VASP Licence in Gibraltar
Gibraltar is a reputable GFSC-supervised non-EU VASP route for crypto businesses that value DLT-provider positioning, local office substance and regulatory credibility, but do not need EU passporting.
Treat the GFSC VASP licence / registration description as CSV-only until legal review confirms the exact current route, activity permissions and terminology.
Regulatory status should be confirmed by local counsel before relying on this route.
What is a Gibraltar VASP route?
A Gibraltar VASP route is a GFSC-supervised licence or registration pathway for virtual asset service activity connected to Gibraltar's DLT-provider positioning. It is a high-reputation non-EU option, not an EU passporting licence and not a low-cost offshore shortcut.
- Jurisdiction
- Gibraltar
- Regulator
- Gibraltar Financial Services Commission (GFSC)
- Regime
- VASP
- Legal basis
- Regulator: Gibraltar Financial Services Commission (GFSC).
Country-specific regulatory statements should be checked against current regulator guidance before relying on this route.
Gibraltar VASP activity scope
The application should map the exact VASP activities before treating Gibraltar as a generic crypto permission. Exchange, custody, wallet, brokerage, advisory, transfer/payment and staking-related models can create different evidence, control and risk requirements.
Exchange
LicensedExchange operations fit within the permitted activities of this route.
Exchange
Exchange operations fit within the permitted activities of this route.
LicensedCustody
LicensedCustody is within scope; review controls requirements.
Custody
Custody is within scope; review controls requirements.
LicensedBrokerage
ConditionalBrokerage or OTC activity typically fits within scope.
Brokerage
Brokerage or OTC activity typically fits within scope.
ConditionalWallet provider
LicensedExchange operations fit within the permitted activities of this route.
Wallet provider
Exchange operations fit within the permitted activities of this route.
LicensedEU market
Not coveredEU passporting not available from this route.
EU market
EU passporting not available from this route.
Not coveredStartups
Not coveredHigh setup complexity means significant budget is needed.
Startups
High setup complexity means significant budget is needed.
Not covered
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Operating model for a GFSC VASP file
A credible Gibraltar file should connect the applicant entity, activity scope, local office, audit, governance, AML controls and technology risk management into one operating model.
Physical office planning is required even though local staff is listed as not required in the CSV snapshot.
Operational control area that should be covered in the applicant's governance and compliance model.
Physical office planning is required even though local staff is listed as not required in the CSV snapshot.Operational control area that should be covered in the applicant's governance and compliance model.
Audit, policies and compliance evidence should be prepared before presenting the route to banks or PSPs.
Operational control area that should be covered in the applicant's governance and compliance model.
Audit, policies and compliance evidence should be prepared before presenting the route to banks or PSPs.Operational control area that should be covered in the applicant's governance and compliance model.
The cost model should include the GBP state fee, annual supervision fee and ongoing maintenance burden.
Operational control area that should be covered in the applicant's governance and compliance model.
The cost model should include the GBP state fee, annual supervision fee and ongoing maintenance burden.Operational control area that should be covered in the applicant's governance and compliance model.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Gibraltar vs EU and offshore routes
Gibraltar can be attractive when reputation, common-law familiarity and GFSC oversight matter more than EU passporting. The tradeoff is a high-complexity, high-maintenance route with limited market-access leverage outside Gibraltar.
Regulatory reputation
Onshore (this jurisdiction)
High
Offshore comparison
Lower recognition
Regulatory reputationHighLower recognitionBanking access
Onshore (this jurisdiction)
Challenging
Offshore comparison
Often restricted
Banking accessChallengingOften restrictedCompliance burden
Onshore (this jurisdiction)
High
Offshore comparison
Variable
Compliance burdenHighVariable
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
When Gibraltar VASP is not suitable
Gibraltar is a poor fit where the business needs EU passporting, a very low budget, minimal maintenance or an MVP-stage route without mature controls.
The target market requires EU/EEA passporting from the licence itself.
The project cannot support a physical office, audit and high annual maintenance cost.
The team needs a fast, low-documentation launch rather than a reputable GFSC route.
The model includes securities, derivatives or other regulated products without separate legal analysis.
Consider instead
- Malta (MiCA) MICA — EU passporting route for European market access
- Dubai (VASP) VASP — Strong UAE and MENA positioning for regulated VASP activity
- Canada (MSB) MSB — Faster registration-style route for non-EU market entry
Country-specific regulatory statements should be checked against current regulator guidance before relying on this route.
