Gibraltar DLT Provider Licence (GFSC): How Exchanges, Custodians & Crypto Payment Firms Get Licensed in 2026

This page is the practical playbook for firms seeking a DLT provider licence in Gibraltar in 2026. Whether you operate a centralised exchange, a custodial wallet service, or a crypto-enabled payment platform, the Gibraltar Financial Services Commission (GFSC) offers one of the most established distributed-ledger-technology licensing frameworks in the world and understanding its requirements end-to-end is the first step toward authorisation.

Gibraltar pioneered DLT-specific regulation in January 2018, becoming the first jurisdiction to create a bespoke licensing regime for firms using blockchain to store or transmit value. The statutory base was consolidated and updated through the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 and further refined by the 2025 Amendment Regulations. After a period of global market consolidation in 2024–2025, demand for reputable, well-regulated jurisdictions has surged again. Gibraltar’s principle-led approach, stable regulatory dialogue, and strong UK/EU-facing reputation make it a compelling choice for teams launching or relocating in 2026.

On this page you will find: eligibility criteria, the GFSC’s ten core regulatory principles, a documentation checklist, indicative fees and timelines, a step-by-step application workflow, common pitfalls, licensed-provider examples, and answers to the most frequently asked questions. A downloadable application checklist mapping each required item to the relevant GFSC guidance note is also referenced below for applicants ready to begin preparation.

Quick Overview DLT Regulations & the GFSC Role

Statutory Base and Recent Changes

The licensing regime rests on the Financial Services (Distributed Ledger Technology Providers) Regulations 2020, which replaced the earlier 2017 framework and introduced a consolidated set of obligations for DLT providers operating in or from Gibraltar. The 2025 Amendment Regulations clarified the scope of regulated activities, refined definitions around token custody and transmission, and aligned certain provisions with evolving international AML/CFT standards. The GFSC has also published updated Guidance Notes on the scope of the DLT regulatory framework (finalised 28 March 2025), which provide detailed commentary on which activities fall within scope and how the regulator interprets key provisions.

What the GFSC Regulates

The GFSC’s DLT supervision covers any firm that, by way of business in or from Gibraltar, uses distributed ledger technology for storing or transmitting value belonging to others. In practice this captures centralised crypto exchanges, order-matching platforms, custodial wallet providers, and payment services that utilise tokens as a medium of transfer. Activities falling under other existing regulatory regimes for instance, banking conducted under the Financial Services Act may be excluded from the DLT framework if the entity is already appropriately authorised.

How to Verify a Licence GFSC Regulated Entities Register

Any member of the public, counterparty, or prospective client can verify licensed DLT providers via the GFSC’s Regulated Entities register. The register lists each authorised firm, its licence category, and the date of authorisation. Checking the register before transacting with a Gibraltar-based DLT provider is a basic due-diligence step that industry observers strongly recommend.

Eligibility Who Needs a DLT Provider Licence in Gibraltar?

Business Models Typically in Scope

• Centralised exchanges: platforms that match buy and sell orders for crypto assets on behalf of customers, holding customer funds during the trading cycle.
• Order-matching services: firms that bring together counterparties for crypto transactions without necessarily holding assets.
• Custodial wallet providers: businesses that safeguard private keys or otherwise hold value on behalf of clients using DLT infrastructure.
• Payment services using tokens: providers that use DLT-based tokens as a medium for transmitting value, facilitating payments, or settling transactions.
• Token sale platforms: entities operating primary or secondary marketplaces for token issuance and distribution.

Who Is Excluded or Already Covered by Other Licences

Not every entity touching blockchain technology needs a DLT provider licence. Banks and payment institutions already regulated under Gibraltar’s Financial Services Act or equivalent EU-derived regimes may be exempt from separate DLT authorisation, provided their existing licence covers the relevant activities. Software developers creating DLT applications without storing or transmitting value belonging to others are generally outside scope. The GFSC’s March 2025 Guidance Note provides detailed analysis of boundary cases, including decentralised protocols and ancillary technology services.

Minimum Organisational and Management Expectations

The GFSC expects every applicant to demonstrate substantive organisational readiness. The following checklist summarises baseline expectations:

• Corporate form: a company incorporated in Gibraltar or a branch of an overseas company registered in Gibraltar.
• Local presence: meaningful mind and management in Gibraltar not merely a registered office. An authorised representative may be required.
• Key personnel: appointment of a Money Laundering Reporting Officer (MLRO) resident in Gibraltar, a Compliance Officer, and directors who satisfy fit-and-proper assessments.
• Capital adequacy: while the regulations do not prescribe a fixed minimum capital figure in the same way as banking legislation, the GFSC expects firms to demonstrate adequate financial resources proportionate to their business model and risk profile.
• Systems and controls: robust IT governance, cybersecurity frameworks, and operational resilience arrangements appropriate to the nature and scale of DLT activities.

