Gibraltar AML and KYC: Due Diligence and Reporting Rules

AML and KYC Obligations in Gibraltar: An OverviewCopy link to section

AML/KYC in Gibraltar refers to the anti-money-laundering and know-your-customer duties that regulated businesses must apply when they take on and monitor clients. These obligations are live and enforced, governed primarily by the Proceeds of Crime Act 2015, and supervised by a set of authorities led by the Gibraltar Financial Intelligence Unit and the financial services regulator.

The duties bind banks, payment and electronic-money institutions, investment firms, distributed-ledger businesses, gaming operators, and certain professions such as lawyers, accountants, and real estate agents. They do not bind an ordinary trading company merely because it is incorporated here.

This article explains who falls within scope, what customer due diligence and ongoing monitoring require, how suspicious activity is reported, and what happens when a firm gets it wrong. It matters most to foreign owners whose entity carries on a regulated activity, and to any owner who relies on a licensed company manager that must apply these rules to them as its customer.

The Legal Framework: The Proceeds of Crime Act 2015Copy link to section

The Proceeds of Crime Act 2015, known as POCA, is the central statute. It targets the laundering of illicit funds, the financing of terrorism, and proliferation financing, and it also sets out the machinery for confiscation, investigation, and recovery of criminal proceeds.

Part II deals with the money-laundering offences themselves, such as concealing or arranging criminal property. Part III carries the preventive regime that most foreign owners care about: who must apply customer due diligence, when, and to what standard.

Several provisions form the backbone of the preventive duties. Section 11 sets out when due diligence applies, section 12 requires ongoing monitoring, section 17 mandates enhanced checks in high-risk cases, section 20 governs politically exposed persons, and section 26 requires written, risk-sensitive policies and procedures.

Two recent amendments sharpen the regime. The Sanctions (Amendment) Act 2024, enacted 23 December 2024, requires regulated firms to screen customers against sanctions lists; the Proceeds of Crime (Amendment) Act 2024 introduces Unexplained Wealth Orders, allowing the Supreme Court to demand an explanation of how property worth over £50,000 was acquired where lawful income appears insufficient.

The framework is aligned with the United Kingdom and harmonised with the EU's fifth and sixth anti-money-laundering directives. That alignment is one reason the territory cleared international review, a point taken up in the enforcement section below.

Company Incorporation in Gibraltar

Set up your company in Gibraltar with Expanship handling registration end to end.

Learn more

Supervisory Authorities and the Role of the GFIUCopy link to section

Supervision is split across several bodies, each responsible for a defined population of regulated persons. The structure matters because the authority that oversees your firm sets the guidance you must follow and conducts the inspections you must pass.

The Gibraltar Financial Intelligence Unit, established in January 1996 and codified in section 1B of POCA, is the central body for receiving, analysing, and disseminating suspicious activity reports. It maintains a secure database of disclosures and passes intelligence to the Royal Gibraltar Police, HM Customs, the Income Tax Office, or the relevant supervisor. Since 2004 it has belonged to the Egmont Group of Financial Intelligence Units, the global network for cross-border information exchange.

The Gibraltar Financial Services Commission supervises the financial sector and applies a risk-based approach to money-laundering and terrorist-financing threats. Other supervisors cover the remaining obliged populations:

• The Office of Fair Trading supervises high-value goods dealers, art market participants, and real estate and letting agents.
• The Gambling Division oversees licensed gaming operators, in coordination with the GFIU.
• The Legal Services Regulatory Authority regulates legal professionals, including onsite verification and enforcement.
• The Financial Secretary supervises the Gibraltar Savings Bank.

Public and private bodies also cooperate through FLINT, a partnership led by the GFIU that brings together the police, HM Customs, the Tax Office, the Commission, and major local banks. Investigation of financial crime itself sits with the Royal Gibraltar Police Economic Crime Unit.

Who Is Caught: Relevant Financial Businesses and Other Obliged EntitiesCopy link to section

The obligations fall on "relevant financial businesses" and on designated non-financial businesses and professions. POCA defines this scope in Part III, with the list of supervisory authorities set out in Schedule 2.

Financial institutions in scope include banks, credit institutions, electronic-money and payment institutions, and other financial service providers. Investment firms and collective investment schemes, including mutual funds and alternative investment funds, are covered, as are cryptocurrency exchanges and wallet providers under the territory's distributed-ledger technology framework.

Among non-financial entities, lawyers, accountants, and real estate agents are obliged persons. Dealers in high-value goods come within Office of Fair Trading supervision where they make or receive cash payment of EUR 10,000 or more, and art market participants are caught on the same supervisory footing.

