Gibraltar crypto license 2026 — GFSC DLT provider
Gibraltar built the world's first dedicated DLT framework in 2018 — four years before MiCA. The Gibraltar Financial Services Commission still runs it with substantive rigour, keeping the licensee population tightly controlled. It is a premium offshore, UK-adjacent credential — but Brexit closed EU passport access.
Why Gibraltar was first
Gibraltar was first. The Financial Services (Distributed Ledger Technology Providers) Regulations 2017 came into effect on 1 January 2018 — four years before EU MiCA. The Gibraltar Financial Services Commission built the framework around nine core principles covering integrity, customer protection, governance, financial soundness, and supervisor engagement. The principles-based design has aged well, accommodating the evolution of crypto activity from simple exchange operations through staking, custody, lending, and tokenisation.
The trade-off is the Brexit consequence. Gibraltar is a British Overseas Territory but is no longer part of the EU, so Gibraltar DLT licences do not produce EU passport access. Operators planning EU customer reach need separate EU member-state CASP authorisation alongside any Gibraltar licence. The dual-track operation is workable but adds compliance overhead. For operators wanting premium offshore positioning with UK-adjacent legal infrastructure and English common-law jurisdiction, Gibraltar remains a credible answer.
What activity needs a DLT licence, and what substance looks like
The framework applies to firms using distributed ledger technology to store or transmit value belonging to others — it is technology-led, capturing any business model where DLT performs the underlying value-storage or value-transmission function. Common in-scope activity includes crypto-asset exchanges that hold customer crypto, custodial wallet services, trading platforms, stablecoin issuance, tokenisation platforms, and crypto lending. Pure software development without customer-asset custody and information-only services sit out of scope. The scope question is fact-specific, and GFSC engages with applicants on borderline cases.
GFSC substance expectations are real. A licensee needs a Gibraltar-incorporated entity, GFSC-approved senior management — CEO and head of compliance through fitness-and-properness review, with Gibraltar residence — a substantive Gibraltar operational team, and a real Gibraltar office with operational headcount. Shell-company arrangements with all operations elsewhere face refusal. Substance investment runs GBP 300,000-650,000 in the first year for a mid-tier DLT licensee.
The application process and banking access
A Gibraltar DLT licence application runs six to nine months for clean files. GFSC expects pre-filing engagement before the formal Form DLT package — business plan, financial projections, AML programme, customer due-diligence procedures, ICT framework, senior management fitness-and-properness documentation, audited financials, and group structure. Substantive supervisor review follows, with typically two to four rounds of information requests and senior management interviews, before an authorisation decision that often carries specific operational conditions to meet during post-approval implementation.
Banking access is the principal operational friction. The Gibraltar banking market is concentrated and crypto-firm onboarding is selective, so many operators supplement a Gibraltar bank account with UK- or EU-licensed EMI providers and maintain multi-jurisdictional banking relationships. Start banking onboarding conversations during the licensing phase rather than after authorisation — the four-to-nine-month banking lag is real and should be budgeted into the operational launch plan.
Gibraltar is the British Overseas Territory whose Gibraltar Financial Services Commission (GFSC) operates the world's first dedicated DLT regulatory framework — the Financial Services (Distributed Ledger Technology Providers) Regulations 2017, effective January 2018 — licensing operators that use distributed ledger technology to store or transmit value belonging to others, on a principles-based model applied with substantive supervisor rigour but with no EU passport access following Brexit.
Fast facts
| Parameter | Value |
|---|---|
| Regulator | Gibraltar Financial Services Commission (GFSC) |
| Framework | Financial Services (DLT Providers) Regulations 2017 — world's first dedicated DLT framework, effective January 2018 |
| Licensee population | 20-30 active DLT licensees as of 2026 — tightly controlled growth |
| Typical timeline | 6-9 months from filing to decision for clean files |
| Substance bar | Gibraltar-resident senior management, GFSC-approved key persons, Gibraltar office and operational team |
| EU position | Not in the EU; Gibraltar DLT licences provide no EU MiCA passport access |
| Best for | Operators wanting premium offshore, UK-adjacent positioning over EU passport reach |
Top counsel for Gibraltar CASP work
Firms below are ranked according to the published CLPAI methodology.
No firms in the index currently feature Gibraltar work.
Frequently asked questions about Gibraltar CASP authorisation
What is the Gibraltar DLT license?
A licence under the Financial Services (DLT Providers) Regulations 2017 administered by the GFSC. It applies to operators using distributed ledger technology for storing or transmitting value belonging to others.
How long does GFSC DLT licensing take?
Six to nine months for clean files. GFSC applies thorough review including business model assessment, fitness-and-properness review, AML programme review, and ongoing supervisor dialogue. Files with substance or AML gaps face material extensions.
Does a Gibraltar DLT licence give EU passport access?
No. Gibraltar is not an EU member following Brexit. Gibraltar DLT licences are Gibraltar national credentials only and do not provide EU MiCA passport access. EU-targeted operations need separate EU member-state CASP authorisation.
What does Gibraltar substance look like for a DLT licensee?
A Gibraltar-incorporated entity, Gibraltar registered office, GFSC-approved CEO and head of compliance with Gibraltar residence, and a substantive Gibraltar compliance team. The substance bar is real and is one of the most-tested elements during GFSC review.
Pitfalls and nuances in Gibraltar
1 Treating Gibraltar as a light-touch offshore credential
GFSC applies substantive review with principles-based supervisor engagement. The licensee population is tightly controlled and the supervisor prioritises quality over volume. Operators expecting light-touch offshore licensing find GFSC more demanding than expected.
2 Filing without Gibraltar-resident senior compliance hires
GFSC requires Gibraltar-resident senior management including a GFSC-approved CEO and head of compliance. Files with non-Gibraltar-resident senior management or thin-substance Gibraltar arrangements face refusal. Senior hire investment is non-negotiable.
3 Assuming Gibraltar provides EU passport access through UK arrangements
Gibraltar is a British Overseas Territory but is no longer part of the EU following Brexit. Gibraltar DLT licences do not produce EU passport access. Operators planning EU customer reach need separate EU member-state CASP authorisation alongside any Gibraltar licence.
4 Underestimating banking access friction
The Gibraltar banking market is concentrated and crypto-firm onboarding is selective. Most Gibraltar-licensed operators rely on Gibraltar-based correspondent arrangements or EMI providers for operational payments. Plan banking strategy in parallel with the GFSC application.
Practitioners in Gibraltar
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes Gibraltar. Editorial picks, sourced from public records.
Regulator and primary sources
The supervisor of CASP authorisations in Gibraltar is Gibraltar Financial Services Commission (GFSC). The legal basis is Financial Services (Distributed Ledger Technology Providers) Regulations 2017 + Financial Services Act 2019. Visit www.gfsc.gi/dlt for the regulator's official guidance, application forms, and supervisory expectations.