Activity fit for this route
Review which crypto activities fit within the scope of this route.
Exchange operations fit within the permitted activities of this route.
Custody is within scope; review controls requirements.
Brokerage or OTC activity typically fits within scope.
Exchange operations fit within the permitted activities of this route.
EU passporting not available from this route.
High setup complexity means significant budget is needed.
Not sure if your model fits? Request a licensing assessment
Business model fit — Gibraltar
Assess how well this route covers your planned activities.
Fit score
- Good fit
- 3/6
- Partial fit
- 3/6
- Poor fit
- 0/6
Gibraltar covers some but not all planned activities
Some activities need additional licensing or separate review before committing.
Is Gibraltar VASP authorisation right for your project?
Best for
- Reputable DLT provider and VASP operations
Not suitable for
- Low-budget startups
Core requirements
Use this section to check the main regulatory and operational requirements before committing to a jurisdiction.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Local presence and substance
Gibraltar is not positioned as a no-substance setup. The CSV snapshot lists a physical office and audit as required, with local staff not required, so the operating plan should still show meaningful governance and local contact points.
Local staff
Not requiredNot required
Review local person requirements before setup.
Physical office
RequiredRequired
A genuine office presence is expected, not a nominal registered address.
Audit
RequiredRequired
External audit is required for ongoing supervision compliance.
Planning notes
- Plan a Gibraltar office footprint and accountable management structure.
- Keep staffing assumptions conservative until local legal review confirms role expectations.
- Align audit, AML, outsourcing and technology controls with the selected VASP activities.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Cost breakdown
Budget for service price, regulatory fees, share capital and ongoing costs separately.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Cost breakdown — Gibraltar
Budget for service price, regulatory fees, share capital and ongoing costs separately.
| Cost item | Amount |
|---|---|
| Service priceApplication preparation and professional services. | €30,900 |
| State fee | €10,000 |
| Required share capitalMust be held, not an expenditure. | €20,000 |
Summary
- One-off costs
- €60,900
- Annual (year 1)
- €0
- Total year 1
- €60,900
Adjust to convert to your base currency.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Application process
The sequence below shows the usual project flow. Exact steps depend on the regulator, business model and application scope. Gibraltar — From 4 months.
Pre-assessment and scope review
1–3 weeksDefine the activity scope, governance model and target markets before formal preparation.
Company setup in Gibraltar
2–6 weeksEstablish legal entity with required governance structure.
Documentation and compliance packBottleneck risk
3–8 weeksPrepare AML/CFT policies, governance documents, controls framework and application materials.
Application submission to Gibraltar Financial Services Commission
1–2 weeksSubmit complete application with all required documentation.
Regulator reviewBottleneck risk
From 4 monthsRegulator reviews the application. May request clarifications. Incomplete files extend this phase.
Depends on: File quality and completeness
Authorisation or registration confirmation
1–4 weeksRegulator confirms authorisation or registration. Commence operations.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
What can delay or increase cost
These factors are most likely to affect timelines and budgets for this route.
Setup complexity is rated high for Gibraltar. Company setup, governance and documentation take longer than average.
Ongoing supervision, audit and compliance costs are above average. Budget for these separately from the application fee.
Incomplete files are the most common cause of delay. Regulator queries extend review by weeks or months.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Banking and PSP feasibility
Gibraltar has high regulatory reputation and medium banking and PSP difficulty in the CSV snapshot, but banks will still review activity scope, token policy, client geography, fiat flows, AML evidence and governance.
Reflects how challenging it is to open and maintain business bank accounts in this jurisdiction.
Reflects availability of payment service providers willing to onboard crypto-licensed entities.
A licence or registration does not guarantee bank account or payment provider approval. Banking feasibility should be reviewed before the application strategy is finalized.
Preparation checklist
- Prepare a banking pack before application or PSP outreach.
- Do not treat GFSC supervision as a guarantee of account opening.
- Expect enhanced review for custody, exchange, high-risk client geographies or complex token flows.
Compliance documentation
Most crypto licensing routes require a documented compliance framework before submission, not only after approval.
- RequiredAML/CFT policy and risk assessmentDocument your customer risk model and control framework.
- RequiredCustomer due diligence (CDD) procedures
- RequiredEnhanced due diligence (EDD) proceduresFor high-risk clients and jurisdictions.
- RequiredTransaction monitoring system and rules
- RequiredSanctions screening procedures
- RequiredSuspicious activity reporting (SAR) process
- RequiredMLRO / Compliance officer appointmentLocal accountability may be required.
