GI · run world-payments-2026-06-20 v13.3.0
content: ai_generated 101 sources retrieved model claude-opus-4-8 ·

Gibraltar

GI schema world-payments-v1 trajectory: not recorded

Last updated · 14 modules · 54 sourced findings · 101 sources in the cumulative register

14Modulesbaseline.modules[]
54Findingsmodules[].findings[]
34Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix (sums to 14 rendered modules; click to filter)
No modules moved this cycle.

Jurisdiction brief

Lead Signal

Gibraltar's payments market-access position is transitional rather than settled. The Financial Services (Gibraltar) (Amendment) (EU Exit) Regulations 2025 extend UK-Gibraltar passporting arrangements to 31 December 2026, pending the permanent Gibraltar Authorisation Regime, which remains outstanding. This transitional extension is the clearest signal this cycle: Gibraltar-based banks, insurers, investment managers, payment institutions, and e-money institutions continue to access the UK market under a time-limited bridge rather than a settled permanent framework, and the timeline for that bridge to convert into something durable has not moved closer this cycle. This matters because Gibraltar's payments sector, one of the more developed e-money and payment-institution hubs among the UK's Overseas Territories, has built its commercial proposition substantially on guaranteed UK market access. A time-limited bridge, even one extended to the end of 2026, is a materially different risk profile for a payment institution's medium-term licensing and capital-planning decisions than a permanent mutual-access framework would be, and the absence of further progress toward the permanent Gibraltar Authorisation Regime this cycle leaves that planning uncertainty unresolved.

14 of 14 modules
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

Gibraltar runs a GFSC-supervised non-bank PI/EMI regime distinct from the UK's, anchored in the Financial Services Act 2019 and the Financial Services (Electronic Money) Regulations 2020 plus the Payment Services Regulations. EMIs (authorised and registered) and PSPs are authorised by the GFSC; credit institutions and EMIs do not need a separate payment-service permission. UK market access for Gibraltar PIs/EMIs runs on a separate transitional track (PSRs Schedule 7 / EMRs reg 74A) pending absorption into the permanent Gibraltar Authorisation Regime (GAR).

Open gap — wpm-int-6Forward GAR Schedule 2A absorption decision (HMT) and draft DLT-framework legislation timing are unresolved; horizons recorded with wide uncertainty bands pending official confirmation.no under-indexing note recorded
Horizon · 2026-2027 (±multi_year)HMT decision on folding Gibraltar payments/e-money access into FSMA Schedule 2Aproposed · T3
Standing sub-brief348 words · last cycle wpm-2026-08-21

Licensing, Authorisation & Market Access

Gibraltar's payments market-access framework is in a transitional state. The Financial Services (Gibraltar) (Amendment) (EU Exit) Regulations 2025 extend UK-Gibraltar passporting arrangements to 31 December 2026, pending the permanent Gibraltar Authorisation Regime, which has not yet come into force. Trade commentary describes the GAR as a unique, permanent mutual-market-access framework for Gibraltar-based banks, insurers, investment managers, payment service providers, and e-money institutions, a status not available to any other Overseas Territory, Crown Dependency, or third country; it remains pending, and the transitional passporting extension is the operative mechanism in the meantime.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and findings (5)
  1. T3Valsen Corporate / GFSC eMoney pages — E-money issuance in Gibraltar is regulated under the Financial Services (Banking) Act 1992 framework and specifically the Financial Services (Electronic Money) Regulations 2011/2020; the GFSC authorises and supervises EMIs.
  2. T1GFSC (fsc.gi) Electronic Money Institutions page — Two EMI types exist: authorised and registered; registered EMIs cannot passport. EMIs may appoint agents (registered with GFSC) and distributors (notified to GFSC); neither may issue e-money.
  3. T1GFSC (fsc.gi) Payment Service Provider page — Authorised Credit Institutions or Electronic Money Issuers are not required to apply for a separate payment-service permission, but must ensure they carry payment services under their authorisation and comply with payment-services requirements; applications follow a Staged Application for Authorisation approach.
  4. T3Ramparts (ramparts.gi) GAR & UK Market Access — Under the Gibraltar Authorisation Regime (GAR) UK market access is via notification (not fresh UK authorisation); payment/e-money activities currently rely on separate transitional provisions — PSRs Schedule 7 and EMRs reg 74A — granting sector-specific temporary permission rather than FSMA deemed authorisation, with HMT yet to decide whether to fold them into Schedule 2A.
  5. T1GFSC (fsc.gi) Electronic Money Institutions page — GFSC raises minimum prudential thresholds: under Schedule 2 paras 15-16 of the Electronic Money Regulations, the minimum requirements of EMD2 (2009/110/EC) are directed to be increased by 20%.

