CMS Expert Guide to Crypto Regulation in Gibraltar

The Gibraltar Financial Services Commission (the GFSC) must maintain a register of relevant financial businesses that receive “proceeds in any form from the sale of tokenised digital assets involving the use of DLT” and “persons that, by way of business, exchange, or arrange or make arrangements with a view to the exchange of virtual assets for money, money for virtual assets or one virtual asset for another”. 

The relevant legislation is the Proceeds of Crime Act 2015 and its subsidiary legislation, the Proceeds of Crime Act 2015 (Relevant Financial Business) (Registration) Regulations 2021. 

Please find below a recap on the Gibraltar offering in the crypto space: 

1. VASPs – Token Issuers (ICO);
2. VAAPs – Market Makers and OTC Desks (Virtual Asset Arrangement Providers); and
3. DLT Licences.
   We also offer: 
4. Crypto Foundations; and
5. Crypto Funds.

Financial Services are regulated under the Financial Services Act 2019 (the FS Act). 
The FS Act and its subsidiary regulations set out the regulatory framework for Gibraltar’s financial services, markets and fiduciary services regime, and the listing of securities, prospectuses and takeovers. The FS Act and its subsidiary regulations have been influenced by European Union policy and legislation and certain regulatory regimes regulated by the FS Act and its subsidiary regulations.

Section 5(1) of the FS Act defines a ‘regulated activity’ as an activity that is (i) of a kind specified in Schedule 2 to the Act; (ii) carried on by way of business; and (iii) it relates to any of the items listed in section 5(2) of the Act. Value belonging to another which is stored or transmitted by means of a database system is included in section 5(2)(o) of the Act and is set out in further detail in Part 16 of Schedule 2 to the Act. Therefore, carrying on by way of business, in or from Gibraltar, the use of distributed ledger technology for the storage or transmission of value belonging to another is a ‘regulated activity’.

Since the 1st January 2018, any firm carrying out by way of business, in or from within Gibraltar, the use of distributed ledger technology (DLT) for storing or transmitting value belonging to other, needs to be authorised by the GFSC as a DLT provider. The Regulations apply to activities not subject to regulation under any other regulatory framework. Firms and activities that are subject to another regulatory framework will continue to be regulated under that framework.

Please find below a recap on the Gibraltar offering in the crypto space: 

1. VASPs – Token Issuers (ICO);
2. VAAPs – Market Makers and OTC Desks (Virtual Asset Arrangement Providers); and
3. DLT Licences.
   We also offer: 
4. Crypto Foundations; and
5. Crypto Funds.

In order to carry out a non-security token sale from Gibraltar, the issuer first needs to be registered as a Virtual Asset Service Provider (VASP) with the Gibraltar Financial Services Commission (GFSC) under the Proceeds of Crime Act 2015 (Relevant Financial Business) (Registration) Regulations 2021.

These Regulations apply to entities issuing tokens from Gibraltar and impose an obligation to be registered with the GFSC for the purposes of anti-money laundering, counter terrorist financing and counter proliferation finance supervision, prior to selling any tokens from Gibraltar.

In accordance with the Proceeds of Crime Act 2015: 

“A person commits an offence if he enters into or becomes concerned in an arrangement which he knows or suspects facilitates (by whatever means) the acquisition, retention, use or control of criminal property by or on behalf of another person.”

“Where a person undertakes relevant financial business and that person:

1. knows, suspects or has reasonable grounds to suspect that another person is engaged in money laundering, or is attempting to launder money;
2. the information or other matter, on which that knowledge or suspicion is based came to his attention in the course of his trade, profession, business or employment, or during the application of customer due diligence measure; and 
3. he does not disclose the information or other matter to the Gibraltar Financial Intelligence Unit as soon as is reasonably practicable after it comes to his attention, he is guilty of an offence.

In relation to cryptocurrency/virtual asset services and for the purposes of the above, “relevant financial business” means a business engaging in one of the following activities:

1. undertakings that receive, whether on their own account or on behalf of another person, proceeds in any form from the sale of tokenised digital assets involving DLT or similar means of recording a digital representation of an asset; and 
2. persons that, by way of business, exchange, or arrange to make arrangements with a view to the exchange of:
   1. virtual assets for money;
   2. money for virtual assets; or
   3. one virtual asset for another. 

