Gibraltar Crypto License: Cost & Process 2026

Gibraltar's Financial Services (Distributed Ledger Technology Providers) Regulations 2017 came into force on 1 January 2018, creating the regulated category “DLT Provider” for businesses using blockchain or similar distributed ledgers to store or transmit value. The Financial Services Act 2019 later consolidated the DLT framework into Gibraltar's broader financial services statute. A DLT Provider licence is now one of the controlled activities listed in Schedule 2 of the Act.

Key structural features:

• Controlled activity — operating a DLT business without a licence is a criminal offence carrying up to 2 years' imprisonment or an unlimited fine
• Ongoing supervision — quarterly regulatory returns and GFSC inspections, not just a one-time approval
• No prescriptive minimum capital floor — capital requirements are set individually based on your business model and risk profile
• Technology-neutral scope — covers any DLT-based asset without needing legislative updates as new protocols emerge

October 2025 Update: Virtual Asset Arrangement Providers (VAAPs)

On 27 October 2025, the DLT framework was expanded to include a new regulated activity: providing virtual asset arrangements. Businesses that facilitate or arrange transactions in virtual assets on behalf of third parties — without themselves taking custody or executing trades — now fall within the GFSC's licensing perimeter. If your platform connects buyers and sellers, routes orders to exchanges, or provides introducer services for crypto transactions, you may need to assess whether this new category applies to you.

Upcoming Legislation (2026)

At Consensus Hong Kong in February 2026, Gibraltar's Minister for Digital and Financial Services Nigel Feetham announced that draft legislation to further update the DLT regulatory framework would be published “within the next few months.” The expected reforms aim to keep Gibraltar's regime competitive as MiCA takes effect across the EU. Applicants beginning the licensing process in mid-2026 should factor in potential regulatory changes before their authorisation completes.

The GFSC regulates DLT Providers against 10 regulatory principles rather than a prescriptive rulebook. You demonstrate ongoing compliance with each principle; the GFSC assesses how, not just whether. The principles cover honesty and integrity, customer care, financial resources, risk management, client asset protection, corporate governance, cyber security, financial crime prevention, resilience, and market integrity.

This structure gives compliant operators flexibility. A custody-only firm structures its controls differently from a spot exchange, while the GFSC retains broad supervisory authority. In practice the GFSC expects a written compliance manual mapped to each principle, reviewed and signed off by senior management at least annually.

Several well-known firms hold Gibraltar DLT Provider licences:

• eToroX Limited (eToro's crypto subsidiary; parent company has 40M+ registered users, Nasdaq-listed since May 2025) holds a Gibraltar DLT Provider licence for crypto operations
• LMAX Digital offers institutional exchange and custody to prime brokers and banks
• Xapo, now Xapo Bank, evolved from cold-storage vault services into a full Gibraltar-regulated bank
• Bitso uses its Gibraltar licence to operate outside its core Latin American markets
• Bullish (acquired by the Bullish group in 2025) operates under the GFSC's Digital Clearing and Settlement Framework, providing institutional-grade exchange and settlement services
• Currency.com runs a tokenised securities exchange under GFSC authorisation

Banks, payment processors, and institutional counterparties accept the GFSC credential where they reject licences from lesser-known registries. That institutional recognition is one reason firms choose Gibraltar over the Cayman Islands, BVI, or unregulated jurisdictions.

You can verify current licensed entities directly on the GFSC's regulated entities search.

The GFSC divides DLT Provider licenses into three categories based on the scale and nature of the activity. The category determines your one-time application fee and, in practice, the scrutiny level applied during the application review.

• Category 1 — GBP 10,000 application fee — Covers lower-risk DLT activities, typically smaller operators or businesses with a narrower scope of service (for example, a single-asset custody platform or a token-based loyalty scheme with limited value throughput).
• Category 2 — GBP 20,000 application fee — Applies to mid-range operators: centralised exchanges handling multiple assets, DeFi-adjacent platforms, or businesses with a broader permitted-activities list.
• Category 3 — GBP 30,000 application fee — Reserved for higher-risk or higher-volume operations, including firms with significant client asset exposure, complex custody arrangements, or systemically material transaction volumes.

