Gibraltar's regulatory position on security tokens
Gibraltar occupies a distinct position in the security token market. The Gibraltar Financial Services Commission (GFSC) administers the Distributed Ledger Technology (DLT) Provider framework – the world's first statutory regime for DLT businesses, enacted in 2018 – alongside a securities law regime under which tokens conferring investment rights are regulated as financial instruments. A token that pays dividends, represents equity in an entity, or carries debt-like rights is treated as a security under Gibraltarian law regardless of the label attached to it in a whitepaper. Issuers who misread that boundary do not face a regulatory grey area; they face an unregistered securities offering in a jurisdiction that takes enforcement seriously.
The GFSC's approach is substance-over-form. Classification turns on the rights the token actually confers – voting, profit-sharing, redemption rights, a claim on assets – not on the marketing term chosen. In our cross-border practice, we routinely see issuers arrive with a "utility" label on a token that, on analysis of its term sheet and smart-contract logic, functions as a share equivalent. Correcting that misclassification before launch is a matter of days. Correcting it after a public offering is a matter of years and significant cost.
Gibraltar's DLT framework does not itself authorise the issuance of securities. An issuer of a security token in Gibraltar must satisfy the GFSC's requirements under the Financial Services Act and the relevant regulations governing public offers of securities or private placements. The DLT Provider licence governs the business of using DLT to store or transmit value belonging to others – it is a necessary but not sufficient condition for operating a security token platform. The two regimes operate in parallel, and both must be addressed.
Contact OBOLUS to map your classification exposure before you commit to a structure. The process above describes the standard path. Your facts – the token rights, the investor base, the issuing entity – change the analysis materially. Map your options.
How token classification works in practice
Token classification under Gibraltar law follows the same substance-over-label principle applied across the leading financial centres, but the GFSC has articulated its position with particular clarity through published guidance under the DLT framework. The starting point is the rights register: what can the holder do with the token, and against whom can those rights be enforced?
A token that grants its holder a right to receive a share of profits, a return of capital on wind-up, or a vote on material decisions is almost certainly a security token (a token representing a financial instrument or investment right) under Gibraltarian law. The DLT technology is irrelevant to that analysis. What matters is the economic and legal substance of the claim.
Contrast that with a utility token – one that functions solely as a means of accessing a defined product or service, with no investment expectation baked in. The line between the two is not always clean. A token that starts as a utility instrument but builds in a yield mechanism, a buyback schedule, or a governance right that affects economic outcomes tends to slide toward the security end of the spectrum. We assess that slide at the structural design stage, before the token architecture is fixed.
A third category – the e-money token (a token that references a fiat currency and is designed as a means of payment) – is regulated separately, and under MiCA for EU-facing distributions. Gibraltar is not an EU member state following Brexit, so MiCA does not apply automatically within the territory. However, an issuer targeting EU retail investors from a Gibraltar structure must assess its MiCA exposure independently, because the offer reaches EU persons regardless of where the issuer sits. The GFSC's classification guidance and the Financial Services Act together form the domestic legal baseline; EU passporting is not available.
One common assumption is that a utility label on a whitepaper settles the legal classification. It does not. Regulators and courts in every leading jurisdiction assess the economic substance of the token's rights. A whitepaper that markets a token as a utility instrument while the underlying smart contract delivers yield is not a defence; it is evidence of the misclassification. We assess classification against the substance of rights, not the marketing label, and we document that analysis in a written opinion that can be shown to the GFSC, to a listing venue, or to counsel in a secondary jurisdiction.
What does the Gibraltar security token offering process look like?
A security token offering in Gibraltar proceeds through four identifiable stages: entity and licence assessment, prospectus or offering document preparation, GFSC engagement, and investor-facing distribution. The timeline across those stages varies by complexity and GFSC workload; it is measured in months rather than weeks for a fully regulated public offer, and somewhat shorter for a structured private placement.
Stage one is entity assessment. The issuing vehicle must be properly constituted – typically a Gibraltar company – and the question of whether a DLT Provider licence is required must be resolved. If the issuer is operating a platform that stores or transmits value on behalf of others using distributed ledger technology, a DLT licence is required separately from any securities authorisation. Issuers who are offering tokens from a clean-vehicle issuer without platform operations may not require a DLT licence, but that determination requires a factual analysis of the business model.
Stage two is documentation. Gibraltar's securities regime requires either a prospectus (for public offers above the relevant threshold) or, for private placements and exempt offers, an information memorandum that satisfies investor-protection standards. The offering document must describe the token's rights accurately, the issuer's financial position, the use of proceeds, and the risk factors specific to the token and to the DLT infrastructure it uses. The GFSC reviews offering documents for compliance; an incomplete or inconsistent document generates significant back-and-forth that lengthens the process.
Stage three is regulatory engagement. The GFSC has a track record of constructive dialogue with well-prepared issuers. Pre-application engagement – a preliminary meeting or letter before the formal submission – is standard practice and materially reduces the risk of a formal rejection. We prepare the pre-application package and manage that dialogue as part of a structured instruction.
