Gibraltar's Distributed Ledger Technology (DLT) Provider regime – the first purpose-built crypto licensing framework enacted by any major financial centre – places KYC and AML obligations at its operational core. Every firm authorised under the Gibraltar Financial Services Commission (GFSC) must satisfy rigorous customer due diligence, transaction monitoring and risk-assessment standards before a single client account is opened. The regime does not treat these as box-ticking exercises; the GFSC supervises them as live compliance obligations, capable of triggering enforcement at any point in the licence lifecycle. This page explains what the framework demands, how an inbound operator builds a compliant onboarding architecture, and where the cross-border picture – entity domicile, user jurisdiction, banking rails – changes the analysis.
What is the regulatory basis for KYC in Gibraltar?
The GFSC's authority over KYC and customer due diligence derives from two converging sources: the DLT Provider regulatory framework enacted under the Financial Services (Distributed Ledger Technology Providers) Regulations, and Gibraltar's domestic AML regime, which implements the FATF Recommendations – including Recommendation 15, the standard specifically applicable to virtual-asset service providers. Together, these create a layered obligation. A DLT Provider licence does not stand alone; it sits inside an AML/CFT architecture that the GFSC monitors on a risk-based, ongoing basis.
The DLT Provider regime covers firms that use distributed ledger technology to store or transmit value belonging to others. That definition captures exchanges, custodians, payment processors and token-issuance platforms. Once a firm falls within that perimeter, it must appoint a qualified Money Laundering Reporting Officer (MLRO), implement a written AML/CFT policy, maintain documented customer due diligence records and report suspicious transactions to the Gibraltar Financial Intelligence Unit (GFIU). None of these obligations are optional. The GFSC has made clear, in published supervisory guidance, that it expects firms to treat AML compliance as a board-level matter – not a back-office function.
One important structural point: Gibraltar's regime operates alongside, not instead of, the home-jurisdiction obligations that apply to the firm's users. A Gibraltar-licensed VASP serving customers in the EU faces both the GFSC's standards and the national AML frameworks of those EU member states. In our practice, operators who underestimate that bilateral exposure frequently find their onboarding architecture is adequate for Gibraltar but deficient for the markets they actually serve.
For a scoped review of your AML architecture against the GFSC's current supervisory expectations, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options
What KYC requirements apply to a Gibraltar DLT firm?
Customer due diligence under the Gibraltar AML regime follows the FATF standard: identify, verify and understand the customer before the business relationship begins, and monitor it throughout. For a retail-facing crypto platform, that means collecting government-issued identity documents and proof of address for individual customers, verifying them against reliable independent sources, and assessing the customer's source of funds and source of wealth where the risk profile warrants it.
The regime uses a risk-based approach. Not every customer requires the same depth of scrutiny. Standard due diligence applies to most retail onboarding. Enhanced due diligence (EDD) is mandatory for politically exposed persons, high-risk jurisdictions identified by the FATF, and customers whose transaction patterns indicate elevated money-laundering or sanctions risk. Simplified due diligence is permitted only in defined low-risk circumstances, and the GFSC expects firms to document their reasoning whenever they apply it.
Beneficial ownership verification is a distinct obligation. Where the customer is a legal entity – a company, a trust, a fund – the firm must identify and verify the individuals who ultimately own or control it, typically defined as those holding a material ownership interest or exercising significant control. The GFSC's supervisory focus on beneficial ownership has intensified in recent years, tracking the FATF's global push for transparency in corporate structures.
Ongoing monitoring is not a one-time event. The firm must review CDD records periodically, flag material changes in the customer's circumstances, and re-verify where the risk profile changes. A Gibraltar firm that onboards a customer at low risk and never reviews that classification – even as transaction volumes grow – is, in the GFSC's view, non-compliant. That position has practical consequences: remediation costs, potential regulatory action, and loss of banking relationships that depend on demonstrable AML hygiene.
How does the Travel Rule operate for Gibraltar VASPs?
The Travel Rule – the FATF obligation requiring VASPs to collect, verify and transmit originator and beneficiary information alongside virtual-asset transfers – applies to Gibraltar DLT Providers under the domestic AML framework, which has incorporated the FATF's updated Recommendation 15. The rule means that when a Gibraltar VASP sends a transfer to another VASP, it must pass the originator's name, account number or wallet identifier, and certain additional data; the receiving VASP must screen and retain that information.