The GFSC is therefore required to maintain a register of relevant financial businesses that receive “proceeds in any form from the sale of tokenised digital assets involving the use of DLT” and “persons that, by way of business, exchange, or arrange or make arrangements with a view to the exchange of virtual assets for money, money for virtual assets or one virtual asset for another”. As such, an entity wishing to create and sell its own tokens from its inventory, or carry out business in relation to the exchange of virtual assets, would be required to register with the GFSC. Successful registration involves implementing robust KYC mechanisms and being listed on the record of registered entities (a public record). This often gives comfort to investors and makes Gibraltar an attractive option for entities wishing to issue tokens to raise capital in support of the development of a new product.

In terms of non-fungible tokens (NFTs), it is important to note that in most cases, these tokens do not confer any rights that would classify them as "transferable securities." Moreover, as per the FATF's guidance, NFTs typically do not meet the criteria for "virtual assets" since they are unique and not intended for use as payment or investment instruments, but rather as collectibles. Consequently, the sale and issuance of certain NFT collections may not fall within the scope of the Proceeds of Crime Act 2015 (Relevant Financial Business) (Regulations) 2021, and thus may not require registration with the regulator. However, this position in not entirely without doubt, and would depend on the characteristics of the NFTs in question. As such, the NFTs would need to be analysed on a case by case basis.

A Gibraltar registered entity which holds or wishes to obtain either a DLT License or VASP registration is not able to passport their services without authorisation of the jurisdiction where the services will be carried out. Gibraltar entities which carry out activities in accordance with the Financial Services (Passport Rights and Transitional Provisions) (EU Exit) Regulations 2020, are granted passporting rights to the UK Market. However, DLT Firm’s do not fall within scope and therefore are not able to passport their services to any jurisdiction outside of Gibraltar.

To achieve promotion or sales of services in any jurisdiction, independent advice would need to be sought in each jurisdiction. 

Persons carrying on regulated activities by way of business in Gibraltar are prohibited unless the person is either an authorised person or an exempt person. The DLT Regulations were made under the FS Act and set out, among other things, the application process for obtaining the relevant permission to carry out ‘DLT Provider’s business’ (as defined in the DLT Regulations), the ongoing obligations of a ‘DLT Provider’ (as defined in the DLT Regulations) and the regulatory principles that a DLT Provider must comply with. Exchanges, trading venues, e-wallets and/or other forms of cryptocurrency service platforms can be structured to operate differently but if operators of such platforms are storing, transmitting or facilitating the transmission of cryptocurrencies or other virtual assets belonging to its customers, then it is likely that they will fall within the scope of the DLT Regulations.

Borrowing/lending will depend on the lending agreement. In cases where there is clearly a loan arrangement and no right to the assets lent (repayment can be in another form), it should not be considered transmitting. The borrower will own the assets and will not be holding for another – when the agreement is signed, the lender will be sending assets contracted for by the borrower so there should be no transmission of value belonging to another.

If lending by way of business, we may need to consider other regulations/licensing requirements.

When analysing yield/staking, one of the main issues we consider is whether the tokens could be deemed ‘Units in collective investment undertakings’, or whether the arrangement could be deemed a ‘Collective Investment Schemes’ (CIS) and/or an ‘Alternative Investment Funds’ (an AIF). Kindly note that there is very little by way of legal or regulatory guidance on this. If the entity in question is storing and/or transmitting crypto assets belonging to its customers, this activity would likely fall within the scope of section 5(2)(o) of the FS Act and require a licence with the GFSC to operate as a DLT Provider. The staking product itself would then form part of their regulatory permissions under this licence. Provided that you include your staking product within your DLT Provider application submission, you should be able to provide the relevant services via the Gibraltar entity once it receives authorisation.

A Gibraltar registered entity which holds or wishes to obtain either a DLT License or VASP registration is not able to passport their services without authorisation of the jurisdiction where the services will be carried out. Gibraltar entities which carry out activities in accordance with the Financial Services (Passport Rights and Transitional Provisions) (EU Exit) Regulations 2020, are granted passporting rights to the UK Market. However, DLT Firm’s do not fall within scope and therefore are not able to passport their services to any jurisdiction outside of Gibraltar.
To achieve promotion or sales of services in any jurisdiction, independent advice would need to be sought in each jurisdiction. 

The application fee is GBP 2,500. 
Legal and other professional fees will be necessary. 

One of the key benefits is legal, regulatory and taxation certainty in what can often still be an uncertain business globally. Gibraltar has established a robust DLT regulatory framework which has been in place since 2018. 
For token sales (which generally fall outside of the DLT licensing framework) Gibraltar has a robust VASP registration system in place which connects project principles directly with the regulator to ensure a high standard of AML and KYC checks. Although the token issuing entity is not licensed by the regulator, this registration/approval process gives comfort both to investors and third-party service providers which are necessary to operate and interact with the traditional financial world (such as banks).