All three categories share the same initial assessment fee of GBP 2,000, payable when the Stage 1 application is submitted. The category-based application fee is payable as the application progresses. Annual supervision fees follow a different structure (see Cost section below).

The GFSC assigns your category during the review process based on your application and financial projections. You cannot self-select a lower category to reduce fees. The full 3-stage process takes up to 9 months.

Lending, borrowing, and staking do not have a separate license category. These activities can be included in a DLT Provider application, but the regulatory treatment lacks specific guidance from the GFSC. If your business model includes yield-generating products or staking-as-a-service, you should flag this at the pre-application meeting so the GFSC can clarify how they will assess it before you invest time in a full application.

The Proceeds of Crime Act 2015 (Relevant Financial Business)(Registration) Regulations 2021 requires certain virtual asset service providers to register with the GFSC. VASP registration is an AML-focused regime. It does not grant the same “regulated financial service” status as a DLT license, but it is legally mandatory for businesses carrying out qualifying activities.

The registration fee is not publicly listed — contact the GFSC's AML/CFT team for the current amount. Processing typically takes 2–4 months (around 3 months on average according to Gibraltar law firms), making it the fastest route to legal operation in Gibraltar. Approval rates are high for well-prepared applicants, though the GFSC does not publish official statistics.

VASP registration covers fiat-to-crypto exchange, crypto-to-crypto exchange, virtual asset transfers, and participation in token issuance or sale. Note: custody and administration of virtual assets typically requires the DLT Provider licence rather than VASP registration alone.

Gibraltar allows crypto-focused investment funds under two structures.

• Experienced Investor Fund (EIF) — Regulated under the Financial Services (Experienced Investor Funds) Regulations. Investors must qualify as “experienced” via one of several paths: EUR 100,000 minimum investment, net worth exceeding EUR 1,000,000 (excluding principal residence), investment professional status, or EUR 50,000 if professionally advised. Suitable for managers running a multi-asset crypto portfolio or a token fund targeting institutional and high-net-worth participants. The fund vehicle itself must appoint a GFSC-authorised manager or obtain its own authorisation.
• Private Fund — Lighter-touch structure available to funds with no more than 50 investors and no public marketing. Often used for family offices or small syndicates investing in digital assets or early-stage token projects. Regulatory costs and disclosure requirements are lower than for an EIF.

If your business model involves raising capital from investors to deploy into crypto markets, rather than providing services to external clients, a Gibraltar fund structure may be more appropriate than a DLT Provider license. The two are not mutually exclusive: a fund manager can hold a DLT license if it also provides third-party DLT-based asset management.

Both routes are issued by the GFSC. The table below covers their practical differences to help you identify which path fits your business model.

Neither route offers EU passporting. If EU market access is a priority, the standard approach is a dual-jurisdiction strategy: operate under the Gibraltar DLT license for non-EU markets while obtaining a separate MiCA-compliant authorisation (for example, in Lithuania, Malta, or Ireland) for EU customers.

The GFSC charges an initial application assessment fee of £2,000 when you submit your Stage 1 pack. The full DLT Provider application fee ranges from £10,000 (Category 1) to £30,000 (Category 3) depending on the complexity of your proposal, payable as the application progresses. Neither fee is refunded if the application is declined.

Annual supervision fees use a component-based methodology under the Financial Services (Fees) Regulations 2020 (as amended in 2023). The total depends on your trade volume and complexity of supervision:

Total annual supervision cost: approximately £14,330 (minimum) to £97,000+ (for high-volume exchanges). The GFSC can also impose an intensive supervision fee of +40% if your firm is placed under enhanced oversight.

