guidance Note 8 alignment, and Gibraltar Financial Intelligence Unit reporting protocols built into the documentation from the outset.
- Underestimating capital requirements at Stage 1. Principle 3 (adequate financial resources) is risk-based; the GFSC will set initial capital well above the applicant’s preferred figure where activity scope warrants it. The common mistake is presenting a £100,000 capital plan for a full custodial exchange and rebuilding the financial projections during Stage 2 under pressure.
- Treating Gibraltar substance as a paper exercise. Nominee directors, serviced offices, and pure non-executive Gibraltar boards consistently produce slower assessment timelines. Experienced applicants relocate at least one executive director to Gibraltar via HEPSS during Stage 1 rather than at Stage 3.
- Skipping pre-application engagement. The GFSC strongly recommends pre-application meetings; in practice, virtually all successful applications include one. The common error is treating pre-application as a formality: well-prepared applicants use the meeting to confirm permission scope, fee category, and the specific Guidance Notes the Commission will apply to their model.
Frequently Asked Questions
Gibraltar is a strong choice for serious, well-capitalised crypto firms that want bank-grade supervision, common-law certainty, and FATF-whitelist status. It is the right jurisdiction for custodial exchanges, custodians, stablecoin issuers, and tokenisation platforms targeting UK, Commonwealth, US, and global markets. Gibraltar is less suited to early-stage projects seeking the lightest-touch registration regime: regulatory cost, substance requirements, and supervisory engagement are materially higher than BVI, Cayman, or Isle of Man registration regimes. The principles-based framework rewards careful preparation and penalises template-based applications. As of , the GFSC is processing record application volumes.
Any Gibraltar-incorporated private company limited by shares whose business model falls within the regulated activity definition: storing or transmitting value belonging to others using distributed ledger technology, or (from ) providing virtual asset arrangement services. The directors, senior managers, controllers, qualifying shareholders, and ultimate beneficial owners must pass the GFSC fit-and-proper test. There is no nationality restriction on directors or shareholders, no minimum local ownership, and no requirement that the parent group be Gibraltar-domiciled. Around 13 firms hold DLT licences as of early 2026, including international groups headquartered in Israel, the United States, Hong Kong, and the United Kingdom.
The DLT Provider Licence covers custodial activity: storing or transmitting value belonging to others using distributed ledger technology. The Virtual Asset Arrangement Provider Licence, introduced on , covers non-custodial activity: arranging the exchange of virtual assets for fiat or other virtual assets without taking custody at any point. A full custodial exchange typically needs the DLT licence; a non-custodial swap service or a broker-style platform typically needs the VAA licence; some business models need both. The GFSC’s updated Scope Guidance Note (October 2025) sets out the distinction in detail.
Not for issuance. Gibraltar’s DLT Provider licence covers storing or transmitting value belonging to others; a token that is a security falls under Gibraltar’s general financial-services regulation (such as the rules for collective investment schemes or MiFID-equivalent activities), not the DLT framework itself. Where the vehicle is a fund, route via fund licensing.
Realistic total project timeline is 9 to 12 months from initial engagement to issued licence. The GFSC’s published nine-month maximum applies from complete Stage 1 submission across Stages 1 to 3; pre-application engagement and Stage 1 document preparation typically add 4 to 8 weeks before the regulatory clock starts. Optional Mobilisation Stage 4 adds up to 12 months for new-build operations where systems and staffing cannot be fully proven until live transactions occur. Applicants with mature operational infrastructure from other jurisdictions often skip Mobilisation. The GFSC closes incomplete applications after 12 months of inactivity.
No. Gibraltar’s framework requires mind and management from Gibraltar, which is interpreted as substantive local presence: a Gibraltar office, market practice of at least two Gibraltar-resident directors, and a Gibraltar-based MLRO and Compliance Officer (or outsourced equivalent meeting the GFSC’s outsourcing standards). Board meetings are physically held in Gibraltar. The HEPSS and Category 2 personal-tax statuses are designed to make senior relocation viable. Applications relying on nominee directors and pure non-executive Gibraltar boards consistently face slower assessment timelines and may be challenged at Stage 2 on Principle 6 grounds.