Stage four is distribution. Where tokens are offered to EU persons, the absence of MiCA passporting from Gibraltar means the issuer must assess whether local EU registration or an exemption applies in each target member state. Where US persons are involved, Regulation D (or another federal exemption) must be considered alongside state-level requirements. In our practice, the cross-border distribution analysis is the element that most often surprises issuers who focus exclusively on the Gibraltar domestic process.
How does Gibraltar STO structuring interact with tax, banking, and cross-border law?
The Gibraltar entity provides the regulatory anchor, but the structure around it – how proceeds are held, how investors are onboarded, how the token is taxed on transfer or redemption – is determined by a stack of overlapping legal regimes that operate independently of the GFSC.
Gibraltar has no capital gains tax and no inheritance tax, and corporate tax applies only to profits accruing in or derived from Gibraltar. That territorial tax base is a genuine structural advantage for token issuers whose primary business activity and user base are outside the territory. However, issuers must account for the tax treatment in the jurisdictions where their investors are located. A security token that pays yield or delivers capital appreciation is likely a taxable event for the investor in their home jurisdiction, and the issuer may have withholding obligations. We work through the investor-jurisdiction tax matrix as part of the structuring process, engaging allied counsel in the relevant jurisdiction where local tax advice is needed.
Banking remains the most operationally complex element of any Gibraltar STO. Gibraltar's banking sector is small. Most issuers will need to bank the offering proceeds outside Gibraltar – in the EU, the UK, or the Channel Islands – which triggers account-opening due diligence at the banking institution in addition to GFSC compliance. In our experience, issuers who arrive at the banking stage without a clean legal opinion on token classification and without a properly drafted offering document face significant delays or outright rejections.
AML and the Travel Rule add a further layer. Where the security token will be traded on a secondary market – a regulated venue or an alternative trading system – the platform operating that market must comply with FATF Recommendation 15 on virtual assets, including passing originator and beneficiary data on transfers above the applicable threshold. The issuer's offering documents should address how secondary trading is contemplated and which regulated venues, if any, are intended to list the token. Leaving that question open creates uncertainty that sophisticated investors will flag during due diligence.
For issuers who also plan an EU distribution, the interaction with MiCA is the most pressing cross-border question. MiCA's whitepaper regime and CASP authorisation requirements apply to crypto-asset service providers operating in the EU, not to the Gibraltar issuer directly – but if the issuer's token reaches EU retail investors through an EU-regulated platform, that platform will conduct its own MiCA compliance analysis of the token before listing it. A token that cannot demonstrate a clear classification under MiCA will not be listed on a compliant EU venue. The Gibraltar offering document and the legal opinion on classification must therefore be drafted with MiCA's framework in mind, even though MiCA does not govern Gibraltar directly.
If your structure crosses into EU distribution or US investor participation, the analysis doubles. A second read of your draft offering document against both frameworks can identify conflicts before they become rejections. Map your options.
Which issuer profile suits a Gibraltar STO structure?
Not every issuer is well-served by a Gibraltar structure. The decision turns on several variables: the investor base, the intended secondary market, the nature of the underlying asset, and the tax profile of the principal beneficiaries.
Profile A – Early-stage technology company raising from sophisticated investors. A Gibraltar STO works well here. The territorial tax base is attractive. The GFSC has engaged with sophisticated issuers and the DLT framework is well understood by institutional investors. A private placement under a Gibraltar information memorandum with an investor-restriction clause covering US persons and EU retail investors is a structurally clean route. Timeline for documentation and regulatory engagement is measured in months; it depends on complexity and the completeness of the initial submission.
Profile B – Issuer targeting broad EU retail participation. Gibraltar is a harder fit. Without MiCA passporting, each EU member state distribution requires a separate access analysis. A CASP-authorised EU issuer with a MiCA prospectus may offer a simpler route to the EU retail market. The decision is not binary – a Gibraltar structure with a parallel EU offering vehicle is viable – but it adds cost and complexity. Issuers in this profile should model both paths before committing.
Profile C – Asset-backed token issuer (real estate, fund interests, infrastructure). Gibraltar has handled asset-backed token structures and the GFSC is familiar with the documentation requirements. The key variable is the nature of the underlying asset. Real estate situated outside Gibraltar introduces the law of the situs – the jurisdiction where the property sits – which governs the validity of the property right being tokenized. We map the situs question at the outset and engage allied counsel in the relevant jurisdiction where the property law analysis requires local input.
Profile D – Existing regulated fund seeking tokenized share class. This is the most structurally complex profile. The fund's existing regulatory status, investor agreements, and constitutional documents must all accommodate the token layer. Gibraltar's fund regime and DLT framework can support this structure, but the implementation timeline is longer and requires engagement with both the fund administrator and the existing investors. Pre-application engagement with the GFSC is particularly important here.
