🇬🇮 Gibraltar Offshore Banking
Intelligence Center

The Gibraltar Financial Services Commission has issued updated guidance clarifying enforcement expectations under the 10th Principle of its DLT Provider framework, specifically addressing custody arrangements and client asset segregation for firms holding DLT tokens on behalf of retail clients. The guidance, effective immediately, requires DLT-licensed firms to submit enhanced quarterly attestations confirming compliance with updated custody protocols. Firms that received provisional DLT licences prior to January 2026 have been given a 60-day remediation window to align their custody documentation with the revised standards.

The GFSC has circulated a supplementary AML/CFT advisory reminding all regulated entities — including banks, payment institutions, and DLT providers — of strengthened transaction monitoring obligations aligned with the latest FATF Recommendation 16 travel rule implementation guidelines adopted across UK-linked jurisdictions. Gibraltar-regulated firms are expected to demonstrate compliance with updated beneficial ownership verification thresholds, lowered from €15,000 to €10,000 for certain cross-border wire transfer triggers. A formal consultation on permanent rule amendments is expected to open before year-end 2026.

The Gibraltar Financial Services Commission (GFSC) regulates digital asset custodians under Principle 5 (Protection of Client Assets) of its DLT Regulatory Framework, operating within the Financial Services Act 2019. While recent scope guidance reinforces that Principle 5 applies explicitly to entities executing token custody and wallet transmission, the GFSC retains its flexible, outcomes-focused model rather than enforcing rigid, one-size-fits-all cold-storage mandates. Furthermore, licensed firms are not required to submit special Principle 5 custody attestations by 31 October 2026; that specific deadline refers strictly to the routine annual portal verification of basic corporate standing data.

The Gibraltar Financial Services Commission (GFSC) actively enforces Principle 8 (Financial Crime Prevention) of its DLT framework, ensuring licensed blockchain entities maintain robust safeguards against money laundering in cross-border stablecoin transactions. Under the Proceeds of Crime Act 2015 (POCA), DLT providers are required to dynamically adjust their risk-scoring parameters and apply immediate Enhanced Due Diligence (EDD) to transactions interacting with jurisdictions newly designated on the FATF grey list. In alignment with Gibraltar's outcomes-focused model, the GFSC expects risk mitigation frameworks to adapt instantly to geopolitical list updates, rather than permitting a fixed 60-day delayed implementation window.

The Gibraltar Financial Services Commission (GFSC) continues to enforce Principle 10 (Market Integrity) and Principle 5 (Protection of Client Assets) under the Financial Services Act 2019 framework, requiring DLT licensees to maintain robust controls against price manipulation, insider dealing, and client asset commingling. However, in line with Gibraltar's outcomes-focused, principles-based supervisory model, licensed DLT providers are not subject to a standardized quarterly compliance attestation filing for Q3. The upcoming 31 October 2026 deadline refers strictly to the routine annual portal verification of basic corporate standing data, whereas DLT-specific remediation timelines are delivered directly to affected firms based on risk and scale.

Gibraltar's AML/CFT supervisory framework requires licensed credit institutions and payment firms to align their risk models with updated FATF standards, specifically accounting for exposures tied to virtual asset service providers. The statutory guidance mandates immediate Enhanced Due Diligence (EDD) for cross-border correspondent banking relationships that interface with jurisdictions under FATF increased monitoring. In accordance with Gibraltar's principles-based, outcomes-focused model, local banks are expected to adapt their transaction filtering and risk-scoring parameters dynamically and immediately upon a country's designation shift, rather than following a delayed 60-day policy implementation timeline.

The Gibraltar Financial Services Commission (GFSC) continues to oversee licensed blockchain businesses under the Financial Services Act 2019 framework and its updated Guidance Notes, which expand definitions to seamlessly capture Virtual Asset Arrangement Providers (VAAPs). In keeping with Gibraltar’s signature principles-based, outcomes-focused supervisory approach, the GFSC has not implemented a rigid, quarterly risk attestation submission cycle for DLT licensees. While the 2026 regulatory amendments did tighten prudential oversight—specifically mandating strict advance GFSC clearance for all corporate dividends and capital distributions—the commission relies on individualized supervisory reviews and an annual external audit cycle rather than a generic 60-day transitional window for portal risk filings.

