2025 NRA: Key Takeaways for Gibraltar’s Financial Services Sector

The Government of Gibraltar has recently published the 2025 National Risk Assessment (NRA), which sets out Gibraltar’s current exposure to money laundering, terrorist financing, proliferation financing, sanctions circumvention, and other financial crime risks. This is the fourth iteration of the NRA and comes at a critical juncture following Gibraltar’s swift removal from the FATF Grey List in 2024. 

The 2025 NRA underscores that Gibraltar’s financial centre has evolved significantly over the past two decades. While traditional private banking and servicing corporate structures once formed the backbone of Gibraltar’s financial services industry, the market has diversified considerably. Today, sectors such as online gambling, e-money products, and DLT Providers/Virtual Asset Service Providers play an increasingly prominent role. These areas offer significant commercial opportunities but, as the NRA  highlights, also carry inherent vulnerabilities that must be carefully managed through robust compliance frameworks.

Geographic exposure continues to be a factor in Gibraltar’s risk landscape, with neighbouring Spain and Morocco assessed as higher-risk jurisdictions. The UK, by contrast, presents a more moderate profile, with ‘medium’ money laundering and low terrorist financing risks. The NRA also notes that fraud, cyber-enabled fraud, and the laundering of criminal proceeds remain areas requiring vigilance. These findings reflect not only the challenges Gibraltar faces but also the jurisdiction’s transparency in recognising them and its commitment to applying proportionate safeguards.

The NRA makes clear that all ‘Relevant Financial Businesses’ (RFBs) subject to the Proceeds of Crime Act 2015 (POCA) must align their own frameworks to these updated findings. In practical terms, this means firms should familiarise themselves with the NRA, reflect its findings in business-wide risk assessments, and update AML/CFT/CPF policies and controls as needed in light of the identified risks. Where gaps or misalignments are identified, firms should move quickly to implement appropriate enhancements.

Looking ahead, the 2025 NRA highlights that Gibraltar’s risk profile will be influenced not only by sectoral and geographic factors but also by geopolitical developments. In particular, the agreement on Gibraltar’s integration with the Schengen area has the potential to reshape border controls, data sharing, and law enforcement cooperation. The report notes that such developments may carry consequential impacts for financial crime risk exposure and regulatory oversight, and stakeholders are urged to monitor these changes closely.

As Gibraltar prepares for its forthcoming Moneyval evaluation in 2027, the NRA serves as a guide for priority areas of focus. It reflects Gibraltar’s determination to maintain a proactive, risk-based approach, but also calls on firms to redouble their efforts in strengthening resilience.

If your firm requires support in navigating the implications of the new NRA - whether in risk assessment, governance updates, or enhancing AML/CFT/CPF frameworks - please feel free to reach out. 

The 2025 NRA can be found here: Microsoft Word - 2025NRA - 11092025.