Gibraltar

The most significant development in this module is the 27 October 2025 entry into force of the Financial Services (Regulated Activities) (Amendment) Regulations 2025, which inserted Virtual Asset Arrangement Providers (VAAPs) into the Financial Services Act 2019 (Part 16, Schedule 2, new paragraphs 139A/139B) as a second regulated activity distinct from DLT Provider custody licensing. VAAPs conducting by-way-of-business exchange of virtual assets for fiat currency, or for other virtual assets, now require Part 7 permission from the GFSC. The amendment includes a 14-day notification requirement and a six-month application transition window, suggesting the GFSC anticipated a population of firms already conducting exchange-type activity under the prior DLT-only perimeter who needed a compliance runway to obtain the new permission. This is a genuine expansion of scope, not a relabelling of the existing DLT license -- exchange/arrangement-of-exchange activity is now separately named and separately permissioned, sitting alongside rather than folded into custodial DLT provision.

The evidentiary basis for this finding is currently secondary: three law-firm/professional-services sources (Hassans, Triay Lawyers, IR Global) describe the amendment's content and effect, but the primary statutory text of the 2025 amendment regulations and the FSA 2019 Schedule 2 insertion have not been independently retrieved this cycle. This is a T3-tier finding held at Probable confidence for that reason, notwithstanding that it is corroborated across three independent secondary sources and addresses what was previously an approximately ten-month stale-evidence gap in the baseline's description of Gibraltar's licensing perimeter.

Outlook

The immediate priority for this module is primary-source retrieval: direct access to the Financial Services (Regulated Activities) (Amendment) Regulations 2025 text and the relevant Financial Services Act 2019 Part 16 Schedule 2 provisions would allow the VAAP finding to be upgraded from Probable to Confirmed and would also permit direct citation of the underlying statutory language rather than secondary description. A related open question is whether the GFSC has published a consolidated, current version of the DLT Provider guiding principles (now reportedly ten) in an accessible primary form. Given the six-month application transition window attached to the 2025 amendment, any firm-level licensing decisions or enforcement actions arising from the VAAP perimeter should become visible over the coming reporting cycles and would materially strengthen this module's evidentiary base once observed.

A further layer of activity-pathway distinction has reportedly emerged following the October 2025 Virtual Asset Arrangement Provider (VAAP) amendment: the GFSC is understood to have updated its Guidance Note on Scope of the DLT Framework to formally distinguish the DLT Provider pathway from the VAA Provider pathway. This is a newer and more granular activity classification than the 2020-basis virtual-asset/VADI distinction and is not yet reflected in the primary claim describing that 2020 distinction. This update has not been independently verified against primary GFSC guidance-note text this cycle, and its confidence has deliberately not been elevated on the strength of the underlying 2020 claim -- the correct characterisation of this evidentiary state is a stale-evidence/missing-counter-evidence gap rather than an overstated-confidence problem, since the original 2020 claim was accurate as of its own basis date.

Separately, historical practice illustrates the absence of a dedicated statutory security-token regime: a 2018 Gibraltar-incorporated security-token-style offering was structured under general Gibraltar company and contract law rather than any bespoke security-token statute, and the GFSC's 2020 guidance update restricts DLT providers from counting reserves of internally generated tokens toward regulatory capital following a public token offering, while separately adding stablecoin-specific risk-management content to the same guidance document.

Outlook

The GFSC's updated Guidance Note on Scope of the DLT Framework (reported November 2025) is the key item to watch for independent primary-source confirmation; once confirmed, it should be integrated as a distinct claim describing the DLT Provider/VAA Provider activity-pathway distinction, separate from the 2020-basis virtual-asset/VADI risk distinction, rather than treated as an amendment to the earlier claim. No indication has emerged this cycle that Gibraltar intends to move toward a MiCA-style statutory taxonomy, and this module should be expected to remain guidance-driven for the foreseeable term absent a specific legislative signal.

The October 2025 Virtual Asset Arrangement Provider (VAAP) amendment introduces a qualification to the DEX finding that has not yet been resolved: because the amendment brings by-way-of-business exchange, and arrangement of exchange, of virtual assets within the FSA 2019 regulated perimeter, it may capture some DEX-facilitation models depending on how "by-way-of-business exchange" is applied to decentralized trading infrastructure. This qualification is annotated against the existing "no dedicated category" finding rather than replacing it, since no primary GFSC guidance has yet confirmed whether or how DEX-facilitation activity is treated under the new VAAP perimeter.

Outlook

This module carries limited signal this cycle: its claims rest substantially on a GFSC homepage reference anchor rather than activity-specific guidance pages, and the DeFi-lending and DEX findings should both be read as provisional pending direct GFSC guidance retrieval. The key open question is whether the VAAP amendment's exchange/arrangement-of-exchange language has been, or will be, applied by the GFSC to DEX-facilitation models specifically -- a determination that would materially change this module's traffic-light assessment if confirmed in either direction. Confirmation of the current status of the 2022 DeFi-lending regulatory-development intent (enacted rule, dated consultation, or unactioned) is a second open item.

Outlook

The central open question for this module is whether the GFSC's 2022 stated intent has since produced any enacted rule or dated consultation as of 2026 -- this is flagged as a lead-signal item requiring direct confirmation with GFSC sources. Until that is resolved, Gibraltar's stablecoin regime should be treated as guidance-only, with issuance authorisation and reserve adequacy remaining structurally uncovered relative to jurisdictions that have adopted MiCA-equivalent stablecoin frameworks. This module's evidence base is thin and should be prioritised for backfill alongside tax_treatment and cross_border_transfer, consistent with known under-indexed areas across the crypto estate.

One identified gap is complaint handling: no dedicated crypto-specific complaint-handling rule distinct from Gibraltar's general financial-services complaint-handling framework has been identified, meaning crypto consumers currently rely on the same general complaints channel as consumers of other regulated financial services, without a crypto-tailored process or escalation route.

Outlook

This module shows no change this cycle and its existing findings -- custody/asset-protection obligations, market-integrity conduct rules, and the standing ICO investor warning -- remain the most binding, in-force elements of Gibraltar's crypto consumer-protection posture. The absence of a dedicated complaint-handling channel is the module's clearest open gap and would benefit from direct confirmation of whether the GFSC's general financial-services complaints process has been formally extended, or found adequate, for crypto-specific complaints.

Outlook

Tax treatment is one of the structurally thinnest modules in Gibraltar's crypto regulatory coverage, and this is a known under-indexed area across the broader crypto monitor estate rather than a defect specific to this jurisdiction. Priority backfill items are direct confirmation from the Gibraltar Income Tax Office on income characterisation of crypto-asset trading, staking or mining income, VAT/GST treatment of digital-asset transactions, and any reporting obligations -- none of which has yet been located in primary form. Until such guidance is located, this module's amber traffic-light assessment reflects a research gap rather than a confirmed favourable or unfavourable tax position for crypto activity.

Outlook

This module remains structurally thin, consistent with cross_border_transfer being a known under-indexed area across the crypto monitor estate. The clearest open question is whether Gibraltar's Proceeds of Crime Act or sanctions framework contains any virtual-asset-specific cross-border transfer or reporting-threshold provision not captured in the FATF/MONEYVAL follow-up report reviewed this cycle -- direct confirmation would either close this gap or confirm that Gibraltar currently governs cryptoasset cross-border flows entirely through its general AML/sanctions architecture without virtual-asset-specific augmentation.