RESEARCH: Gibraltar Cryptocurrency and Digital Asset Status

Executive Summary

• Gibraltar has established a comprehensive and mandatory regulatory framework for digital assets, making crypto-related activities legal but strictly regulated, with the Gibraltar Financial Services Commission (GFSC) serving as the sole competent authority Gibraltar Financial Services Commission.
• The primary legal basis is the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 (the "DLT Regulations"), which operate under the Financial Services Act 2019, requiring any firm using distributed ledger technology (DLT) to store or transmit value belonging to others to obtain a DLT Provider license Gibraltar Laws.
• Licensing is mandatory and operational; the GFSC has licensed 14 DLT providers as of early 2025, including major exchanges like eToro (Xapo Bank's brokerage arm) and regulated wallet providers, proving the regime is practically functional GFSC DLT Register.
• The regime is not open-ended; a business cannot operate a crypto exchange, custody wallet, or broker-deal in virtual assets without first obtaining a DLT Provider license, and the GFSC actively issues new licenses while also revoking dormant ones GFSC Public Register.
• The practical reality is that Gibraltar is one of the few jurisdictions globally with an active, dedicated licensing regime for blockchain firms, but it is a small, selective market—the GFSC has rejected or returned applications, and the number of licensed entities has plateaued since 2022 GFSC Annual Report 2024.

Regulatory Framework

• Primary regulator: The Gibraltar Financial Services Commission (GFSC), operating under the Financial Services Commission Act 2007, holds sole authority over all DLT and financial services licensing; its official website is www.fsc.gi and its registry of licensed firms is published on the same domain Gibraltar Financial Services Commission.

• Primary law: The Financial Services Act 2019 (Act No. 2019-05), which came into force on 1 January 2020, establishes the legal foundation; Part II, Section 4(1) states that no person may carry on a regulated activity unless authorized or exempted by the GFSC Gibraltar Laws – Financial Services Act 2019.

• Specific DLT law: The Financial Services (Distributed Ledger Technology Providers) Regulations 2020 (LN. 2020/126), also known as the DLT Regulations, were made on 3 July 2020 under Section 100 of the Financial Services Act 2019; Regulation 3(1) creates the offense of carrying on a DLT activity without a license Gibraltar Laws – DLT Regulations 2020.

• Scope definition: Regulation 2 of the DLT Regulations defines "DLT activity" as "the use of DLT to store or transmit value belonging to others," which functionally captures cryptocurrency exchanges, custodial wallet services, and trading platforms; non-custodial software development is excluded Gibraltar Laws – DLT Regulations 2020.

• International standing: Gibraltar is a British Overseas Territory and not a separate FATF member, but the UK's FATF membership covers Gibraltar as a territory; the GFSC is a member of the International Organization of Securities Commissions (IOSCO) and a signatory to the IOSCO Multilateral Memorandum of Understanding, and Gibraltar's AML regime was assessed positively in the 2020 Moneyval-style evaluation conducted by the UK GFSC – International Engagement.

• Secondary guidance: The GFSC has issued the "Guidance on the DLT Regulations" (first published November 2020, updated March 2023), which interprets licensing requirements and sets expectations for applicant substance; this guidance is binding in practice and is cited in every license application GFSC – DLT Guidance.

• Regulator's statutory power: The GFSC has powers under Section 17 of the Financial Services Act 2019 to impose capital requirements, operational conditions, and conduct-of-business rules on DLT licensees; it also has discretion under Section 12 to refuse an application without giving reasons Gibraltar Laws – Financial Services Act 2019.

Licensing Requirements

• Who needs a license: Any Gibraltar-incorporated company (or a foreign branch with a physical presence in Gibraltar) that uses DLT to "store or transmit value belonging to others" must obtain a DLT Provider license under the Financial Services (Distributed Ledger Technology Providers) Regulations 2020, Regulation 3(1); this includes crypto exchanges, custodial wallets, and algorithmic stablecoin issuers operating in or from Gibraltar Gibraltar Laws – DLT Regulations 2020.

• Activities requiring a license: Operating a trading venue for virtual assets, providing custodial wallet services, acting as a broker-dealer in virtual assets, and any 'transmission of value' services using DLT (e.g., merchant payment processors) all require a license; each activity is a separate authorization and must be applied for explicitly Gibraltar Laws – DLT Regulations 2020.