For businesses that also need VASP registration under Gibraltar’s AML framework, there is a separate registration fee (contact the GFSC’s AML/CFT team for current fees). Most crypto exchanges and custodians require both: the DLT licence covers your principal activity authorisation; VASP registration places the firm under GFSC’s AML/CFT/CPF supervision regime under POCA 2015, in line with FATF Recommendations (including the Travel Rule, in effect since 22 March 2021). Budget for both from day one.

Legal and compliance work is the largest cost category. The range depends on your business model complexity and how polished your documentation is when you engage a firm.

If you engage an in-house MLRO rather than an outsourced one, factor in a full-time salary. A qualified MLRO in Gibraltar commands £65,000 – £100,000+ per year in total employment cost (gross salary plus employer National Insurance at ~18%), with experienced DLT/crypto specialists at the upper end. For early-stage operators, outsourcing is common until transaction volumes justify the headcount.

A Gibraltar DLT licence is granted to a Gibraltar-incorporated entity. You cannot hold the licence through an offshore holding company. This means you need a live Gibraltar company before you apply.

Gibraltar does not set a fixed minimum share capital for DLT Providers. The GFSC assesses financial resource requirements individually under Principle 3 (Resources), based on your business model and risk profile. Expect the regulator to set a capital adequacy threshold during authorisation, with the amount varying by whether you operate a custody platform, exchange, or transmission service.

Physical presence in Gibraltar is expected rather than optional. The GFSC scrutinises where your senior management actually sits and where decisions are genuinely made. A virtual office does not satisfy substance requirements.

The spread below depends on whether you outsource your MLRO, your business model complexity, and office space requirements.

Once licensed, annual costs include supervision fees, compliance staff, audit, and office running costs. These do not decrease in year two. Growing transaction volumes trigger additional GFSC reporting obligations.

The GFSC’s active supervision model means you cannot let compliance slip. Companies that budget £90,000–£250,000 per year from the outset sustain their licence without issue; those that underestimate ongoing costs face licence conditions or surrender within two years.

Your business must be incorporated in Gibraltar as a private limited company under the Companies House Gibraltar framework. A branch of a foreign company does not qualify; the licensed entity itself must be Gibraltar-registered.

A physical office in Gibraltar is mandatory. The GFSC will verify that the business has genuine substance in the jurisdiction: local staff, a working address, and operational infrastructure. Directors do not all need to be Gibraltar residents, but at least one director must demonstrate meaningful involvement in the Gibraltar operation. The GFSC applies a “mind and management” test during its fit-and-proper assessment, so a purely nominal directorship will not pass.

The company's governing documents (memorandum and articles of association, shareholder register, and group structure chart) must be submitted with the application. If your group includes entities in other jurisdictions, you must disclose the full ownership chain to the ultimate beneficial owner (UBO), with certified identification for any person holding 25% or more of shares or voting rights, or exercising significant control by other means (per the Register of UBOs, Nominators and Appointors Regulations 2017).

Two roles are non-negotiable for every Gibraltar DLT application:

• Money Laundering Reporting Officer (MLRO) — must be GFSC-approved and demonstrate Gibraltar-specific knowledge of POCA. The GFSC generally expects a Gibraltar-resident MLRO for DLT Providers given substance requirements; however, outsourcing to an EEA-based MLRO is permitted under specific conditions in line with the GFSC's Outsourcing Guidance Note. In practice, Gibraltar residence is strongly preferred. The MLRO is responsible for internal suspicious activity reporting, staff AML training, and direct liaison with the Gibraltar Financial Intelligence Unit (GFIU). The GFSC will interview shortlisted candidates and assess their AML/CFT knowledge directly.
• Compliance Officer — responsible for day-to-day regulatory compliance, policy maintenance, and reporting obligations to the GFSC. In smaller firms, the MLRO and Compliance Officer roles may be held by the same person, provided that individual has the capacity and relevant experience to cover both functions adequately.