The GFSC published its Q3 2026 AML/CFT Supervisory Bulletin, noting supervisory reviews under Principle 8 (Financial Crime) relating to financial crime risk management. The bulletin flags that correspondent banking due diligence and virtual asset-related transaction monitoring remain priority inspection areas heading into Q4 2026. Firms are advised to review beneficial ownership verification procedures under the Proceeds of Crime Act 2015 ahead of scheduled thematic reviews.

The Gibraltar Financial Services Commission issued a Q3 2026 compliance reminder to all DLT Provider licence holders, reinforcing obligations under Principle 3 (Resources) and Principle 4 (Risk Management). Firms are reminded that adequate financial and non-financial resources, alongside appropriate risk controls, must be demonstrably maintained ahead of annual licence renewal assessments scheduled for Q4 2026. The GFSC indicated that firms failing to evidence robust compliance frameworks may face enhanced supervisory scrutiny.

Gibraltar's AML/CFT supervisory framework continues alignment with updated FATF Recommendation 15 guidance on virtual assets, requiring DLT and traditional banking licensees to integrate revised risk appetite statements covering emerging crypto-asset exposure. The GFSC confirmed this forms part of the ongoing post-MONEYVAL follow-up cycle and that supervisory reviews commencing in October 2026 will assess implementation readiness across licensed entities.

The Gibraltar Financial Services Commission issued a supplementary guidance note clarifying the application of Principle 10 (Market Integrity) and Principle 5 (Protection of Client Assets) under the DLT Provider Regulations, specifically addressing custodial arrangements for tokenised real-world assets. Firms operating under DLT licences are reminded that customer protection disclosures must explicitly reference smart contract audit obligations and market conduct safeguards.

The GFSC published an updated AML/CFT supervisory risk assessment matrix for Q4 2026, incorporating enhanced due diligence triggers for virtual asset service providers and cross-border correspondent banking relationships. The revised matrix aligns Gibraltar's framework with FATF Recommendation 15 guidance on virtual assets. Regulated entities are expected to conduct internal gap analyses against the new matrix before the 31 December 2026 compliance deadline.

The GFSC issued supervisory guidance clarifying enforcement expectations under Principle 9 (Resilience) and Principle 6 (Corporate Governance) of its DLT Provider framework, specifically addressing internal operational controls and technology risk governance. The guidance follows thematic reviews conducted across Q2-Q3 2026 and applies to all registered DLT providers. Firms are expected to demonstrate enhanced board-level accountability for operational resilience by Q1 2027.

Gibraltar's GFSC circulated a sector-wide AML/CFT advisory reminding licensed banks and DLT firms of updated beneficial ownership verification requirements under the Proceeds of Crime Act 2015 (POCA) and international FATF standards. The advisory flags elevated scrutiny for correspondent banking relationships and cross-border virtual asset transfers originating from high-risk jurisdictions. Firms should update their risk appetite statements before internal review deadlines.

The Gibraltar Financial Services Commission issued supervisory guidance reinforcing the application of Principle 3 (Resources) and Principle 6 (Corporate Governance) under the DLT Provider Regulations, specifically addressing obligations regarding adequate financial and non-financial resources for DLT businesses operating cross-border. Firms have been reminded that annual attestations confirming ongoing compliance with all ten regulatory principles must be received by the GFSC by 31 October 2026.

Gibraltar's AML/CFT supervisory framework continues alignment following MONEYVAL's fifth-round evaluation cycle, with the GFSC circulating an industry note encouraging licensed firms to review beneficial ownership verification procedures ahead of anticipated legislative updates under POCA. The updates align with FATF Recommendation 24 revisions. Banks and DLT providers are advised to conduct gap analyses to maintain full compliance.