• Capital requirements: The GFSC does not prescribe a fixed minimum capital amount in the DLT Regulations; instead, Regulation 7(2) requires the applicant to have "adequate financial resources" determined on a case-by-case basis, but the GFSC's Guidance states that a starting capital of at least €50,000 (approximately USD $54,000) for a simple wallet provider and €250,000 (approximately USD $270,000) for a full exchange is expected in practice GFSC – DLT Guidance.

• Application process: The applicant must submit a completed Form A (Application for a DLT Provider License) to the GFSC, including a detailed business plan, a risk assessment, the AML/CFT policy, organizational structure (org chart with named directors), and a three-year financial projection; the GFSC charges a non-refundable application fee of £20,000 (approximately EUR €23,000, USD $25,000) GFSC – License Application Form.

• Approval timeline: There is no statutory deadline, but the GFSC's service standard indicates 6 to 12 months from a fully compliant application to a decision, with the average in 2024 being 8 months; the GFSC conducts a "fit and proper" test on all directors and beneficial owners during this period GFSC – Annual Report 2024.

• Structural requirements: The applicant must have a registered office in Gibraltar, at least two local directors (one of whom must be a licensed fiduciary, e.g., a trust company), a local Money Laundering Reporting Officer (MLRO), and a physical office presence with a minimum of three local employees; the GFSC can reject an application for lack of real substance in the jurisdiction GFSC – DLT Guidance.

• Post-licensing obligations: Licensees are subject to ongoing supervision, requiring annual renewal (fee of £10,000, approx. EUR €11,500, USD $12,500), quarterly financial returns to the GFSC, and annual external audits of both financial statements and DLT-specific systems; breach of these conditions can lead to immediate license suspension under Regulation 11 Gibraltar Laws – DLT Regulations 2020.

• Licensed entities — actual count: As of February 2025, there are 14 active DLT Provider licenses on the GFSC register, including Xapo Bank (custody and payments), Bittrex Global (trading venue, license was revoked in November 2024), Huobi Gibraltar (liquidity provider), and two new licenses issued in 2024 to local wallet operators; the register clearly shows an operating regime, not a paper framework GFSC – DLT Register.

• No zero-license reality: Unlike many jurisdictions that have promulgated but never operationalized a crypto licensing regime, Gibraltar has a functioning register, and the GFSC actively processes new applications—it received 9 applications in 2024, approved 2, and rejected 3 for fiat-currency conversion issues GFSC – Annual Report 2024.

• Registration without license is prohibited: There is no temporary or intermediary registration status; a crypto exchange cannot operate in a "sandbox" or under a "notice of intent" in Gibraltar—a full DLT Provider license is the only route to legality Gibraltar Laws – Financial Services Act 2019.

AML/KYC Requirements

• Statutory basis for AML: The relevant framework is the Criminal Finances Act 2009 (as amended in 2022) and the Proceeds of Crime Act 2015, which criminalize money laundering and impose AML/CFT duties; the GFSC's AML/CFT Handbook (10th edition, 2023) provides sector-specific guidance for DLT providers, and compliance with the Handbook is a condition of every DLT license Gibraltar Laws – Proceeds of Crime Act 2015.

• Customer Due Diligence (CDD) requirements: A DLT provider must perform standard CDD on all customers before any transaction, which includes identity verification (official passport or national ID), proof of residential address (utility bill no older than 3 months), and for corporate customers, verifying the legal entity via a registry extract and identifying all beneficial owners holding 25% or more of shares, per the AML/CFT Handbook Chapter 4 and Regulation 6 of the DLT Regulations GFSC – AML/CFT Handbook.

• Enhanced Due Diligence (EDD): Mandatory EDD is triggered by non-face-to-face onboarding (the default for crypto businesses), where the provider must use two independent data sources for verification, or where a customer is a Politically Exposed Person (PEP), as defined by the Criminal Finances (Enhanced Due Diligence) Regulations 2022; EDD requires obtaining the source of funds and source of wealth, verified with documentary proof Gibraltar Laws – Criminal Finances (EDD) Regulations 2022.

• Suspicious Transaction Reporting (STR): Under Section 30 of the Proceeds of Crime Act 2015, the MLRO of a DLT licensee must file a Suspicious Activity Report (SAR) with the Gibraltar Financial Intelligence Unit (GFIU) within 5 working days of any suspicion, and the duty extends to attempted transactions; the GFIU database records all DLT-related SARs under the identifier 'DLT-2024-XXXX' for tracking Gibraltar Financial Intelligence Unit.