All principal persons (directors, senior managers, the MLRO, and significant shareholders) undergo individual fit-and-proper assessments. This includes criminal record checks, credit checks, and a review of any prior regulatory sanctions. CVs must demonstrate direct experience in financial services or the specific DLT activity the company intends to carry out.

Gibraltar does not prescribe a fixed minimum share capital for DLT Provider applicants. The GFSC sets financial resource requirements individually based on your business model, scale, and risk profile under Regulatory Principle 3. In practice, expect unencumbered capital in the range of £50,000–£100,000 for typical small-to-medium operators; large custody platforms or exchanges may be required to hold significantly more.

You must demonstrate sufficient capital to ensure an orderly, solvent wind-down of the business (including realistic costs and time required for customers to find alternative service providers), plus adequate working capital for ongoing operations as projected in your business plan. The GFSC also requires DLT Providers to conduct an external audit at least annually. A custody platform will face higher capital expectations than a pure-play advisory firm.

For businesses handling client assets (custody or exchange services), additional financial safeguards such as client money segregation will be required as a licence condition.

Gibraltar's anti-money laundering legislation applies fully to DLT Providers. Your AML/KYC framework must be fully documented and operational before you submit your application. The GFSC does not license businesses on the basis that compliance will be built after approval.

Your submission must include:

• AML/CFT Policy — covering risk appetite, customer risk classification, and escalation procedures
• Customer Due Diligence (CDD) procedures — including Enhanced Due Diligence (EDD) triggers for higher-risk customers, politically exposed persons (PEPs), and customers from high-risk jurisdictions
• Transaction monitoring procedures — specifying how on-chain and off-chain transactions are screened, flagged, and investigated
• Sanctions screening — real-time or near-real-time screening against OFAC, UN, EU, and UK HMT lists
• Record-keeping policy — Gibraltar requires AML records to be retained for a minimum of five years
• Staff training programme — with documented training schedules and completion records

The GFSC will assess the quality of these documents during its review. Boilerplate policies copied from other jurisdictions often fail this assessment. Procedures must reflect Gibraltar's specific legislative framework and your actual business model.

Regulatory Principle 7 (Cyber Security) requires DLT Providers to “ensure that all systems and security access protocols are maintained to appropriate high standards.” Your application must describe your technical architecture and demonstrate that appropriate security controls are in place.

Key areas the GFSC reviews include:

• Cybersecurity policy — covering access controls, intrusion detection, incident response, and penetration testing schedules
• Private key management — for custody operations, you must document cold/hot wallet segregation, multi-signature procedures, and key recovery processes
• Business continuity and disaster recovery — documented plans with tested recovery time objectives
• Outsourcing and third-party risk — if core functions are outsourced, the GFSC expects third-party due diligence and ongoing oversight controls

Data protection is a parallel obligation. Gibraltar's data protection regime consists of the Gibraltar GDPR (in force since 1 January 2021, replacing direct EU GDPR application post-Brexit) and the Data Protection Act 2004, which together maintain GDPR-equivalent obligations on controllers and processors. DLT Providers must comply with standard GDPR-equivalent obligations, including 72-hour breach notification to the Gibraltar Regulatory Authority (GRA), which acts as the Information Commissioner.

Not every crypto business needs a full DLT Provider licence. The VASP registration track applies to firms whose activities are limited to virtual asset transfers and exchange without holding client funds. Registration requires no Stage 1–3 sequencing, no minimum capital, and typically closes in 2–4 months from submission.