Pre-application engagement is not formally mandatory, but in practice virtually every successful applicant engages the GFSC’s DLT supervisory team before formal submission. The pre-application meeting confirms whether the DLT or VAA permission applies (or both), agrees the GFSC fee category, identifies documentation gaps, and signals the supervisor’s expectations on capital adequacy and substance. Skipping pre-application engagement typically extends the formal assessment timeline by 4 to 8 weeks because the regulator must clarify scope and fee category in the Stage 1 request-for-information process rather than in advance.
There is no fixed statutory minimum capital. The GFSC sets initial capital on a risk-based basis under Principle 3 (adequate financial resources) during Stage 1 and Stage 2 assessment. Market practice ranges from £100,000–£250,000 for low-complexity firms (limited-scope custody, low transaction volumes) to £1 million or more for full custodial exchanges. The GFSC takes activity scope, projected transaction volumes, custody architecture, and wind-down cost reserves into account when setting the figure. Applicants are typically asked to revise upward from their proposed capital plan during Stage 2; experienced applicants build a Stage 1 capital plan with documented headroom.
Realistic Year 1 total cost is £250,000–£800,000+ before regulatory capital, depending on activity scope and complexity. GFSC fees account for £16,000–£60,000+ of this. The largest cost components are legal advisory (£60,000–£180,000), compliance documentation (£80,000–£180,000), and the Compliance Officer/MLRO function (£60,000–£180,000). Annual ongoing costs from Year 2 onwards typically run £190,000–£500,000+. These figures exclude regulatory capital, which is set by the GFSC on a risk-based basis and held separately. Total project economics work for serious operators with £1 million+ of working capital available at outset.
No. FATF removed Gibraltar from its increased-monitoring list on following completion of the action plan agreed in June 2022. MONEYVAL terminated enhanced follow-up procedure in May 2024, rating Gibraltar Compliant on 23 of the 40 FATF Recommendations and Largely Compliant on the remaining 17, with no Non-Compliant ratings, one of only 11 jurisdictions globally with that profile. The European Commission removed Gibraltar from its high-risk third-countries list on . Gibraltar’s current AML/CFT standing is a banking and counterparty advantage rather than a drag.
Workable but demanding. Locally-licensed Gibraltar credit institutions number in single digits; operating account onboarding requires the full compliance package and GFSC supervisory acceptance. Realistic timeline 4 to 12 weeks for primary banking, with multi-institution architecture (Gibraltar operating plus EU-domiciled EMI plus crypto-friendly payment institutions) typical for full-service operations. The real constraint is correspondent banking capacity for crypto activity: Gibraltar banks rely on UK and EU correspondents who set their own crypto risk appetite. Experienced applicants begin banking applications in parallel with the GFSC submission, not after authorisation.
A Gibraltar DLT or VAA licence does not grant EU market access or passporting rights. Gibraltar is non-EU post-Brexit and MiCA does not apply. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative, but ESMA’s guidelines (applicable from ) interpret this very narrowly: any form of EU-targeted marketing, EU-language website content, geo-targeted advertising, app store availability, or use of EU-based influencers voids the exemption. Operators seeking systematic EU market access should obtain a separate CASP authorisation in an EU member state. See Reverse Solicitation Under MiCA for full detail.
Audited annual financial statements (deadline 9 months from financial year-end), annual return covering activity, customer numbers, transaction volumes, regulatory capital position, and material incidents. Compliance Officer’s annual report to the board with a copy submitted to the GFSC where retail customers are served. Continuous reporting via the GFSC Digital Portal, including event-driven notifications of material change under Section 83A of the FSA 2019: change of control, senior staff changes, business-model evolution, IT infrastructure changes. Travel Rule submissions and SAR/STR reporting to the Gibraltar Financial Intelligence Unit on a per-transaction or per-event basis. Plan for £190,000+ in annual ongoing compliance cost.
Gibraltar Company Formation
Gibraltar private company limited by shares formation, registered office, and substance. Prerequisite to DLT licensing.
Crypto Business Banking
90+ banking partners across Europe, the UK, and offshore. Operating, treasury, and crypto-fiat settlement rails for Gibraltar-licensed firms.
VASP, CASP and MiCA Licensing Overview
How VASP, CASP, and MiCA fit together across jurisdictions, with a complete map of every regulated crypto-asset service.
Start Your Gibraltar DLT Provider Application
Jagelski & Partners coordinates the entire Gibraltar DLT and VAAP licensing process: from Gibraltar private company formation through GFSC authorisation and banking. One engagement, one point of contact.