- RecommendedBoard-approved governance charter
- ConditionalOutsourcing policy and monitoringRequired if functions are outsourced.
- RecommendedICT / cybersecurity policy
- RequiredComplaints handling procedure
- RequiredAnnual external audit engagementRequired for ongoing supervision compliance.
Country-specific regulatory statements should be checked against current regulator guidance before relying on this route.
Documents to prepare
Preparing these materials before filing reduces regulator questions and helps with banking or payment provider onboarding.
Corporate documents
AML and compliance
Operational
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Regulator profile
Gibraltar Financial Services Commission (GFSC)
Official regulator websiteStrong international recognition and established supervision track record.
Reflects documentation depth, governance requirements and expected review friction.
Reflects likelihood of delays, additional information requests or policy uncertainty.
Country-specific regulatory statements should be checked against current regulator guidance before relying on this route.
Risk assessment
Main risk dimensions for the Gibraltar route.
Route risk rating — setup complexity: High.
Route risk rating — maintenance cost: High. Budget for ongoing compliance, fees and supervision separately.
Route risk rating — regulatory reputation: High.
Route risk rating — regulatory risk: Low to medium. Weak compliance, vague scope or insufficient controls increase review risk.
Mitigation: Prepare an evidence-based compliance file before submission.
Route risk rating — banking difficulty: Medium. Authorisation does not guarantee bank account opening.
Mitigation: Start banking outreach and compliance preparation before the application.
This content is for general orientation only. Crypto regulation changes quickly and the final scope should be confirmed through a jurisdiction-specific legal review before filing or incorporation.
Gibraltar vs other VASP routes
Compare Gibraltar with Malta for EU passporting, Dubai for UAE/MENA positioning and Canada for a faster registration-style route. Gibraltar is strongest when the priority is reputable non-EU VASP and DLT-provider positioning.
Gibraltar
VASP
- Price
- 30 900 EUR
- Timeline
- From 4 months
- Passporting
- No passporting
- Banking
- Medium
- Reputation
- High
Malta (MiCA)
MICA
- Price
- 20 700 EUR
- Timeline
- From 6 months
- Passporting
- EU/EEA
- Banking
- Medium
- Reputation
- High
+ EU passporting route for European market access
− Requires EU substance and MiCA compliance planning
View routeDubai (VASP)
VASP
- Price
- 22 300 EUR
- Timeline
- From 6 months
- Passporting
- No passporting
- Banking
- Medium
- Reputation
- High
+ Strong UAE and MENA positioning for regulated VASP activity
− Higher local substance and annual supervision burden
View routeCanada (MSB)
MSB
- Price
- 20 600 EUR
- Timeline
- From 2 months
- Passporting
- No passporting
- Banking
- Medium
- Reputation
- High
+ Faster registration-style route for non-EU market entry
− Registration positioning is weaker than a high-reputation VASP licence
View routeFees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Gibraltar vs other VASP jurisdictions
Compare key parameters across VASP-regulated jurisdictions.
Check your readiness for Gibraltar VASP authorisation
Documented AML/CFT policies, risk assessment, compliance officer.
20 000 GBP minimum capital required.
Documented AML/CFT policies, risk assessment, compliance officer.
Board, management, accountability chain defined.
Banking strategy and identified partners.
Readiness status
Answer the criteria on the left to see your readiness status.
Frequently asked questions
No. The activity scope should be mapped to the exact exchange, custody, wallet, brokerage, advisory, transfer, payment or staking features before relying on the route.
No. Gibraltar is a non-EU route and the CSV snapshot classifies it as no passporting. EU market access should be assessed through MiCA or another EU/EEA route.
Usually no. The CSV snapshot lists high setup complexity, high maintenance cost, a physical office requirement, audit and GBP regulatory fees.
Prepare the activity map, local office plan, governance, AML and sanctions framework, audit readiness, technology controls, token policy, banking package and budget for state and annual supervision fees.
Gibraltar is often considered for reputable DLT provider and VASP operations, but the exact legal route and terminology should be confirmed by local counsel before client-facing claims are made.
The page is not legal advice and should not be relied on as a substitute for advice from qualified counsel in the relevant jurisdiction.
Your dedicated specialists
Enrico
Rein
Jurata
Andrej
Marta
Katrin
Inga
Request a Gibraltar VASP assessment
Share your planned activities, target markets and timeline. We will review which crypto licensing route is likely to fit.