LogoRegulatory Alerts

Gibraltar: crypto & digital assets regulation

Regulated

Gibraltar VASP/DLT dual regime: AML registration under 2015 Act and DLT licensing under 2020 Regulations

Lead regulator:
Gibraltar Financial Services Commission (GFSC)
Key law:
Proceeds of Crime Act 2015 and DLT Regulations 2020
Last updated:
2026-07-12

Gibraltar operates a dual regulatory framework for digital assets, overseen by the Gibraltar Financial Services Commission (GFSC). Virtual Asset Service Providers (VASPs) must register under the Proceeds of Crime Act 2015 to comply with anti-money laundering requirements, while Distributed Ledger Technology (DLT) providers require a specific license under the DLT Regulations 2020.

The VASP registration regime applies to firms carrying on business from Gibraltar, focusing on financial crime prevention and customer due diligence. The DLT licensing framework is principles-based, requiring providers to meet strict standards in areas such as corporate governance, cybersecurity, client asset protection, and market integrity.

Recent guidance emphasizes an outcomes-focused approach, mandating robust risk management, adequate resources, and resilience. The regulatory direction of travel supports innovation while maintaining high standards of integrity and consumer protection within the jurisdiction.

Who regulates

  • Gibraltar Financial Services Commission (GFSC)

    Primary supervisor for both VASP registration and DLT licensing

    [1][2][3]

Core laws & rules

  • Proceeds of Crime Act 2015 (2015)

    Establishes the legal basis for AML/CFT obligations, including the 2021 Regulations for the transfer of virtual assets and VASP registration requirements.

    [1][3][4]

  • DLT Regulations 2020 (2020)

    Creates a specific licensing regime for Distributed Ledger Technology providers, imposing requirements on governance, resources, security, and client asset protection.

    [2][5][6]

Licensing & registration

  • VASP Registration

    Mandatory registration for firms carrying on VASP activities from Gibraltar under the Proceeds of Crime Act 2015.

    [3]

  • DLT Provider License

    Licensing required for DLT providers under the 2020 Regulations, covering operational, technical, and organizational standards.

    [2][5]

Restrictions & warnings

  • Strict adherence to AML/CFT standards is required, including customer due diligence and reporting under the Proceeds of Crime Act.

    [4]

  • DLT providers must segregate customer funds and assets, maintain robust cybersecurity, and ensure business continuity.

    [6][7][8]

Direction of travel

  • The regime is outcomes-focused and principles-based, with ongoing guidance updates to address market integrity and operational resilience.

    [2][9]

Sources

  1. Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021 · 2026-06-23
  2. GFSC Guidance Note on the Scope of the DLT Framework · 2026-03-25
  3. VASP Registration Scope Guidance Note · 2022-10-12
  4. DLT Framework — Guidance Note 8 Financial Crime · 2020-09-17
  5. GFSC Guidance Note 4: Risk Management for Distributed Ledger Technology Providers · 2020-02-21
  6. DLT Framework — Guidance Note 5 Protection of Client Assets · 2020-02-21
  7. DLT Framework — Guidance Note 7 Cyber Security · 2020-09-17
  8. DLT Framework — Guidance Note 9 Resilience · 2020-02-21
  9. DLT Framework — Guidance Note 10 Market Integrity · 2022-04-27

Email alerts for Gibraltar updates

New circulars, rules and guidance — a digest in your inbox, same day.

This guide is compiled automatically from 9 primary-source documents published by Gibraltar's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-07-12). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.