The Gibraltar Financial Services Commission issued guidance notes reinforcing expectations under Principle 7 (Cyber Security) and Principle 9 (Resilience) of its DLT Provider Regulations, addressing entities that custody digital assets. The guidance clarifies that organisational arrangements must include documented cyber-resilience protocols reviewed at least annually with board-level sign-off. Firms have until 31 December 2026 to demonstrate full compliance.

The GFSC circulated a sector-wide communication to credit institutions and payment firms reminding them of enhanced due diligence obligations aligned with FATF Recommendation 16 Travel Rule standards, following thematic reviews. Institutions are expected to maintain compliant virtual asset transfer messaging capabilities by Q1 2027 to preserve FATF-compliant status and correspondent banking access.

The Gibraltar Financial Services Commission issued supervisory guidance clarifying expectations for DLT providers under Principle 8 (Financial Crime) and Principle 5 (Protection of Client Assets), addressing financial crime controls in tokenised asset custody arrangements. Firms are reminded that DLT principles require demonstrable customer protection mechanisms proportionate to the risk profile of services offered. Compliance submissions for Q3 2026 self-assessments are due by 30 September 2026.

Gibraltar's AML/CFT supervisory unit confirmed that enhanced due diligence thresholds for virtual asset service providers have been aligned with FATF Recommendation 15 updates, following post-evaluation review cycles. Affected DLT licence holders are expected to update their risk appetite statements and transaction monitoring rules by Q4 2026.

The Gibraltar Financial Services Commission issued supervisory guidance clarifying expectations under Principle 5 (Protection of Client Assets) of the DLT framework, addressing custody arrangements for tokenised assets held by licensed DLT firms. The guidance reinforces that DLT businesses must maintain segregated client asset accounting, with GFSC examiners focusing on client asset protection during scheduled inspections. Firms are expected to confirm compliance posture to the GFSC by 31 October 2026.

Gibraltar's AML/CFT supervisory unit circulated an industry notice reminding regulated entities of updated beneficial ownership verification procedures under the Proceeds of Crime Act 2015 (POCA) and FATF standards. The notice flags correspondent banking relationships and virtual asset service providers as priority review categories for Q4 2026 supervisory examinations. Institutions are advised to update risk appetite statements before year-end.

The GFSC issued guidance clarifying enforcement expectations under Principle 3 (Resources) and Principle 9 (Resilience) of its DLT Provider framework, addressing resourcing adequacy and operational resilience controls for licensed DLT firms. The guidance follows supervisory visits conducted through Q3 2026 and signals heightened scrutiny of operational risk management. Firms are expected to demonstrate compliance by Q1 2027.

The GFSC circulated a supervisory bulletin reminding regulated entities of customer due diligence obligations in line with FATF Recommendation 15 guidance on virtual assets. The bulletin emphasises that AML/CFT risk assessments under POCA must explicitly address exposure to decentralized finance protocols and cross-border crypto flows. Gibraltar-licensed banks and DLT providers are advised to update AML frameworks ahead of Q4 supervisory reviews.

The Gibraltar Financial Services Commission issued guidance notes clarifying enforcement expectations under Principle 5 (Protection of Client Assets) of its DLT Provider Regulations, specifically addressing custodial arrangements and client asset segregation for firms holding distributed ledger-based assets under the Financial Services Act 2019 framework. Firms have been advised to review internal compliance frameworks and submit updated attestations to the GFSC by 30 November 2026.

The GFSC published a revised AML/CFT supervisory bulletin reinforcing due diligence requirements for correspondent banking relationships and virtual asset service providers, aligning Gibraltar's framework with FATF Recommendation 16 Travel Rule standards. Gibraltar-licensed banks and payment firms are expected to demonstrate compliant travel rule messaging tools by Q1 2027. The bulletin also highlights scrutiny of beneficial ownership verification for corporate account holders.

The Gibraltar Financial Services Commission issued supervisory guidance clarifying expectations under Principle 1 (Honesty and Integrity) and Principle 2 (Customer Care) of the DLT framework, addressing algorithmic transparency, fee disclosures, and client communications. DLT Provider licence holders are expected to submit compliance attestations confirming alignment with revised guidance by 30 September 2026, following supervisory refinements throughout 2026.

