Gibraltar crypto license 2026 — GFSC DLT provider

Gibraltar's early DLT framework

Gibraltar moved early. The Financial Services (Distributed Ledger Technology Providers) Regulations 2017 came into effect on 1 January 2018 — about five years before MiCA was adopted in 2023 and nearly seven before MiCA's CASP regime applied from 30 December 2024. When the Financial Services Act 2019 commenced, they were replaced by the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 (LN.2020/012, in force 15 January 2020), which were renamed the Financial Services (DLT Providers and VAA Providers) Regulations 2020 from 27 October 2025.

The framework is principles-based. The Schedule to the Regulations sets ten regulatory principles: honesty and integrity; due regard to customers' interests and fair, clear and not misleading communication; adequate financial and non-financial resources; effective management and control; protection of customer assets and money; effective corporate governance; high standards for systems and security access protocols; systems to prevent, detect and disclose financial crime; resilience and orderly wind-down; and, since 27 April 2022, conduct that maintains or enhances market integrity.

The trade-off is the Brexit consequence. Gibraltar is a British Overseas Territory and left the EU with the UK, so Gibraltar permissions do not produce EU passport access. Operators planning EU customer reach need a separate EU member-state CASP authorisation alongside any Gibraltar permission. The dual-track operation is workable but adds compliance overhead. For operators wanting UK-adjacent legal infrastructure and English common law, Gibraltar remains a credible option.

What activity needs a DLT or VAA permission, and what substance looks like

A DLT Provider permission covers firms that use distributed ledger technology to store or transmit value belonging to others. The test is technology-led and fact-specific, and the GFSC sets out its approach in its Guidance Note on the Scope of the DLT Framework. Custodial wallet services and platforms that hold customer crypto are typical in-scope businesses; pure software development without customer-asset custody and information-only services sit out of scope. Since 27 October 2025 a separate VAA Provider permission covers exchanging, or arranging the exchange of, virtual assets for money or for other virtual assets. The GFSC engages with applicants on borderline cases.

Substance needs to be real. Chambers' 2026 guide reports that day-to-day management must be carried out from Gibraltar and that a locally based MLRO is expected; in practice that means a Gibraltar office with operational headcount. The GFSC can direct that a person who is not fit and proper must not perform a function (regulation 7). Shell-company arrangements with all operations elsewhere do not meet these expectations. Practitioners put first-year spending, including substance, at GBP 300,000-650,000 for a mid-sized licensee (practitioner estimate).

The application process and banking access

An application must be made in the form and manner the GFSC directs and carry the prescribed fee (regulation 3), and the GFSC must not grant permission unless satisfied that the applicant will at all times comply with the regulatory principles (regulation 4). Practitioners report six to nine months for clean files, with pre-filing engagement, a package covering the business plan, financial projections, AML programme, customer due-diligence procedures, ICT framework, fitness-and-propriety documents, audited financials and group structure, two to four rounds of information requests and management interviews, and conditions to meet after approval (practitioner estimates). Once licensed, a firm must give the GFSC at least 30 days' notice before declaring a dividend, and the GFSC may object (regulation 5A, in force since 26 March 2026).

Banking access is the principal operational friction. The Gibraltar banking market is concentrated and crypto-firm onboarding is selective, so many operators supplement a Gibraltar bank account with UK- or EU-licensed EMI providers and keep several banking relationships. Start banking conversations during the licensing phase rather than after authorisation; practitioners report a four-to-nine-month banking lag that should be built into the launch plan (practitioner estimate).