Why Choose Gibraltar for Crypto Licensing?
Gibraltar runs one of the world’s first bespoke crypto frameworks, administered by the GFSC and in force since 1 January 2018. The DLT Provider Licence sits inside a common-law system with FATF-whitelist standing and UK market alignment, and from October 2025 the framework also covers non-custodial Virtual Asset Arrangement Providers. We deliver this licence as one accountable engagement.
Gibraltar’s whitelist status and first-bespoke-regime pedigree are real, but they are downstream of one load-bearing reality: the GFSC’s substance requirements are not cosmetic, and any applicant leaning on paper structure or nominee directors will find the process significantly slower and the regulator’s tone materially less receptive. The quality of your submission and the reality of your Gibraltar substance determine whether you sit at the front of the queue or at the back, and with record application volumes, that difference is measured in months.
The First Bespoke DLT Framework
Gibraltar’s framework predates every European competitor. It is principles-based: ten Regulatory Principles against which the GFSC calibrates supervisory expectations case by case, giving a well-prepared applicant more room on a novel model than a rules-based EU regime would. We build the application to those principles from the first draft, so it reads as Gibraltar work, not a template adapted from elsewhere.
UK Alignment and Common-Law Certainty
Gibraltar is a self-governing British Overseas Territory whose courts apply English common law, with final appeal to the Privy Council, and have produced modern decisions characterising crypto-assets as property. The Gibraltar Authorisations Regime, under the UK Financial Services Act 2021 and extended to 31 December 2026, gives a statutory market-access route into the UK for traditional financial-services activities. For UK- and Commonwealth-domiciled groups, that alignment lowers integration friction materially.
FATF Whitelisted, Top-Tier AML Standing
FATF removed Gibraltar from its increased-monitoring list on 23 February 2024, and the European Commission removed it from the high-risk third-countries list on 9 July 2025. MONEYVAL terminated enhanced follow-up in May 2024, rating Gibraltar Compliant or Largely Compliant on all 40 FATF Recommendations, one of only 11 jurisdictions globally with zero Non-Compliant ratings. Unlike BVI, which remains grey-listed, Gibraltar’s whitelist standing is now a banking and counterparty advantage.
Which Business Models Suit Gibraltar?
Gibraltar rewards serious, well-capitalised operators that need regulatory depth and a clean AML reputation, not early-stage projects chasing the cheapest registration. If your customers are UK, Commonwealth, US or global rather than EU retail, and your business is custodial and well-funded, it is a strong fit. If you are early-stage, capital-constrained or selling chiefly to EU retail, we will point you elsewhere among the jurisdictions we serve.
- Custodial exchanges and trading venues holding customer fiat or crypto pending settlement: the core DLT Provider use case.
- Virtual asset custodians running hot, warm and cold custody for institutional and retail clients.
- Stablecoin and asset-backed token issuers that retain custody of the backing, often paired with an e-money permission.
- Non-custodial swap and brokerage models that fit the VAA Provider permission introduced in October 2025.
- Established groups with operational maturity in another jurisdiction looking to add a credible, UK-aligned, common-law licence.
- × Early-stage projects chasing the lightest-touch, lowest-cost registration: the substance and supervisory load here is real.
- × Operators selling predominantly to EU retail, who need MiCA passporting Gibraltar cannot give. We deliver crypto licences in Lithuania, Cyprus and Malta for that.
- × US persons, who we do not take on as service clients.
What We Do for You
This is a serviced jurisdiction. We do not introduce you to someone who might help; we do the work and we are accountable for it, from the first scoping call to the issued licence and beyond. Where in-country specialists are needed, we use lawyers, accountants and licensed specialists we have personally vetted and work with directly, never an unverified third party.
- Company formation. We incorporate the Gibraltar private company limited by shares, arrange the registered office and put the corporate structure in place.
- Scoping and GFSC pre-application. We confirm whether you need the DLT permission, the VAA permission or both, agree the fee category, and engage the GFSC supervisory team before formal submission.
- The full application build. We write the Comprehensive Business Plan, financial projections, the AML/CFT policy suite, the Business-Wide Risk Assessment, Travel Rule implementation and the fit-and-proper packages, all bespoke to your model.
- We file and manage the application. We submit, we respond to every round of GFSC queries, and we deal with the regulator directly through all stages of the staged authorisation process.
- Banking, in parallel. We open banking conversations alongside the GFSC submission so a licence does not arrive without somewhere to settle.
- Ongoing compliance. After authorisation we can run or supervise the annual returns, audits, MLRO function and supervisory engagement.