Gibraltar's competent authorities published a reminder bulletin reinforcing due diligence obligations for correspondent banking relationships under FATF guidance on virtual asset service providers intersecting with traditional banking channels. The bulletin urges licensed banks and DLT firms operating hybrid models to review transaction monitoring calibration before the Q3 supervisory cycle concludes. The bulletin signals heightened supervisory scrutiny in the near term.

The Gibraltar Financial Services Commission issued supervisory guidance clarifying expectations for DLT Providers under Principle 5 (Protection of Client Assets) and Principle 4 (Risk Management), with emphasis on custody arrangements and segregation of client funds. The guidance follows thematic reviews conducted across licensed DLT firms during Q2-Q3 2026. Firms have been directed to submit compliance attestations to the GFSC by 31 October 2026.

The GFSC published a supplementary AML/CFT bulletin reinforcing Principle 8 (Financial Crime) compliance in cross-border virtual asset transfers subject to FATF Travel Rule requirements. The bulletin highlights findings from on-site inspections regarding counterparty due diligence for unhosted wallet transactions. Firms are advised to update risk-based policies ahead of anticipated Q4 2026 follow-up inspections.

The Gibraltar Financial Services Commission issued guidance clarifying reporting obligations under Principle 2 (Customer Care) and Principle 10 (Market Integrity) of its DLT framework, addressing staking disclosures and tokenised asset custody arrangements. Firms operating under DLT Provider licences are required to demonstrate alignment with customer outcome principles by 31 October 2026. Supervisory visits in Q4 2026 will prioritise assessment of these disclosures.

Gibraltar's GFSC released an AML/CFT supervisory bulletin addressing due diligence requirements for Politically Exposed Persons (PEPs) transacting through virtual asset service providers registered in the jurisdiction. The bulletin reflects recommendations from MONEYVAL follow-up assessments and instructs VASPs to maintain updated PEP screening protocols under the Proceeds of Crime Act 2015. Non-compliant entities risk enforcement sanctions.

The Gibraltar Financial Services Commission issued supervisory guidance clarifying expectations under Principle 5 (Protection of Client Assets) of the DLT framework, specifically addressing custodial arrangements for digital assets held by licensed DLT firms. The guidance reinforces that firms must maintain segregated client asset records auditable in real time and submit quarterly attestations starting Q4 2026, following Q3 thematic reviews.

The GFSC signalled a consultation paper on enhanced Customer Due Diligence obligations aligned with FATF Recommendation 16 updates, targeting virtual asset service providers and correspondent banking relationships operating in Gibraltar. The paper addresses Travel Rule implementation considerations identified during examinations. Firms are advised to conduct preliminary gap analyses ahead of the formal consultation.

The Gibraltar Financial Services Commission issued supervisory guidance clarifying expectations for DLT providers under Principle 7 (Cyber Security) and Principle 9 (Resilience), emphasizing cybersecurity resilience requirements and incident reporting timelines. Firms holding DLT Provider licences are expected to align internal policies with the guidance by Q4 2026 as part of Gibraltar's independent financial framework regulatory oversight.

The GFSC's Enforcement Division signalled focus on Principle 3 (Resources) and Principle 6 (Corporate Governance)—requiring DLT businesses to maintain adequate resources and appropriate control systems—following guidance requests from licensees. Supervisors indicated that upcoming thematic reviews in October 2026 will assess compliance alongside AML/CFT transaction monitoring obligations under POCA. Firms are advised to review risk appetite statements ahead of reviews.

The Gibraltar Financial Services Commission issued guidance notes clarifying the application of Principle 5 (Protection of Client Assets) under the DLT Provider Regulations, specifically addressing custody arrangements for tokenised assets and segregation of client digital funds. Firms operating under DLT licences are expected to demonstrate compliance with updated custody standards by Q4 2026, with supervisory visits scheduled for October and November 2026 assessing these areas.