Core Ten Principles the Regulator’s Test for Licensing

The GFSC’s regulatory framework is principle-led. Applicants must demonstrate compliance with each of the following ten principles, providing evidence tailored to their business model:

1. Honesty and integrity: the firm and its key individuals must act with honesty and integrity. Evidence: personal questionnaires, background checks, character references.
2. Customer care: the firm must pay due regard to the interests and needs of customers. Evidence: complaints-handling procedures, customer-facing terms and conditions.
3. Adequate financial resources: the firm must maintain financial resources sufficient for its operations. Evidence: audited accounts, capital projections, source-of-funds documentation.
4. Risk management: the firm must manage and control its business effectively. Evidence: enterprise risk framework, risk registers, board-level oversight procedures.
5. Protection of client assets: client assets must be adequately safeguarded. Evidence: custody arrangements, asset-segregation policies, third-party audit reports.
6. Corporate governance: the firm must have effective governance arrangements. Evidence: board charter, committee structures, role definitions for senior management.
7. Systems and security: the firm must ensure its systems and security protocols are robust. Evidence: penetration-test reports, incident-response plans, SOC 2 or ISO 27001 certifications where appropriate.
8. Financial crime prevention: the firm must have effective AML/CFT systems. Evidence: AML/CFT policy manuals, transaction-monitoring procedures, MLRO appointment letters.
9. Resilience: the firm must have resilient and reliable systems. Evidence: business-continuity plans, disaster-recovery documentation, key-management architecture.
10. Regulatory engagement: the firm must be open and cooperative with the GFSC. Evidence: designated regulatory contact, reporting frameworks, willingness to participate in thematic reviews.

Documentation Checklist What to Prepare

Preparing a comprehensive application package is the single most effective way to accelerate GFSC review. The following high-level checklist covers the core documents most applicants will need:

• Constitutional documents: certificate of incorporation, memorandum and articles of association, shareholding structure and UBO declarations.
• Business plan: three-year projections, market analysis, product descriptions, revenue model, and growth strategy.
• Governance pack: board charter, organisational chart, role descriptions for directors, MLRO, Compliance Officer, and other key function holders.
• AML/CFT framework: policies, procedures, risk assessments, customer due-diligence methodology, transaction-monitoring protocols, and SAR reporting procedures.
• Custody arrangements: detailed description of how client assets are held, segregated, and protected including hot/cold wallet architecture, multi-signature controls, and insurance coverage (if any).
• IT and cybersecurity architecture: system topology, encryption standards, penetration-testing reports, disaster-recovery and business-continuity plans.
• Risk assessments: enterprise-level risk framework, operational risk register, and specific DLT-related risk analysis (e.g., smart-contract risk, network-fork risk).
• Financial documentation: audited accounts (if existing business), capital adequacy statement, source-of-funds evidence for investors and beneficial owners.
• Personal questionnaires: completed GFSC personal questionnaire forms for all directors, controllers, and key individuals.
• Token documentation: technical whitepaper or token mechanics document (if the business involves token issuance or use of proprietary tokens).

A downloadable application checklist structured as a page-by-page mapping to the relevant GFSC Guidance Notes is available for applicants who want a print-ready tracking tool. The checklist enables teams to mark each item as “in progress,” “complete,” or “not applicable” and cross-reference each requirement to the specific regulatory provision.

Packaging tip for multi-jurisdictional groups: if your entity holds licences in other jurisdictions, include a summary appendix listing each licence, the issuing authority, and a brief note on how it interacts with the Gibraltar DLT framework. Provide certified copies and certified translations of any non-English documents.

Fees & Typical Timelines

Costs associated with a DLT provider licence in Gibraltar fall into three categories: regulatory fees payable to the GFSC, professional fees for legal and compliance advisors, and ongoing annual supervisory fees. The GFSC publishes its fee schedule, and applicants should confirm current amounts directly with the Commission. Professional fees vary depending on the complexity of the business model, the readiness of existing documentation, and the extent of advisory support required.