Regulatory Framework
The Gibraltar DLT regime is governed by the Financial Services (DLT Providers and VAA Providers) Regulations 2020 (LN 2020/012, in force 15 January 2020), made under the FSA 2019. The original 2018 framework was consolidated into the 2020 Regulations, and an October 2025 amendment (LN 2025/254) renamed them to bring non-custodial Virtual Asset Arrangement Providers within Part 7 of the Act. We work to this framework day to day and build every application against it.
The Ten Regulatory Principles
Every DLT licensee must comply with the Schedule of Regulatory Principles (the original nine plus Principle 10 on market integrity, added in 2022). In summary, a licensee must: (1) act with honesty and integrity; (2) treat customers fairly and communicate clearly; (3) maintain adequate financial and non-financial resources; (4) manage its business with due skill, care and diligence; (5) protect customer assets and money it holds; (6) have effective corporate governance; (7) keep systems and security to high standards; (8) prevent, detect and disclose financial crime; (9) be resilient, with orderly, solvent wind-down arrangements; and (10) maintain market integrity. We build the application to satisfy each principle on first reading.
Regulatory Overlap
DLT and VAAP licensees commonly interact with three adjacent Gibraltar regimes, and the wrong starting permission can trigger an authorisation refusal or enforcement against unauthorised business. Stablecoin issuers whose tokens function as e-money may need an e-money firm authorisation alongside or instead of the DLT licence; tokenised securities and crypto-derivatives trigger the investment-services regime as well as the DLT permission; and native-token issuance without custody falls under the POCA Schedule 9 AML/CFT registration regime rather than the DLT framework. We confirm the perimeter before we file.
Licence Types and Activities Covered
Since 27 October 2025 Gibraltar recognises two regulated activities: the DLT Provider Licence for custodial business (storing or transmitting value belonging to others using distributed ledger technology) and the Virtual Asset Arrangement Provider Licence for non-custodial business (exchanging virtual assets for fiat or for other virtual assets without taking custody). We confirm which one your model needs before a single document is filed.
Covered Activities
- Custodial exchange services (DLT). Operating a venue where customers buy, sell or swap virtual assets and the operator holds customer fiat or crypto pending settlement.
- Virtual asset custody (DLT). Holding private keys or virtual assets for customers across hot, warm and cold custody.
- Stablecoin issuance (DLT, often combined with e-money). Issuing and redeeming fiat- or asset-backed stablecoins where the issuer retains custody of the backing.
- Crypto-fiat on-ramp and payment services (DLT, often combined with payment permissions). Converting fiat to crypto and back where the operator settles balances on its own ledger.
- Non-custodial arrangement and brokerage (VAAP). Exchanging or matching virtual assets without taking custody at any point: one-to-one swap services and broker-style platforms.
Pure protocol-layer DeFi without a central operator, native-token issuance without custody (POCA Schedule 9 instead), collective investment schemes (the fund regime instead) and pure-collectible NFTs typically fall outside the DLT regime. We tell you which side of the line your model sits on before you commit.
Requirements
Gibraltar imposes no single statutory minimum capital, no fixed director count and no mandatory local share-ownership; the framework is principles-based. The make-or-break elements are mind-and-management from Gibraltar (Principle 6), board fitness and propriety, capital adequacy calibrated to activity (Principle 3, set risk-based by the GFSC), and a fully-built AML/CFT framework matching POCA and GFSC guidance. Demonstrating real Gibraltar substance, not paper substance, is the difference between a fast and a slow approval, and we assemble each of these for you.
| Requirement | Specification |
|---|---|
| Entity type | Gibraltar private company limited by shares (Companies Act 2014) |
| Minimum directors | No statutory minimum; market practice is at least two, both Gibraltar-resident, applying the four-eyes principle |
| Foreign ownership | 100% permitted; no nationality restriction on shareholders or directors |
| Minimum capital | Risk-based; no statutory floor; set by the GFSC against activity scope and volumes |
| Local office | Yes, a physical office in Gibraltar (not a serviced address) |
| Compliance Officer / MLRO | Mandatory; preferably Gibraltar-resident; can be outsourced subject to GFSC outsourcing guidance and retained accountability |
| Audit | Annual financial-statements audit by an approved Gibraltar auditor required under the FSA 2019 |
| AML/CFT framework | POCA Schedule 9 plus GFSC Guidance Note 8 (Financial Crime); Business-Wide Risk Assessment mandatory |
| Travel Rule | Mandatory from 22 September 2022 for virtual asset transfers ≥ €1,000 |
| Wind-down plan | Mandatory under Principle 9; orderly and solvent wind-down documented at authorisation |
Fit-and-Proper and Substance
The GFSC’s fit-and-proper test applies to directors, senior managers, controllers (≥10% holders) and beneficial owners, assessing integrity, competence and financial soundness. Each completes a Personal Questionnaire and submits regulatory references from prior regulated roles. We sequence those references and prior-regulator clearances early, because gaps in employment history or unresolved historic matters are what slow Stage 2.