#

Safeguarding is governed by the Financial Services (Electronic Money) Regulations 2020 (Regs 31-32: segregation option 1 / insurance-or-guarantee option 2), with safeguarded funds forming a priority asset pool on an insolvency event. Conduct is governed by the GFSC Consumer Duty (Core Principles and Consumer Duty Regulations 2024, in force 9 May 2024, UK-aligned). Financial promotions are tightened by the Financial Services (Restricted Promotions) Regulations 2025 (in force 1 May 2025) restricting promotion of speculative illiquid securities to retail clients.

Open gap — wpm-int-5Financial-promotion enforcement outcomes under the Restricted Promotions Regs 2025 not yet evidenced; only the rule's entry into force is documented.Financial-promotion enforcement is a methodology under-indexed area; no GIB enforcement-action evidence surfaced this cycle.
Standing sub-brief199 words · last cycle wpm-2026-08-21

Conduct, Safeguarding & Financial Promotions

Gibraltar's conduct framework for GFSC-licensed firms includes retail-client-outcome obligations under the Financial Services (Core Principles and Consumer Duty) Regulations 2024, effective 9 May 2024. These obligations currently apply within the scope those Regulations established at the time of their effect.

The Gibraltar Financial Services Commission has separately signalled a possible expansion of Consumer Duty scope to cover all retail customers, not solely UK customers, during 2026 to 2027. This is a forward-looking signal rather than an in-force change: no enacted instrument implementing the expansion was identified this cycle, and the timeline carries a multi-year uncertainty band. Firms currently limiting Consumer Duty-equivalent retail protections to UK customers, on the basis that the 2024 Regulations' effective scope was UK-customer-focused, should treat the signalled all-retail-customer expansion as a live planning item rather than a settled requirement.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and findings (4)
  1. T1Gibraltar Laws (gibraltarlaws.gov.gi) — Financial Services (Electronic Money) Regulations 2020 — The Financial Services (Electronic Money) Regulations 2020 require EMIs to keep relevant funds segregated (safeguarding option 1) or covered by insurance/guarantee (safeguarding option 2), set out insolvency-event provisions, and give the GFSC power to exclude assets and sanctioning/administrative-penalty powers.
  2. T1GFSC (fsc.gi) Consumer Duty page / Triay Lawyers — Gibraltar's Consumer Duty is set out in the Financial Services (Core Principles and Consumer Duty) Regulations 2024, effective 9 May 2024, replicating the UK FCA Consumer Duty; it currently applies to firms serving UK retail customers (excluding DLT providers) and is to be extended to all retail customers by ministerial appointment (anticipated 2026-2027).
  3. T3Triay Lawyers / Europa Group — The Financial Services (Restricted Promotions) Regulations 2025 (in force 1 May 2025) tighten promotion of speculative illiquid securities, restricting promotions to general retail clients and removing the 'excluded communications' exemption; promotions limited to high-net-worth / sophisticated investors providing signed declarations.
  4. T1GFSC (fsc.gi) news / Ramparts — GFSC published Guidance Notes on Consumer Duty and the Fair Treatment of Vulnerable Customers (following consultation closing 14 Aug 2024) and conducted a thematic review of Consumer Duty Board Reports released March 2025.

#

Gibraltar was the first jurisdiction to regulate DLT, via the Financial Services (Distributed Ledger Technology) Regulations 2020 (subsidiary to the Financial Services Act 2019), built on nine/ten regulatory principles. DLT providers storing or transmitting value for others require GFSC authorisation (FSA 2019 s.139). Gibraltar is outside the EU so MiCA does not formally apply and a Gibraltar authorisation does not confer MiCA passporting, though the GFSC is progressively aligning the DLT framework with MiCA. Stablecoin/reserve and clearing-and-settlement reforms are in train (Digital Clearing & Settlement Framework, May 2025; Virtual Asset Arrangements amendments, Oct 2025).

Standing sub-brief309 words · last cycle wpm-2026-06-23

Stablecoins & Digital Money

Gibraltar's stablecoin and digital-money position rests on first-mover regulatory infrastructure. Gibraltar was the first jurisdiction to provide a comprehensive DLT/crypto regulatory framework via the DLT Regulations, subsidiary to the Financial Services Act 2019; section 139 of that Act makes DLT-provider activities — storing or transmitting value belonging to others in or from Gibraltar — regulated activities requiring GFSC authorisation. The regime is built on a set of regulatory principles and the GFSC regulates exchanges, custodians and wallet providers. This first-mover status is the jurisdiction's principal competitive differentiator in attracting crypto and stablecoin operators, all of which sit on the non-bank side of the regulated population.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T3Global Legal Insights — Blockchain & Cryptocurrency Laws 2026 (Gibraltar) — Gibraltar became the first jurisdiction to provide a comprehensive regulatory framework for blockchain/crypto with the Financial Services (Distributed Ledger Technology) Regulations, subsidiary legislation to the Financial Services Act 2019; the GFSC regulates DLT firms including exchanges and wallet providers.
  2. T3Ramparts (ramparts.gi) — Gibraltar crypto-asset regulatory regime — FSA 2019 s.139 makes DLT-provider activities (using DLT to store or transmit value belonging to others, in or from Gibraltar) regulated activities requiring GFSC authorisation.
  3. T3Key2Law / Regulated United Europe (rue.ee) — Gibraltar is not in the EU so MiCA does not formally apply within its territory; a Gibraltar authorisation does not create MiCA passporting rights into the EEA, but the GFSC is progressively aligning the DLT framework with MiCA standards and firms serving EU users must comply with MiCA.
  4. T3Key2Law / company.gi DLT licence guide — Pending stablecoin reforms: announced DLT-regime updates include stronger stablecoin regulation (reserve requirements and custody standards), rules for DEX/smart contracts with a central operator, and tighter cybersecurity/third-party risk requirements; draft legislation expected per Minister Feetham (Consensus HK, Feb 2026).

