Firms doing business in DLT activities, including cryptocurrency exchanges and custodians, must be authorised and licensed as DLT Providers by the GFSC.

The Staged Application Process will implement three main stages, with the addition of a fourth “mobilisation” stage, (applied at the discretion of the GFSC), each with specific documentation and information to be provided:

1. Business Model, Capital, Key Individuals:

• Application Fee (in full)
• Application Form
• Stage 1 of the DLT Comprehensive Business Plan (not including Stages 2 and 3)
• Controller Form (for each Controller)
• Source of wealth/funds for each shareholder with evidence to support it

2. Risks framework, Financial crime, Business Continuity, Corporate Governance, IT systems:

• Stage 2 of the DLT comprehensive business plan (not including Stage 3)
• Documentation and information including, but not limited to:
• Corporate Governance and control
• Business Continuity Management Plan
• IT infrastructure, Cyber and systems including outsourcing arrangements
• Operational and Outsourcing Risk including material outsourcing arrangements
• Outsourcing Register
• Systems controls and Risk Management
• Financial Crime controls, compliance with Anti-Money Laundering/Combating the Financing of Terrorism requirements (as applicable)
• Risk Methodology and framework policy documents
• Risk Register and controls
• Disaster Recovery Plan
• Safeguarding of customer assets policies and procedures - including but not limited to private key management, distribution of client assets between hot and cold storage and details of third parties and risk assessment performed by the applicant in choosing provider
• Updated business plan, if required

3. Non-Financial Resources, Compliance Structure, Conduct of Business, KPI's, Consumer Duty, Operational Resilience:

• Stage 3 of the DLT Comprehensive Business Plan
• Documentation and information including, but not limited to:
• The applicant's Terms and Conditions
• The applicant's Risk Warning and/or Disclosure Statement
• Proposed fee schedule
• Non-financial resources
• Compliance structure
• Conduct of Business (Full Conduct Risk Framework documents)
• Detail of KPIs
• Consumer Duty compliance (as applicable)
• Operational Resilience compliance (as applicable)
• Remuneration Policy
• Conflict of Interest Policy
• Conflict of Interest Register
• Liquidity/solvency policies
• Internal Audit Plan
• Complaints Handling Policy
• Market Abuse/Insider Trading Policies
• Terms of Reference of the Board, Board sub-committees, Risk Committee and/or Audit Committee, Underwriting/Pricing committees, as applicable
• Audit, accounting, and banking arrangements
• Professional Indemnity Insurance
• Contracts with parties to whom material operational functions are outsourced
• Completed and signed Regulated Individual Forms and Non-Executive Director Forms
• Mobilisation Plan (if applicable)

When the GFSC is satisfied with the Stage 3 responses and information, the application will move to a GFSC decision for authorisation. Once a permission has been granted, an onsite visit will be completed. This will give the firm the opportunity to evidence to the GFSC that the processes and controls implemented and communicated during the presentation are effective and work in practice.

 

4. Mobilisation - Systems Testing (this stage is optional and will be activated if the GFSC deems it necessary to ‘test’ the firm’s systems and controls; this route also allows an applicant to obtain a permission and operate within a controlled environment, allowing it time to develop its operational capabilities)

Requirements for a Private Limited Liability Company:

• Company can have 1-50 shareholders (natural or legal persons) and there are no restrictions to their nationalities or place of residence
• Only one director (natural or legal person) is necessary and there are no restrictions to residence or nationality
• Hiring a company secretary
• Having a registered office in Gibraltar

Principles to be observed by DLT Providers:

• A DLT Provider must conduct its business with honesty and integrity.
• A DLT Provider must pay due regard to the interests and needs of each and all its customers and must communicate with them in a way that is fair, clear and not misleading.
• A DLT Provider must maintain adequate financial and non-financial resources.
• A DLT Provider must manage and control its business effectively, and conduct its business with due skill, care and diligence; including having proper regard to risks to its business and customers.
• A DLT Provider must have effective arrangements in place for the protection of customer assets and money when it is responsible for them.
• A DLT Provider must have effective corporate governance arrangements.
• A DLT Provider must ensure that all of its systems and security access protocols are maintained to appropriate high standards.
• A DLT Provider must have systems in place to prevent, detect and disclose financial crime risks such as money laundering and terrorist financing.
• A DLT Provider must be resilient and have contingency arrangements for the orderly and solvent wind down of its business.
• A DLT Provider must conduct itself in a manner which maintains or enhances the integrity of any markets in which it participate.

Key role-holders:

Management must reside in Gibraltar and all key strategic decisions must be made here. This is fundamental importance when applying for a DLT Provider licence as the GFSC will expect to see this. The principal role-holders will be expected to work in Gibraltar including the CEO, CFO and CTO. Some day to day operational functions can be outsourced and delegated to people or companies outside Gibraltar.

To comply with AML/CFT requirements, DLT Providers are required to:

• implement KYC, AML/CFT policies
• establish due diligence procedures for clients
• appoint a Money Laundering Reporting Officer (MLRO)
• establish systems and procedures to prevent money laundering
• provide relevant persons with money laundering training and familiarization with their money laundering procedures
• check on appropriate staff members
• conduct an independent audit to test due diligence, record keeping, internal controls, risk assessment and management, compliance management, and employee screening

Licence fees:

GFSC licence fees (depending on the complexity and category assigned to the DLT Provider):

• £10,000 (~€8,350) - £8,000 (~€6,700) (balance payable on submitting full application)
• £20,000 (~€16,700) - £18,000 (~€15,000) (balance payable on submitting full application)
• £30,000 (~€25,000) - £28,000 (~€23,400) (balance payable on submitting full application)

The cost of annual licence maintenance fees also depends on the complexity of the DLT provider:

• £10,000 (~€8,350)
• £20,000 (~€16,700)
• £30,000 (~€25,000)

Corporate income tax (CIT)

Companies are subject to Gibraltar tax on income accrued in and derived from Gibraltar. Income earned outside the territory of Gibraltar is not subject to Gibraltar tax.

Companies incorporated in Gibraltar and engaged in cryptocurrency activities are subject to corporate tax at the standard rate of 15% (in 2024).

Capital Gains Tax (CGT)

There is no CGT in Gibraltar.

Value-added tax (VAT)

There is no VAT in Gibraltar.