Key Takeaways
- Gibraltar's DLT regulatory framework gives a crypto company a recognised legal basis, but authorisation depends on which activity you carry out.
- Meeting the nine regulatory principles and economic substance expectations is central to operating a licensed Gibraltar crypto company.
- Banking friction and securing reliable fiat rails remain the main practical hurdles, even where tax treatment of digital-asset activity is favourable.
- Choosing between token issuance, NFTs, holding, trading, or exchange determines your licensing posture and shapes counterparty due diligence.
Why Gibraltar Is a Leading Jurisdiction for a Crypto Company
A Gibraltar crypto company sits inside one of the oldest purpose-built regulatory frameworks for blockchain businesses anywhere. The distributed ledger technology (DLT) regime, introduced in January 2018, was the first of its kind to set out how firms using DLT to store or transmit value belonging to others must be authorised and supervised. Oversight rests with the Gibraltar Financial Services Commission (GFSC), a regulator built on the same principles as the UK Financial Conduct Authority.
The appeal for a foreign founder is a mix of regulatory certainty, a common law system in the English language, a flat 15% corporation tax, and no VAT or capital gains tax. The territory does not regulate cryptocurrencies themselves; it regulates the access points to the market, which keeps the perimeter focused on custody, exchange, and remittance rather than the assets in the abstract.
This article explains how that framework works in practice, where authorisation is triggered, how digital-asset profits are taxed, and the banking and structural limits a non-resident owner should price in before committing. It is most relevant to founders and investors building a licensed exchange, custody, token, or fund business who want a credible non-EU base and can fund genuine local substance.
Gibraltar's DLT Regulatory Framework and What It Covers
The framework is set out in the Financial Services (Distributed Ledger Technology) Regulations, subsidiary legislation under the Financial Services Act 2019. It applies to firms that, by way of business, use DLT to store or transmit value belonging to others, whether that value is held on-chain or off-chain.
Gibraltar law avoids categorising individual cryptocurrencies. Instead it uses the broad term virtual asset: a digital representation of value that can be traded or transferred and used for payment or investment, excluding tokenised fiat currencies and certain financial instruments.
Rather than detailed prescriptive rules, authorised firms must satisfy ten regulatory principles. Nine were present from the start; the tenth, covering market integrity, was added in 2021 after a government working group.
Reform is expected. The territory has signalled stronger rules for stablecoins, tighter cybersecurity expectations, and clearer treatment of decentralised exchanges where a central operator exists, with an anticipated update to the DLT Regulations around late 2025 to early 2026 that may bring VASP registration formally inside their scope.
Whether you need a full DLT licence usually turns on one question: do you hold or control value belonging to others? If you do, a licence is required; if you genuinely do not, you may sit outside the main perimeter.
Company Incorporation in Gibraltar
Set up your company in Gibraltar with Expanship handling registration end to end.
Choosing Your Crypto Activity: Token Issuance, NFTs, Holding, Trading, or Exchange
Exchanges, trading, token issuance, and initial coin offerings are all permitted. What changes from one model to the next is which regime applies, and that drives cost, timeline, and substance.
- Token issuance (ICO/ITO): Generally falls under the VASP registration regime, not the full DLT licence, unless the issuer also stores or transmits value belonging to others. Although the issuing entity is not licensed, registration gives comfort to investors, banks, and other service providers.
- NFTs: The position requires a perimeter analysis. The GFSC scope guidance confirms NFTs likely fall within the meaning of "value", so issuers, sellers, and platforms must check whether they are caught.
- Pure holding (treasury or investment company): Not a controlled activity if the firm holds only its own assets on-ledger and does not handle value for others; no DLT licence is needed, though VASP registration may apply where tokenised assets are sold.
- Exchange and custody: A licence is required wherever the business uses DLT to hold other people's assets or private keys.
Security tokens are a separate matter. Where a token qualifies as a financial instrument, the financial-services provisions of the governing Act apply alongside or instead of the DLT analysis.
One open point matters for EU-facing models: the territory has not confirmed whether it will adopt the EU's MiCA regime in whole, in part, or at all.