#

Gibraltar has implemented a UK-equivalent Operational Resilience regime: the GFSC published Operational Resilience, Outsourcing/Third-Party Risk Management and Liquidity Risk Management Guidance Notes in 2024 following industry consultation. Firms identify important business services and set impact tolerances (deadline 13 July 2024), with full compliance expected after 13 July 2026. DORA applies indirectly to firms that are part of EU groups. Gibraltar may set requirements differing from both FCA and PRA given its smaller market.

Standing sub-brief193 words · last cycle wpm-2026-06-23

Operational Resilience & Critical Infrastructure

Gibraltar's operational-resilience regime is closely aligned with UK approaches and carries the most imminent compliance deadline in the current spine. The GFSC published Guidance Notes on Operational Resilience, Outsourcing/Third-Party Risk Management and Liquidity Risk Management, with consultation concluding 12 January 2024. The implementation pathway required firms to set impact tolerances by 13 July 2024 and to hold a prioritised plan by 13 July 2026; after 13 July 2026, firms must remain within impact tolerances in severe-but-plausible disruption. This applies to both bank and non-bank GFSC-regulated payments firms. DORA applies indirectly to EU-group firms, layering an additional resilience expectation onto Gibraltar entities within EU groups.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T1GFSC (fsc.gi) news — Guidance Notes publication — The GFSC published Guidance Notes on Operational Resilience, Outsourcing/Third-Party Risk Management and Liquidity Risk Management following an industry consultation that concluded 12 January 2024; the outsourcing note complements the Operational Resilience Regulations and Guidance Note, aligned with UK approaches.
  2. T3PwC Gibraltar — Operational Resilience — Firms must have identified important business services and set impact tolerances by 13 July 2024, hold a prioritised plan by 13 July 2026, and after 13 July 2026 have comprehensive strategies to remain within impact tolerances in severe-but-plausible disruption.
  3. T3Isolas (gibraltarlawyers.com) — GFSC Annual Report 2023/24 — The GFSC implemented a UK-equivalent Operational Resilience regime and UK-equivalent Consumer Duty regime as part of legislative amendments enhancing regulatory alignment with the UK (GFSC Annual Report 2023/24).
  4. T3Sicsic Advisory / Grant Thornton Gibraltar — The EU's DORA applies indirectly to Gibraltar-presence firms that are part of EU groups or operate a Brexit solution via an EU subsidiary; the GFSC is likely to have different operational-resilience requirements to both the FCA and PRA given the smaller market.

#

Gibraltar PSPs/acquirers operate under the international four-party card-scheme rules (Visa/Mastercard), PCI DSS (PCI SSC), and — given Gibraltar's UK-aligned post-Brexit posture and SEPA reachability — interchange/scheme-fee economics broadly tracking the UK/EU model. Gibraltar has no domestic card scheme; compliance flows through scheme rulebooks and PCI DSS rather than a bespoke Gibraltar interchange regulation. Searched: GFSC card-scheme/interchange instruments — no Gibraltar-specific interchange cap instrument identified; scheme/PCI obligations apply via the international schemes.

Open gap — wpm-int-1No Gibraltar-specific domestic interchange-cap instrument or domestic card scheme identified; scheme/PCI obligations flow via international Visa/Mastercard rulebooks and PCI SSC — confirmed absent, not unsearched.no under-indexing note recorded
Standing sub-brief159 words · last cycle wpm-2026-06-23

Scheme & Network Compliance

Card acquiring in Gibraltar runs on standard four-party scheme economics, with Visa and Mastercard interchange paid acquirer-to-issuer, PCI DSS compliance, and scheme-mandated technical standards. The compliance perimeter for both bank and non-bank acquirers flows through international scheme rulebooks and the PCI SSC rather than a bespoke domestic instrument. Critically, and on confirmed absent-field provenance, no Gibraltar-specific domestic interchange-cap instrument or domestic card scheme was identified — this was searched and found absent, not merely unsearched. Gibraltar acquirers and PSPs therefore inherit scheme-fee economics directly, and the absence of a domestic cap means there is no local interchange relief available.