Substance is read through Principle 6: a real Gibraltar office, board meetings physically held and minuted in Gibraltar, and senior management with substantive responsibilities resident there. The HEPSS and Category 2 personal-tax statuses make senior relocation viable. Applications leaning on nominee directors and pure non-executive boards draw slower assessment, so we build genuine substance in from the outset.
Application Process
The GFSC operates a Staged Application for Authorisation Process: a five-month maximum on Stage 1, with Stages 2 and 3 adding up to four further months, plus an optional Mobilisation stage for new-build operations. The five-month clock only starts when the submission is complete to the GFSC’s satisfaction, which is why we invest in pre-application engagement and Stage 1 document quality. We run you through every stage, deal with the GFSC at each one, and handle every document in English (no certified translations needed for English-language material).
Stage 1 4–8 weeks
Pre-Application
We form the Gibraltar entity first (see our Gibraltar company formation service →), then engage the GFSC DLT supervisory team to scope the model, confirm the permission, agree the fee category and identify documentation gaps. We run this in parallel with banking, which itself takes 4–12 weeks.
Stage 2 up to 5 months
Stage 1 Submission and Assessment
We file the Comprehensive Business Plan, Personal Questionnaires, group structure, fit-and-proper documentation, AML/CFT framework, projections and capital plan. The GFSC reviews against the ten Regulatory Principles. Expect two to three rounds of written queries with 10-business-day response targets, all of which we handle.
Stage 3 8–12 weeks
Stage 2 Documentation Build-Out
The full operational suite: AML/CFT policies, the BWRA, sanctions screening, transaction monitoring, Travel Rule, custody and key-management procedures (DLT only), wind-down plan and cybersecurity architecture, all written as original Gibraltar work.
Stage 4 4–8 weeks
Stage 3 Final Assessment and Authorisation
Presentation to GFSC decision-makers, a final readiness review and the decision. In-principle approval is followed by licence issuance once conditions precedent (typically capital injection and operational readiness) are met.
Stage 5 Optional, up to 12 months
Mobilisation
For new-build DLT operations the GFSC may grant a Mobilisation permission for limited live operation while build-out completes. Groups with operational maturity elsewhere usually skip it.
Timeline
Realistic total project timeline is 9–12 months from initial engagement to issued licence, plus optional Mobilisation. The published nine-month maximum applies from a complete Stage 1 submission across Stages 1–3; pre-application engagement and Stage 1 document preparation add 1–3 months before the regulatory clock starts.
| Stage | Duration | Cumulative |
|---|---|---|
| Pre-application engagement and documentation build | 4–8 weeks | 1–2 months |
| Stage 1 GFSC assessment (maximum) | Up to 5 months | 6–7 months |
| Stage 2 documentation build-out | 8–12 weeks | 8–10 months |
| Stage 3 final assessment and authorisation | 4–8 weeks | 9–12 months |
| Total to licence | 9–12 months | 9–12 months |
| Mobilisation (optional, for new-build operations) | Up to 12 months | n/a |
In practice the GFSC processes Stage 1 within four months for complete, well-prepared submissions and closes incomplete applications after 12 months of inactivity. With the regulator reporting record application volumes, the quality of the submission decides where you sit in the queue, which is why we get it right before it goes in.
Taxation
Gibraltar has a 15% headline corporate tax rate (raised from 12.5% on 1 July 2024), with no VAT, no capital gains tax, no inheritance tax and no withholding tax on dividends, interest or royalties paid to non-residents. DLT firm interest income is taxed as trading income from 1 February 2024. We structure the entity and senior-team residency with the tax position in mind from the start.
| Tax | Rate | Application to Crypto Activities |
|---|---|---|
| Corporate income tax | 15% (from 1 July 2024) | Trading profits accrued in or derived from Gibraltar by licensed DLT/VAA firms |
| Capital gains tax | 0% | None at corporate or personal level |
| Value added tax | None | No VAT in Gibraltar |
| Withholding tax (dividends, interest, royalties) | 0% to non-residents | Cross-border crypto-fee payments |
| Personal income tax | Top marginal up to 39%; HEPSS and Cat 2 routes cap senior liability | Senior staff salaries |
| Pillar Two QDMTT | 15% (from 31 December 2023 financial years) | Multinational groups with consolidated revenue ≥ €750m |
All rates as of June 2026. The HEPSS and Category 2 personal-tax statuses cap assessable income for relocating senior staff and high-net-worth individuals, making executive relocation viable. Gibraltar implements the OECD Common Reporting Standard and is moving to the Crypto-Asset Reporting Framework (first CARF reporting expected in 2027). We coordinate the tax and residency planning alongside the licensing build.