The VASP and DLT Provider Licensing Posture: When You Need Authorisation
Authorisation runs on two mechanisms that complement each other. DLT Provider licensing applies when you act as a custodian or remitter of value belonging to others. VASP registration under section 9 of the Proceeds of Crime Act 2015 applies to firms whose virtual-asset activity is a "relevant financial business" but does not require a full licence.
VASP registration captures a defined set of activities:
- Receiving proceeds in any form from the sale of tokenised digital assets
- Exchanging virtual assets for money, or money for virtual assets
- Exchanging one virtual asset for another
Carrying on such business without registering is a criminal offence, exposing those responsible to a fine or imprisonment on conviction. This is not a formality to defer.
A licensed DLT firm must appoint at least one local director and an approved Money Laundering Reporting Officer. The GFSC favours pre-application discussion so an applicant can confirm scope before committing, then moves through a three-stage process that opens with a business plan covering the proposed name, activity, products, and operating arrangements.
Not every crypto model is caught. A genuinely software-only business that does not store, transmit, safeguard, intermediate, or control value for others may sit outside the main perimeter entirely. Around thirteen firms operated under the framework at the time of its 2020 refresh, including names such as eToro, Huobi, LMAX, and Bitso.
Ongoing Compliance in Gibraltar
Keep your Gibraltar entity compliant with filings, returns, and statutory obligations.
Meeting the Nine Regulatory Principles and Economic Substance Expectations
Applicants must show they understand and can meet the core principles: honesty and fairness in conduct, due regard for customer interests, adequate financial and non-financial resources, sound governance, and market integrity, among others. These are outcomes the regulator tests against, not boxes to tick.
Substance is not optional, and it is where many founders underestimate the commitment. To be authorised, a firm must be registered with a real office in the jurisdiction, and the mind and management of the business must be conducted from that office in a way the firm can evidence.
What gets scrutinised in practice:
- Accuracy of your regulatory perimeter analysis
- Quality of governance and the calibre of the board
- Maturity of AML, counter-terrorist-financing, and counter-proliferation-financing controls
- Oversight of any outsourced functions
- Technology and operational-resilience controls
Firms holding client crypto, fiat flows, or private keys should expect deeper review of custody, safeguarding, and wind-down planning. The Travel Rule applies to virtual-asset transfers valued at EUR 1,000 or more, requiring counterparty VASPs to obtain and pass specified customer information. Firms dealing with retail clients must also apply the Financial Services (Core Principles and Consumer Duty) Regulations 2024.
The real cost drivers tend to be advisory fees, governance staffing, AML tooling, cyber controls, audit, office costs, and the internal time spent fixing issues raised during review. A thin, template application no longer survives.
Tax Treatment of Digital-Asset Activity for a Gibraltar Company
Corporation tax is charged at a flat 15%, applied on a territorial basis under the Income Tax Act 2010, meaning tax falls only on profits accrued in and derived from the jurisdiction. The rate rose from 12.5% on 1 January 2024 and has held steady since.
A licensed DLT provider is treated as deriving its income locally, so its DLT-related profits are taxable at 15%. There is no escaping local tax on a licensed activity by arguing the income arises elsewhere.
Three absences favour digital-asset models. The territory levies no capital gains tax, so appreciation in digital assets is not taxed as a gain; no VAT applies to token sales, exchange fees, or crypto transactions; and no withholding tax is charged on dividends, interest, or royalties paid to non-residents, so profit repatriation to a foreign owner suffers no local leakage.
The weak point is the treaty network. There is exactly one double-taxation agreement, with the United Kingdom, alongside roughly 27 tax information exchange agreements.
With only one double-tax treaty, foreign withholding taxes imposed by counterpart countries on royalties, interest, or service fees paid to your Gibraltar company generally cannot be reduced. Model this before routing high-withholding income streams through the entity.
