Crypto license in Gibraltar

The regulation of crypto businesses in this jurisdiction is based on creating a transparent and predictable legal environment that both supports innovation and ensures market safety.
The key body responsible for oversight in this area is the Gibraltar Financial Services Commission (GFSC). It licenses and supervises companies using distributed ledger technology (DLT), including cryptocurrency exchanges and wallet providers. The GFSC’s main objectives are to protect consumers, maintain market integrity, and prevent risks to financial stability, without restricting technological innovation.

In addition to licensing and supervision, cryptocurrency companies in Gibraltar are required to comply with strict rules on anti-money laundering, terrorist financing, and the proliferation of weapons of mass destruction. These requirements are enshrined in the Proceeds of Crime Act 2015 (POCA) and related regulations, as well as the Sanctions Act 2019. The GFSC has issued detailed AML/CFT/CPF guidelines for regulated companies, which strengthens control and reduces opportunities for abuse.

It is important to note that cryptocurrencies themselves are not directly regulated in Gibraltar. The authorities have focused on regulating market access points — that is, companies providing services — rather than digital assets themselves. This approach has been well received by the industry and has contributed to the growth in the number of blockchain projects attracted to the jurisdiction.

Legal framework for crypto business in Gibraltar

In 2018, Gibraltar became one of the first jurisdictions to adopt and implement the Distributed Ledger Technology(DLT Framework), which sets out licensing requirements for cryptocurrencies and other blockchain-based activities. Today, Gibraltar continues to actively develop legislation that ensures the integrity of crypto businesses and stimulates the development of blockchain-based products and services.

The Financial Services Act, adopted in 2019, is the main piece of legislation governing the activities of cryptocurrency companies in Gibraltar. This law establishes 10 principles for regulating crypto businesses and requires all DLT providers to conduct their economic activities in good faith to maintain the reputation of the market.

Despite Gibraltar’s exit from the European Union along with the UK, its anti-money laundering (AML) rules are still in line with the Fifth and Sixth EU Anti-Money Laundering Directives (AMLD5 and AMLD6). This means that companies operating in the DLT sector in Gibraltar must comply with requirements such as proven senior management competence, implementation of customer verification procedures (KYC) and other internal policies aimed at identifying and mitigating risks associated with customers and their countries of residence.

In addition to specific cryptocurrency regulations, cryptocurrency operations in Gibraltar may also be subject to other relevant laws and regulations, including:

• Proceeds of Crime Act (2015, updated in March 2021). The law regulates measures to combat money laundering and terrorist financing, requiring cryptocurrency companies to implement effective anti-money laundering and customer identification procedures (AML and KYC) to prevent illegal financial activities.
• Data Protection Act (2004, updated in October 2019). Cryptocurrency companies are required to comply with the Data Protection Act to ensure the confidentiality and security of personal data collected and processed in the course of their activities.
• Companies Act (2014, updated in January 2022), which regulates registration, management, and reporting requirements for companies operating in Gibraltar.
• Consumer Protection Legislation. The Regulation on Consumer Protection ensures that customers are properly informed and protected when conducting cryptocurrency transactions or using cryptocurrency services.
• Intellectual Property Regulation (2021). Cryptocurrency companies may be interested in considering intellectual property laws when developing and protecting their technologies, trademarks, or other intellectual assets.
• Financial Services Regulations (CP & CD Regulations), effective May 2024. This document is designed to improve the quality of service provided to retail clients by financial companies licensed in Gibraltar.

It is important for cryptocurrency companies operating in Gibraltar to comply with the relevant laws and regulations governing their activities. The GFSC and other regulatory bodies monitor and enforce these laws to ensure the security of Gibraltar’s cryptocurrency ecosystem.

Licensing and Registration

In Gibraltar, conducting cryptocurrency business in 2026 requires official permission from the Gibraltar Financial Services Commission (GFSC). Regulation is based on two key mechanisms — licensing of DLT providers and registration of virtual asset service providers (VASPs), which complement each other and form a comprehensive control system.

A crypto license (DLT License) is issued to companies that operate using distributed ledger technology and store or transfer third-party digital assets. The following are subject to licensing:

• crypto exchanges;
• wallet providers;
• crypto asset exchange companies;
• token issuers and administrators;
• consulting firms in this field.

The licensing process includes verification of the business model, corporate governance, cybersecurity measures, and AML/CFT/CPF compliance procedures. The basis for regulation is the Financial Services (Distributed Ledger Technology) Regulations (DLT Regs), which are built on ten principles covering customer protection, business sustainability, and the prevention of financial crime.

Separately, there is VASP (Virtual Asset Service Provider) registration, which is mandatory for those who sell tokens (including through ICOs or OTC transactions) or organize the exchange of virtual assets. This registration is provided for by the Proceeds of Crime Act 2015 (POCA) and the 2021 subordinate legislation. To obtain VASP registration, companies must submit their internal AML/CFT/CPF policies and procedures to the GFSC, as well as information about directors, shareholders, and employees performing key functions (including the MLRO — Money Laundering Reporting Officer).