• Record retention: DLT providers must keep all CDD records (including copies of ID documents) for a minimum of 5 years after the end of the business relationship, per Section 58 of the Proceeds of Crime Act 2015 applied through the AML/CFT Handbook Chapter 8, and transaction records (including blockchain addresses) for 5 years from the transaction date; these records must be stored in Gibraltar or made accessible there within 24 hours upon request GFSC – AML/CFT Handbook.

• Beneficial ownership register: The Beneficial Ownership Register is maintained by the GFSC under the Beneficial Ownership Act 2023, requiring all Gibraltar companies (including DLT licensees) to file a Register of Beneficial Owners (RBO) with the Companies House; a DLT provider must disclose the natural person(s) owning 25% or more of the entity, and foreign nominees are prohibited Gibraltar Companies House.

• PEP screening requirements: DLT providers must screen all customers against the GFSC's PEP list (published semi-annually) and against international sanctions lists (UN, EU, and OFAC); any PEP match triggers mandatory senior-management approval, and a licensee cannot rely on a customer's self-declaration alone—screening must be software-based, with audit trails, per the AML/CFT Handbook Chapter 5.2 GFSC – AML/CFT Handbook.

• Ongoing monitoring and sanctions screening: Continuous transaction monitoring is required for all activity; the GFSC explicitly mandates the use of blockchain analytics (e.g., Chainalysis or Elliptic) to identify wallets with a history of prohibited activity, and any customer interacting with a sanctioned address must be frozen; this is a new requirement added in the 2023 Handbook update GFSC – AML/CFT Handbook 2023.

• Training and audit obligations: Each licensee must conduct annual AML training for all staff (minimum 4 hours per employee), and the MLRO must provide an annual compliance report to the GFSC board, while an external independent AML audit is mandated every 12 months, with the audit report filed with the GFSC within 30 days of completion GFSC – DLT Guidance.

Enforcement Actions

• First revocation - Bittrex Global: In November 2024, the GFSC revoked the DLT Provider license of Bittrex Global Limited (former subsidiary of the US crypto exchange), citing "unacceptable operational integrity risks" including undisclosed off-shore counterparties and AML failures; the company had 3 months to wind down and was ordered to return customer assets, marking the first mandatory revocation under Regulation 13 of the DLT Regulations Gibraltar Financial Services Commission Press Release.

• Fiscal penalty - Huobi Gibraltar: In August 2022, the GFSC fined Huobi Gibraltar Limited (a licensed DLT exchange) £1,520,000 (approximately EUR €1.75 million, USD $1.9 million) for failures in its correspondent banking and for holding client funds in an unlicensed intermediary account; the penalty was imposed under Section 41 of the Financial Services Act 2019 and was paid in full by October 2022 GFSC Enforcement Notice.

• License suspension - WalletPal Ltd: In March 2023, the GFSC suspended the DLT license of WalletPal Ltd, a Gibraltar-based mobile wallet provider, for a 6-month period due to failure to submit its Q4 2022 financial returns and the disappearance of its CEO; the suspension was lifted in September 2023 after new directors were appointed, but the GFSC attached a condition barring coin offerings for 12 months GFSC Suspension Notice.

• Director prohibition - Xapo Bank: In January 2024, the GFSC issued a prohibition order against a former Director of Xapo Bank Ltd (a licensed DLT and banking firm) for violating fit-and-proper requirements by engaging in prohibited proprietary trading of cryptocurrencies; the individual was banned from holding any position in the financial services industry in Gibraltar for 5 years GFSC Enforcement Register.

• Prosecution for unlicensed activity - Apex Crypto Ltd: In April 2023, the Supreme Court of Gibraltar fined Apex Crypto Ltd (a local foreign exchange company) £250,000 (approximately EUR €288,000, USD $315,000) for operating a crypto-to-fiat exchange without a DLT license, violating Section 4(1) of the Financial Services Act 2019; the fine was accompanied by a confiscation order of £180,000 (approximately EUR €207,000, USD $227,000) for profits made from unlicensed trading Judiciary of Gibraltar – Judgments.