Industry observers report that total professional and regulatory set-up costs for a straightforward exchange or custody application typically range from moderate to significant comparable to other reputable European jurisdictions. Annual supervisory fees are also payable post-authorisation. The following comparison table provides a high-level view of how Gibraltar’s DLT provider licence benchmarks against alternative European regimes:

All figures are indicative and based on publicly available information and industry experience. Applicants should confirm current fee schedules with the GFSC and obtain tailored quotes from their professional advisors. A more detailed jurisdictional comparison is available in the forthcoming Gibraltar vs Malta vs Liechtenstein guide.

How to Apply for a Gibraltar DLT Provider Licence Step-by-Step Workflow

The GFSC application process follows a structured sequence from initial assessment through to post-licence compliance. The workflow below reflects current regulatory practice and industry experience. Each step includes action items and indicative time windows; actual timelines depend on the completeness of the application and the complexity of the business model.

Step 1: Pre-Assessment & Jurisdiction Decision (Weeks 1–3)

Before committing to a Gibraltar application, conduct a gap analysis to determine whether the DLT licence is the correct authorisation for your business. Review the GFSC’s Guidance Note on scope to confirm your activities fall within the DLT framework. Assess whether existing licences held in other jurisdictions provide any overlap or exemption.

• Action: map your business activities against the regulated-activity definitions in the DLT Regulations 2020.
• Action: prepare a one-page summary of your corporate structure, target markets, and proposed Gibraltar presence.
• Action: contact the GFSC to arrange a pre-application meeting or initial engagement (recommended but not mandatory).

Step 2: Engage Local Counsel & Compliance Advisor (Weeks 2–4)

The GFSC expects applicants to demonstrate robust governance from the outset. Engaging experienced local counsel familiar with the GFSC’s expectations significantly improves the quality of the application and reduces the likelihood of extended query cycles.

• Action: appoint Gibraltar-qualified legal counsel with DLT licensing experience.
• Action: appoint or identify a compliance advisor to assist with AML/CFT policy drafting, risk assessment, and MLRO selection.

Step 3: Prepare Corporate Structure & Local Presence (Weeks 3–8)

Establish or register your Gibraltar company (or branch of an overseas company). Appoint directors who satisfy fit-and-proper criteria. Identify and appoint a local MLRO.

• Action: incorporate a Gibraltar company or register a branch.
• Action: secure office premises in Gibraltar with adequate infrastructure for your operations.
• Action: complete personal questionnaires for all proposed directors, MLRO, and key function holders.
• Estimated time: 3–6 weeks for company incorporation and initial appointments.

Step 4: Draft Core Application Documents (Weeks 4–12)

This is typically the most intensive phase. Prepare the business plan, AML/CFT policy suite, risk assessments, custody model documentation, and governance framework.

• Action: draft a detailed business plan covering products, revenue model, market analysis, and three-year financial projections.
• Action: develop comprehensive AML/CFT policies and procedures, including customer due diligence, transaction monitoring, and suspicious-activity reporting.
• Action: document custody arrangements hot/cold wallet architecture, multi-signature controls, asset-segregation methodology, and insurance or bonding.
• Action: prepare IT/cybersecurity architecture documents, including penetration-test reports and disaster-recovery plans.
• Estimated time: 4–8 weeks for document compilation (longer for complex multi-product businesses).

Step 5: Technical Readiness Security, Custody & Architecture (Weeks 6–14)

The GFSC places significant weight on the security and resilience of DLT platforms. For exchange and custody applicants, this step often runs in parallel with document drafting.

• Action: commission independent penetration testing and vulnerability assessments.
• Action: prepare proof-of-concept demonstrations for the custody model and trading infrastructure.
• Action: document key-management procedures, wallet architecture, and incident-response protocols.

Step 6: Financials & Source-of-Funds Documentation (Weeks 8–12)

• Action: compile audited financial statements (for existing businesses) or certified capital-availability letters.
• Action: prepare source-of-funds and source-of-wealth declarations for all beneficial owners and significant investors.
• Action: ensure capital adequacy projections demonstrate sufficient runway for at least 12–18 months of operations.

Step 7: File Application with the GFSC (Week 12–14)

Submit the completed application package to the GFSC, including all forms, supporting documents, and the application fee.

• Action: complete GFSC application forms (available from the GFSC website).
• Action: submit certified copies of all corporate and personal documents.
• Action: pay the application fee as prescribed by the GFSC’s current fee schedule.

Step 8: Respond to GFSC Queries & Prepare for Interviews (Weeks 14–30)

The GFSC will review the application and issue queries. This phase often involves multiple rounds of questions, requests for supplementary documentation, and for many applicants in-person or virtual interviews with key personnel.