• Eligible activities — Exchange of virtual assets (crypto-to-crypto, crypto-to-fiat, fiat-to-crypto) and virtual asset transfer services where the operator does not take control of crypto-assets belonging to others as part of the service provision. Firms that take such control typically need a full DLT Provider licence.
• AML requirements still apply — VASP registrants must maintain a GFSC-approved MLRO (Gibraltar-resident strongly preferred; EEA-based permitted under specific outsourcing conditions), implement AML/KYC procedures, and file Suspicious Activity Reports (SARs) with the Gibraltar Financial Intelligence Unit.
• Limitations — Neither VASP registration nor the DLT Provider licence grants passporting rights into the EU or EEA, since Gibraltar exited the EU on 31 January 2020. Firms targeting European markets must obtain a separate MiCA licence in an EU member state. The Gibraltar DLT licence may support a smoother MiCA application given Gibraltar's regulatory reputation.
• Upgrade path — A registered VASP can apply for a DLT Provider licence at any point. Existing registrants benefit from a known AML track record already on file with the GFSC, which can streamline the application process.

1. Honesty and integrity — All persons who direct or manage the business must conduct themselves with honesty and integrity. The GFSC carries out detailed due diligence on beneficial owners, directors, and key function holders. Criminal records, regulatory sanctions, and undisclosed conflicts of interest are each grounds for refusal.
2. Customer care — Pay due regard to customer interests and communicate clearly without misleading. Covers onboarding disclosures, fee transparency, complaint handling, and marketing materials.
3. Financial resources — The firm must maintain adequate financial resources at all times. Gibraltar does not prescribe a single minimum capital figure for all DLT businesses; the GFSC sizes the requirement to the risk profile of each applicant. You must demonstrate that your resources cover operating expenses, wind-down costs, and any client liabilities.
4. Risk management — Submit a written risk framework covering market, credit, operational, liquidity, and cyber risk. The GFSC expects documented policies, not generic templates.
5. Protection of client assets — Segregated custody, clear record-keeping, and procedures preventing commingling of client funds or crypto with proprietary assets.
6. Corporate governance — Board with documented oversight, clear lines of responsibility, and named accountability for compliance, risk, and finance functions.
7. Cyber security — All systems and access protocols maintained to high standards: penetration testing, disaster recovery, business continuity, and secure access controls for platforms handling customer data or digital assets.
8. Financial crime prevention — Full AML/CFT framework mandatory before the GFSC issues a licence: risk-based CDD, transaction monitoring, SAR procedures, and a named MLRO.
9. Resilience — Demonstrate that staffing, operational capacity, and technology infrastructure can handle the volume and complexity described in your application.
10. Market integrity — Added in 2022. Requires measures to prevent market manipulation, insider trading, and conduct that could improperly influence prices or liquidity. Disclosure and trading standards must match the scope of your activities.

Gibraltar's corporate income tax rate is 15%, applied under the Income Tax Act 2010 (increased from 12.5% effective 1 July 2024). The rate applies to profits that qualify as accruing in or derived from Gibraltar. Income from a business whose activity requires a licence under any Gibraltar law, including a DLT Provider licence, is deemed to accrue in and derive from Gibraltar—except for activities carried on outside Gibraltar by a foreign branch or permanent establishment.

There is no minimum tax for ordinary corporate taxpayers (note: the Global Minimum Tax Act 2024 introduces a 15% Domestic Minimum Top-up Tax for multinational groups with consolidated revenue exceeding €750 million). There is no branch profits tax and no withholding tax on payments to non-residents. You file an annual corporate tax return with the Gibraltar Income Tax Office. Gibraltar does not form part of the EU VAT area, so EU VAT directives do not apply, and post-Brexit you are not subject to EU state-aid rules that could complicate your tax position.

Loss restriction for regulated sectors: DLT Providers licensed under the Financial Services Act 2019 may only offset up to 50% of their taxable profits in any accounting period using losses brought forward. The remaining 50% is fully taxable for that year. Factor this into your startup-phase tax planning if you expect to accumulate losses in early years.

Anti-avoidance: The Income Tax (Amendment) Act 2025 introduced a General Anti-Avoidance Rule (GAAR) empowering the Commissioner of Income Tax to dismiss or modify the effects of arrangements deemed to constitute tax avoidance.