No periodic updates recorded against this sub-brief.

Sources and findings (3)
  1. T1ECB Occasional Paper No 131 (interchange) / industry (Stored, Justt) — Card acquiring in Gibraltar runs on standard four-party scheme economics: interchange is paid by the acquirer to the issuer per transaction, set by Visa/Mastercard, with acquirers passing scheme fees and interchange to merchants; PCI DSS compliance and scheme-mandated technical standards apply to acquirers/PSPs.
  2. T3Quadrapay (Gibraltar payment gateway) / UCSB PCI glossary — Gibraltar-based merchants/PSPs are served by acquirers requiring PCI DSS compliance and adherence to card-scheme rules; acquirers must be defined as such by a payment brand and are subject to payment-brand rules and merchant-compliance procedures.
  3. T3WorldFirst (SEPA countries list) — Gibraltar is a SEPA-reachable territory, so euro instant/credit-transfer scheme rails (SCT/SCT Inst) and the ISO 20022 message standard are accessible to Gibraltar-domiciled euro accounts.

#

Gibraltar's principal payment corridors are euro (via SEPA, in which Gibraltar is reachable) and sterling (UK-aligned, via UK market-access arrangements). Cross-border euro settlement runs through SEPA mechanisms (TARGET2/EURO1) typically accessed indirectly via correspondent/sponsor banks since only regulated credit/PI/EMI entities can participate. Gibraltar's crypto/stablecoin sector adds digital-asset remittance corridors (stablecoin payments providers established locally).

Standing sub-brief139 words · last cycle wpm-2026-06-23

Payment Corridor Dynamics

Gibraltar is a SEPA-reachable territory, so euro SCT and SCT Inst scheme rails and the ISO 20022 message standard are accessible to Gibraltar-domiciled euro accounts. SEPA settlement runs via TARGET2 (ECB) and EURO1 (EBA CLEARING), with only regulated EMIs, PIs and credit institutions able to participate directly. In practice, smaller Gibraltar PSPs typically access SEPA indirectly via a sponsor or correspondent bank, creating a dependency that shapes corridor economics. Euro and sterling are Gibraltar's principal corridors, with the sterling corridor running through UK-aligned market-access arrangements.

No periodic updates recorded against this sub-brief.

Sources and findings (3)
  1. T3WorldFirst (SEPA bank transfers) — Gibraltar is part of the SEPA zone (listed among overseas territories included in SEPA), enabling euro credit transfers and direct debits to/from Gibraltar-domiciled euro accounts under the SEPA scheme.
  2. T3Payment Labs / UniCredit GTB — SEPA euro settlement runs via TARGET2 (ECB) and EURO1 (EBA CLEARING); only regulated EMIs, PIs or credit institutions can participate in SEPA, so smaller Gibraltar PSPs typically access via indirect participation or a sponsor/correspondent bank.
  3. T3company.gi Gibraltar Crypto Directory — Gibraltar hosts stablecoin-payments and remittance providers among its DLT-licensed firms (e.g. a Gibraltar-founded stablecoin payment solutions provider also holding a MiCA licence in Europe), adding digital-asset cross-border corridors.

#

Gibraltar's payments/fintech market is concentrated in EMIs, PSPs and DLT firms, with the DLT regime driving global attention and a maturing pool of licensed firms. The sector spans e-money institutions, virtual-asset exchanges, custodians and stablecoin payments providers. Industry bodies (Gibraltar Electronic Money Association, Gibraltar Bankers Association, Gibraltar Association for New Technologies, GFIA) provide formal policy channels. The market skews toward crypto/DLT and e-money rather than a large domestic bank-acquiring base.

Standing sub-brief178 words · last cycle wpm-2026-06-23

Industry Structure & Commercial

Gibraltar's payments and fintech market is concentrated in EMIs, PSPs and DLT firms, skewing toward crypto/DLT and e-money rather than a large domestic bank-acquiring base. Market-mapping data lists roughly 87 fintech startups — around 32 funded and around 13 at Series A or later — including Xapo Bank, INX and eToroX, indicating a private-company-heavy structure. This count rests on T4 directory data and is Possible-grade; private-company signal is systematically under-indexed by methodology, so the figures should be treated as indicative rather than precise. Industry bodies such as GEMA, GBA, GANT and GFIA provide formal policy channels. The structural concentration in crypto and e-money rather than bank acquiring is what shapes the jurisdiction's risk and growth profile.

No periodic updates recorded against this sub-brief.

