Obtaining crypto licenses, white label consulting,
ICO/STO, supporting NFT marketplaces, drafting policies
for crypto projects, DAOs, and gamify projects
A crypto license in Gibraltar gives a blockchain business access to one of the longest-running crypto frameworks in the world, supervised by the Gibraltar Financial Services Commission (GFSC). Gibraltar was one of the first jurisdictions to adopt a purpose-built regulatory framework for blockchain businesses, and firms operating under GFSC permissions include Digital Asset Management Ltd, eToro X Limited, Hippo Capital Co Limited, LMAX Digital Broker Ltd and Xapo VASP Limited. This page explains which activities need a Gibraltar crypto licence, what the GFSC charges, which people and documents the regulator expects and how long the process takes. SBSB Fintech Lawyers supports founders at every stage, from scoping the business model to final approval.
In October 2026, Gibraltar’s appeal to major fintech players was confirmed once again: on 19 October, the GFSC granted a DLT Provider licence to Revolut Global Digital Assets Limited, a newly created subsidiary of Revolut. The neobank, which serves more than 80 million customers worldwide, already provides crypto services in the UK and, under MiCA, across the EEA. It will use the Gibraltar entity to support its crypto expansion into international markets beyond those regions. Revolut joins a line of well-known exchanges and brokers authorised in Gibraltar, including CEX.IO and Bullish.
What is a crypto license in Gibraltar?
A Gibraltar crypto license is a permission granted by the GFSC under the Financial Services (DLT Providers and VAA Providers) Regulations 2020. The licence is required for any firm that, by way of business in or from Gibraltar, uses distributed ledger technology to store or transmit value belonging to others. The market uses several names for the same authorisation: DLT license Gibraltar, Gibraltar DLT licence, Gibraltar cryptocurrency license or GFSC DLT provider licence. Since 27 October 2025, the framework also covers Virtual Asset Arrangement (VAA) providers, which exchange virtual assets for fiat, fiat for virtual assets or one virtual asset for another.
Instead of a long rulebook, the GFSC applies regulatory principles. They cover honesty and integrity, customer care, financial resources, risk management, protection of client assets, corporate governance, cybersecurity, financial crime prevention, resilience and market integrity. Each applicant must show how its own business model meets every principle. The GFSC’s DLT framework page and its Guidance Note on the Scope of the DLT Framework set out the regulator’s approach.
A principles-based regulator assesses outcomes, not checklists. The applicant who explains its own risks better than anyone else wins the GFSC's trust.
Which crypto activities need a DLT licence
A crypto licence Gibraltar firms hold covers a wide range of virtual asset business. The GFSC confirms the exact scope for each business model at the pre-application meeting, so the list below shows typical cases rather than a closed catalogue.
Crypto exchange
Operating a trading platform or exchanging crypto for fiat, fiat for crypto or one crypto-asset for another. Since October 2025, pure exchange arrangements can also be authorised as a VAA provider.
Custody and wallets
Custody and administration of clients’ crypto-assets, including custodial wallet services, private key management and hot and cold storage.
Brokerage and order execution
Receiving and executing orders on behalf of clients, including trading in crypto derivatives and structured products. These products are allowed, subject to suitability assessments and MiFID-style conduct rules.
OTC desks
Arranging bilateral crypto-to-fiat or crypto-to-crypto trades for clients, where the firm holds or moves client value.
Payments and transfers
Transmission or transfer of crypto-assets between users, wallets or accounts, including payment and remittance services built on a blockchain.
Staking and tokenisation
Staking services, DeFi protocols and tokenisation platforms that hold or move clients’ digital assets, where appropriately governed and disclosed.
What does not need a DLT licence
- Pure software projects that never hold or control client assets, such as non-custodial wallet developers or blockchain analytics tools.
- Token sales on their own, although a token may fall under securities or fund legislation depending on its structure.
- Firms already licensed in Gibraltar that use DLT only to improve internal processes.
- Some virtual asset service providers that are outside the DLT framework. These register with the GFSC under the Proceeds of Crime Act 2015 instead.
A bank that wants to offer virtual currency wallets, however, must obtain DLT authorisation.
Crypto license in Gibraltar cost
The Gibraltar crypto license cost has two parts: the regulatory charges set by the GFSC and the budget for people, premises, systems and advisers. Regulatory charges are fixed in the Financial Services (Fees) Regulations 2020 and published each year in the GFSC fees newsletter.
