DLT Provider Authorization in Gibraltar

Suitable for exchanges that use DLT infrastructure and are involved in storing, controlling or transmitting client value.

Suitable for wallet businesses that hold client assets, manage private keys or provide infrastructure enabling control over virtual assets.

Suitable for companies providing custody or safeguarding services for funds, institutions, professional investors or other third-party clients.

Suitable for platforms that hold, control, safeguard or transfer virtual assets on behalf of clients or counterparties.

Suitable for businesses using DLT to support settlement, transfer or value-flow arrangements involving third-party assets.

Suitable for international crypto or fintech groups where the Gibraltar entity performs the regulated DLT function within a broader corporate structure.

Suitable for infrastructure providers that are not merely technical vendors, but have operational control over client assets, wallet access or transaction execution.

Suitable for models involving exchanges, custody, wallet infrastructure, settlement or other arrangements where the business stores or transmits third-party value using DLT.

The business must carry on, or propose to carry on, DLT Provider business in or from Gibraltar and maintain sufficient substance appropriate to its business model.

A private company must have at least 1 director, while other companies must have at least 2 directors.

The applicant must provide detailed information on controllers, shareholders and ownership structure as part of the GFSC assessment.

Directors, controllers and other key individuals must demonstrate relevant skills, experience and suitability for the proposed regulated business.

Shareholders and controllers may need to provide evidence of source of wealth and source of funds.

The company must establish effective corporate governance, internal control and risk management arrangements.

The applicant must demonstrate sufficient financial and non-financial resources, including suitable personnel, a compliance structure, and audit, accounting, and banking arrangements.

Where material functions are outsourced, the applicant must maintain proper contracts, risk assessment, oversight and an outsourcing register.

The applicant must provide detailed information on controllers, shareholders and ownership structure, including evidence of source of wealth and source of funds where required.

Directors and other key individuals must demonstrate appropriate skills, experience, integrity and suitability for managing a regulated DLT business.

The company must have an appropriate compliance structure with sufficient resources to monitor regulatory obligations and internal controls.

The applicant must maintain effective financial crime controls, including AML/CFT policies, customer due diligence, transaction monitoring and risk-based procedures.

The company must establish a clear risk methodology, risk register, internal control framework and oversight of key business risks.

The GFSC expects detailed information on IT infrastructure, systems architecture, cybersecurity, operational resilience and protection of technology systems.

The applicant must maintain appropriate business continuity and disaster recovery arrangements to support stable regulated operations.

Where the business holds or controls customer assets, it must demonstrate proper safeguarding arrangements, wallet access controls, private key management and custody procedures.

Material outsourcing must be documented, risk-assessed and monitored through effective oversight, contracts and an outsourcing register.

The company must prepare appropriate terms and conditions, risk warnings, fee arrangements, complaints handling procedures and conflict-of-interest controls.

The applicant should demonstrate effective arrangements for audit, accounting, banking and operational financial management.

Before authorization, the company must show that its documented policies, systems, controls and personnel arrangements can operate effectively in practice.

The applicant submits the initial application form together with the required Stage 1 information and application fee.

The business plan must describe the business model, services, group structure, target market, strategy, transaction flows and the role of the Gibraltar entity.

Controller Forms must be prepared for each controller involved in the applicant’s ownership or control structure.

Shareholders and controllers must provide evidence of source of wealth and source of funds where required.

The applicant must provide financial projections and demonstrate adequate capital and financial resources for the nature, scale and complexity of the business.

The file should include governance arrangements, internal controls, risk methodology, risk register, management responsibilities and oversight procedures.

The applicant must prepare AML/CFT policies, customer due diligence procedures, transaction monitoring controls and financial crime prevention documentation.

The GFSC expects information on IT infrastructure, systems architecture, cybersecurity, operational resilience and technology controls.

The application should include business continuity and disaster recovery arrangements showing how the business can continue operating under disruption.

Where the business holds or controls customer assets, the file should explain private key management, wallet access controls, hot and cold storage arrangements and custody safeguards.

Material outsourcing arrangements must be documented through contracts, risk assessments, oversight procedures and an outsourcing register.

The Stage 3 package may include terms and conditions, risk warnings, proposed fee schedule, conflicts of interest framework and complaints handling policy.

The applicant should provide documents covering compliance structure, conduct risk framework, KPIs, remuneration policy, liquidity and solvency policies and relevant governance materials.

Where applicable, completed forms for regulated individuals and non-executive directors may be required as part of the GFSC review.

The applicant must demonstrate that it has sufficient capital for the proposed DLT activities, taking into account the size, risk and complexity of the business.

The GFSC reviews whether the company has enough financial resources to operate safely, sustainably and in line with its regulatory obligations.

Financial projections form part of the authorization assessment and must be consistent with the business model, growth strategy and planned operations.

The Stage 1 application package includes payment of the application fee. The exact amount should be confirmed based on the current GFSC fee schedule and the applicant’s business model.

Applicants should budget for compliance, AML/CFT controls, governance, audit, accounting, banking, IT systems, cybersecurity, business continuity and professional support.

Where the business holds or controls customer assets, additional costs may arise for custody infrastructure, wallet controls, private key management, insurance, third-party provider due diligence and safeguarding procedures.

Material outsourcing arrangements must be properly documented, risk-assessed and monitored, which may require external technology, custody, compliance or operational providers.

Where applicable, the GFSC may review professional indemnity insurance and other risk coverage arrangements as part of operational readiness.

The standard corporate income tax rate in Gibraltar is 15%.

