Gibraltar: Fintech

The In-House Lawyer Logo

This country-specific Q&A provides an overview to Fintech law in Gibraltar.

It will cover open banking, regulation of data, cryptocurrencies, blockchain, AI and insurtech.

This Q&A is part of the global guide to Fintech. For a full list of jurisdictional Q&As visit

  1. What are the sources of payments law in your jurisdiction?

    The Payment Services Directive (2007/64/EC), which became law in Gibraltar via the Financial Services (EEA) (Payments Services) Regulations 2010 (“the Payment Services Regulations”) – and the amendments brought by the second iteration of the Payment Services Directive, EU (2015/2366), which were transposed through the domestic Financial Services (Payment Services) Regulations 2018 (LN. 2018/010).

  2. Can payment services be provided by non-banks, and if so on what conditions?

    Yes - except for credit facilities, such as loans, and provided they are authorised or registered by the Gibraltar Financial Services Commission (“GFSC”). Registered firms are subject to less stringent compliance requirements, but are limited in both the services they can provide as well as in terms of monthly turnover. A payment institution can apply for one of the three classes of licence available, depending on the services it intends to provide. To apply, the firm needs to present a bundle comprising of the application fee, the completed application form, a business plan, financial projections as well as questionnaires for individuals, body corporates or trusts – depending on the structure of the applicant. Lastly, the firm has to disclose specific sets of information when providing the payment services - the amount of information required to comply with such duty will depend on whether the firm will provide for a one-time or an ongoing payment service.

  3. What are the most popular payment methods and payment instruments in your jurisdiction?


  4. What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?

    Open banking is mandated by PSD2. Gibraltar has implemented PSD2 by enacting the Financial Services (Payment Services) Regulations 2018. These regulations came into force in January 2018 and apply to payment services provided in or from Gibraltar. The following activities, when carried out as a regular occupation or business activity, are payment services –

    (a) services enabling cash to be placed on a payment account as well as all the operations required for operating a payment account;

    (b) services enabling cash withdrawals from a payment account as well as all the operations required for operating a payment account;

    (c) execution of payment transactions, including transfers of funds on a payment account with the user’s payment service provider or with another payment service provider–

    (i) execution of direct debits, including one-off direct debits;

    (ii) execution of payment transactions through a payment card or a similar device;

    (iii) execution of credit transfers, including standing orders;

    (d) execution of payment transactions where the funds are covered by a credit line for a payment service user–

    (i) execution of direct debits, including one-off direct debits;

    (ii) execution of payment transactions through a payment card or a similar device;

    (iii) execution of credit transfers, including standing orders;

    (e) money remittance;

    (f) payment initiation services; and

    (g) account information services.

  5. How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?

    The General Data Protection Regulation 2016/679 applies, as in the other Member States of the European Union (‘EU’), to the processing of ‘personal data’ - it builds upon Gibraltar’s Data Protection Act 2004 which was designed to implement the Data Protection Directive 95/46/EC. The impact is therefore comparable to that of the other Member States of the EU.

  6. What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?

    Both the jurisdiction and its regulator, the GFSC, have been at the very forefront of financial innovation. The Financial Services (Distributed Ledger Technology Providers) Regulations 2017 (the “DLT Regulations”) represents the first legal framework in Europe to cover the use of distributed ledger technology (“DLT”) and, together with the upcoming token offering regulations (the “Token Offering Regulations”), is testament to Gibraltar’s commitment to promote innovation while safeguarding the quality of the jurisdiction and the end customers.

    Furthermore, as part of this ongoing effort to stimulate healthy innovation, the GFSC has also established the Innovate and Create Team. The team is made up of experts from a number of organisations involved in the financial industry and its core purpose is to assist businesses with both the implementation of innovative ideas and the introduction of new products and services into the market.

  7. Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?

    The main risk to the growth of the fintech market in Gibraltar is Brexit. The future for licenced financial services institutions who rely on passporting their services to other European Union (“EU”) Member States is currently uncertain as there are few details as to the effect of Brexit. Nevertheless, many of the licensed firms in Gibraltar source the majority of their business from the United Kingdom and it is expected that post-Brexit Gibraltar will retain a strong relationship with the UK.

    Firms licenced under the DLT Regulations are not able to passport their services to other EU Member States, in the same way that firms authorised to conduct electronic money activities, payment services and investment services can, as the DLT Regulations were not introduced in order to give effect to any EU directives. The EU has not yet developed and implemented a harmonised approach with regards to the use of DLT in financial services. Brexit should therefore have no impact on those firms licensed under the DLT Regulations. The current position is that those firms licensed by the GFSC under the DLT Regulations can provide their services in any jurisdiction in which the provision of those services are not expressly prohibited by or subject to any legislation of the particular jurisdiction in which the licensed firm wishes to provide its services.

