Gibraltar

Crypto Licensing

Gibraltar licenses crypto-asset activity through the Financial Services (DLT Providers and VAA Providers) Regulations 2020, made under the Financial Services Act 2019. The core licensing test is activity-based: a person who, in the course of business, uses distributed ledger technology to store or transmit value belonging to a third party, or who carries on a virtual asset arrangement, must hold a Part 7 permission from the Gibraltar Financial Services Commission. This perimeter test has not changed within the research gathered for this jurisdiction and remains the foundational gate for any crypto-asset business seeking to operate from Gibraltar.

A more recent feature of the regime is the dividend non-objection requirement at regulation 5A, in force since 26 March 2026: a relevant DLT or VAA provider may make a dividend or comparable capital distribution only after notifying the GFSC, and only where the GFSC has not objected. This sits within the regime's broader prudential expectations, which are expressed through the GFSC's ten regulatory principles rather than through a codified capital-adequacy formula. No numeric own-funds minimum specific to DLT or VAA providers has been located; Principle 3, concerning resources, appears to be applied qualitatively by the GFSC rather than through a fixed threshold, and no enforcement-penalty maxima specific to unlicensed DLT or VAA activity, or to breach of the ten principles, have been located either. A licence holder under this regime is supervised by the GFSC on an ongoing basis against the ten principles, which cover matters including resources, custody of client assets, and market conduct, but the regime does not provide the kind of prescriptive numeric capital or penalty schedule that a reader familiar with other crypto-licensing regimes might expect to find.

Taken together, the current standing position is one of a principles-based, activity-triggered licensing perimeter, now supplemented by a specific capital-distribution control, operating without a codified numeric capital floor or a published penalty schedule for breach.

Token Classification

Gibraltar does not operate a comprehensive statutory taxonomy classifying tokens by type, for example, distinguishing payment tokens, utility tokens, and security tokens as separate statutory categories. Token-related activity is generally assessed under the general Financial Services Act 2019 and DLT Provider framework rather than under a dedicated classification statute.

The clearest development in this module is the Protected Cell Companies (Amendment) Bill 2026, published 29 April 2026 and not yet enacted. The Bill would introduce a bespoke legal framework for the issuance of tokenised shares within protected cell companies operating as Gibraltar Financial Services Commission-authorised Experienced Investor Funds, subject to prior Commission approval. This creates a narrow, fund-specific tokenisation gateway rather than a general-purpose classification scheme: it addresses fund-share tokenisation by protected cell companies structured as Experienced Investor Funds specifically, and does not extend to token issuance by operating companies or standalone token issuers more broadly. The Bill's enactment status remains pending as of this cycle.

Outlook

Passage of the Protected Cell Companies (Amendment) Bill 2026 would be the clearest signal of progress in this module, converting the current proposed fund-share tokenisation gateway into an enacted framework. No broader token-classification taxonomy initiative was identified as pending this cycle.

Stablecoin Regime

Gibraltar has no dedicated statute governing stablecoin issuance, reserve requirements or redemption rights; this absence is a structural feature of the regime, not a gap in research. The first instrument to name stablecoin use explicitly is regulation 22 of the Prediction Market Regulations 2026, which permits stablecoin settlement within licensed prediction markets. Under that regulation, using a stablecoin for settlement purposes in this context does not, of itself, cause the operator or a participant to carry on any separate regulated activity — a narrow carve-out tied specifically to the prediction-market licensing track rather than a general stablecoin framework applicable across Gibraltar's financial-services perimeter.

This leaves Gibraltar's stablecoin position split between a genuine structural gap (no issuance, reserve or redemption regime for a stablecoin issuer as such) and a narrow, purpose-built exception for settlement use inside one specific licensed-activity class. A firm seeking to issue a stablecoin from Gibraltar, as distinct from merely accepting one in settlement within a prediction market, would find no bespoke licensing or prudential framework addressing that activity directly; it would fall to be assessed, if at all, under the general Financial Services Act 2019 and DLT/VAA Regulations framework applicable to virtual asset activity generally.

Outlook

Whether the Prediction Market Regulations' settlement carve-out is extended, or a dedicated stablecoin issuance framework is introduced, remains unaddressed by any regulatory horizon item identified this cycle. The structural gap on issuance, reserves and redemption stands as the current position.