Gibraltar DLT license fees
| Fee | 2025/26 (GFSC newsletter) | When it is paid |
|---|---|---|
| Initial application assessment fee | £2,000 | At the pre-application stage |
| GFSC application fee (Part 7 permission, DLT provider) | £45,000 | On submission of the application |
| Annual base fee | £11,897 | Within 28 days of the April invoice |
| Annual additional fee | £27,362 | Together with the base fee |
| Annual trade activity fee | 0.1% of trade volume, capped at £90,000 | Together with the base fee |
The GFSC annual fees 2026 apply to the financial year from 1 April 2026 to 31 March 2027. In the first year, annual charges are calculated pro rata from the date of authorisation.
Requirements for a Gibraltar crypto license
A GFSC crypto license requires real substance in Gibraltar, fit and proper people and a documented control framework.
Local presence. A local office is mandatory to demonstrate “mind and management” in Gibraltar. It must serve as the operational base for key management personnel, who are expected to be physically present for the majority of the time.
Gibraltar entity. A Gibraltar private limited company (GibCo) must be incorporated and maintained.
Capital and financial projections. There is no fixed minimum capital requirement. Capital adequacy must match the firm’s prudential risks and, as a minimum, allow an orderly and solvent wind-down. Financial forecasts must be prepared and validated by a local Gibraltar accountant. Where appropriate, the GFSC also expects professional indemnity insurance.
Local staffing. The GFSC requires qualified individuals who ensure effective governance and compliance in Gibraltar:
- Directors. At least two directors, with a minimum of one resident in Gibraltar. They need expertise in fintech, blockchain or financial services and must spend a substantial part of their time in Gibraltar.
- MLRO. Must be based in Gibraltar and approved by the GFSC. A Deputy MLRO is recommended and can be a non-resident, subject to GFSC approval.
- Compliance Officer. Strongly recommended to be resident in Gibraltar. In smaller firms, the role may be combined with the MLRO if the GFSC agrees.
- Non-Executive Director. At least one independent, Gibraltar-resident NED is advisable.
- Finance and accounting. A local accountant prepares financial statements and regulatory returns, and an external Gibraltar-accredited auditor is required.
- IT and information security. An Information Security Officer or IT lead must be designated. This role may be remote if IT and cyber frameworks are documented and regularly tested.
Each key person completes a regulated individual form. The GFSC assesses their integrity, competence and financial position, and shareholders and controllers must evidence their source of wealth and funds.
Application documents. The DLT license Gibraltar application package includes (additional documents and information may also be required for each individual business):
- Business Plan with financial projections;
- AML/CFT Compliance Manual;
- Risk Management Policy;
- IT and Cybersecurity Policy;
- Corporate Governance Manual;
- Data Protection Manual;
- Complaints and Conflict of Interest Policies;
- Disaster Recovery and Business Continuity Plan;
- Liquidity/Solvency Policy;
- Employee Remuneration and Delegation Policies;
- client asset safeguarding procedures, including private key management.
How to get a crypto license in Gibraltar: step by step
Since 2024, the GFSC uses a staged application process: each stage opens only after the regulator is satisfied with the previous one.
- KYC and preparation. We collect KYC documents, agree engagement terms and reserve the company name.
- Incorporation and team. We incorporate the Gibraltar company and appoint local directors, the MLRO and other key persons.
- Regulatory documents. We prepare the business plan, policies (AML/CFT, governance, IT) and the initial application package.
- Pre-application meeting. The applicant presents its business model to the GFSC DLT team, which confirms whether the activity falls within the framework.
- Stage 1. The firm pays the GFSC application fee and files the application form, controller forms, source of wealth evidence and the core business plan.
- Stages 2–3. The GFSC reviews governance, risk management, IT and cyber security, outsourcing, AML controls, client asset safeguarding, conduct of business and regulated individual forms. Key individuals present the business to the regulator.
- Stage 4 and decision. The GFSC completes its final checks and grants the Gibraltar DLT licence. After authorisation, it visits the firm to confirm that the controls work in practice.
Documents required to start a project
- Certified copy of the international passport of each shareholder, director, MLRO and other key person (notarised and apostilled).
- Detailed CVs of directors, shareholders and key personnel, in English and ideally in EU format.
- Proof of residential address for all individuals, such as a utility bill or bank statement issued within the last 3 months.
- Initial corporate structure, including shareholding breakdown, control relationships and organisational chart.
- Description of the business model: services, target clients, geographic focus and intended token or asset types.
- Overview of the technology stack and operational setup, such as wallet architecture, custody approach and platform design.
- Initial AML/CFT framework assumptions, including client onboarding, transaction monitoring and PEP/sanctions screening tools.
- List of existing internal policies and compliance documentation, if available, for review and gap analysis.
- Information on funding: capitalisation plan, source of funds and anticipated financial forecasts.
- Any group structure or affiliated entities, with an explanation of intra-group relationships.
