Regulatory AlertsGibraltar: fintech & payments regulation
RegulatedGibraltar fintech: VASP registration under POCA 2015; GFSC supervises DLT & payments
- Lead regulator
- Gibraltar Financial Services Commission (GFSC)
- Also involved
- Bank of Gibraltar (banking interface) · NFIU (AML reporting)
- Core law
- Financial Services Act 2019; Proceeds of Crime Act 2015
- Entry capital
- —
- Approval timeline
- —
- Customer assets
- —
- Data protection
- Data Protection Act 2018 · Information Commissioner
- Sandbox
- —
Gibraltar regulates fintech primarily through the GFSC under the Financial Services Act 2019 and AML frameworks. Virtual Asset Service Providers (VASPs) and DLT firms require registration or licensing. Traditional payment services may fall under EMI licensing or AML registration depending on scope. The regime is principles-based with active supervision.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Payment processing / gateway | Uncertainverify with regulator Payment processing may require EMI license or AML registration | — | — | — |
| E-money & wallet issuance | Uncertainverify with regulator E-money issuance likely requires Financial Services License | — | — | — |
| Domestic money transfer | Uncertainverify with regulator Domestic transfers may be unregulated or require AML registration | — | — | — |
| Cross-border remittance | Uncertainverify with regulator Cross-border remittance may require AML registration or license | — | — | — |
| Agent network | Uncertainverify with regulator Agent network requirements depend on underlying service regulation | — | — | — |
| Open banking / account information | Uncertainverify with regulator Open banking not explicitly regulated; likely falls under general fintech | — | — | — |
| Foreign-exchange services | Uncertainverify with regulator FX services may require EMI license or AML registration | — | — | — |
New — what changed recently
- 2026-06-01GFSC Guidance Note on Change of Control — Clarified controller identification criteria and assessment procedures for acquisitions under the Financial Services Act 2019.[1]
- 2026-03-25GFSC Guidance Note on the Scope of the DLT Framework — Defined scope of DLT framework, establishing outcomes-focused regime for DLT and Virtual Asset Arrangement providers.[2]
- 2025-03-28GFSC Guidance Note on Scope of the DLT Framework — Established that firms using DLT for storage or transmission of value belong to regulated activities.[3]
Market-entry checklist
- 1Determine regulatory scopeAssess if activities fall under VASP registration, DLT licensing, or traditional financial services.
- 2Register with GFSCSubmit application for VASP registration or Financial Services License as applicable.
- 3Implement AML/CFT controlsEstablish robust anti-money laundering and counter-terrorist financing procedures compliant with POCA 2015.
- 4Notify change of controlEnsure prior notification to GFSC for any transactions involving significant influence or aggregated holdings.