A Gibraltar DLT licence is Part 7 permission from the Gibraltar Financial Services Commission (GFSC) to use distributed ledger technology to store or transmit value that belongs to other people. Since 27 October 2025, crypto exchange and brokerage businesses that do not take custody need a separate VAA provider permission instead. Both regimes are principles-based. E-money and payment firms are licensed under EU-derived rules with fixed capital thresholds.
At a glance
| Item | Position as of October 2026 |
|---|---|
| Regulator | Gibraltar Financial Services Commission (GFSC) |
| Crypto legislation | Financial Services Act 2019; Financial Services (DLT Providers and VAA Providers) Regulations 2020 |
| Permissions | DLT provider (custody or transmission); VAA provider (exchange or arranging, non-custodial) |
| Standard | Ten regulatory principles, applied in proportion to risk |
| DLT application fee | £45,000 (2025/26 fee year) |
| E-money initial capital | At least €350,000 |
| UK or EU passport for crypto | None |
Who needs a DLT provider licence?
You need DLT provider permission if, by way of business in or from Gibraltar, you use DLT to store or transmit value belonging to others. The GFSC treats holding or controlling private keys as storage. Controlling the sending of value counts as transmission.
The GFSC’s March 2025 scope guidance lists these as typically in scope:
- custodial wallet providers and crypto ATM operators
- spot exchanges, both custodial and non-custodial, and crypto-denominated derivatives venues that fall outside other financial instruments rules
- OTC and brokerage desks that hold or move client value on DLT
- lending and borrowing platforms that hold collateral, and managed investment services that hold client assets
- operators of smart contracts, decentralised apps and exchanges that keep control or influence, and stablecoin arrangements, both assessed case by case
Usually out of scope are non-custodial wallet software, hardware wallet makers, pure advice, research and open-source development, own-account mining or staking, and developers who keep no control or commercial benefit. Firms that issue or sell their own tokens stay under the Proceeds of Crime Act 2015 registration regime, not DLT licensing.
What changed in October 2025: VAA providers
On 27 October 2025, providing virtual asset arrangements became a regulated activity under the Financial Services Act 2019. The activity covers exchanging virtual assets for money, money for virtual assets, or one virtual asset for another, and arranging those exchanges. The regulations were renamed to cover both DLT providers and VAA providers.
The dividing line is custody:
- Take custody and use DLT to store or move client assets: you need DLT provider permission.
- Arrange or execute exchanges without custody: OTC desks, brokers, market makers and peer-to-peer platforms need VAA provider permission.
These businesses had been on an AML-only registration. Those already registered had to notify the GFSC within 14 days and apply for Part 7 permission within six months. Funds, pension schemes and their managers or depositaries dealing for their own regulated business are excluded.
What are the regulatory principles?
The GFSC will only grant permission if it is satisfied that you will meet the regulatory principles at all times. In summary, you must:
- act honestly and with integrity
- treat customers fairly and communicate clearly
- hold adequate financial and non-financial resources
- manage the business with due skill, care and diligence, including risk management
- protect client assets and money
- have effective corporate governance
- keep systems and security access protocols at a high standard
- prevent, detect and disclose financial crime
- be resilient, with plans for an orderly and solvent wind-down
- protect the integrity of the markets you take part in
The GFSC applies principles 5 and 10 differently to VAA providers, because they do not hold client assets. Since 26 March 2026, any DLT or VAA provider must notify the GFSC at least 30 days before paying a dividend or other capital distribution. The GFSC can object. The maximum administrative penalty for a firm is the higher of £1 million, 5% of annual turnover, or twice the benefit gained.
How do you apply for a DLT licence?
The GFSC uses a staged, risk-based process. Plan for these steps.
1. Early engagement
Present your model to the GFSC’s authorisations team so it can confirm whether you need DLT permission, VAA permission or neither, and how complex it considers your business.
2. Form a Gibraltar entity and appoint people
Incorporate a Gibraltar company with local management. Our guide to setting up a company in Gibraltar explains incorporation. Directors, controllers and key staff will be assessed as fit and proper.