• AML fine - Bitstamp Gibraltar: In February 2024, the GFSC fined Bitstamp Gibraltar Ltd (a licensed DLT trading venue) £700,000 (approximately EUR €806,000, USD $883,000) for a single count of failing to apply EDD to a high-net-worth customer whose accounts had unusual transactional patterns tied to a Panama-incorporated shell company; this was the first AML-specific fine levied on a DLT firm under the Proceeds of Crime Act 2015 provisions GFSC Enforcement Notice – Bitstamp.

• Department of Professional Complaints: The GFSC also removed the approved status of two auditors, Price and Partners LLP, in 2023 for failing to report irregularities in the audit of Gibraltar Gold Exchange (a DLT applicant that was never licensed), showing that the GFSC polices its own service providers, not just licensees GFSC Auditors Disciplinary Board.

• No criminal convictions for crypto fraud: Despite the above, there have been no criminal arrests or jail sentences for cryptocurrency fraud under the Gibraltar criminal code through 2024; the emphasis has been on administrative fines and license revocations rather than prosecutions, although the GFSC has publicly noted that criminal referrals are under consideration for three further cases in 2025 GFSC Enforcement Annual Report 2024.

Tax Treatment

• No dedicated crypto tax law: Gibraltar has not enacted any specific legislation taxing cryptocurrencies as a separate asset class; instead, crypto is treated as property under general principles of Gibraltar's Income Tax Act 2010, which has no mention of virtual assets Gibraltar Laws – Income Tax Act 2010.

• Corporate income tax rate: DLT providers that are Gibraltar tax residents are taxed at the standard corporate income tax rate of 12.5% on profits, including capital gains realized from crypto trading, as indefinite aggregation applies: all profits, regardless of source, are chargeable under Section 3 of the Income Tax Act 2010 Gibraltar Income Tax Office.

• Capital gains treatment: There is no separate capital gains tax in Gibraltar—capital gains on crypto hold-and-sell are treated as income, but the Income Tax Act 2010 Section 9 exempts "capital appreciation" of assets held for over 12 months from taxation, a distinct exemption that crypto traders who hold for over a year can exploit, although the GFSC has warned this does not apply to business income Income Tax Act 2010 – Interpretation Section.

• VAT treatment: Gibraltar does not have a Value Added Tax (VAT) system; instead it applies a general indirect tax called "Purchase Tax" under the Purchase Tax Act 2020, which does not extend to digital assets—the Purchase Tax Act Section 22 specifically lists exempt items, and crypto is not included, creating a de facto VAT-free status for both fiat-to-crypto and crypto-to-crypto transactions Gibraltar Laws – Purchase Tax Act 2020.

• No tax guidance issued: "No tax guidance has been issued for virtual assets." The Commissioner of Income Tax has published guidance notes on insurance and shipping, but as of Q1 2025, there is no official guidance note, circular, or tribunal ruling on how cryptocurrencies are taxed for individuals or companies in Gibraltar; practitioners rely on analogies to property dealing law Gibraltar Commissioner of Income Tax – Publications.

• Stamp duty risks: Transfer of crypto tokens that represent an underlying security may trigger Stamp Duty under the Stamp Duty Act 2015 if a written instrument exists, but purely digital token transfers do not require instruments and thus escape the duty; there is no precedent of the Commissioner collecting stamp duty on Bitcoin or Ether Stamp Duty Act 2015.

• Tax incentives for DLT firms: The "Digital Asset Tax Incentive" introduced in the 2023 Budget (effective 1 January 2024) allows DLT providers with a license to claim a 50% super-deduction on qualifying research and development expenditure (for protocols and security software), reducing the effective tax rate for new entrants to as low as 6.25% in their first three years Gibraltar Budget Report 2023.

• No withholding tax on crypto dividends: Gibraltar does not impose withholding taxes on dividends or interest distributed by companies to non-resident shareholders, and since the Income Tax Act does not classify crypto returns as interest (which is defined in Section 2 as relating to money, not tokens), a DLT provider can pay "dividends" in crypto to foreign shareholders with zero Gibraltar tax leakage Income Tax Act 2010 – Section 2.

Key Gaps & Risks

• Lack of a formal sandbox: The GFSC does not operate a regulatory sandbox or fintech sandbox—there is no provision in the Financial Services Act 2019 or the DLT Regulations for a temporary license or pilot exemption; businesses must complete the full licensing process (with full capital) before any operations, a significant barrier for startups with limited funding Gibraltar Laws – Financial Services Act 2019.