Two further points shape the outlook. The territory has joined the Crypto-Asset Reporting Framework (CARF), with automatic exchange of crypto-asset tax information expected to begin in 2027 or 2028. And companies with annual gross income of GBP 1,250,000 or more must file audited accounts, while those below that line submit accounts with an independent accountant's report.
Gibraltar Incorporation Pricing
See transparent pricing to incorporate and maintain a company in Gibraltar.
Banking Friction and Securing Fiat Rails for a Crypto Venture
Banking is often the second gate, and it can be harder to pass than the regulatory one. Even with a clean DLT analysis, most tier-one correspondent banks apply enhanced due diligence to crypto entities and may decline regardless.
A DLT licence or VASP registration improves your prospects materially. It does not guarantee acceptance. The practical lesson is to build banking relationships in parallel with the regulatory application rather than after it.
| Route | Role | Practical note |
|---|---|---|
| Xapo Bank | Local bank with digital-asset capability | Crypto-to-fiat; subject to onboarding |
| Novus Bank, Turicum Private Bank | International and private-client flows | Policy and onboarding dependent |
| LMAX Digital | Institutional-grade exchange | Availability depends on client type |
| CoinPayments, Crypto.com Pay | Specialised crypto PSPs | Higher fees, longer due diligence |
| Stripe, Adyen | Global PSPs for early validation | Acceptance not guaranteed for crypto entities |
Costs climb where a model combines custody, exchange, and token issuance, or spans several jurisdictions. A weak board, a generic AML manual, or an unclear source-of-funds story will stall a banking file faster than any legal drafting point.
One structural change worth tracking is the Gibraltar Authorisation Regime, which affects locally based e-money institutions and their access to UK payments.
Crypto On-Ramps, Off-Ramps, and Stablecoin Settlement in Practice
Cryptocurrencies are recognised as a means of payment alongside fiat, but most counterparties still expect settlement in GBP or EUR. Converting crypto to fiat in an AML-compliant way, with documentation, normally means routing through a regulated bank or licensed exchange.
Named conversion routes referenced in practice include Xapo Bank for on-chain-to-fiat movement, LMAX Digital as an institutional on and off-ramp, Currency.com within the local DLT ecosystem, and OTC desks run by licensed providers. Travel Rule obligations bite at transactions of EUR 1,000 or above.
Compliance tooling is part of the operating cost: KYC, sanctions screening, PEP and adverse-media checks, transaction monitoring, and a Travel Rule vendor. Suspicious transaction reports go to the Gibraltar Financial Intelligence Unit, which receives, analyses, and disseminates them under the proceeds-of-crime regime.
Two settlement constraints deserve attention. Post-Brexit, the territory sits outside the SEPA zone, so EUR settlement must run through a SEPA-accessible bank or EMI partner, adding cost and a dependency. And there is no finalised stablecoin-specific framework yet; stablecoins are treated as virtual assets and run through the standard perimeter analysis, with reserve and custody rules among the anticipated reforms.
Reputation, Investor Confidence, and Counterparty Due Diligence
For a non-resident, the standing of the base jurisdiction shapes how easily banks, investors, and counterparties will engage. On that measure the territory has improved markedly.
The territory has appeared on the OECD tax-transparency whitelist since 2009 and has never featured on the EU list of non-cooperative jurisdictions. As of February 2024 it is no longer under increased monitoring by the FATF, having strengthened its AML and CFT measures. Spain has also begun formally removing it from its long-standing blacklist, which clears a specific due-diligence hurdle for Spain-linked parties.
DLT permission holders are supervised to the same standard as banks. The financial intelligence unit belongs to the Egmont Group and shares information systematically with peers. One notable signal: the only security token offering known to have passed SEC review and approval was issued by a company based here, which read as external validation of the framework.
None of this is a free pass. Acceptance still depends on demonstrating genuine substance and a real business purpose; the jurisdiction positions itself as transparent and well-regulated rather than as an offshore haven, and counterparties test accordingly.
Where Gibraltar Falls Short for a Crypto Company and Practical Workarounds
Several limits are structural, and a foreign founder should weigh them honestly before incorporating.