In addition, Gibraltar has separate regimes for crypto funds, which can be set up as experienced investor funds (EIFs) or private funds and used for collective investment in crypto assets.

Not all activities require a license in this jurisdiction. For example:

• Mining is not directly regulated if it is not accompanied by the provision of services to third parties.
• NFTs are, in most cases, considered collectible assets rather than financial instruments and therefore do not require registration (but there may be exceptions depending on the structure of the token).

Cryptocurrencies themselves are also not subject to regulation — control only extends to access points (exchanges, brokers, and services).

Register of crypto companies

Gibraltar has an official register of crypto companies, which is maintained by the GFSC. It includes organizations that fall under the category of Relevant Financial Businesses (RFB) — companies that:

• Derive income from the sale of tokenized digital assets using distributed ledger technology (DLT);
• Or engage in the commercial exchange of virtual assets for money, money for virtual assets, or one crypto asset for another.

The register of crypto companies is public and open to investors, counterparties, and partners. This increases the level of trust in registered companies, as anyone can check whether a particular firm is officially registered and supervised by the GFSC.

In 2026, Gibraltar has the following main types of licenses and registrations for cryptocurrency activities:

• 1. Distributed ledger technology license (DLT License) — the main form of regulation for crypto businesses.

It is required for companies that store or transfer customers’ digital assets, use blockchain to provide services, or launch exchanges or wallets.

DLT licences in Gibraltar are divided into several categories based on the business model, activity type,and scale of the company. The category affects the amount of annual fees:

• Category 1 — blockchain projects (GBP 10,000 (approximately USD 13,500) per year);
• Category 2 — ICO projects (GBP 20,000 (approximately USD 27,000) per year);
• Category 3 — exchanges and trading platforms (GBP 30,000 (approximately USD 40,400) per year).

• 2. Virtual Asset Service Provider (VASP) Registration is mandatory for companies selling or exchanging digital assets, including OTC transactions and ICOs, if they conduct business from Gibraltar.

Regulation focuses on compliance with AML/CFT standards, requires a risk management policy and registration of key persons (directors, shareholders, AML officers).

• 3. Crypto Funds.

Created for collective investment in digital assets. The most common forms are:

• EIF (Experienced Investor Fund) — for wealthy and experienced investors;
• Private Funds — closed-end funds with a limited number of participants.

Both structures allow investment in crypto assets, provided that corporate governance standards are met and licensed administrators are appointed.

Gibraltar does not levy a specific tax on cryptocurrencies. However, cryptocurrency companies in Gibraltar are still required to adhere to general taxation principles and pay the general taxes imposed by the Internal Revenue Service.The tax year in Gibraltar runs from July 1 to June 30, and tax returns must be filed accordingly by the due dates.

Gibraltar is renowned for its low taxation and offers certain tax advantages to cryptocurrency businesses. For example, Gibraltar does not impose taxes on capital gains, interest, and dividends. As of April 1, 1997, Gibraltar also discontinued the estate duty.

In addition, Gibraltar’s taxation system does not include value-added tax (VAT). Corporate tax in Gibraltar is governed by the Income Tax Act 2010 and applies to profits derived from income accumulated and earned in Gibraltar. For companies in the cryptocurrency industry, the corporate tax rate is 12,5%.

Under the Social Security Act 2021, all cryptocurrency companies registered in Gibraltar are required to make weekly social security contributions regardless of the location of their employees, as long as they are registered with the Employment Service. Contributions range from £28 to £50 per week ($37 to $66).

The social security exemption applies in the following cases:

• the employee is also working elsewhere in Gibraltar and their contributions are fully covered by the other employer.

• the employee holds a valid A1 certificate issued by another country in the European Economic Area where their contributions are paid.
• for start-ups with up to 20 employees and small companies with up to 10 employees, there is a credit of £100 (approximately $131) per employee in the first year towards social security.

Stamp duty applies to the transfer or sale of real estate situated in Gibraltar or shares in a company that owns real estate in Gibraltar and is based on the market value of the real estate. Stamp duty rates vary depending on the value of the property.

Gibraltar currently has only one international Double Taxation Agreement signed with the UK. However, companies can take advantage of relief on foreign tax that has already been paid. A Gibraltar resident who receives income subject to tax in Gibraltar and derived from another jurisdiction where tax has already been paid is entitled to a unilateral exemption in Gibraltar from taxation of that income. The amount of the exemption is equal to the tax already paid or Gibraltar tax (the lower value is chosen).

It is important to note that tax legislation is subject to change and it is recommended that you seek advice from a tax professional to obtain up-to-date information on the applicable tax rates and rules in Gibraltar.