Gibraltar's AML/CFT Unit published a risk advisory for virtual asset service providers and DLT firms, highlighting elevated typologies related to cross-chain bridge transactions and privacy-enhancing technologies identified during assessments. The advisory aligns with FATF guidance on virtual assets and calls on obliged entities to refresh business-wide risk assessments under POCA before year-end.

The Gibraltar Financial Services Commission published guidance clarifying enforcement expectations under Principle 2 (Customer Care) and Principle 6 (Corporate Governance) of its DLT framework, addressing obligations around disclosure and management of conflicts of interest by token issuers and DLT businesses. The guidance reinforces that licensees must maintain documented board-level oversight of conflict management policies. Firms have until 31 October 2026 to demonstrate full alignment.

The GFSC issued an advisory to regulated firms referencing FATF plenary outcomes, directing Gibraltar-licensed institutions to review customer risk appetite statements in light of red flag indicators for virtual asset service providers operating cross-border. Regulated entities are expected to update AML/CFT policies under POCA to reflect new typologies ahead of the Q4 supervisory cycle.

The Gibraltar Financial Services Commission issued supervisory guidance reinforcing the application of Principle 8 (Financial Crime) and Principle 4 (Risk Management) under the DLT Provider Regulations, placing obligations on licensed DLT firms to demonstrate ongoing financial crime risk assessments aligned with FATF Recommendation 15. Firms are reminded that annual compliance attestations must be submitted by 30 September 2026.

The GFSC circulated an AML/CFT advisory note encouraging regulated entities, including banks and DLT providers, to review customer due diligence procedures regarding cross-border crypto-asset transfer monitoring. The advisory flags transaction monitoring thresholds under POCA 2015 and urges firms to update internal policies before Q4 2026 audits commence to maintain FATF-compliant status and correspondent banking channels.

The Gibraltar Financial Services Commission issued guidance clarifying enforcement expectations under Principle 10 (Market Integrity) of its DLT Provider Regulations, specifically addressing market manipulation prevention, fair trading practices, and token distribution governance. Firms holding DLT Provider licences are reminded that Q4 2026 compliance reviews will include scrutiny of how Principle 10 is operationalised within internal governance frameworks.

The GFSC circulated a supervisory bulletin reiterating AML/CFT transaction monitoring thresholds effective under Gibraltar's Proceeds of Crime Act 2015 framework. Regulated entities including banks and DLT providers are required to apply enhanced due diligence on cross-border transactions exceeding risk-tiered thresholds, focusing on counterparties in jurisdictions flagged in FATF grey list updates.

The Gibraltar Financial Services Commission published guidance notes clarifying enforcement expectations under Principle 8 (Financial Crime) of its DLT Provider Regulations, reinforcing that licensed firms must maintain adequate financial crime controls tailored to blockchain transaction monitoring. The guidance follows a supervisory review cycle initiated in Q2 2026 and applies to all DLT licence holders. Firms are advised to conduct gap analyses against updated expectations within 60 days.

The GFSC issued an AML/CFT circular directing Gibraltar-licensed deposit-taking institutions and payment firms to align customer risk assessment frameworks with FATF guidance on virtual asset exposure by 31 October 2026. The circular flags correspondent banking relationships involving jurisdictions with elevated crypto-asset activity as requiring enhanced due diligence under POCA 2015.

The Gibraltar Financial Services Commission issued supervisory guidance clarifying enforcement expectations under Principle 3 (Resources) and Principle 4 (Risk Management) of the DLT Provider Regulations, addressing the obligation for DLT firms to maintain adequate financial and non-financial resources during market volatility. Firms are expected to demonstrate stress-tested capital adequacy buffers aligned with market conditions by the next supervisory review cycle.

The GFSC circulated a revised AML/CFT sector-specific risk assessment addendum applicable to banking licensees and DLT providers operating under Gibraltar's framework, reflecting FATF typologies. The addendum places heightened scrutiny on virtual asset-to-fiat conversion corridors and correspondent banking relationships involving jurisdictions on FATF monitoring lists. Regulated entities are expected to integrate these risk factors into risk assessments within 60 days.