Gibraltar Regulatory Update: Virtual Asset Arrangements Now Fall Under The Financial Services Act.

Gibraltar has today implemented a significant update to its financial regulatory framework, bringing virtual asset arrangements (“VAAs”) squarely within the scope of the Financial Services Act 2019 (“FSA”). 

Since 1 January 2018, any firm carrying out by way of business, in or from within Gibraltar, the use of distributed ledger technology (“DLT”) for storing or transmitting value belonging to others needs to be authorised by the Gibraltar Financial Services Commission (“GFSC”) as a ‘DLT Provider’.

For activities outside the scope of the DLT framework, the Proceeds of Crime Act 2015 (Relevant Financial Business)(Registration) Regulations 2021 impose an obligation on specified businesses to be registered with the GFSC for the purposes of anti-money laundering, counter terrorist financing and counter proliferation finance supervision, and comply with the Proceeds of Crime Act 2015 (the “POCA Registration”). 

Under the previous framework, the GFSC was to maintain a register of relevant financial businesses that receive “proceeds in any form from the sale of tokenised digital assets involving the use of DLT” and “persons that, by way of business, exchange, or arrange or make arrangements with a view to the exchange of virtual assets for money, money for virtual assets or one virtual asset for another”. This captured both token issuing entities and those arranging or facilitating virtual asset exchanges, including OTC desks and market makers.

This position now changes under the Financial Services (Regulated Activities)(Amendment) Regulations 2025. From today, providing virtual asset arrangements, meaning exchanging virtual assets for fiat currency, fiat for virtual assets, or one virtual asset for another, is formally classified as a regulated activity under Part 16 of Schedule 2 to the FSA. Businesses carrying out these activities must now obtain Part 7 permission from the GFSC.  

Token issuers that issue or sell their native token remain within the POCA Registration regime, but entities that make arrangements in virtual assets are now brought within scope of the DLT regime. Certain entities, including collective investment schemes, pension funds, and the depositaries and managers of collective investment schemes and pensions funds, are excluded when dealing on their own account.

Key Changes 

The term “virtual asset” now expressly adopts the definition contained in the Proceeds of Crime Act 2015, ensuring consistency across the financial services and AML supervision frameworks. In addition, the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 have been renamed and updated to reflect the supervision of both DLT Providers and ‘VAA Providers’. The regulated activity previously described as “value stored and transmitted by database system” now reads as “value stored or transmitted by database and virtual asset arrangements”, and includes the section describing such activity. Further, corresponding amendments have been made to the Proceeds of Crime Act 2015 and its registration regulations to remove VAA businesses from the AML-only regime and align them with this new licensing requirement.

Who is Affected? 

As a consequence of the aforementioned amendments, any business that facilitates virtual asset exchange transactions as part of its commercial offering will now be affected.

However, as stated, exemptions exist where certain institutions - such as collective investment schemes, pension funds, and the depositaries and managers of such schemes and funds - are dealing solely on their own behalf.

Transitional Arrangements (Effective Immediately) 

Businesses to which these changes apply and that were previously operating under POCA Registration only now have two key obligations:

1. Notify the GFSC within 14 days (from today) that they intend to continue their activities; and
2. Submit a Part 7 permission application within six months.

Firms that complete these steps are permitted to continue operating while their application is processed. Where an application is ultimately refused, the GFSC may allow the business to wind down operations in an orderly manner.

If you require any further information on these changes or require guidance in navigating the transitional arrangements, please feel to reach to me at: jerome.compson@hassans.gi.