- No EU passporting. Following Brexit, MiCA does not apply, and a local DLT licence carries no passporting rights into EU member states. EU-facing operations need a separate MiCA authorisation in an EU country. A common answer is a dual structure: an EU entity for EU customers and a Gibraltar entity for the rest of the world.
- Thin treaty network. With one double-tax treaty, royalty, interest, and service-fee income from high-withholding countries cannot be relieved by treaty. For IP-holding or royalty-stream models this is a real disadvantage against Ireland, Luxembourg, or the Netherlands.
- Banking friction is genuine. A licence helps but does not remove enhanced due diligence; relationships must be built alongside the application, not after it.
- Substance is mandatory and costed. A real office, a local director, and an approved MLRO are required. This is not a shelf-company arrangement, and minimal-substance applicants are rejected.
- CARF is coming. Automatic exchange of crypto-asset tax information is expected from 2027 or 2028, removing any information-privacy benefit for non-compliant founders.
- Stablecoin gap and no direct SEPA. No finalised stablecoin framework exists yet, so stablecoin builders face uncertainty pending reform; and EUR settlement must route through a SEPA-member partner.
The honest summary is that this base gives direct UK access, a lower headline tax rate, a flexible regulator, and a track record of nearly a decade, but no EU passport. It is a weaker fit for founders chasing automatic EU access, minimal substance, or a quick offshore workaround.
Conclusion
For a credible, non-EU crypto venture that can fund real local substance, this jurisdiction is one of the more durable choices in Europe: an established framework, a respected regulator, a flat 15% tax with no VAT or capital gains tax, and a reputation that has moved firmly in the right direction. The trade-off is concrete cost and effort, and no shortcut to the EU market.
The first thing to settle before anything else is your customer geography. If a material share of your users sit in the EU, you will need a separate MiCA authorisation regardless, and you should decide early whether a dual structure justifies the combined burden.
How Expanship Can Help Your Business in Gibraltar
Expanship supports foreign founders through the full path of establishing and running a crypto company here, from confirming whether your model needs a DLT licence or VASP registration to standing up the local substance the GFSC expects. The same team handles the wider obligations a foreign-owned entity carries once it is live.
- Company incorporation and structuring for your chosen crypto activity
- Registered agent and registered office in the jurisdiction
- Support with economic-substance arrangements and tax registration
- Ongoing compliance management against DLT and AML requirements
- Accounting and bookkeeping, including audit-threshold filings
- Banking and payment-provider introductions for crypto-to-fiat rails
To discuss your structure and timeline, contact Expanship Gibraltar.
Frequently Asked Questions
It depends on custody. If your business uses DLT to store, transmit, or control value belonging to others, you need a full DLT Provider licence; if your activity is caught as a relevant financial business but does not involve holding others' value, VASP registration under section 9 of the Proceeds of Crime Act 2015 generally applies instead.
No. Following Brexit the jurisdiction sits outside the EU and MiCA does not apply, so a local licence carries no EU passporting rights. Serving EU customers at scale requires a separate MiCA authorisation in an EU member state, which is why many founders run a dual structure.
A licensed DLT provider is treated as deriving its income locally and is taxed at a flat 15% corporation tax rate on those profits. There is no VAT on crypto transactions, no capital gains tax on digital-asset appreciation, and no withholding tax on dividends, interest, or royalties paid to non-residents.
A registered office in the jurisdiction is required, and the mind and management of the business must be conducted from there in a way the firm can evidence. A DLT-authorised firm must also appoint at least one local director and an approved Money Laundering Reporting Officer; minimal-substance arrangements are rejected.
It helps materially but does not guarantee acceptance. Most tier-one correspondent banks apply enhanced due diligence to crypto entities regardless of the licence, so banking relationships should be built in parallel with the regulatory application, supported by a clear board, AML framework, and source-of-funds narrative.
The jurisdiction has committed to the Crypto-Asset Reporting Framework, with automatic exchange of crypto-asset tax information expected to begin in 2027 or 2028. Founders should assume their activity will be reportable and structure on a compliant basis rather than relying on information privacy.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