Not ready to book? Ask Emma first. She answers now, and if it needs a human she takes your details so the consultation starts ahead.
References
Show all references
- Gibraltar Laws, Financial Services (DLT Providers and VAA Providers) Regulations 2020 (LN 2020/012), gibraltarlaws.gov.gi, accessed .
- Gibraltar Laws, Financial Services Act 2019 (Act 2019-26), gibraltarlaws.gov.gi, accessed .
- PwC Tax Summaries, Gibraltar: Corporate Taxes on Corporate Income, taxsummaries.pwc.com, accessed .
- EY Tax Alert, Gibraltar Issues Budget 2024 Including Corporate Tax Increases, ey.com, accessed .
- Hassans International Law Firm, DLT Regulation in Gibraltar: The Ten Principles, gibraltarlaw.com, accessed .
- HM Government of Gibraltar, Press Release 631/2020: Gibraltar Regulator Refreshes Jurisdiction’s DLT Regulation, gibraltar.gov.gi, accessed .
- Gibraltar Laws, Financial Services (DLT Providers) (Amendment) Regulations 2025 (LN 2025/040), gibraltarlaws.gov.gi, accessed .
- Triay Lawyers, Summary of the Financial Services (Regulated Activities) (Amendment) Regulations 2025, triay.com, accessed .
- Gibraltar Financial Services Commission, Guidance Note: Scope of the DLT Framework, fsc.gi, accessed .
- The Sovereign Group, European Commission Removes Gibraltar from High-Risk List, sovereigngroup.com, accessed .
- Gibraltar Financial Services Commission, DLT Providers: Application Process, fsc.gi, accessed .
- HM Government of Gibraltar, Press Release 220/2024: Insurer and DLT Tax Bill Passed in Parliament, gibraltar.gov.gi, accessed .
- FATF, Jurisdictions under Increased Monitoring: 23 February 2024, fatf-gafi.org, accessed .
- Council of Europe MONEYVAL, Gibraltar Improves Compliance with International Agreements on Money Laundering and Terrorist Financing, coe.int, accessed .
- Gibraltar Financial Services Commission, Staged Application for Authorisation Process, fsc.gi, accessed .
- Hassans International Law Firm, Gibraltar Regulatory Update: Virtual Asset Arrangements Now Fall Under the Financial Services Act, gibraltarlaw.com, accessed .
- Hassans International Law Firm, Amendments to Gibraltar’s Corporate Tax, gibraltarlaw.com, accessed .
- Gibraltar Financial Services Commission, DLT Providers: Authorisation Requirements, fsc.gi, accessed .
- Triay Lawyers, DLT Proposal: Fees, Principles, Timeline, triay.com, accessed .
- Gibraltar Financial Services Commission, DLT Provider Guidance Notes: Financial Crime (Guidance Note 8), fsc.gi, accessed .
- Hassans International Law Firm, The GFSC’s Consultation of its Revised AML/CFT/CPF Guidance Notes, gibraltarlaw.com, accessed .
- HM Government of Gibraltar, Press Release 753/2023: Gibraltar’s Strategic Initiative: Transforming Financial Authorisation Processes for Speed and Efficiency at the GFSC, gibraltar.gov.gi, accessed .
- Global Legal Insights, Blockchain and Cryptocurrency Laws 2026: Gibraltar, globallegalinsights.com, accessed .
- HM Government of Gibraltar, Press Release 112/2023: Changes to the GFSC’s Annual Regulatory Fees, gibraltar.gov.gi, accessed .
- HM Government of Gibraltar, Global Minimum Tax Act 2024, gibraltarlaws.gov.gi, accessed .
- PwC Tax Summaries, Gibraltar: Individual Other Tax Credits and Incentives (HEPSS, Cat 2), taxsummaries.pwc.com, accessed .
- Century 21 Gibraltar, Category 2 Gibraltar (HEPSS): Tax, Requirements and 2026 Guide, century21gibraltar.com, accessed .
- Gibraltar Financial Services Commission, Regulatory Settlement Agreement between the GFSC and TAP Global Limited, fsc.gi, accessed .
- FATF GAFI, Anti-money Laundering and Counter-Terrorist Financing Measures: Gibraltar Follow-Up Report 2024, fatf-gafi.org, accessed .
- Ramparts, The Gibraltar Authorisation Regime (GAR) and UK Market Access, ramparts.gi, accessed .