• Action: designate a single point of contact to manage all GFSC correspondence.
• Action: respond to queries promptly and comprehensively delays in this phase are the most common cause of extended timelines.
• Estimated time: 8–24 weeks depending on the volume of queries and complexity of the application.

Step 9: Pre-Approval Conditions & Licensing Instrument (Weeks 28–36)

If the GFSC is minded to approve the application, it may issue a conditional approval specifying actions the applicant must complete before the full licence is granted. Common conditions include finalising staffing appointments, completing technical audits, or demonstrating live-environment testing.

• Action: satisfy all pre-approval conditions within the GFSC’s stipulated timeframe.
• Action: provide evidence of completion for each condition.

Step 10: Go-Live & Post-Licence Compliance (Ongoing)

Upon full authorisation, the firm is listed on the GFSC Regulated Entities register and may commence regulated DLT activities. Post-licence compliance obligations begin immediately.

• Action: implement supervisory reporting schedules as directed by the GFSC.
• Action: file AML/CFT returns and suspicious-activity reports as required.
• Action: maintain ongoing dialogue with your GFSC supervisory contact.

Common Pitfalls & Post-Licence Compliance Obligations

Common Pitfalls

• Incomplete AML/CFT policies: weak customer due diligence procedures or insufficient coverage of token-specific transaction flows are among the most frequent reasons for extended query cycles.
• Poorly documented custody arrangements: failure to clearly articulate how client assets are segregated, protected, and recoverable in insolvency scenarios.
• Insufficient board-level governance: directors who lack relevant experience or who cannot demonstrate active oversight of the DLT business.
• Underestimating technical controls: inadequate key-management documentation, missing hot/cold wallet split rationale, or absence of a tested incident-response plan.
• Unclear token classification: business plans that fail to explain the token economics, the regulatory status of tokens used, or the interaction between proprietary tokens and third-party assets.

Post-Licence Obligations

• Supervisory reporting: regular filings to the GFSC including financial returns, operational reports, and statistical data on schedules prescribed by the Commission.
• AML/CFT ongoing obligations: continued compliance with Gibraltar’s Proceeds of Crime Act obligations, including suspicious-activity reporting and periodic risk-assessment updates.
• Record-keeping and audit readiness: maintaining comprehensive records of transactions, customer data, and internal decisions and being prepared for GFSC inspections or thematic reviews.
• Notification obligations: prompt notification to the GFSC of material changes to the business, senior personnel, control structures, security incidents, or breaches of licence conditions.
• Licence conditions: compliance with any specific conditions imposed as part of the licensing instrument which may include customer thresholds, local staffing requirements, or restrictions on particular activities.

Practical mitigation tips: schedule regular internal audits (at least annually); appoint an experienced MLRO with dedicated capacity; maintain SOC 2 or ISO 27001 posture for custody services where appropriate; and establish a regulatory-change monitoring process to ensure ongoing alignment with GFSC expectations and any legislative amendments.

Licensed Provider Examples

The GFSC’s Regulated Entities register lists all firms currently authorised under the DLT framework. While individual circumstances vary, publicly available information reveals several instructive patterns:

• Centralised exchange operator: a well-known exchange obtained full DLT provider authorisation after implementing custodial asset segregation, engaging independent third-party auditors for its wallet infrastructure, and appointing a dedicated Gibraltar-resident MLRO with prior financial-services experience.
• Custodial wallet provider: a custody-focused firm secured its licence by demonstrating a multi-layered key-management architecture, comprehensive insurance coverage for digital assets under custody, and board-level cybersecurity expertise.
• Token-based payment service: a payment platform utilising DLT-based tokens for cross-border settlement received authorisation after producing detailed token-economics documentation and a robust AML/CFT framework tailored to payment-flow risks.

Readers can verify licensed DLT providers directly on the GFSC register to confirm the authorisation status of any Gibraltar-based provider.

Sources

• GFSC Distributed Ledger Technology Providers: Overview & Framework
• GFSC Regulated Entities Register
• GFSC Guidance Note: Scope of the DLT Regulatory Framework (Final, 28 March 2025)
• Government of Gibraltar Financial Services (Distributed Ledger Technology Providers) Regulations 2020 (Consolidated)
• Government of Gibraltar Financial Services (Distributed Ledger Technology Providers) (Amendment) Regulations 2025

To take the next step, review the downloadable application checklist, complete your pre-assessment against the GFSC’s ten principles, and arrange an application-readiness review with Global Law Experts.