The initial application assessment form requires a non-refundable GBP £2,000 fee to the GFSC. Within 2 weeks of receiving the form, the relevant team at the GFSC will carry out the initial assessment and categorise the business into one of three categories.

These fees are as follows: 

• Category 1 - GBP 10,000 (of which GBP 8,000 would remain payable following the payment of the GBP 2,000 initial assessment fee);
• Category 2 - GBP 20,000 (of which GBP 18,000 would remain payable); and
• Category 3 - GBP 30,000 (of which GBP 28,000 would remain payable).

Legal and other professional fees will be necessary.

One of the key benefits is legal, regulatory and taxation certainty in what can often still be an uncertain business globally. Gibraltar has established a robust DLT regulatory framework which has been in place since 2018. 
For token sales (which generally fall outside of the DLT licensing framework) Gibraltar has a robust VASP registration system in place which connects project principles directly with the regulator to ensure a high standard of AML and KYC checks. Although the token issuing entity is not licensed by the regulator, this registration/approval process gives comfort both to investors and third-party service providers which are necessary to operate and interact with the traditional financial world (such as banks).
 

We note that obtaining a DLT Licence is a more stringent process than that of becoming a registered VASP (ICO or VAAP) in Gibraltar. However, our team has vast experience in this space and have a great professional relationship with the regulator. The success rate is around 65%-75%. 

It is also important to note that during the pre-application stage with the regulator, the firm will be able to obtain a good indication of their chances of success. Should the applicant have a successful pre-application meeting with the GFSC, the success rate will be around 95%.

These are some of the companies that hold a DLT Licence in Gibraltar: eToro, LMAX, Xapo, Bitso, and Currency.com.

This registration is focused on compliance and in particular anti-company laundering (AML) and counter-terrorist financing (CTF).

Amongst other requirements, the GFSC will need to be satisfied that the applicant (not an exhaustive list):

• complies with the applicable AML/KYC legislations and requirements;
• has implemented appropriate AML/CTF procedures;
• creates an appropriate and complaint onboarding system; and
• undertakes customer due diligence (CDD) and enhanced due diligence (EDD) when required.

A Gibraltar token issuer can be set up as a regular company limited by shares or as a company limited by guarantee.

The company will require a locally based MLRO who is attached to the company by way of employment or directorship.

Gibraltar has a territorial basis system of taxation. Companies are only taxed on profits accruing in or deriving from Gibraltar. “Accrued in and derived from” is defined by reference to the location of the activities that give rise to the profits. In any case, the corporate tax rate for taxable profits is just 15%.

Personal income tax is charged at an effective rate of 25% on the first GBP 500,000 of income. Gibraltar does not levy any capital gains tax, inheritance tax or tax on passive income. In addition, Gibraltar offers the Category 2 (High Net Worth) Individuals (Cat 2) and the High Executive Possessing Specialist Skills (HEPSS) tax rules to eligible persons. Cat 2 individuals only pay tax on the first GBP 118,000 of assessable income. At current rates of tax, the maximum tax payable is currently GBP 42,380.  The tax payable by a HEPSS is limited to the first GBP 160,000 of earned income. At current rates of tax, the annual tax liability of a HEPSS individual is currently GBP 43,440 per annum, or GBP 3,620 payable for every month during which a HEPSS certificate is issued (as at October 2024).

A Gibraltar DLT Provider will be required to comply with the wider rules and guidance under the FS Act. A DLT Provider will require a physical presence and a footprint in the jurisdiction. This will include an office space and a handful of employees (depending on the nature of the firm’s operations in or from Gibraltar). 

Gibraltar has a territorial basis system of taxation. Companies are only taxed on profits accruing in or deriving from Gibraltar. “Accrued in and derived from” is defined by reference to the location of the activities that give rise to the profits. In any case, the corporate tax rate for taxable profits is just 15%.

Personal income tax is charged at an effective rate of 25% on the first GBP 500,000 of income. Gibraltar does not levy any capital gains tax, inheritance tax or tax on passive income. In addition, Gibraltar offers the Category 2 (High Net Worth) Individuals (Cat 2) and the High Executive Possessing Specialist Skills (HEPSS) tax rules to eligible persons. Cat 2 individuals only pay tax on the first GBP 118,000 of assessable income. At current rates of tax, the maximum tax payable is currently GBP 42,380.  The tax payable by a HEPSS is limited to the first GBP 160,000 of earned income. At current rates of tax, the annual tax liability of a HEPSS individual is currently GBP 43,440 per annum, or GBP 3,620 payable for every month during which a HEPSS certificate is issued (as at October 2024).