Sources and findings (3)
  1. T3Mondaq — Gibraltar FinTech Comparative Guide — The DLT Regulations have increased global attention with a growing pool of licensed firms; established e-money and payment-services firms have moved into fintech, and offerings span virtual-asset custody, exchanges, EMIs, PSPs, MiFID firms and crypto-funds.
  2. T3Mondaq — Gibraltar FinTech Comparative Guide — Industry associations including the Gibraltar Electronic Money Association, Gibraltar Bankers Association, Gibraltar Association of Compliance Officers and Gibraltar Association for New Technologies act as formal channels between policymakers and the private sector.
  3. T4Tracxn — Gibraltar fintech startups — Market-mapping data indicates a sizeable fintech population in Gibraltar (a directory lists roughly 87 fintech startups, ~32 funded with ~13 at Series A+), including names such as Xapo Bank, INX and eToroX, indicating a private-company-heavy structure.

GFSC enforcement is risk-based, with effective and proportionate use of enforcement powers (including sanctioning/administrative penalties under the EMR 2020) as a stated regulatory objective. No landmark Gibraltar payments-sector litigation or major published GFSC enforcement action against a payments/EMI firm was surfaced for the baseline window; UK safeguarding-insolvency case law (recent UK court judgments on PI/EMI insolvency) is materially relevant given Gibraltar's UK-aligned regime. Searched: GFSC enforcement register / Gibraltar payments penalties 2025-2026 — no Gibraltar-specific payments enforcement action confirmed; note: large 'GFSC' fines in search results were the Guernsey FSC (different regulator), not Gibraltar.

Open gap — wpm-int-2No landmark Gibraltar payments-sector litigation or published GFSC enforcement action against a payments/EMI firm surfaced for the baseline window. Caution: large 'GFSC' fines in search (e.g. Utmost Worldwide £1.96m Mar 2026) are the GUERNSEY FSC, not Gibraltar.no under-indexing note recorded
Standing sub-brief273 words · last cycle wpm-2026-08-08

Legal & Litigation

The confirmed legal development for Gibraltar this cycle is textual and constitutional rather than contentious: the UK-EU Agreement in respect of Gibraltar, signed 14 July 2026 and provisionally applied from 15 July 2026, is understood to operate expressly 'without prejudice' to Gibraltar's underlying constitutional status, and does not alter or restore financial-services passporting arrangements. This is assessed rather than confirmed at high confidence specifically on the 'without prejudice' framing point, though the non-restoration of passporting itself is a Tier-1-sourced, high-confidence finding from the House of Commons Library. No litigation, dispute, or contentious legal proceeding connected to Gibraltar's payments or financial-services market access has been identified this cycle; the legal development in view is the Treaty's own drafting posture, not a judicial or adversarial process.

No periodic updates recorded against this sub-brief.

Sources and findings (2)
  1. T1GFSC (fsc.gi) Enforcement Strategy / EMR 2020 — The GFSC describes itself as a risk-based regulator for which effective and proportionate use of enforcement powers is instrumental to its regulatory objectives; the EMR 2020 provide GFSC sanctioning powers and maximum administrative penalty amounts.
  2. T3Gibson Dunn (FCA safeguarding proposals) — Recent UK court judgments have created legal uncertainty over the framework applying when a payment/e-money firm safeguarding funds enters insolvency — directly relevant to Gibraltar's UK-aligned safeguarding regime and a key legal-infrastructure watch item.

#

Merchant acquiring for Gibraltar businesses is served largely by international/offshore acquirers and PSPs operating under card-scheme rules and PCI DSS, with anti-fraud rules engines, chargeback/dispute handling and high-risk-merchant treatment managed at the acquirer/scheme level rather than via a bespoke Gibraltar acquiring statute. Gibraltar's high-risk verticals (notably iGaming) shape acquirer risk appetite. Searched: Gibraltar acquiring regime / GFSC merchant-acquiring rules — no Gibraltar-specific acquiring instrument distinct from PSP authorisation + scheme/PCI rules identified.

Open gap — wpm-int-3Merchant-acquiring detail rests on T4 sources (Quadrapay/NowG.net); no bespoke Gibraltar acquiring statute exists. Merchant-acquiring ops are a methodology under-indexed area.Merchant-acquiring operations are systematically under-indexed; Gibraltar acquiring detail is thin and aggregator-sourced — under-confident pending higher-tier corroboration.
Standing sub-brief160 words · last cycle wpm-2026-06-23

Merchant Acquiring & Risk

Merchant acquiring for Gibraltar businesses is served largely by international and offshore acquirers and PSPs operating under card-scheme rules and PCI DSS. Anti-fraud rules engines, chargeback and dispute handling, and high-risk-merchant treatment — notably for iGaming — are managed at acquirer and scheme level. No Gibraltar-specific acquiring statute distinct from PSP authorisation plus scheme and PCI rules was identified. This detail rests on T4 sources and is Possible-grade; merchant-acquiring operations are a systematically under-indexed area, and the Gibraltar acquiring picture is thin and aggregator-sourced, to be treated as under-confident pending higher-tier corroboration. The iGaming high-risk vertical drives acquirer reserve and payout terms, which is material to merchant economics in the jurisdiction.