Timeline: how long does it take?
A typical project takes around 12 months from the first KYC documents to authorisation. About half of that time is preparation on the applicant’s side; the rest is the GFSC review.
| Stage | Duration | Weeks | Month |
|---|---|---|---|
| KYC, engagement terms, name reservation | 2–4 weeks | 1–4 | I |
| Incorporation, appointment of local directors, MLRO and other key persons | 4 weeks | 5–8 | II |
| Business plan, policies and initial application package | 6–8 weeks | 9–16 | III–IV |
| Initial application, pre-application meeting and feedback | 4–8 weeks | 14–22 | IV–V |
| Submission of the full licence application (Stage 1) | 4–8 weeks | 22–30 | VI–VII |
| GFSC review (Stages 2–4), responses to queries and authorisation | GFSC target: up to 9 months for all stages; in practice 4–8 months | 31–52 | VIII–XII |
The GFSC aims to move applicants through Stages 1–3 within six months and to complete Stage 4 for DLT firms within a further three months (GFSC staged approach). These are maximum targets, not guarantees. In practice, a complete and consistent application with an experienced team typically spends 5–9 months under review. Exchanges with complex products can take longer.
The clock depends less on the regulator and more on the applicant. Delays usually come from incomplete source of funds evidence, generic policies borrowed from other jurisdictions and late changes to the business model. A material change during the review may lead to a new assessment of the whole application.
Obligations after licensing
Authorisation marks the start of ongoing supervision. A licensed DLT or VAA provider must comply with the regulatory principles at all times and promptly inform the GFSC of any event that may affect that compliance. The main recurring duties include:
- Annual audit. Audited financial statements prepared by a Gibraltar-accredited auditor.
- GFSC reporting. Regular supervisory returns and notifications of material events.
- AML/CFT. Customer due diligence, transaction monitoring and suspicious activity reporting under the Proceeds of Crime Act 2015.
- Travel Rule. Collecting and transmitting originator and beneficiary information with crypto transfers.
- Change of control. GFSC approval before a change of controller or a material change to the business model.
- Dividends. Since March 2026, a dividend or other capital distribution requires prior notice to the GFSC and no objection from it.
- Annual fees. Payment of the annual regulatory and AML supervision fees within 28 days of the April invoice.
- Ongoing substance. Keeping the office, resident directors, MLRO and real decision-making in Gibraltar.
- Resilience. Maintaining and testing business continuity, cyber and wind-down plans.
Late payment of fees triggers a £250 administrative charge and interest at 5% above the base rate.
Taxation of crypto companies in Gibraltar
| Tax | Details |
|---|---|
| Corporate income tax | 15% on profits accrued in or derived from Gibraltar (since 1 July 2024). Profits generated outside Gibraltar are generally not taxed. |
| VAT | There is no VAT in Gibraltar. |
| Capital gains | Generally not taxed. |
| Withholding tax | No withholding tax on dividends, interest or royalties paid by a Gibraltar company, regardless of the recipient's tax residency. |
| Social insurance | Employers contribute approximately 20% of an employee's gross salary, and employees approximately 10%. There are no payroll taxes beyond these contributions. |
Large multinational groups fall under the Global Minimum Tax Act 2024, which introduces a domestic top-up tax in line with the OECD Pillar Two rules. For a licensed crypto business, the key tax question is often where management and control actually sit.
A licence and a tax structure should be designed together. The same substance that satisfies the GFSC also protects the company's tax residence.
Gibraltar vs MiCA, UK, Switzerland
Gibraltar is a British Overseas Territory outside the EU, so a Gibraltar crypto licence does not carry MiCA passporting rights. The right jurisdiction depends on target markets, budget and the product itself.
| Criterion | Gibraltar | EU (MiCA) | United Kingdom | Switzerland |
|---|---|---|---|---|
| Regulator | GFSC | National authority of the home member state | FCA | FINMA and self-regulatory organisations |
| Legal basis | DLT and VAA Providers Regulations 2020 | Regulation (EU) 2023/1114 | FSMA 2000 (Cryptoassets) Regulations 2026 | AML Act, Banking Act, planned FinIA reform |
| Approach | Principles, case-by-case assessment | Detailed rulebook with technical standards | Full FSMA authorisation | SRO membership for most intermediaries |
| Market access | Gibraltar; other markets need a local check | Passport to all EEA states | UK clients | Swiss clients |
| Status in 2026 | In force since 2018, VAA added in 2025 | Fully applicable | Applications open from 30 September 2026, regime starts on 25 October 2027 | Crypto-institution licence proposed, expected from 2027 |
Gibraltar suits firms that value direct dialogue with the regulator and an English common law environment. MiCA is the better route for businesses whose core clients are in the EU. The UK regime becomes essential for firms targeting British consumers after October 2027, so growing groups often combine several licences.
