Gibraltar Crypto Licence 2026: The GFSC DLT Guide

Most jurisdictions bolted crypto rules onto existing financial law. Gibraltar wrote a framework from scratch — and did it before almost everyone else. Its Distributed Ledger Technology (DLT) Regulatory Framework, live since January 2018, was one of the first laws anywhere built specifically for blockchain business, and its GFSC DLT Provider licence is widely respected.

On our client files, the operators who choose Gibraltar aren’t chasing the fastest or cheapest registration; an offshore VASP covers that need. They want a premium, reputation-heavy credential that banks and counterparties respect, in an English-common-law base. This guide explains what a Gibraltar crypto licence really is in 2026, covering the GFSC DLT framework, the ten regulatory principles, cost and capital, the timeline, and the one caveat that decides it: Gibraltar is outside the EU, so this licence does not passport into the single market. For a newer crossover of gambling and digital assets, see how Gibraltar’s prediction-market authorisation folds stablecoin settlement straight into a gaming permit.

What a Gibraltar crypto licence is — the DLT framework

A Gibraltar crypto licence is a DLT Provider licence issued by the Gibraltar Financial Services Commission (GFSC) under the Distributed Ledger Technology Regulatory Framework. The trigger is broad and deliberately technology-neutral: any firm that uses DLT to store or transmit value belonging to others must hold the licence. Running an exchange, holding client assets in custody, moving value across a ledger for customers — all of it falls inside the framework. The DLT Provider licence is backed by VASP registration for AML purposes, so the anti-money-laundering obligations sit alongside the conduct regime rather than in a separate silo.

What makes Gibraltar historically significant is that it got there first. When the framework launched in January 2018 it was one of the earliest pieces of legislation anywhere written specifically for blockchain business, and it set a template that several later jurisdictions followed. Years of DLT supervision since then have produced a mature ecosystem — experienced advisers, service providers and, critically, a regulator that genuinely understands the sector rather than treating it as an exception to be managed.

The GFSC is a single, quality-first regulator that is deliberately selective about who it licenses. It is not a volume registry chasing headcount; it grants the DLT Provider licence to firms that can demonstrate real substance, competent management and sound controls, and it keeps them under ongoing supervision afterwards. That selectivity is where the licence’s value comes from: because few firms qualify, banks, custodial partners and institutional counterparties trust the ones that do, which is why the Gibraltar licence keeps opening doors that a lighter-touch registration cannot. For a fuller map of how this non-EU model sits against the wider licensing landscape, our EU CASP vs offshore VASP comparison places it in context.

The ten principles the GFSC licenses against

Here is the heart of the Gibraltar approach, and where it diverges sharply from MiCA. Rather than a prescriptive rulebook with fixed numbers, the GFSC regulates against ten regulatory principles and applies them proportionately to your scale and risk. The framework opened in 2018 with nine principles; a tenth, Market Integrity, was added in 2021. A DLT Provider must evidence, principle by principle, how its business meets each one.

The advantage of a principles-based regime is that it scales. A small, low-risk provider is not held to the same operational weight as a large custodian holding client value at volume — the GFSC calibrates expectations to the actual risk you carry. The trade-off is that there is no box you tick to be “done”: you have to demonstrate genuine, substantive compliance with each principle, backed by real governance and evidence. Our Gibraltar DLT licence explainer walks through the ten principles and how a file is built to satisfy each one.

Capital, fees and timeline

This is where operators used to MiCA need to reset their assumptions. Gibraltar does not run the EU’s fixed capital classes. There is no €50,000 / €125,000 / €150,000 ladder here. Instead the GFSC requires a risk-based capital reserve — an amount proportionate to your scale, the activities you run and the risk you present. A custodian holding significant client value will be expected to hold more than a lightweight, low-risk provider. The figure is set to your model, which is precisely what “principles-based” means in practice.

The fees, by contrast, are fixed in law. Under Fee Block G1 of the Financial Services (Fees) Regulations 2020, an application for a Part 7 permission costs £45,000. The annual fee is a £12,254 base fee plus an additional £28,183, with a trade activity fee of 0.1% of your reported trade volume on top, capped at £92,700. On top of the government-side numbers you fund the Gibraltar company, genuine local substance and management, the AML/CFT programme and the compliance build. Expect the process to run six to twelve months end to end; the GFSC review is thorough and quality-focused by design, and a well-evidenced file moves through it far more smoothly than a thin one.

The fee schedule is only half the year-one picture — the other half is the substance, the reserve and the compliance function. Our dedicated Gibraltar crypto licence cost breakdown models the full year-one all-in, and the Gibraltar crypto licence requirements guide sets out the company, people and documentation the GFSC expects before it will even accept a file.

The no-EU-passport caveat — and how to solve it

This is the single most important fact about a Gibraltar crypto licence, and the one most often missed. Gibraltar is a British Overseas Territory that left the EU alongside the United Kingdom. Its DLT framework is separate from MiCA, and a GFSC DLT Provider licence therefore does not passport into the European Union. Holding one does not, on its own, entitle you to serve customers in France, Germany, Spain or any other member state on a cross-border basis.

None of this diminishes what the Gibraltar licence is good for. For a global business whose markets don’t hinge on EU passporting, it delivers something an EU CASP can’t buy off the shelf: the reputational weight of a pioneering, quality-first regulator in an English-common-law jurisdiction. The mistake is treating it as an EU licence — it isn’t one, and any adviser who implies otherwise is selling you the wrong thing.

Gibraltar or an EU CASP — how to choose

The fair way to place Gibraltar is against the EU’s harmonised alternative. An EU CASP under MiCA gives you standardised, prescriptive rules, fixed capital classes (€50k–€150k by service class) and, above all, a passport across all 27 member states. Gibraltar gives you a proportionate, principles-based regime, a risk-based reserve and a premium reputation, but no passport. Which one fits depends mainly on whether you need that passport.

So Gibraltar suits a specific profile: quality-first operators who value a reputation-heavy licence over raw market reach; exchanges and custodians that use DLT to hold or transmit client value; teams that prefer an English-common-law regulatory environment; and global businesses whose markets don’t require EU passporting. If EU access is central to your model, start with an EU CASP instead — our EU CASP vs offshore VASP guide frames that decision in detail, and a Lithuanian CASP is often a fast EU route to pair alongside Gibraltar.

The Gibraltar trade-off

Compared with an offshore VASP, a Gibraltar crypto licence costs more, takes longer and demands real substance: a Gibraltar company, fit-and-proper management with genuine industry experience, an AML/CFT programme to AMLD5/6 standards, and a capital reserve sized to your risk. Against an EU CASP it lacks the single-market passport that MiCA guarantees. In return it carries the standing of one of the world’s first, and most respected, crypto regulators, in a common-law jurisdiction that banks take seriously.

If a premium, globally-respected licence is where your business is heading, we run the entire GFSC file: the Gibraltar company and substance, the DLT Provider application, the principle-by-principle evidence, the AML/CFT and market-integrity frameworks, and the crypto-friendly banking around it. The government costs and our fee appear as separate lines on the quote. See the full scope on our Gibraltar crypto licence page, then book a free consultation and we’ll model the real year-one economics, including whether Gibraltar alone or Gibraltar paired with an EU CASP fits your actual plan, before you commit a pound.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.