Three major taxes simply do not exist in Gibraltar:

• Capital gains tax — generally none. When your company disposes of crypto assets or shares at a profit, no capital gains charge arises. (Note: from 1 January 2025, profits from the sale of property may be taxable for entities holding five or more properties—this exception does not affect typical DLT operations.)
• VAT — Gibraltar has no value-added tax. You do not charge VAT on your services. You also cannot reclaim input tax on purchases.
• Dividend withholding tax — there is no withholding tax system on dividend distributions. Non-resident shareholders receive dividends free of Gibraltar tax. Gibraltar ordinarily-resident individual shareholders may have a tax liability on dividends declared in their personal income tax return. There is also no stamp duty on the transfer of shares in most circumstances.

This combination means your effective post-tax, post-distribution rate is limited to the 15% corporate charge on taxable profit. No further layer of tax erodes the distribution when it reaches shareholders.

If you hire staff in Gibraltar or relocate founders there, you pay social insurance contributions as a percentage of gross earnings. Employees contribute 10% of gross earnings and employers contribute 18%, subject to minimum and maximum annual thresholds set by the Gibraltar Income Tax Office. For the 2025/2026 tax year, the employee minimum annual contribution is approximately £745, with a maximum cap that limits the charge for higher earners.

The combined employer–employee rate is 28% of gross earnings, subject to separate annual minimum and maximum caps for each side. Self-employed individuals pay their own contributions at 20% of gross earnings, within annual limits published by the Income Tax Office.

Gibraltar's treaty network is limited, but the most commercially significant agreement is in place: the UK–Gibraltar Double Taxation Agreement prevents the same income being taxed twice in both territories. For crypto businesses with UK operations, UK-resident shareholders, or founders who previously paid UK tax, the DTA provides relief mechanisms and defines which territory has primary taxing rights.

Beyond the UK DTA, Gibraltar relies on domestic unilateral relief provisions rather than an extensive bilateral treaty network. If your shareholder base or operational footprint spans multiple jurisdictions, you need to assess treaty exposure jurisdiction by jurisdiction. Limited treaty coverage is a trade-off, partly offset by the 15% headline rate, which leaves less tax for a second jurisdiction to dispute.

Gibraltar offers two structured residency schemes that cap personal income tax for founders who physically relocate. Both are administered by the Gibraltar Finance Centre and require genuine residence.

• Category 2 (HNW) — designed for individuals with net assets exceeding £2 million. You pay Gibraltar tax on a maximum of the first £118,000 of assessable income (threshold reviewed annually), regardless of total worldwide income. Minimum tax: £37,000; maximum: £42,380. A refundable deposit of £42,380 is payable on application. You must occupy an approved residential property and must not engage in trade, business, or employment in Gibraltar without the prior approval of the Finance Centre Director. Directorships of Gibraltar-licensed entities (including DLT Providers) require such approval, since the licensed activity is by definition Gibraltar business. Approval is discretionary, based on benefit to Gibraltar's economic development.
• HEPSS (High Executive Possessing Specialist Skills) — targeted at senior executives employed by Gibraltar-based businesses who possess specialist skills not readily available locally. HEPSS caps the individual's Gibraltar income tax at a fixed ceiling, with only £160,000 of employment income exposed to Gibraltar tax regardless of salary (annual liability: £39,940 at current rates). HEPSS requires the employer company to sponsor the application and demonstrate the specialist nature of the role. Note: founders rarely qualify directly under HEPSS—the more common path for high-net-worth founders is Category 2. HEPSS may apply if the founder takes a formally specialist role with a minimum £160,000 salary and obtains Finance Centre Director approval.

Cat 2 does not impose a statutory minimum presence requirement in Gibraltar, but applicants should ensure they do not become tax-resident in another jurisdiction (e.g., by exceeding 183 days elsewhere). HEPSS requires genuine employment in Gibraltar with year-round exclusive accommodation. UK founders in particular should take advice on the statutory residence test and the UK–Gibraltar DTA before assuming that a move to Gibraltar terminates UK tax liability.