  8. What tax incentives exist in your jurisdiction to encourage fintech investment?

    There is no specific tax incentive. However, businesses are often attracted to Gibraltar’s competitive corporate tax rate which is currently set at 10% of profits “accrued in and derived from Gibraltar” instead of, for example, 19% in the UK. Additionally, Gibraltar does not have capital gains tax, wealth tax, value added tax or inheritance tax. Furthermore, Gibraltar offers HEPSS - a scheme for high executives possessing specialist skills (see question 10 for further details) – and a scheme known as Category 2. The Category 2 tax residency is a special tax regime in Gibraltar whereby individuals who are in possession of a Category 2 certificate issued by the Gibraltar Finance Centre are taxed on the first £80,000 of assessable income, resulting in a maximum tax liability of £27,560 as tax rates presently stand. In order to be obtain this tax residency status an application must be made to the Gibraltar Finance Centre. Approval by the Gibraltar Finance Centre under this tax regime will be subject to a number of conditions being met such as, but not limited to, the individual being of substantial and sound financial standing having a minimum net worth of £2 million and the individual must either own or rent approved residential accommodation in Gibraltar. A Category 2 individual cannot generally engage in a trade, business or employment in Gibraltar, unless agreed in advance with the Finance Centre director.

  9. Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?

    Gibraltar has been attractive to high profile businesses dealing with, or otherwise concerned with:

    • the use of DLT, to store and transmit cryptographic assets;
    • electronic money;
    • payment services; and,
    • MIFID.
  10. If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?

    Gibraltar has been very responsive to new commercial trends, and has been able to provide businesses with ‘speed to market’ – a very attractive proposition for entrepreneurs, especially given the culture of ‘no-compromise’ in terms of transparency: a must in order to maintain and further the high quality of the jurisdiction. The establishment of a very solid gaming industry confirms the ability to attract novel industries and to create fertile regulatory-ground on which these can sprout and grow.

    Gibraltar has been at the forefront of legal development in financial technology, as one of the first jurisdictions in the world to provide a regulatory framework for DLT based businesses, and this has attracted numerous high profile Blockchain based businesses, including (but not limited to) crypto-exchanges, custodians and e-wallet services providers. The forthcoming Token Offering Regulations are intended to compliment the DLT Regulations, and together they will form a complete regulatory framework.

    Gibraltar is also attractive to new businesses due to schemes such as HEPSS (High Executive Possessing Specialist Skills). Those individuals who are granted HEPPS status have a special fiscal status in Gibraltar whereby their gross assessable income is capped at £120,000 per annum which would result in a total tax liability of approximately £29,940.

  11. Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?

    There is no specific cap or quotas. To work in Gibraltar, a foreign professional would need a work permit and, potentially, a Visa according to his/her nationality.

    Access to talent has not been an issue with regards to novel industries, such as fintech and the gaming industry, particularly due to Gibraltar’s welcoming attitude to personnel having uncommon and specific skills and experience. Section 7(3) of the Employment Regulations 1994, which regards the provision of work permits, showcase Gibraltar’s attitude toward immigration – whereby employers should first seek talent within the jurisdiction before outsourcing it from outside. Therefore Gibraltar encourages access to talent from abroad while at the same time protecting the internal job market.

  12. If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?


  13. What protections can a fintech use in your jurisdiction to protect its intellectual property?

    Gibraltar relies on English law for the protection of its registered and unregistered IP rights. Most fintech is software-based and so copyright, patent (where the technical innovation goes beyond software ‘as such’ having technical effect), and trade-secrets are perhaps the most relevant forms of protection for the technology itself. Trade marks remain, of course, fundamental for the protection of businesses’ brands.

    While it is possible to enforce patents’ and trade marks’ rights through Gibraltar’s courts, first registration is done through the dedicated UK offices. Once the UK registration of the right is successfully obtained, applicants can then seek extension of the right so as to include the territory of Gibraltar. As in the UK, copyright arises automatically provided the work qualifies for protection and information that is confidential, identifiable as such and disclosed in circumstances imparting the need of confidentiality acquires the status of trade secret – both copyright and trade secrets are enforceable through the UK or Gibraltar courts.

  14. How are cryptocurrencies treated under the regulatory framework in your jurisdiction?

    Cryptocurrency itself is not regulated in Gibraltar. The DLT Regulations, however, regulate entities that, by way of business, either store or transmit value belonging to others, using DLT. It is expected that the forthcoming Token Offering Regulations will focus on three key aspects, namely:

    • the promotion, sale and distribution of tokens;
    • the operation of secondary market platforms trading in tokens; and
    • the provision of investment and ancillary services relating to tokens.