Implementation is technically non-trivial. The VASP-to-VASP data exchange requires a compatible messaging protocol. The market has converged on several interoperability solutions – firms in our practice use a range of them – but the choice of protocol does not discharge the underlying obligation. The GFSC expects firms to demonstrate, on request, that Travel Rule-compliant data is being transmitted and received for qualifying transfers. A firm that has licensed a Travel Rule tool but has not integrated it into its transaction flow is, in regulatory terms, as exposed as one that has done nothing.
The cross-border dimension matters acutely here. A Gibraltar firm transacting with a VASP in a jurisdiction that has not yet implemented the Travel Rule faces the "sunrise problem" – the counterparty cannot receive compliant data. The GFSC's guidance does not excuse non-compliance on this basis. The practical approach, which we advise, is to document the jurisdictional gap, apply enhanced due diligence to those transactions and retain the data internally pending a compliant counterparty. Regulators in the leading hubs increasingly expect this kind of documented risk management over passive gaps.
Who must be MLRO, and what governance does the GFSC expect?
Every Gibraltar DLT Provider must appoint a dedicated MLRO – an individual who holds sufficient seniority and authority within the firm to discharge the role effectively. The GFSC must be notified of the appointment, and any change in MLRO requires a further notification. The regulator conducts its own fitness and propriety assessment of the individual.
The MLRO's duties include: receiving and evaluating internal suspicious activity reports from staff; deciding whether to file an external report with the GFIU; maintaining the firm's AML/CFT policy and procedures; leading staff training; and providing the board with regular compliance reports. That last point is not ceremonial. The GFSC expects the board to engage substantively with AML matters – to ask questions of the MLRO, to review management information, and to act on recommendations. A board that rubber-stamps the MLRO's reports without engagement is a governance failure the regulator will identify in a supervisory visit.
For smaller or start-up operators, the MLRO function can present a practical challenge. The role requires genuine expertise in AML and CFT – not simply a senior person willing to sign forms. In our practice, firms that try to staff the MLRO role on the cheap typically discover the problem during their first GFSC interaction, not before. The cost of remediation – including possible licence conditions – invariably exceeds the cost of getting the appointment right the first time.
A related governance expectation is the written AML/CFT policy. This document must be specific to the firm's business model, risk profile and customer base. A generic template, lifted from another jurisdiction or another business, does not meet the GFSC's standard. The policy must address the firm's actual products, channels and geographies – and it must be reviewed and updated when material changes occur.
What does transaction monitoring require in practice?
Effective transaction monitoring for a Gibraltar crypto firm means running automated alerts against rules and scenarios calibrated to the firm's specific risk profile, reviewing those alerts with human judgment, and escalating genuine concerns into the suspicious activity reporting process. The GFSC does not prescribe a specific software solution, but it does expect the monitoring system to be proportionate to the volume and risk of the firm's activity.
For an exchange or custody provider, monitoring must cover at minimum: large or unusual transactions; patterns consistent with structuring; transactions involving addresses flagged by sanctions screening tools; and activity inconsistent with the customer's stated profile. On-chain forensics add a dimension that traditional financial monitoring does not face. The ability to trace fund flows across the blockchain – using tools that map wallet clusters, exchange deposits and mixer interactions – means that the definition of "unusual" is technically richer for crypto than for fiat.
In a recent compliance matter, a digital-asset exchange operating under a DLT Provider licence discovered, during a GFSC review, that its transaction monitoring rules had not been updated since go-live. The firm had grown substantially, its product mix had changed and new high-risk geographies had been added to its user base. We helped the firm redesign its rule set, recalibrate its thresholds and document the process. The review concluded without enforcement action. The lesson is straightforward: transaction monitoring is a living system, not a configuration that runs indefinitely without attention.
How does the Gibraltar KYC framework interact with banking and cross-border structure?
The cross-border reality for a Gibraltar DLT Provider is that the licence governs what the firm may do within the GFSC's perimeter; it does not resolve the firm's obligations elsewhere. A business incorporated in Gibraltar, serving customers in the UK and the EU, simultaneously faces the GFSC's AML standards, the FCA's financial-promotion and VASP registration regime for UK-facing activity, and the national AML frameworks of the EU member states where users are located. The DLT licence is one layer of a multi-layer compliance stack.
