Regulatory AlertsGibraltar: crypto & digital assets regulation
RegulatedGibraltar VASP registration via GFSC under Proceeds of Crime Act 2015
- Lead regulator
- Gibraltar Financial Services Commission (GFSC)
- Also involved
- —
- Core law
- Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021
- Entry capital
- —
- Approval timeline
- —
- Customer assets
- Strict segregation and robust protection systems required
- Data protection
- GDPR / Data Protection Act 2018 · Information Commissioner
- Sandbox
- —
Gibraltar operates a principles-based regulatory regime for Distributed Ledger Technology (DLT) and Virtual Asset Service Providers (VASPs), supervised by the GFSC. The framework is anchored in the Proceeds of Crime Act 2015 and its 2021 Transfer of Virtual Assets Regulations. The regime is outcomes-focused, requiring firms to demonstrate compliance with specific regulatory principles rather than adhering to rigid prescriptive rules. The regulatory direction of travel emphasizes robust risk management, market integrity, and strict adherence to anti-money laundering standards.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Exchange / trading platform | LicenceDLT Provider[1][2] Requires DLT Provider registration under Proceeds of Crime Act 2015 | — | — | GFSC |
| Custody of client assets | LicenceDLT Provider[3][2] Must implement strict segregation of customer funds and assets | — | — | GFSC |
| Token issuance / public offering | Uncertainverify with regulator Unclear if token issuance alone triggers VASP registration without service provision | — | — | — |
| Broker-dealer / OTC desk | LicenceDLT Provider[2] Falls under DLT Provider scope if carrying on business from Gibraltar | — | — | GFSC |
| Stablecoin issuance | Uncertainverify with regulator No specific stablecoin regime identified; likely falls under general VASP rules | — | — | — |
| Crypto payments acceptance | LicenceDLT Provider[4][2] Virtual asset transfers are regulated under Proceeds of Crime Act 2015 | — | — | GFSC |
| Mining / staking services | Uncertainverify with regulator Mining/staking not explicitly defined as VASP activity in provided texts | — | — | — |
| Advisory / portfolio management | Uncertainverify with regulator Advisory services not explicitly listed as regulated VASP activity | — | — | — |
New — what changed recently
- 2021-03-22Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021 — Established the current regulatory framework for virtual asset transfers and VASP registration.[4]
Market-entry checklist
- 1Register as DLT Provider with GFSCSubmit application under Proceeds of Crime Act 2015 if carrying on business from Gibraltar.
- 2Implement AML/CFT ComplianceAdhere to Proceeds of Crime Act 2015 and GFSC Guidance Note 8 on financial crime prevention.
- 3Establish Corporate GovernanceEnsure board independence and effective structures per Guidance Note 6.
- 4Secure Client AssetsImplement strict segregation of customer funds and robust protection systems per Guidance Note 5.
- 5Deploy Cyber Security ControlsMaintain robust risk management and cybersecurity frameworks per Guidance Note 7.