Pros and cons of a Gibraltar crypto license
| Pros | Cons |
|---|---|
| More than eight years of GFSC supervisory experience with DLT businesses | No automatic passporting into the EU or the UK |
| Principles-based framework that adapts to new business models | £45,000 GFSC application fee and substantial annual charges |
| No ban on crypto derivatives or leverage | Real substance: local office, resident directors and MLRO |
| Direct dialogue with the regulator through pre-application meetings | Thorough staged review that usually takes several months |
| 15% corporate tax, no VAT and a territorial tax system | Change of control and dividends need GFSC approval |
| English-speaking common law jurisdiction with UK ties | Limited local talent pool raises staffing costs |
For most serious projects, these drawbacks are manageable with proper planning. A realistic budget and a Gibraltar-based team form the foundation of a successful application.
Our Gibraltar crypto licensing services
SBSB Fintech Lawyers provides turnkey support for applicants seeking a GFSC DLT provider licence or a VAA permission. We handle the project from the first scoping call to final approval and beyond:
Company incorporation. We draft and collect the incorporation documents and register the Gibraltar company.
Licence application. We run the initial application and pre-application process and coordinate with the GFSC through every stage of the review.
Business plan and policies. We prepare the business plan and the full set of manuals and policies the GFSC expects: AML/CFT, data protection, corporate governance, remuneration, delegation, complaints, conflicts of interest, risk management, business continuity, liquidity and information security.
Banking. We support the opening of a business account for the licensed company.
Local substance. We help find an office in Gibraltar and source qualified local directors, MLROs and compliance officers.
Post-licensing support. We provide ongoing compliance support and prepare change of control and material change applications.
Work is split into stages, so each phase is agreed and paid before it starts. Contact us to discuss your project and receive a roadmap with timelines and a document checklist tailored to your business model.
FAQ About a Crypto License in Gibraltar
How much does a crypto license in Gibraltar cost?
GFSC charges include a £2,000 initial assessment fee, a £45,000 application fee and annual fees of about £44,000 plus 0.1% of trade volume. Our turnkey legal package costs EUR 50,250. Office, staff and audit come on top.
How long does it take to get a crypto license in Gibraltar?
Around 12 months from the first KYC documents to authorisation. The GFSC review itself typically takes 4–8 months for a complete application.
Can a foreigner get a crypto license in Gibraltar and own the company 100%?
Yes. Foreign shareholders can own 100% of a Gibraltar company. Each controller must pass the fit and proper assessment and prove the source of wealth and funds.
Do I need a physical office and local staff in Gibraltar?
Yes. The GFSC requires a local office, at least one resident director and a Gibraltar-based MLRO. Key management must spend most of their time in Gibraltar.
Can I open a bank account for a Gibraltar DLT company?
Yes, although crypto firms face enhanced due diligence. A GFSC licence and a strong AML framework improve acceptance by banks and EMIs. Account opening is part of our turnkey service.
Is Gibraltar a MiCA jurisdiction?
No. Gibraltar is outside the EU, so a GFSC licence gives no passport under MiCA. Firms serving EU clients at scale need a separate CASP authorisation in an EU member state.
Can I buy a ready-made company with a Gibraltar DLT licence?
Not as a shortcut. Any acquisition of control requires prior GFSC approval, with the same fit and proper and source of funds checks as a new application.
Jurisdictions
Crypto Licenses
Get in touch with us
Daria Lysenko
Senior lawyer
Valeriia Kozel
Customer manager
You can be interested in following articles
MiCA License Deadline Has Passed: What Crypto Companies Without a CASP License Can Do Now (2026)
What ESMA’s Statement Means for Crypto Companies in Europe: Practical Tips for Compliance
Crypto License in Latin America (2026): A Practical Guide for Launching in El Salvador, Brazil, Argentina & Panama
SRO License in Switzerland (2026): Requirements, Costs and How to Obtain
How Much Does a Gambling License Cost in 2026?
Why Operators are Turning to Liberia for iGaming Licensing: A Competitive Alternative to Curacao
MiCA Regulation: New Rules and Outlook for 2026
US Crypto Regulations
The Beginner’s Guide to Online Gambling Licences: Everything You Need to Know
Top 5 Crypto-Friendly Jurisdictions for 2025-2026: Expert Guide by SBSB FinTech Lawyers
Seychelles vs Mauritius Forex Licenses: Costs, Benefits, and Licensing Process
Sweden Amends Gambling Act to Crack Down on Unlicensed Operators
Customer reviews