Cost estimates reflect government and statutory fees only; professional (legal and consulting) fees are additional in every jurisdiction.

A Gibraltar DLT licence authorises you to operate from Gibraltar and serve non-EU clients. It does not give you the right to market or provide services to customers domiciled in EU member states under a regulatory passport.

Operators targeting EU residents have two realistic paths:

• Dual-jurisdiction strategy — Obtain the Gibraltar DLT licence for global operations and a MiCA CASP authorisation (through a Cyprus, Malta, or Estonian entity, for example) for EU market access. The Gibraltar entity can serve as the group's operational hub; the MiCA entity handles EU-facing business. This adds cost but gives you the cleanest legal structure.
• Reverse solicitation — Under MiCA Article 61, EU residents may approach a third-country firm on their own initiative, without that firm holding a CASP passport. However, the rules are narrow: the exemption covers only services requested by the client and does not permit the firm to solicit EU business, run EU-targeted advertising, or expand the scope of services beyond what the client requested. Regulators in France and Germany have already indicated they will read this exemption strictly. Relying on reverse solicitation as a primary EU strategy carries material legal risk.

For operators whose clients are primarily in Asia, Latin America, or the Middle East, Gibraltar's 15% corporate tax, principles-based framework, and shorter timeline relative to Malta or a full MiCA authorisation make it a practical standalone option. The choice between Gibraltar and MiCA comes down to where your customers are.

• Principles-based regulation — The GFSC regulates DLT providers against ten core principles rather than a prescriptive rulebook. You design your own compliance architecture instead of fitting every process into a rigid checklist, which gives more room for novel asset classes or hybrid products.
• Favorable tax regime — You pay 15% corporate tax with no capital gains tax, no inheritance tax, and no VAT. For a crypto business with high trading or settlement volume, the gap versus EU high-tax jurisdictions (where effective rates reach 25–30%) compounds from year one.
• Fast VASP track — VASP registration typically closes in 2–4 months. A full DLT Provider licence takes 6–9 months for well-prepared applicants under the GFSC's three-stage process.
• Established crypto ecosystem — Gibraltar hosts licensed exchanges, custody providers, and DLT infrastructure firms. You get access to local legal counsel with crypto-specific track records, banks that already onboard token projects, and a regulator familiar with most compliance patterns.
• High jurisdictional reputation — Institutional counterparties, payment processors, and correspondent banks treat the Gibraltar DLT licence as credible. The GFSC holds IOSCO membership and applies FATF AML/CFT standards, which reduces friction when you open banking relationships or enter enterprise partnerships.
• FATF compliance & grey-list removal — Gibraltar was removed from the FATF grey list on 23 February 2024 after demonstrating effective AML/CFT supervision and international cooperation. The EU followed with its own delisting in June 2025. These clearances materially improve the jurisdiction's reputation with correspondent banks, payment processors, and institutional counterparties who previously imposed enhanced due diligence on Gibraltar-linked entities.

• No EU passporting — A Gibraltar DLT licence does not carry MiCA passporting rights. If you need to serve EU retail clients directly, you will require a separate MiCA authorisation from a member state regulator.
• Mandatory physical presence — The GFSC requires a genuine local establishment: a registered office, resident senior management, and demonstrable operational substance on the ground. A brass-plate arrangement will not pass review. Factor in the cost of office space, local directors, and compliance staff when modelling total operating costs.
• Selective approval process — The GFSC rejects or requires remediation of many applications. Common failure points: inadequate AML/CFT frameworks, insufficient financial resources, or a management team that cannot demonstrate relevant experience.
• Small domestic market — Gibraltar has approximately 38,000 residents (2022 Census: 37,936). The licence works as a base for international operations, not as access to a local customer base.
• Higher operational costs than Estonia or Caribbean centres — Office rents, professional fees, and substance requirements push costs above lighter-touch jurisdictions. See the cost breakdown for full first-year budget ranges.