Gibraltar does not operate a VAT system, does not impose capital gains tax, and generally does not impose withholding tax on dividends, interest or royalties paid by Gibraltar companies to non-residents.

Before submitting a formal application, the applicant is encouraged to engage with the GFSC’s DLT team to discuss the proposed business model, services and activities.

The applicant submits Stage 1 information, including the application form, application fee, Stage 1 DLT Comprehensive Business Plan, Controller Forms, source of wealth and source of funds evidence, and information on the business model, ownership, capital and key persons.

At this stage, the GFSC focuses on understanding the proposed business model, control structure, capital position and individuals responsible for the business before allowing the application to move forward.

The applicant submits Stage 2 documentation covering risk management, corporate governance, AML/CFT, financial crime controls, IT systems, cybersecurity, business continuity, outsourcing, disaster recovery and customer asset safeguarding.

The GFSC reviews the applicant’s control environment and operational infrastructure, including private key management, hot and cold wallet arrangements and third-party provider due diligence where custody-related models are involved.

The applicant submits Stage 3 materials, including terms and conditions, risk warnings, fee schedule, compliance structure, conduct risk framework, KPIs, remuneration policy, conflicts of interest framework, complaints handling policy, liquidity and solvency policies.

Applicants may be invited to deliver a presentation covering key individuals, business model, group structure, products and services, target market, strategy, financial projections and how the company will meet the DLT regulatory principles.

Once the GFSC is satisfied with the Stage 3 information and the application as a whole, the application proceeds to a formal authorization decision.

Where relevant, a mobilization period may follow authorization and include systems testing, implementation checks, and further assessment of operational readiness.

After permission is granted, the GFSC may carry out an on-site visit to verify that the systems, processes and controls described during the application process are implemented and operating effectively.

Before formal submission, the applicant may engage with the GFSC’s DLT team to discuss the proposed business model, services, activities and regulatory perimeter.

The GFSC reviews the business model, capital position, ownership and control structure, shareholders, controllers and key individuals responsible for the business.

The regulator assesses risk management, financial crime controls, business continuity, corporate governance, IT systems, cybersecurity, outsourcing and customer asset safeguarding.

The GFSC reviews non-financial resources, compliance structure, conduct of business, Consumer Duty, operational resilience and readiness to operate as a regulated business.

Applicants may be invited to present the business model, group structure, key people, target market, financial projections, products and regulatory approach to the GFSC.

Once the GFSC is satisfied with the Stage 3 information and the application as a whole, the process moves to the formal authorization decision.

Where applicable, a discretionary mobilization period may follow authorization and include systems testing, implementation checks and further operational readiness assessment.

After permission is granted, the GFSC may conduct an on-site visit to verify that the systems, processes and controls described in the application operate effectively in practice.

The standard corporate income tax rate in Gibraltar is 15% for most companies.

Gibraltar does not operate a VAT system, which may simplify the tax position for certain business models.

Gibraltar does not impose capital gains tax.

Gibraltar generally does not impose withholding tax on dividends, interest or royalties paid by Gibraltar companies to non-residents.

The actual tax treatment depends on where the company’s income is accrued or derived and on the wider operating and group structure.

After authorization, the DLT Provider remains supervised by the Gibraltar Financial Services Commission and must continue meeting regulatory expectations.

The company must maintain effective AML/CFT controls, customer due diligence, transaction monitoring and financial crime prevention procedures.

The provider must maintain effective corporate governance, internal controls, risk methodology, risk register and management oversight.

The company must keep appropriate IT infrastructure, cybersecurity controls, systems architecture, business continuity and disaster recovery arrangements.

Where the business holds or controls customer assets, it must maintain safeguarding arrangements, including wallet access controls, private key management and custody procedures.

Material outsourcing arrangements must remain documented, risk-assessed and monitored through contracts, oversight procedures and an outsourcing register.

The GFSC may carry out an on-site visit after authorization to confirm that the systems, processes and controls described during the application are actually implemented and working in practice.

A business may need authorization if it uses DLT in or from Gibraltar to store or transmit value belonging to others. The assessment depends on substance, not on the commercial name of the service.

A company does not need DLT Provider Authorization only because it develops blockchain software or uses DLT. If it does not store, control or transmit third-party value, it may fall outside the regime.

Gibraltar is not part of the EU or EEA MiCA passporting framework. DLT Provider Authorization does not automatically allow the company to provide regulated crypto-asset services across the EU or EEA.

If the business holds or controls customer assets, it must demonstrate strong safeguarding arrangements, including private key management, wallet access controls and custody infrastructure.

The GFSC expects detailed information on IT infrastructure, cybersecurity, systems architecture, business continuity, disaster recovery and operational resilience.

The applicant must maintain effective AML/CFT controls, customer due diligence, transaction monitoring and financial crime prevention measures proportionate to the risks of the business.

Material outsourcing is allowed, but the DLT Provider remains responsible for regulated activities and must maintain risk assessment, contracts, oversight and an outsourcing register.

After authorization, the GFSC may carry out an onsite visit to verify that the systems, processes and controls described in the application are actually implemented and working in practice.

The process is staged and document-heavy. Applicants move to the next stage only when the GFSC is satisfied with the current stage materials and responses.

ICOs and token sales do not automatically fall within the DLT Provider framework only because tokens are issued using DLT. Depending on the token and structure, other financial services rules or AML/CFT registration may apply.

Gibraltar’s tax treatment depends on where income is accrued or derived and on the company’s operating and group structure.

The business must carry on, or propose to carry on, DLT Provider business in or from Gibraltar and maintain sufficient substance, governance and operational presence appropriate to its model.