Ongoing Compliance
A Gibraltar DLT or VAAP licence is an indefinite authorisation, but supervisory engagement is continuous: annual financial statements, supervision fees, regulatory returns, board attestations and notifications of material change are mandatory, and thematic reviews and on-site inspections are routine. Authorisation is the start of compliance, not the end, with real annual obligations from Year 2 onwards. We can run or supervise all of it so the licence stays in good standing.
- Annual reporting. Audited financial statements (due 9 months from financial year-end) and an annual return covering activity, customer numbers, transaction volumes, capital position and material incidents. The Compliance Officer reports annually to the board, copied to the GFSC where retail customers are served.
- Continuous notifications. Material changes (control, senior staff, business model, IT infrastructure) require pre-notification under Section 83A of the FSA 2019, filed through the GFSC Digital Portal.
- Financial-crime reporting. Travel Rule submissions and SAR/STR reporting to the Gibraltar Financial Intelligence Unit on a per-transaction or per-event basis.
- Supervisory engagement. Scheduled annual reviews, cross-sector thematic reviews and on-site visits. We help you keep a standing inspection pack rather than scramble at notification.
Unauthorised DLT business carries criminal liability under Section 30 of the FSA 2019, but enforcement is proportionate: the GFSC favours supervisory remediation and no DLT licences have been publicly revoked to date. Staying in good standing is straightforward when the compliance function is properly resourced, which is exactly what we put in place.
Banking
Banking for Gibraltar DLT licensees is workable but demanding, and we manage it for you as a supporting part of the engagement. The local banking sector is small and correspondent capacity for crypto activity is limited, so most licensees combine a Gibraltar operating account with a licensed EU EMI and crypto-friendly payment institutions. Allocate 4–12 weeks for primary banking, and we begin applications in parallel with the GFSC submission, not after it, so a licence does not arrive without somewhere to settle.
Operating-account onboarding requires the full compliance package: GFSC supervisory acceptance, the AML/CFT framework, board screening and detailed source-of-funds documentation. Cross-currency rails (GBP, EUR, USD) are achievable in 4–8 weeks for well-prepared applicants, while crypto-fiat settlement typically needs a separate stablecoin-friendly EMI relationship. We work through credit institutions and licensed EMIs we deal with directly. A licence without banking is a certificate on the wall, so we treat banking as part of the delivery, not an afterthought. Learn about our Banking service →
International Standing and EU Market Access
Gibraltar is FATF-clear, and its standing is now a banking and counterparty advantage. FATF removed it from the increased-monitoring list on 23 February 2024; MONEYVAL terminated enhanced follow-up in May 2024 with Compliant or Largely Compliant ratings on all 40 Recommendations and no Non-Compliant ratings; and the European Commission delisted Gibraltar from its high-risk third-countries list on 9 July 2025. It is one of only 11 jurisdictions globally with that AML profile.
A Gibraltar DLT or VAAP licence confers no EU passporting rights, and MiCA contains no third-country equivalence regime. ESMA’s guidelines (from 27 April 2025) read Article 61 narrowly: any EU-targeted marketing, EU-language website content, geo-targeted advertising, app-store availability or use of EU-based influencers voids the exemption. For systematic EU market access, an EU CASP authorisation is the right route, which we also deliver in Lithuania, Cyprus and Malta. For the detail, see Reverse Solicitation Under MiCA →
How Gibraltar Compares
Gibraltar competes most directly with Malta and Cyprus among the established EU/EEA crypto centres, with Estonia as the cost-leader alternative. The trade-off is regulatory pedigree, tax position and UK adjacency against EU passporting. We deliver crypto licences in all four, so this comparison is honest about where each fits.