That distinction is the practical takeaway for most foreign owners. You may never file a suspicious activity report yourself, but you will be on the receiving end of your agent's checks, and those checks are why onboarding and annual reviews ask for identity evidence and source-of-funds information.

Ongoing Compliance in Gibraltar

Keep your Gibraltar entity compliant with filings, returns, and statutory obligations.

Learn more

Customer Due Diligence and KYC RequirementsCopy link to section

Customer due diligence, defined in section 10 of POCA, is the core of the know-your-customer duty. A regulated firm must apply it before establishing a business relationship and before carrying out an occasional transaction of EUR 15,000 or more (or its equivalent).

Four measures sit at the heart of due diligence:

1. Identify the customer and verify identity using reliable, independent documents, data, or information.
2. Identify the beneficial owner and take reasonable steps to verify who that person is.
3. Understand and record the purpose and intended nature of the relationship.
4. Conduct ongoing monitoring, including scrutiny of transactions over the life of the relationship.

If a firm cannot complete these checks, it must not proceed with the transaction or relationship, and it must consider filing a suspicious activity report. For a foreign owner this is decisive: an incomplete file is not a delay you can negotiate around, it is a legal bar to onboarding.

Remote onboarding is permitted under the national framework, including document verification, biometric liveness, and video identification where regulation calls for it. That allows a non-resident to satisfy due diligence without travelling, provided the evidence meets the standard.

Lighter treatment exists in narrow cases. A Gibraltar public authority acting as a customer qualifies for simplified due diligence, and the Minister may raise the simplified threshold for in-territory payment transactions from EUR 250 to a ceiling of EUR 500.

Enhanced Due Diligence, PEPs, and High-Risk SituationsCopy link to section

Some relationships demand more than the standard checks. Under section 17, a firm must apply enhanced due diligence and enhanced ongoing monitoring, on a risk-sensitive basis, in prescribed high-risk situations.

Politically exposed persons are dealt with specifically in section 20. Where a firm proposes a relationship with a PEP, it must obtain senior approval, establish the source of funds and source of wealth, and apply enhanced monitoring throughout. A senior manager, typically the money laundering reporting officer or a designated representative, must sign off the arrangement, and the definition reaches a person previously entrusted with prominent public functions by an international organisation or by a state outside the United Kingdom, Gibraltar, or the EEA.

Other triggers raise the standard automatically:

• Non-face-to-face business, a prescribed enhanced-diligence trigger.
• Correspondent banking with a respondent institution from a non-EEA state, under section 19.
• Sanctions exposure, screened against HM Treasury's Consolidated List, as the territory applies United Kingdom sanctions.

Sanctions screening is no longer optional good practice. The Sanctions (Amendment) Act 2024 requires firms to maintain controls that screen both new and existing customers against international lists, with matches reported and assets frozen immediately; failure is a criminal offence.

The Commission also publishes a regularly updated list of high-risk countries. A firm dealing with a counterparty connected to such a jurisdiction should expect to apply enhanced measures and document why its response is proportionate to the assessed risk.

Gibraltar Incorporation Pricing

See transparent pricing to incorporate and maintain a company in Gibraltar.

View pricing

Ongoing Monitoring and Transaction ScrutinyCopy link to section

Due diligence is not a one-time event. Section 12 requires continuous monitoring of every business relationship, keeping due-diligence information current through periodic and event-triggered reviews.

The regulator expects substance, not a box-ticking exercise. The Commission scrutinises a firm's systems and their effectiveness, and it has signalled that a crude two-tier model, standard or enhanced with nothing calibrated in between, will not meet its expectations.

Underpinning all of this is the risk assessment. Section 25A obliges a regulated business to undertake and review a dedicated assessment of money-laundering, terrorist-financing, and proliferation-financing risks across its activities, customers, geographies, products, and transaction methods. The intensity of due diligence applied to any customer must trace back to that assessment.

Governance closes the loop. The board of a regulated business should receive at least an annual report from its money laundering reporting officer on the firm's anti-money-laundering activities and issues, and for distributed-ledger providers monitoring extends to on-chain transactions, wallet addresses, and transaction patterns.

AML Record-Keeping RequirementsCopy link to section

Records must survive long after a relationship ends. All due-diligence documentation, transaction records, and supporting evidence are kept for a minimum of five years from the end of the business relationship or the date of an occasional transaction.