Banking is where this complexity surfaces most immediately. Correspondent and corporate bank accounts for crypto firms remain difficult to obtain, even with a GFSC licence. The banks that will bank a Gibraltar DLT Provider are conducting their own KYC on the firm – reviewing its AML policy, its transaction monitoring setup, its MLRO credentials and its customer base. A firm whose compliance architecture is superficially adequate for the GFSC but does not hold up to a bank's due diligence team will find accounts closed or not opened. In our practice, we map the compliance architecture against both the regulator's standard and the realistic bank due diligence process before advising a client to commit to Gibraltar as a domicile.
Tax interaction is a separate layer. Gibraltar has a territorial income-tax regime; profits arising in Gibraltar are taxable, profits arising outside are not. The KYC and AML obligations do not change the tax analysis, but the corporate structure – where the entity sits, where management and control sits, where revenue is booked – has direct AML implications. A company with nominal Gibraltar presence and substantive activity elsewhere will face questions from both the GFSC and any bank reviewing the structure.
If you are working through the licence, banking and compliance architecture for a Gibraltar operation, write to OBOLUS at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options
What are the most common KYC compliance failures in Gibraltar?
The GFSC's supervisory record, and our own practice across digital-asset compliance work, point to a consistent set of recurring failures. They are worth naming directly.
The first is insufficient risk assessment at onboarding. Firms apply standard due diligence to every customer, regardless of risk profile, because a uniform process is operationally simpler. The regulator's risk-based approach requires proportionality. Applying EDD only when a customer is already under investigation – rather than at onboarding, when the risk indicators were present – is a failure of the process, not just of the outcome.
The second is inadequate ongoing monitoring. CDD records are collected at onboarding and never revisited. Customers whose activity evolves materially – higher volumes, new counterparties, changed source of funds – are not re-screened. The GFSC expects periodic review cycles, and it asks for evidence of them during supervisory visits.
The third is a mismatch between the written AML policy and actual practice. The policy says one thing; the operational process does another. This gap is typically discovered in an audit or a regulatory review, not before. Closing it requires both a policy rewrite and operational retraining.
A common assumption is that a licence from a smaller or offshore jurisdiction provides an equivalent AML framework to Gibraltar's DLT regime, so the firm can serve clients globally with a single structure. That assumption is incorrect. The GFSC's regime is substantive, supervised and increasingly aligned with FATF standards. An operator who treats it as lighter-touch than it is will find the gap during supervision, not before.
Related at OBOLUS
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – end-to-end compliance architecture across the major VASP regimes
- KYC and onboarding framework in Switzerland – how FINMA's AML regime compares for an inbound operator
- NFT project legal structuring: a cross-jurisdiction comparison – token classification and compliance across multiple forums
FAQ
What does the Travel Rule require from a VASP?
Under the FATF's Recommendation 15 – adopted into Gibraltar's domestic AML regime and applicable to DLT Providers – a VASP must collect, verify and transmit originator and beneficiary information alongside qualifying virtual-asset transfers. This data must accompany the transfer to the receiving VASP, which must screen and retain it. The obligation applies to both outgoing and incoming transfers. Firms that transmit to counterparties in jurisdictions without Travel Rule implementation should document the gap and apply enhanced due diligence to those transactions.
Who must act as MLRO for a crypto firm?
A Gibraltar DLT Provider must appoint a named, qualified Money Laundering Reporting Officer notified to the GFSC. The individual must hold genuine AML expertise and sufficient seniority within the firm to discharge the role effectively. The GFSC conducts a fitness and propriety assessment of the appointee. Changes in MLRO require further notification. A senior person without specific AML experience does not satisfy the standard; the regulator expects both technical competence and operational authority to act on suspicious activity reports.
How do regulators audit crypto AML programs?
The GFSC typically reviews a DLT Provider's AML program through a combination of desk-based reviews and on-site supervisory visits. Reviewers examine the written AML/CFT policy, CDD records, transaction monitoring alert logs and escalation documentation, suspicious activity reports filed with the GFIU, MLRO board reports and staff training records. Gaps between the written policy and operational practice are a common finding. Firms should maintain contemporaneous audit trails for each element – not reconstructed documentation prepared for the visit.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit, and we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in AML framework design and VASP compliance architecture across the GFSC and other leading digital-asset regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.