No periodic updates recorded against this sub-brief.

Sources and findings (2)
  1. T4Quadrapay (Gibraltar payment gateway) — Gibraltar-based businesses obtain card acceptance via acquirers/PSPs offering merchant accounts and payment gateways with anti-fraud rules engines and customer-monitoring tools to identify and eliminate fraudulent transactions and protect the merchant account.
  2. T4NowG.net (offshore merchant processing) — Offshore acquiring (relevant to Gibraltar's high-risk verticals such as iGaming) operates under scheme rules, interchange and issuer-approval logic with KYC/AML and PCI DSS compliance; settlement involves payout cadence, currency conversion and reserves.

#

Gibraltar positions itself as an innovation-forward fintech hub. Headline 2025 developments: the Digital Clearing and Settlement Framework (May 2025), developed with the GFSC and Bullish, positioned as the world's first dedicated regime for crypto clearing and settlement of virtual-asset derivatives via regulated CCPs; Virtual Asset Arrangements amendments (October 2025); and the Restricted Promotions Regulations 2025. Draft DLT-framework legislation is expected per Minister Feetham (Consensus HK, Feb 2026). The market also shows neobank/digital-banking and RegTech build-out.

Standing sub-brief315 words · last cycle wpm-2026-08-08

Product Innovation & Market Development

Two confirmed product-innovation developments define Gibraltar's payments-adjacent innovation environment this cycle. The Protected Cell Companies (Amendment) Bill 2026 would require prior Gibraltar Financial Services Commission approval before a protected cell authorised as an experienced-investor fund can issue tokenised shares, with investor-eligibility, cybersecurity, custody, and risk-disclosure conditions attached to that approval. This is a non-bank-facing development that extends Gibraltar's distributed-ledger-technology regulatory infrastructure into fund-share issuance specifically — a distinct use case from the jurisdiction's existing DLT exchange and custody licensing gateway, and one that sits within the funds and asset-management space rather than the payments-processing space directly, though it is payments-adjacent in the sense that any tokenised-share settlement infrastructure will likely require payment-rail integration.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T3Gibraltar International Magazine (gibraltarfinance.com) / company.gi — The Digital Clearing and Settlement Framework (May 2025), developed with the GFSC and exchange Bullish, is positioned as the world's first dedicated regulatory regime for crypto clearing and settlement, covering risk management, asset safeguarding and settlement finality for virtual-asset derivatives.
  2. T3company.gi DLT licence blog / Triay Lawyers — Recent DLT-related developments include Virtual Asset Arrangements amendments (October 2025) and Restricted Promotions Regulations (May 2025); draft DLT-framework legislation expected 'within the next few months' per Minister Nigel Feetham at Consensus Hong Kong (Feb 2026), likely bringing VASP registrations within the DLT Regs.
  3. T3company.gi / Gibraltar AML Country Update 2026 — Gibraltar has committed to implementing the OECD Crypto-Asset Reporting Framework (CARF), and the Financial Services (Regulated Activities) (Amendment) Regulations 2025 make the provision of virtual asset arrangements a regulated activity under FSA 2019.
  4. T4fintech.gi — Gibraltar is attracting neobank/digital-banking and RegTech activity, with the GFSC continuing to refine its framework to keep pace with technology and the territory positioned as a hub for compliance-technology innovation.

#

Consumer protection rests on the GFSC Consumer Duty (Core Principles and Consumer Duty Regulations 2024, in force 9 May 2024, UK-aligned, outcomes-based). Crucially, on APP fraud Gibraltar has NO equivalent of the UK's mandatory reimbursement regime: under the Financial Services (Payment Services) Regulations 2020, PSPs must only reimburse 'unauthorised' payments, so APP-fraud victims (who authorise the payment) are not guaranteed reimbursement — a material divergence from the UK PSR mandatory reimbursement regime introduced October 2024. The GFSC issues consumer fraud-awareness alerts.