A recent matter: classification, cross-border distribution, and secondary market preparation
In a recent instruction, a technology company incorporated outside Gibraltar approached us to structure a security token offering for a software licensing revenue-share instrument. The token's commercial design had been drafted with a utility label, but an analysis of the underlying term sheet revealed that it conferred a proportional right to platform revenues – clearly a security under any applicable framework. We advised on restructuring the classification position, prepared a Gibraltar offering document compliant with the Financial Services Act, and produced a cross-border distribution matrix covering the EU and three additional target markets. We also prepared the token's secondary-market listing documentation for submission to a regulated venue. The offering closed to the target investor cohort within the planned timetable, and the issuer subsequently engaged allied counsel in two EU jurisdictions for the member-state access analysis we had identified as necessary at the outset.
What are the most common structuring mistakes in Gibraltar security token offerings?
The most expensive mistake in a Gibraltar STO is late-stage classification correction. An issuer who builds the token architecture, drafts the whitepaper, and begins investor marketing before obtaining a written classification opinion faces the prospect of halting the process, revising the documentation, and re-engaging investors after a delay. In a market where investor appetite is time-sensitive, that interruption has a direct commercial cost.
The second most common mistake is treating Gibraltar as an isolated domestic transaction. Gibraltar's GFSC authorisation does not confer distribution rights in any other jurisdiction. An offering document that does not address the jurisdictions where investors are located – even by way of explicit restriction – creates exposure in those jurisdictions. We see this most frequently with EU and UK investor participation, where the financial promotion rules and MiCA's reach create obligations that the issuer did not anticipate.
A third frequent error is underestimating the banking and custody preparation. Investors in a security token offering expect to understand, before they commit, where proceeds are held, by whom, under what custodial arrangement, and what happens to those proceeds if the offering fails. An offering document that is silent on these points does not meet investor-protection standards and will be queried by the GFSC.
Finally, issuers frequently overlook the AML onboarding burden. A security token offering requires investor due diligence at the level expected for a regulated securities transaction. KYC, source-of-funds verification, and sanctions screening must be built into the onboarding process before the first investor commits capital. The infrastructure to support that onboarding – whether in-house or through a third-party provider – needs to be in place before the offering opens, not after it closes.
Self-assessment: is your Gibraltar STO structure ready?
Before engaging regulators or investors, an issuer should be able to answer the following questions with documented, defensible positions. Where the answer is unclear, that is the engagement point for legal counsel.
- Has the token's rights register been analysed against Gibraltar's Financial Services Act and the GFSC's classification guidance? Is the classification supported by a written legal opinion?
- Is the issuing entity properly constituted in Gibraltar, with appropriate officers and a registered office?
- Does the business model require a DLT Provider licence in addition to any securities authorisation?
- Has the offering document (prospectus or information memorandum) been drafted to meet GFSC standards, and does it accurately describe the token's rights, the use of proceeds, and the risk factors?
- Has the cross-border distribution analysis been completed for all jurisdictions where investors are expected?
- Is the banking and custody arrangement for offering proceeds identified and documented in the offering materials?
- Is the AML/KYC onboarding process designed and operational before the offering opens?
- If secondary trading is contemplated, has the secondary market listing strategy been identified and does it address the Travel Rule obligations of the trading venue?
An issuer who can answer all eight questions positively, with documentation, is well-positioned to engage the GFSC constructively and to close an offering on schedule.
Related at OBOLUS
- Token offerings and securities for digital-asset businesses – end-to-end legal counsel on structuring, classification, and distribution across multiple jurisdictions
- Security token: a legal guide for digital-asset businesses – a detailed reference on what makes a token a security and why the distinction matters operationally
- Asset recovery and the limits of on-chain transparency – what happens when a token offering goes wrong and recovery proceedings become necessary
FAQ
Is my token a security?
The answer turns on the rights the token confers, not the label you assign it. If the token grants its holder a share of profits, a vote on material decisions, a redemption right, or a claim on the issuer's assets, it is almost certainly a security under Gibraltar law and under most comparable frameworks. A written classification opinion – assessed against the actual term sheet and smart-contract logic – is the only reliable way to establish and document that position before you launch.
Do I need a MiCA whitepaper?
Gibraltar is not an EU member state, so MiCA does not apply within Gibraltar directly. However, if your token will be offered to retail investors in EU member states, or traded on an EU-regulated venue, MiCA's whitepaper and CASP authorisation requirements apply to the parties facilitating that distribution in the EU. A Gibraltar-domiciled issuer targeting EU investors should prepare documentation that satisfies MiCA standards even without a formal MiCA obligation, because EU-regulated venues will require it before listing.
How should an airdrop be structured legally?
An airdrop – a distribution of tokens to recipients without direct payment – is not automatically exempt from securities law. If the distributed token is a security, distributing it without compliance with applicable securities laws constitutes an offer regardless of the absence of consideration. The structuring questions are: what rights does the airdropped token confer; who receives it and in which jurisdictions; and is there an indirect consideration element embedded in the conditions for receipt? Each element requires legal analysis before the airdrop is executed.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice – we act only for businesses, and we assess classification against the substance of rights rather than the marketing label. For a scoped assessment of your Gibraltar STO structure, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, DLT regulatory frameworks, and cross-border structuring for digital-asset issuers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.