3. Prepare the application
You will need a business plan and financial projections, capital and wind-down planning, governance and risk frameworks, client-asset arrangements, IT and cyber security documentation, and AML and FATF Travel Rule controls. You should expect detailed questions on how keys are generated, stored and recovered.
4. Assessment and presentation
The GFSC reviews each section against the principles and usually asks for presentations from management. Expect several rounds of questions.
5. Grant and conditions
Permission may come with conditions, for example on product scope or capital, before you go live. Opening a bank account can take as long as the licence itself. See opening a business bank account in Gibraltar.
The GFSC does not publish an indicative timeline for DLT or VAA applications. Adviser estimates published in 2026 run from about four months for simple models to 9–18 months for most applicants, with custody and exchange businesses at the longer end.
How much does a Gibraltar DLT licence cost?
For the 2025/26 fee year, the GFSC published these DLT provider fees:
| Fee | 2025/26 amount |
|---|---|
| Application fee | £45,000 |
| Annual trade activity fee | Capped at £90,000 |
| Additional annual fee | £27,362 |
| AML supervision fee | £3,900 |
For 2026/27 (from 1 April 2026) the Financial Services (Fees) Regulations 2020 keep the application fee at £45,000 and raise the annual fees by about 3%. The annual fee is now a £12,254 base fee plus a 0.1% trade activity fee capped at £92,700 and an additional fee of £28,183, and the AML supervision fee is £4,017. VAA providers pay exactly the same fees as DLT providers.
On top of these, budget for local staff, office space and audit. Published 2026 adviser estimates put legal, compliance and security-testing work at around £60,000 to £170,000 for a typical project, and more for complex custody models. Gibraltar corporate tax is 15%.
What about e-money and payment institutions?
E-money institutions are authorised under the Financial Services (Electronic Money) Regulations 2020, which follow the EU E-Money Directive model:
- Initial capital of at least €350,000, held before permission is granted.
- Small e-money institutions can qualify if average outstanding e-money stays at or below €5 million and monthly payment transactions average no more than €3 million.
- Application fee for an e-money institution was £45,000 for 2025/26, with an AML supervision fee of £3,900.
One Gibraltar law firm puts the overall timeline at 12 to 18 months from project start, through the GFSC’s staged application process. That estimate assumes you respond quickly to questions. Our guide to e-money and payment institution licensing covers capital, safeguarding and the 2026/27 fees in detail.
Can a Gibraltar fintech serve UK customers?
It depends on the sector. Gibraltar is the only British Overseas Territory with market access into the UK for financial services. According to the FCA, firms passporting between Gibraltar and the UK do so under transitional arrangements that run until 31 December 2026. That date may be extended until the permanent Gibraltar Authorisation Regime (GAR) under the UK Financial Services Act 2021 is ready. In June 2026 Gibraltar’s minister told Parliament the GAR was about 18 months away. As of late October 2026 no further extension had been announced: the FCA and the Bank of England still give 31 December 2026, and the Bank of England notes the date can be extended again until the GAR is in place. Check the FCA page before relying on access after that date.
E-money and payment firms rely on separate transitional provisions in the UK’s Electronic Money and Payment Services Regulations. DLT and VAA providers have no UK access route at all. They must meet UK rules on their own terms, including the new UK cryptoasset regime due to apply from October 2027.
What changed with the 2026 UK–EU treaty?
For fintech licensing, little changed directly. The UK–EU treaty, applied provisionally since 15 July 2026, does not restore EU financial services passporting and does not bring Gibraltar into the EU single market. A Gibraltar DLT firm cannot passport under MiCA. To serve EU customers at scale, it needs a MiCA authorisation in an EU member state. The treaty does commit the UK and EU to cooperate on anti-money laundering and counter-terrorist financing, so that Gibraltar’s standards stay equivalent to the EU’s. It has no provisions specific to DLT or crypto firms.
The treaty does help with staffing and travel, because the border fence has gone. Our UK–EU treaty explained for business covers the wider picture, and the licensed sectors hub compares Gibraltar’s other regulated regimes.