Standing sub-brief174 words · last cycle wpm-2026-06-23

Consumer Protection & APP Fraud

Gibraltar's consumer-protection position carries a material divergence from the UK. Under the Financial Services (Payment Services) Regulations 2020, Gibraltar PSPs are only required to reimburse consumers for 'unauthorised' payments. Because authorised push payment (APP) fraud involves the victim authorising the payment, such transactions fall outside the regulations and victims are not guaranteed reimbursement — a material divergence from the UK PSR mandatory reimbursement regime introduced in October 2024. No equivalent mandatory reimbursement regime presently exists in Gibraltar, and the GFSC issues consumer APP-fraud awareness alerts. This divergence materially lowers PSP fraud-liability exposure in Gibraltar relative to the UK, applying to both bank and non-bank firms, and represents a competitive and consumer-protection differential operators should weigh.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T3Isolas (gibraltarlawyers.com) — APP Fraud — Under the Financial Services (Payment Services) Regulations 2020, Gibraltar PSPs are only required to reimburse consumers for 'unauthorised' payments; because APP fraud involves the victim voluntarily making the payment, such transactions fall outside the PSR Regulations and victims are not guaranteed reimbursement.
  2. T3Isolas (gibraltarlawyers.com) — APP Fraud — Gibraltar's position contrasts with the UK Mandatory Reimbursement Regime introduced October 2024; no equivalent regime presently exists in Gibraltar, so PSPs are not legally obligated to reimburse APP-fraud victims.
  3. T1GFSC (fsc.gi) Consumer Duty / Triay Lawyers — The Consumer Duty is an outcomes-focused standard of care (Four Outcomes + Cross-Cutting Rules) under the Financial Services (Core Principles and Consumer Duty) Regulations 2024; the GFSC commenced thematic reviews of firms' compliance from Q3 2024.
  4. T1GFSC (fsc.gi) Consumer Alert — The GFSC issues consumer fraud-awareness alerts, including on rising APP fraud where fraudsters impersonate banks or the Royal Gibraltar Police to induce victims to make payments.

#

sentinel. Gibraltar's AML/CFT framework for the payments context is anchored in the Proceeds of Crime Act 2015 (POCA), the Terrorism Act 2018 and subsidiary regulations, supervised by the GFSC (for financial firms) with the GFIU as FIU and the OFT for certain DPMS sectors. The crypto Travel Rule is in force via POCA (since 22 March 2021). A 2025 National Risk Assessment was completed; MONEYVAL last evaluated Gibraltar in 2019 (terminating 5th-round follow-up after substantial AML/CFT enhancements, contributing to EU/grey-list removal), with the next MONEYVAL evaluation due 2027. Carried as Sentinel position; no original illicit-finance analysis performed.

Standing sub-brief211 words · last cycle wpm-2026-06-23

AML/CFT & Financial Crime

This module is sourced from the Sentinel feed; WPM performs no original illicit-finance analysis, and original AML and sanctions analysis is routed to FIM. Per Sentinel (membercheck.com/aml-cft-legislation-in-gibraltar), Gibraltar's AML/CFT framework is anchored in the Proceeds of Crime Act 2015 (POCA), the Terrorism Act 2018 and subsidiary regulations, supervised by the GFSC for financial firms, with the GFIU as the financial intelligence unit and the OFT covering certain designated non-financial sectors; obliged entities owe customer-due-diligence and risk-based verification duties.

No periodic updates recorded against this sub-brief.

Sources and findings (10)
  1. T3MemberCheck (AML/CFT Gibraltar) / GFSC AML page — sentinel. POCA 2015 designates the GFSC among supervisory bodies; obliged entities owe CDD and risk-based verification duties; the GFIU gathers and disseminates financial-crime intelligence under POCA, the Terrorism Act 2018 and the Drug Trafficking Act 1995.
  2. T3Notabene (Travel Rule Gibraltar) — sentinel. The crypto Travel Rule has been in effect in Gibraltar since 22 March 2021 (entry into force of POCA provisions), with the GFSC monitoring compliance; an 18-month grace period ran to September 2022.
  3. T1HM Government of Gibraltar 2025 NRA / Financial Crime portal — sentinel. Gibraltar completed its most recent National Risk Assessment for AML/CFT/PF in 2025 and is preparing for the next MONEYVAL evaluation in 2027 under revised FATF standards; it was last evaluated by MONEYVAL in 2019.
  4. T3Gibraltar AML Country Update 2026 (Thomson Reuters) — sentinel. Following substantial AML/CFT enhancements, MONEYVAL terminated 5th-round follow-up reporting and the European Commission concluded Gibraltar meets standards, supporting its removal from the grey list; the Sanctions Act 2019 and Terrorism Act 2018 (incl. proliferation-financing offence) form part of the framework.
  5. T?FIM (sentinel.gi) per-JID baseline profile — Gibraltar — Gibraltar (British Overseas Territory) runs its own AML/CFT/CPF regime under the Proceeds of Crime Act 2015, Terrorism Act 2018 and Sanctions Act 2019, supervised by the GFSC and GFIU. It was removed from FATF increased monitoring in Feb 2024 and the EU high-risk list in June 2025, but retains structural exposure via its offshore-facing insurance, gaming and DLT/crypto sectors and a historically porous Spain frontier.
  6. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness
  7. T1FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-001) — Sanctions: OFSI wind-down
  8. T1FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-004) — Enforcement: OFSI (HM Treasury) — Maritime Mutual Association Limited (Maritime Mutual Gibraltar) and subsidiaries
  9. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: enforcement-absence
  10. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: capacity-deficit

#

Gibraltar PSPs/EMIs access euro settlement indirectly via SEPA (TARGET2/EURO1) and sterling rails through UK-aligned/sponsor arrangements, since direct SEPA participation is limited to regulated credit/PI/EMI entities. As a small jurisdiction historically perceived as higher-risk, Gibraltar firms (and their crypto/iGaming exposure) face de-risking pressure in establishing/maintaining correspondent-banking relationships — a structural access constraint consistent with the global CPMI/BIS de-risking pattern affecting smaller jurisdictions. Searched: Gibraltar central-bank account access — Gibraltar has no central bank; settlement access is intermediated via UK/EU correspondent and sponsor banks.