| Factor | Gibraltar | Malta | Cyprus | Estonia |
|---|---|---|---|---|
| Licence Type | DLT Provider / VAAP (FSA 2019) | MiCA CASP | MiCA CASP | MiCA CASP |
| Regulator | GFSC | MFSA | CySEC | FSA (Finantsinspektsioon) |
| Regime Track Record | First bespoke DLT regime (2018) | MiCA from 2024; long VFA track record | MiCA from 2024 | MiCA from 2024; FIU-era legacy |
| Timeline | 9–12 months total | 9–18 months | 8–14 months | 6–12 months |
| Corporate Tax | 15%; no VAT, no CGT | 35% nominal, effective ~5% after refund | 15% | 22% (deferred on undistributed profits) |
| Banking Access | 4–12 weeks; multi-institution typical | 4–8 months; heavy due diligence | Workable; 8–14 weeks | Selective; multi-institution typical |
| EU Passporting | No | Yes (MiCA) | Yes (MiCA) | Yes (MiCA) |
| UK Market Access | Gibraltar Authorisations Regime route | None | None | None |
| FATF Status | Clear (whitelisted Feb 2024) | Clear | Clear | Clear |
| Best For | Well-capitalised custodial operators serving UK and global non-EU customers | Mid-to-large CASPs wanting EU passporting | CASPs wanting MiFID-grade EU supervision in English | Cost-sensitive EU-focused operators |
If your end customers are predominantly EU-based, Gibraltar’s absence of MiCA passporting is decisive, and Malta, Cyprus or Estonia is the better route. If you serve UK, Commonwealth, US and global customers, Gibraltar’s common-law system, FATF whitelist status and UK alignment outweigh the passporting gap. The deciding question is where your customers and counterparties sit. Tell us your model and we will give you a straight answer.
Frequently Asked Questions
Is Gibraltar a good jurisdiction for crypto licensing?
Gibraltar is a strong choice for serious, well-capitalised firms that want bank-grade supervision, common-law certainty and FATF-whitelist status, especially custodial exchanges, custodians and stablecoin issuers targeting UK, Commonwealth, US and global markets. It is less suited to early-stage projects seeking the lightest-touch registration: cost, substance and supervisory engagement are higher than BVI, Cayman or Isle of Man. We do not take on US persons as service clients.
How long does a Gibraltar DLT licence application take?
Realistic total timeline is 9 to 12 months from initial engagement to issued licence. The published nine-month maximum applies from a complete Stage 1 submission across Stages 1 to 3; pre-application engagement and Stage 1 preparation add roughly 4 to 8 weeks before the regulatory clock starts. Optional Mobilisation adds up to 12 months for new-build operations. The GFSC closes incomplete applications after 12 months of inactivity, so we file complete the first time.
What is the minimum capital for a Gibraltar DLT Provider Licence?
There is no fixed statutory minimum. The GFSC sets initial capital on a risk-based basis under Principle 3, taking activity scope, projected transaction volumes, custody architecture and wind-down cost reserves into account, so a low-complexity firm carries materially less than a full custodial exchange. We build your Stage 1 capital plan with documented headroom so the GFSC does not force a costly upward revision mid-assessment. Book a free consultation and we will size the capital position against your specific model.
Can a Gibraltar DLT licensee serve EU clients?
A Gibraltar DLT or VAA licence does not grant EU market access or passporting. Gibraltar is non-EU and MiCA does not apply. MiCA Article 61 permits third-country firms to serve EU clients only on the client’s own initiative, and ESMA’s guidelines (from 27 April 2025) read this very narrowly: any EU-targeted marketing, EU-language website content, geo-targeted advertising, app-store availability or EU-based influencers voids the exemption. For systematic EU access, obtain a separate CASP authorisation in an EU member state, which we also deliver. See Reverse Solicitation Under MiCA.
[Formation
Gibraltar Company Formation
Gibraltar private company limited by shares formation, registered office and substance. The prerequisite to DLT licensing.](/company-formation/gibraltar/) [Banking
Crypto Business Banking
Operating, treasury and crypto-fiat settlement support for Gibraltar-licensed firms, delivered alongside the licence.](/banking/) [Crypto Licensing
VASP, CASP and MiCA Licensing Overview
How VASP, CASP and MiCA fit together across the jurisdictions we serve, with a map of every regulated crypto-asset service.](/crypto-licensing/)
Start Your Gibraltar DLT Provider Application
We deliver the entire Gibraltar DLT and VAAP licensing process: Gibraltar company formation, GFSC authorisation, banking support and ongoing compliance, in one engagement with one point of contact. We file the work and we stand behind the outcome.
Banking & Payments
A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Services
- Gibraltar Company Formation: Private company limited by shares incorporation, registered office and substance
- Banking: Operating, treasury and crypto-fiat rails for Gibraltar-licensed firms
- Crypto Licensing (VASP / CASP / MiCA): The full jurisdiction map and category guidance
- Solutions for Crypto Exchanges: End-to-end delivery for custodial exchange operators
- Reverse Solicitation Under MiCA: Practical analysis for non-EU operators serving EU clients