Gibraltar Crypto Licence Requirements in 2026

A Gibraltar crypto licence requires a Gibraltar company with genuine substance, a GFSC DLT Provider licence backed by VASP registration for AML, and fit-and-proper directors with real local presence. A Gibraltar crypto licence is a pioneer’s credential — and the requirements file behind it reflects a regulator that got there first and stayed selective. Gibraltar wrote one of the world’s first purpose-built crypto frameworks in January 2018, and the GFSC still runs it the way it started: principles-based, proportionate to risk, and quality-first. That is why the licence carries weight with banks and counterparties, and why the file asks for a real business rather than a company and a fee.

This is the requirements checklist we work from on our own desk. It covers exactly what the 2026 GFSC Distributed Ledger Technology (DLT) regime demands — a Gibraltar company with genuine substance, fit-and-proper management, AML/CFT to Gibraltar and FATF standards, resilient systems and custody controls — all measured against ten regulatory principles. If you are pricing Gibraltar against an EU CASP, this is the substance you are really paying for.

The structure: a Gibraltar company with a DLT Provider licence

Everything starts with a Gibraltar company. The GFSC licenses a Gibraltar-incorporated entity with genuine local substance — not an offshore holding company applying from elsewhere, and not a nameplate address. This is the first hard difference from a light offshore VASP registration: there is no remote-only route, and the licensee’s home is Gibraltar.

The licence itself is a DLT Provider licence. Gibraltar’s framework applies to any firm that, by way of business, uses distributed ledger technology to store or transmit value belonging to others — exchanges, custodians, wallet providers, payment and settlement firms. That DLT authorisation is backed by VASP registration for AML purposes, so the anti-money-laundering perimeter is covered alongside the conduct one. For the framework itself and how the ten principles came together, our Gibraltar DLT licence explainer maps the regime in full, and the flagship Gibraltar crypto licence guide covers what the licence buys.

One caveat drives structuring decisions from day one: Gibraltar left the EU with the United Kingdom, so the DLT framework is separate from MiCA and does not passport into the single market. A Gibraltar licence is a premium, globally-respected, English-common-law credential — but to serve EU users you pair it with an EU CASP. That is a positioning choice, not a defect, and many groups hold both.

The ten regulatory principles

This is what makes Gibraltar distinctive. Rather than a prescriptive rulebook, the GFSC assesses every DLT Provider against ten regulatory principles — the original nine, plus a tenth, Market Integrity, added in 2021 — and regulates proportionately to your scale and risk. The application is, in effect, an evidence file showing how your business meets each one. Assertion is not enough; the GFSC wants documented controls behind every principle.

Because the principles are outcomes-focused, the GFSC judges whether your arrangements are appropriate for your business — not whether you have copied a template. A small advisory firm and a large custodian meet the same principles to a very different depth. That flexibility is the point of a principles-based regime, and it is also why a thin, generic file fails: there is no box-ticking shortcut.

Fit-and-proper management and local substance

Gibraltar is a substance regime, and the people behind the business are assessed as closely as the business itself. At application you must have in place:

• A Gibraltar company as the licensee — incorporated and genuinely administered in Gibraltar, with operational infrastructure, not a registered address.
• Fit-and-proper directors and senior managers — with real, demonstrable crypto-industry experience. The GFSC expects people who understand the model they are running, and it runs suitability, criminal-record, sanctions and source-of-funds checks on controllers and beneficial owners.
• A resident operational presence — genuine local substance and management, so the business is directed from Gibraltar rather than held remotely.
• A dedicated compliance and MLRO function — resourced and accountable, owning the AML programme and the regulator relationship.

Note the contrast with a light offshore registration: that is exactly what Gibraltar does not accept, and it is why the licence is bankable where a shell is not. Source-of-wealth evidence on beneficial owners is the file that takes longest to assemble, so start it on day one rather than treating it as a closing step. Costs sit outside scope here — for the flat GFSC fee, the risk-based reserve and the year-one all-in, see the Gibraltar crypto licence cost guide.

AML/CFT, custody and cybersecurity

Alongside people and governance, the GFSC reviews your control frameworks — and for a crypto firm these are the heart of the file.

AML/CFT to Gibraltar and FATF standards. The VASP registration that sits behind the DLT licence means your AML programme has to be operable, not template filler. You need customer due diligence, ongoing monitoring, sanctions screening, the Travel Rule for virtual-asset transfers, and suspicious-activity reporting — all drafted to AMLD5/6 standards and mapped to the FATF Recommendations, run by an MLRO who actually executes them. Our primer on iGaming AML and KYC covers what an operable programme looks like in practice; the same discipline applies to a crypto file.

Client-asset protection and custody controls. Under principle five, where you hold client value on DLT you must safeguard and segregate it. That means documented custody arrangements, secure key management, cold-storage controls and clear reconciliation — the GFSC wants to see how client assets are protected if the firm fails.

Resilient systems and cybersecurity. Principle seven requires high-standard, tested systems and security access protocols: encryption, access control, monitoring, business-continuity arrangements and independent testing. Principle nine adds a credible, solvent wind-down plan.

Market integrity. The tenth principle expects controls that prevent market abuse and keep operations fair and orderly — trade-surveillance and conflict-of-interest arrangements appropriate to what you do.

How the GFSC assesses the file — and the order to build it

Because supervision is principles-based, the GFSC assessment is a judgement about your whole business, not a checklist pass. Reviewers weigh the coherence of the model, the calibre of the people, the robustness of the technology and the strength of your principle-by-principle evidence together. A quality-first, selective regulator is slower and more demanding than a registration mill — and that is precisely what gives the licence its reputation and its banking access. Realistically, plan for six to twelve months on a well-prepared file.

Requirements are one thing; sequence is another. The order that avoids rework is: assess the model against the ten principles and set the substance and capital plan first; incorporate the Gibraltar company and stand up local substance and management; assemble every beneficial-owner fit-and-proper file — source of funds and source of wealth — in parallel, because they take the longest; draft the AML/CFT, custody, cyber and market-integrity frameworks against your actual operating model; then build the principle-by-principle evidence pack. Only then does the GFSC application go in.

None of this is the light-touch route a pure offshore registration offers — and that is the point. The GFSC regime asks for a real Gibraltar company, real people, risk-appropriate capital and working control frameworks, and in exchange gives you a pioneering, globally-respected credential in an English-common-law jurisdiction that banks and counterparties trust. Get the file complete and internally consistent the first time and the six-to-twelve-month window is achievable; file with gaps and it drifts.

Ready to assemble your GFSC requirements pack, or want a second opinion on a file you have already started? Our team handles the full Gibraltar substance, fit-and-proper and principle-by-principle build end to end, and will review any application against the Commission’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.