The GFSC levies annual supervision fees based on a base fee plus a trading-volume component (as of the 2025/2026 fee year):

The GFSC reserves the right to charge an additional £22,660 where supervision is more complex. An intensive supervision fee of +40% may also apply if your firm is placed under enhanced oversight. Ad hoc charges (e.g., material change notifications) are billed separately. You must also retain a local compliance officer, a statutory requirement, at a typical Gibraltar salary of £65,000–£100,000 per year in total employment cost.

Gibraltar DLT licensees submit quarterly and annual regulatory returns to the GFSC covering financial position, transaction volumes, incident disclosures, and capital adequacy. Key reporting obligations include:

• Quarterly financial returns — balance sheet, P&L, own-funds calculation, and client asset reconciliation filed within 30 days of quarter-end.
• Annual audited accounts — prepared under IFRS or UK GAAP and submitted within four months of financial year-end.
• Material change notifications — any significant change to business model, key personnel, or technology must be pre-approved by the GFSC before implementation.
• Incident and breach reporting — cyber incidents, AML breaches, and significant operational failures must be reported to the GFSC within 24–72 hours depending on severity.

Failure to file on time triggers late-filing fees and can escalate to a formal supervisory review. The GFSC also conducts on-site inspections, typically every 12–24 months for active licensees.

Gibraltar’s AML/CFT regime is based on the Proceeds of Crime Act 2015 (POCA) and supporting regulations, aligned with FATF Recommendations rather than EU directives (Gibraltar left the EU with the UK in January 2020). All DLT providers supervised under the GFSC’s AML/CFT regime must maintain and regularly update their AML/KYC frameworks to reflect revised FATF guidance and domestic regulatory notices.

Gibraltar applies the Travel Rule at a threshold of €1,000 (or equivalent in other currencies). Any crypto-asset transfer at or above this value requires the originating Virtual Asset Service Provider (VASP) to collect, verify, and transmit beneficiary information to the receiving VASP before or alongside the transaction. Specific obligations include:

• Originator data — full name, account number (or wallet address), and physical address or national identity number must accompany outgoing transfers ≥€1,000 (or equivalent).
• Beneficiary screening — incoming transfers must be screened against sanctions lists; unhosted-wallet transfers above threshold require enhanced due diligence.
• Record retention — Travel Rule data must be stored for a minimum of five years and made available to the OFT on request.
• Annual AML risk assessment review — the business-wide risk assessment must be reviewed and updated at least annually, or whenever material changes occur.

VASP-to-VASP Travel Rule compliance requires a technical solution (e.g., integration with a Travel Rule protocol such as TRISA or OpenVASP). Budget for both the software licence and the operational overhead of managing unmatched counterparties.

The GFSC has broad enforcement powers under the Financial Services Act 2019 and the DLT Provider Regulations 2020. The regulator has already publicly censured and fined DLT licensees since the framework launched. The main enforcement tools are:

• Financial penalties — administrative fines scaled to the gravity of the breach, any profit made, and aggravating or mitigating factors under the GFSC’s Sanctioning Guide.
• Public censure — formal public statements naming the firm and the breach, with direct reputational and commercial consequences.
• Licence suspension or revocation — the GFSC can suspend a licence with immediate effect in cases involving consumer risk or AML failure, halting all regulated activity.
• Prohibition orders — key individuals can be barred from holding controlled functions in any Gibraltar-regulated firm.

Criminal prosecution for AML/CFT breaches under the Proceeds of Crime Act remains a possibility alongside GFSC administrative action. The cost of non-compliance (fines, remediation, legal defence) far exceeds the annual cost of running a compliant programme. The most common triggers for enforcement action are inadequate transaction monitoring, failure to file SARs, and late regulatory returns.