Standing sub-brief208 words · last cycle wpm-2026-06-23

Correspondent Banking, Settlement & Access

The analytical spine of this module is the bank versus non-bank access asymmetry. Gibraltar PSPs and EMIs access euro settlement indirectly via SEPA (TARGET2/EURO1) and sterling rails through UK-aligned and sponsor arrangements, since direct SEPA participation is limited to regulated credit, PI and EMI entities. Crucially, Gibraltar has no central bank, so settlement access is intermediated via UK and EU correspondent and sponsor banks — making Gibraltar EMIs and PIs respondents dependent on correspondent and sponsor banks acting as gateway. As a small jurisdiction with crypto and iGaming exposure, Gibraltar firms face de-risking pressure consistent with the global CPMI/BIS pattern affecting smaller jurisdictions, driven by correspondent banks bearing AML/CTF liability for their respondents. The de-risking dynamic and the absence of a central bank make sponsor and correspondent-bank dependency a core operational risk for Gibraltar payments firms.

No periodic updates recorded against this sub-brief.

Sources and findings (3)
  1. T1BIS/CPMI — Correspondent banking report — Smaller respondent banks in jurisdictions perceived as too risky are especially affected by reductions in correspondent-banking relationships ('de-risking'), per CPMI/BIS — a structural pressure relevant to Gibraltar's small, crypto-and-gaming-weighted financial centre.
  2. T3Payment Labs / UniCredit GTB — SEPA euro settlement is via TARGET2 (ECB) and EURO1 (EBA CLEARING); since only regulated EMIs/PIs/credit institutions can participate, Gibraltar firms typically access settlement indirectly through a sponsor/correspondent bank acting as gateway.
  3. T2Congress.gov CRS — Correspondent Banking and De-Risking — De-risking is driven by correspondent banks bearing AML/CTF liability and regulatory/reputational risk for respondents, leading large banks to shed relationships with smaller banks in jurisdictions viewed as high-risk — directly constraining access for small-jurisdiction respondents.

#

Trailing-12-month (approx. Jun 2025-Jun 2026) commercial/product signals in Gibraltar's payments/DLT space center on public-private framework launches (GFSC + Bullish digital clearing & settlement) and product/regulatory milestones (Virtual Asset Arrangements Oct 2025, Restricted Promotions May 2025) rather than large disclosed M&A. Discrete commercial events captured below; several values undisclosed.

Open gap — wpm-int-4Private-company/funding signals (Tracxn ~87 fintechs, Bullish ~$5.6B valuation, stablecoin-provider MiCA expansion) rest on T4 directory data; deal values largely undisclosed.Private-company signals are under-indexed; Gibraltar commercial intelligence relies on aggregator/directory sources rather than primary disclosure.
Standing sub-brief99 words · last cycle wpm-2026-08-08

Commercial Intelligence & Fintech

76 operators and providers held a Gibraltar gambling licence as of 29 July 2026, continuing to constitute the demand base for Gibraltar EMI and PSP high-risk payment processing. No new PSP/EMI M&A deal, investment round or product launch was identified for Gibraltar this cycle; this entry records the licensed-operator demand base rather than a discrete commercial event.

No periodic updates recorded against this sub-brief.

Sources and findings (3)
  1. T3Gibraltar International Magazine / company.gi — Gibraltar, the GFSC and exchange Bullish launched the Digital Clearing and Settlement Framework (May 2025) for crypto-derivative clearing/settlement via regulated CCPs — a flagship public-private product/regulatory event.
  2. T4company.gi Gibraltar Crypto Directory — Bullish — which operates from Gibraltar among other licences — is NYSE-listed (BLSH) with a reported ~$5.6B valuation and also owns CoinDesk, indicating significant capital-markets activity tied to a Gibraltar-connected crypto operator.
  3. T4company.gi Gibraltar Crypto Directory — A Gibraltar-founded stablecoin payment solutions provider (one of the earliest DLT-licensed firms, ~55 employees) has expanded by also obtaining a MiCA licence in Europe — a product/market-expansion signal.
No modules match.

Filters combine as OR inside a group and AND across groups.

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Gibraltar
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewernot recorded
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.

Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.

Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; per-module RAG traffic light; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-08-26. A year-precision row is never promoted into a tighter band.

Orphan deltas: 2 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card.

Envelope: baseline resolved at jurisdiction_json.baseline; 14 module(s), 54 finding(s), 96 source(s) in the cumulative register.