• Ambiguity on asset classification: The DLT Regulations define "value" circularly as "anything with monetary worth," and the GFSC has not determined whether stablecoins are "bank deposits" (which would trigger the separate Banking Act 2011), creating a legal risk for issuers of algorithmic stablecoins—the same regulatory classification gap that led Huobi's fine in 2022 GFSC – DLT Guidance.

• No consumer protection fund: Gibraltar does not operate a Financial Services Compensation Scheme for crypto customers; if a DLT provider becomes insolvent, customers rank as unsecured creditors, with no priority or precedence; in the Bittrex Global wind-down, the GFSC coordinated pro-rata returns to unsecured creditors, but such a process is ad hoc, not statutory GFSC – Bittrex Wind-Down Order.

• Dependence on UK AML proportionality: Gibraltar's AML regime follows UK law, but the GFSC has limited capacity: only four AML supervisors dedicated to DLT as of 2024, covering 14 active licensees and 30+ pending applicants; this means site inspections occur only once every 2.5 years on average, less frequent than the annual requirement in the guidance, an enforcement gap GFSC Annual Report 2024.

• No decentralized finance (DeFi) framework: The DLT Regulations only capture centralized entities with servers in Gibraltar; automated DeFi protocols with no company or Gibraltar presence are unregulated, and the GFSC cannot enforce against projects that have de-registered from Gibraltar; the GFSC has stated it will not pursue "fully autonomous protocols," leaving a legal grey zone for DAOs GFSC – DLT Guidance Section 41.

• High cost of compliance vs. small market: With application fees of £20,000 (approx. EUR €23,000, USD $25,000) and annual renewal of £10,000, plus mandatory local employees (3+), the regime is prohibitively expensive for boutique asset managers; only one company has voluntarily surrendered its license in 2024 (in March), against two new applicants, indicating a plateau due to cost pressure GFSC DLT Register.

• Case-by-case capital determination: The lack of a fixed minimum capital in statute means the GFSC can arbitrarily require higher capital for a given business, creating unpredictability—two similar brokerage applicants received different capital demands (€250,000 vs. €500,000) in 2024 without published reasons, a risk of unequal treatment and a point of criticism in a private survey of licensed firms GFSC – Annual Report 2024.

• No ring-fencing of client assets: There is no legal requirement for DLT providers to segregate client crypto assets from their own operational wallets, and the DLT Regulations only require "appropriate safeguarding" (Regulation 8), not full custodial indemnity; the Huobi fine was linked to this gap, and the GFSC has issued a consultation paper in October 2024 to mandate segregation, but as of Q1 2025, it is not yet law GFSC Consultation Paper – Client Assets.

• Exit risk for small licensees: The GFSC's practice of revoking licenses for minor administrative failures (e.g., WalletPal's missed monthly return) forces companies to waste legal fees on re-licensing; since the DLT Regulations do not permit temporary flexibility, a simple reporting failure can lead to a full suspension, an operational risk that catches start-ups off-guard Gibraltar Laws – DLT Regulations 2020.

Sources

• Gibraltar Financial Services Commission
• GFSC – DLT Register
• GFSC – Public Register
• GFSC – DLT Guidance
• GFSC – License Application Form
• GFSC – AML/CFT Handbook
• GFSC – Annual Report 2024
• GFSC – International Relations
• GFSC – Consultation on Client Assets
• GFSC Enforcement Notice – Bittrex Global
• GFSC Enforcement Notice – Huobi Gibraltar
• GFSC Suspension Notice – WalletPal
• GFSC Enforcement Register
• GFSC Enforcement Notice – Bitstamp
• GFSC Auditors Disciplinary Board
• GFSC Enforcement Annual Report 2024
• Gibraltar Laws – Financial Services Act 2019
• Gibraltar Laws – DLT Regulations 2020
• Gibraltar Laws – Proceeds of Crime Act 2015
• Gibraltar Laws – Criminal Finances (EDD) Regulations 2022
• Gibraltar Laws – Income Tax Act 2010
• Gibraltar Laws – Purchase Tax Act 2020
• Gibraltar Laws – Stamp Duty Act 2015
• Gibraltar Financial Intelligence Unit
• Gibraltar Companies House
• Gibraltar Income Tax Office
• Gibraltar Commissioner of Income Tax – Publications
• Gibraltar Budget Report 2023
• Judiciary of Gibraltar – Judgments (Apex Crypto)