    It is necessary to consider tokens within the context of Gibraltar’s existing securities legislation and electronic money regulations as tokens may have certain features or characteristics that bring them within the scope of such legislation. Tokens, due to their intended purpose and nature, may be considered akin to traditional regulated financial instruments such as shares, debentures, derivatives, options and other securities. Each token and its use case must be analysed on a case by case to determine whether or not it is caught by such legislation.

  15. How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?

    At present there are no laws, rules or regulations in place prohibiting initial coin offerings. There is also no regulation in force that was specifically designed to regulate initial coin offerings or initial token sales. It is, however, necessary to consider token sales within the context of Gibraltar’s existing regulatory landscape as tokens may have certain features or characteristics that bring them within the scope of such regulations however the purpose of the forthcoming Token Offering Regulations is to regulate this area. The Token Offering Regulations will focus on three key aspects, namely:

    • the promotion, sale and distribution of tokens;
    • the operation of secondary market platforms trading in tokens; and
    • the provision of investment and ancillary services relating to tokens.

    The Token Offering Regulations will set standards for initial coin offerings and initial token sales to be better tailored to the issuers’ needs in terms of structure, to provide investors with more confidence through the implementation of robust standards and consequently, to maintain the credibility of the jurisdiction.

    Generally, initial coin offerings and initial token sales will not be caught under the DLT Regulations. However, there may be instances where, depending on what the token will be used for and how the token issue is structured, the token may fall within the DLT Regulations and/or other existing financial services legislation, for example, it could be deemed as a Collective Investment Scheme or an Alternative Investment Fund. Each offering needs to be analysed and considered on a case by case basis.

    Entities undertaking an initial coin offering or an initial token sale are required to comply with Gibraltar’s anti-money laundering and counter-terrorism financing provisions by virtue of section 9(1)(p) of the Proceeds of Crime Act 2015 (“POCA”), which provides that:

    “undertakings that receive, whether on their own account or on behalf of another person, proceeds in any form from the sale of tokenised digital assets involving the use of distributed ledger technology or a similar means of recording a digital representation of an asset”

    will be considered a “relevant financial business” and will therefore be obligated to comply with POCA.

  16. Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?

    The GFSC has received approximately 40 applications for authorisation under the DLT Regulations. The GFSC has issued Covesting, a crypto trading platform, and Coinfloor, a bitcoin exchange, with the first DLT licenses allowing them to operate as fully regulated financial services entities. Five other applicants, including eToro and TokenMarket, have been granted in-principle licences and we expect these firms to receive their full licences in the coming months. Once these seven applicants are authorised, there will be a number of live blockchain projects which will include crypto-exchanges, cryptocurrency wallet providers and custodian service providers.

  17. To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?

    Providing a legal framework capable of welcoming and encouraging the growth of new technology has been a key focus in the development of the DLT Regulations, which is the reason why Gibraltar does not regulate the technology but instead focuses on regulating those entities who use the technology as part of their business. This flexible yet robust regulatory framework allows the fintech industry in Gibraltar to mature and advance within a regulated environment without the need to constantly update the regulations. Therefore, the development and adoption of AI is highly encouraged by the jurisdiction and its regulators.

  18. Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?

    Traditional insurance firms in Gibraltar are becoming increasingly receptive to the idea of insuring fintech businesses, particularly in respect of those business seeking authorisation from the GFSC. However, currently, insurers are not ‘jumping aboard the fintech bandwagon’ in regards the adoption and integration of fintech into their businesses. Therefore, we expect a slow adoption of financial technology for this particular sector of the industry.

  19. Are there any areas of fintech that are particularly strong in your jurisdiction?

    There is a strong market for initial coin offerings, and crypto-exchanges and wallet service providers, which is expected given the introduction of the ground-breaking DLT Regulations and the forthcoming Token Offering Regulations. There is also a strong presence of electronic money institutions and payment services providers which have formed an important element of the financial market in Gibraltar.

  20. What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?

    There is a high degree of collaboration between fintech businesses and financial institutions, especially since said businesses still rely on the traditional banking system and services (for example loans) in order to establish their businesses and operate on an ongoing basis. Financial institutions in Gibraltar are becoming increasingly comfortable as the fintech industry begins to mature.

  21. To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?

    We are starting to see a number of banks in Gibraltar partnering with fintech companies in order to enhance their offering and some are also carrying out their own fintech development program.

  22. Are there any strong examples of disruption through fintech in your jurisdiction?

    DLT businesses and the industry as a whole is still in its infancy, with the first two firms being issued DLT licences and a further five firms receiving in-principle licences under the DLT Regulations. Once the remaining five businesses receive their full licences from the GFSC in the coming months we expect some disruption in the jurisdiction although we anticipate that the disruption caused by these businesses will be felt strongly in other jurisdictions worldwide as they will primarily use Gibraltar as their base of operations.