The records must be detailed enough to reconstruct individual transactions and must be produced to the Commission or the Financial Intelligence Unit on request. Record-keeping is one of the named Part III obligations, with reporting-officer records addressed in section 20A and the general duty in section 25.

No prescribed format applies. The governing principle is simply that records be held in a form that lets a competent authority reconstruct what happened.

Suspicious Activity Reporting Through THEMIS and the Tipping-Off ProhibitionCopy link to section

When suspicion of money laundering or terrorist financing arises, the firm must report it to the Financial Intelligence Unit. The preferred channel is THEMIS, a secure online portal accessed through the GFIU reporting page.

Access is controlled. An entity must register its money laundering reporting officer or nominated person to obtain login credentials, and only that officer, a deputy, a compliance officer, or a director may submit a report on the organisation's behalf. A separate signed form is required for each organisation or user, certified by an authorised signatory, and where THEMIS is unavailable, forms may be sent by email or delivered to the unit at Suite 832, Europort.

A report must carry enough detail to let an investigating officer act: the transaction, the reason for suspicion, the suspected criminality, and any supporting evidence. Reports are filed as soon as practically possible once activity is deemed suspicious, and real estate agents must report promptly, including attempted transactions. Suspected fraud, by contrast, goes to the Royal Gibraltar Police rather than through a suspicious activity report.

The Money Laundering Reporting Officer and the Registered Agent's RoleCopy link to section

Every regulated business needs a money laundering reporting officer. Section 28 sets out the internal reporting procedures the officer maintains, and where a business is run by a single person, that individual fills the role.

The officer is the gatekeeper for reporting. Only the officer, a deputy, a compliance officer, or a director may submit a report through THEMIS, and the officer must seek the unit's consent before proceeding with a transaction once a report has been filed, the "consent" mechanism under section 17(1). The role must be free of commercial conflict, and appointing an officer does not shield other senior managers from personal or corporate liability for permitting money laundering.

For a foreign owner the registered agent is where the regime becomes tangible. A Gibraltar company must use a licensed company manager, and that manager is itself a relevant financial business under POCA. It must apply full due diligence to the entity it manages, identify the beneficial owners, and submit to the Commission's audits of its anti-money-laundering programme. When an officer or portal user leaves, the agent must notify the unit promptly so access can be revoked.

Penalties and Enforcement for Non-ComplianceCopy link to section

Breaches carry both criminal and administrative consequences. Section 33 makes it a criminal offence to fail to comply with a long list of core duties, including the due-diligence, monitoring, enhanced-diligence, record-keeping, and policy requirements.

Administrative enforcement runs in parallel. POCA and the Supervisory Bodies (Powers Etc.) Regulations 2017 empower supervisors to impose financial penalties, suspend or withdraw licences, ban individuals from managerial functions, and issue directions under their published enforcement policies.

No single public maximum penalty figure is fixed in statute; fines are proportionate and escalate with severity, so the relevant supervisor's enforcement policy is the place to check current scales. Unexplained Wealth Orders add a further dimension: where lawful income appears insufficient to explain property worth over £50,000, the Supreme Court may demand an account, non-compliance raises a presumption that the property is recoverable, and a false statement is itself a crime.

The wider record is reassuring for foreign investors. FATF removed the territory from its grey list on 23 February 2024, and a MONEYVAL follow-up report in May 2024 confirmed all 40 FATF Recommendations were rated largely compliant or compliant.

ConclusionCopy link to section

For a non-resident owner, the message is that AML/KYC duties usually reach you indirectly, through the licensed company manager who must verify your identity, your beneficial owners, and your source of funds before and during the relationship. Your obligation is practical rather than statutory: keep clean, current evidence ready, because an incomplete file legally blocks onboarding and slows everything that follows.

If your entity does carry on a regulated activity, the position changes entirely, and you take on the full apparatus of an officer, a written risk assessment, monitoring, and reporting. Decide which of the two you are early, since the difference shapes every later compliance choice.

How Expanship Can Help Your Business in GibraltarCopy link to section

Expanship supports foreign owners through the AML/KYC process by acting as or coordinating with a licensed company manager, preparing the due-diligence file regulators and banks expect, and keeping beneficial-ownership and source-of-funds information current. The same team handles the broader obligations of running a foreign-owned entity in the territory.

• Company formation and structuring
• Registered agent and registered office services
• Ongoing compliance and filing management
• Accounting and bookkeeping
• Economic-substance and beneficial-ownership support
• Banking introductions

To discuss your AML/KYC position or any related requirement, contact Expanship Gibraltar.

Frequently Asked QuestionsCopy link to section