Consumer Protection

Consumer and customer-asset protection for Gibraltar's digital-asset sector is built into the ten regulatory principles set out in the Financial Services (DLT Providers and VAA Providers) Regulations 2020, rather than into a separate, freestanding consumer-protection statute specific to crypto-assets. Two of those ten principles bear directly on consumer protection: Principle 5, governing the protection of customer assets, and Principle 10, governing market integrity. The GFSC's updated Guidance Note on the Scope of the DLT Framework now states that Principle 5 does not apply to Virtual Asset Arrangement Providers, because those entities, by the nature of the VAA Provider authorisation track, do not take custody of client virtual assets; Principle 5 continues to apply in full to DLT Providers, who by definition do take custody. The same Guidance Note states that Principle 10, the market-integrity principle, is unlikely to apply to VAA Providers, on the basis that such providers are unlikely to participate in markets in the course of their business, while continuing to govern DLT Providers generally.

The practical effect of this scoping is that a customer dealing with a VAA Provider, rather than a DLT Provider, should understand that the custody-asset-protection principle that would otherwise apply under the DLT Framework's ten-principle structure does not extend to that relationship, because the VAA Provider model is built around non-custodial arrangement rather than holding client assets. This is a scope clarification of how the existing ten-principle framework applies across the two authorisation tracks, not a new consumer-protection instrument or a change to the principles themselves. As with the licensing-track development above, this reading rests on law-firm commentary describing the updated Guidance Note rather than on the GFSC's own text, which was not directly retrieved this cycle.

Outlook

Direct retrieval of the GFSC's own updated Guidance Note text would allow the Principle 5 and Principle 10 scoping statements to be confirmed with primary-source certainty. Consumers and counterparties dealing with Gibraltar-authorised VAA Providers specifically should, on the current reading, understand that custody-asset protection under Principle 5 is not a feature of that authorisation category, a distinction that did not need to be drawn with this degree of clarity before the Guidance Note update.

Tax Treatment

Gibraltar does not levy capital gains tax, and private disposal gains on crypto-assets are generally not taxed as capital gains under the Income Tax Act 2010. This is a standing, general feature of Gibraltar's tax system rather than a crypto-specific concession, and it applies to individuals disposing of crypto-assets in a private capacity in the same way it applies to disposals of other capital assets.

Gibraltar has committed to implementing the OECD Crypto-Asset Reporting Framework. Data collection under CARF is scheduled to begin in 2026, with the first cross-border information exchanges expected in 2027 or 2028. This is a scheduled, non-disruptive reporting change: it introduces new reporting obligations on relevant crypto-asset service providers operating in or from Gibraltar, requiring them to collect and report specified information about crypto-asset transactions and account holders, without altering the underlying absence of capital gains tax on private crypto disposals described above.

Outlook

Publication of Gibraltar-specific CARF implementing rules or guidance, ahead of the 2026 data-collection start, is the clearest development to watch for in this module.

Cross-Border Transfer

Gibraltar's cross-border transfer framework for virtual assets rests on two separate planks: travel-rule compliance and market-access passporting, and both show a tightening posture. On the travel-rule side, the Funds (Transfer) Regulations 2026 (LN 2026/134), made under the Proceeds of Crime Act 2015 and supervised jointly by the Gibraltar Financial Intelligence Unit and the Gibraltar Financial Services Commission, revoked and replaced the prior instrument (LN 2021/194) and have been in operation since 15 July 2026. This is the current authority governing the information that must accompany a cross-border funds transfer, including a virtual-asset transfer, from a Gibraltar-regulated entity.

On market access, a Gibraltar DLT/VAA permission provides no MiCA passport into the EU, and the temporary UK passporting bridge under the FSMA (Gibraltar) Order 2001, extended by SI 2025/1182 to 31 December 2026, excludes DLT/VAA activity from its scheduled categories. This means Gibraltar-licensed crypto firms currently have no UK market-access route under the bridge regardless of when or whether the bridge itself expires on schedule, and no EU route via MiCA equivalence. The combined effect is that a Gibraltar VAA licence holder is structurally without a direct passported route into either of its two principal neighbouring markets.

Outlook

The bridge's scheduled 31 December 2026 expiry is a date to watch, though because DLT/VAA activity is already excluded from its categories, the expiry itself does not change the market-access position for crypto firms. Whether a successor UK regime (such as a Gibraltar Authorisation Regime) or an EU-level accommodation emerges to close this gap is the open question for this module.