Key Takeaways
- FATF standards reach Gibraltar through MONEYVAL evaluations that assess both technical compliance with the 40 Recommendations and effectiveness against the 11 Immediate Outcomes.
- Gibraltar's domestic AML/CFT framework rests on POCA, oversight by the GFSC, and intelligence handling through the Gibraltar Financial Intelligence Unit.
- Follow-up reports and action plans track Gibraltar's remediation progress, signaling how the jurisdiction maintains its standing over time.
- Non-resident owners and advisers feel FATF alignment in practical due diligence, reporting expectations, and the territory's ongoing engagement.
FATF and Gibraltar: How a British Overseas Territory Fits the Global AML/CFT Picture
FATF in Gibraltar operates through MONEYVAL, the Council of Europe's permanent monitoring body, rather than through direct FATF membership. Gibraltar is a British Overseas Territory assessed against the same 40 FATF Recommendations that apply worldwide, and in February 2024 the FATF removed Gibraltar from its list of jurisdictions under increased monitoring.
This article explains how that framework reaches the territory, where its compliance now stands, and what the change in regulatory standing means for someone incorporating or banking through a Gibraltar entity. It is written for foreign owners, investors, and their advisers weighing counterparty risk and ongoing obligations.
What the Financial Action Task Force Does and Why Its Standards Reach Gibraltar
The Financial Action Task Force is an independent inter-governmental body that sets the global standard for countering money laundering, terrorist financing, and proliferation financing. Its 40 Recommendations form the benchmark against which national systems are measured, and the FATF calls on every country to implement them effectively.
Gibraltar is not a direct FATF member. Assessment runs instead through MONEYVAL, a permanent monitoring body of the Council of Europe established in September 1997, which evaluates compliance with the principal AML/CFT standards and recommends improvements to national authorities.
MONEYVAL reviews several British jurisdictions, including the Crown Dependencies of Guernsey, Jersey, and the Isle of Man, alongside this Overseas Territory. The territory had previously sat within a quasi-regional body that HM Government of Gibraltar considered inadequate; in 2015 it was permitted to be evaluated by MONEYVAL, bringing it into the recognised assessment chain.
The practical effect is that a Gibraltar entity is judged by the same technical and effectiveness yardstick used across the FATF network. For a foreign owner, that consistency matters more than the indirect route through which it arrives.
Company Incorporation in Gibraltar
Set up your company in Gibraltar with Expanship handling registration end to end.
Gibraltar's Mutual Evaluation History Under MONEYVAL and the FATF Framework
The territory had sought entry into MONEYVAL's processes for years before the move was approved, a push driven by HM Government of Gibraltar. The first full assessment under the fifth round began with an on-site visit in April 2019, testing compliance against the 2012 FATF Recommendations using the 2013 Methodology.
That Mutual Evaluation Report was adopted at MONEYVAL's 59th Plenary in Strasbourg, held 2 to 6 December 2019, and its findings were endorsed by the FATF. The report recorded substantial legislative reform, supported by the Proceeds of Crime Act 2015, the Terrorism Act 2018, and the Sanctions Act 2019, among other measures.
Following the assessment, the jurisdiction entered MONEYVAL's enhanced follow-up procedure. Effectiveness was rated moderate on average, with seven of the eleven Immediate Outcomes rated Moderate, three Low, and one Substantial.
In June 2022 the FATF placed Gibraltar on its grey list, citing weaknesses in pursuing regulatory sanctions and final confiscation judgments. At the FATF Plenary in Paris on 21 to 23 February 2024, the territory was formally removed from the list of jurisdictions under increased monitoring, alongside Barbados, Uganda, and the United Arab Emirates.
Technical Compliance with the 40 Recommendations: Where Gibraltar Stands
At the time of the 2019 report, the territory was rated compliant or largely compliant on 75% of the 40 Recommendations, partially compliant on the remaining quarter, and non-compliant on none. The trajectory since then has been steadily upward.
The first Enhanced Follow-up Report in December 2021 lifted eight Recommendations from partially compliant to compliant and one from partially compliant to largely compliant. The same report addressed virtual assets, where Gibraltar was among the earliest MONEYVAL territories to build a regulatory framework and was re-rated largely compliant on Recommendation 15.
A second Enhanced Follow-up Report in May 2024 upgraded Recommendation 36 on international instruments to largely compliant. That move brought every one of the 40 Recommendations to either largely compliant or compliant, placing the territory among the more technically compliant jurisdictions in the global network.
| Milestone | Compliant / largely compliant | Outstanding |
|---|---|---|
| 2019 Mutual Evaluation Report | 75% of 40 Recommendations | 25% partially compliant; none non-compliant |
| 2021 first follow-up | 9 Recommendations re-rated upward | minor deficiencies on 16 (largely compliant) |
| 2024 second follow-up | all 40 at largely compliant or compliant | no further reporting required this round |
The original report carried 78 recommended actions. By the 2024 review, that number had fallen to two.
Ongoing Compliance in Gibraltar
Keep your Gibraltar entity compliant with filings, returns, and statutory obligations.
Effectiveness Ratings and the 11 Immediate Outcomes for Gibraltar
Technical compliance measures whether the right laws exist; the 11 Immediate Outcomes measure whether the system actually works. These outcomes capture the goals an effective AML/CFT regime should achieve in practice.
The 2019 baseline was modest: seven Moderate, three Low, one Substantial. The consolidated ratings on the FATF's Gibraltar country page show a markedly stronger position.
| Outcome | Rating |
|---|---|
| IO1 | High |
| IO2 | High |
| IO3 | High |
| IO4 | High |
| IO5 | High |
| IO6 | Substantial |
| IO7 | High |
| IO8 | High |
| IO9 | High |
| IO10 | Moderate |
| IO11 | Substantial |
In the 2019 assessment, authorities judged terrorist-financing risk as low to medium, and no such case had reached prosecution during the 2014 to 2018 review window. One caution applies to readers: MONEYVAL's follow-up reports examine formal changes to law and institutions, not whether reforms work in day-to-day practice.
Gibraltar's Domestic AML/CFT Architecture: POCA, the GFSC and the Gibraltar Financial Intelligence Unit
The Proceeds of Crime Act 2015 (POCA) is the central money-laundering statute. It sets the legal framework for prevention and enforcement, and Part III details the obligations on regulated firms: customer due diligence, record-keeping, internal procedures, and staff training.
The wider counter-terrorist financing regime sits across several instruments, including the Terrorism Act 2018, the Counter-Terrorism Act 2010, and the Sanctions Act 2019. Criminal penalties under POCA reach imprisonment of up to 14 years together with unlimited fines.
Supervision rests with the Gibraltar Financial Services Commission (GFSC), the financial regulator overseeing banks, e-money institutions, payment firms, funds, investment firms, company managers, professional trustees, and others. It applies a risk-based supervisory approach and can impose financial penalties, issue public statements, restrict or revoke licences, and refer matters for criminal prosecution.
Intelligence work falls to the Gibraltar Financial Intelligence Unit (GFIU), which gathers, analyses, and shares intelligence on criminal conduct routed through regulated businesses. Other supervisory authorities operate under POCA for specific sectors, including the Gambling Division for online gaming and the Office of Fair Trading for high-value goods dealers.
For a regulated entity, the operational obligations are concrete:
- Conduct risk-based customer due diligence on clients and beneficial owners
- Appoint a Money Laundering Reporting Officer (MLRO)
- File suspicious activity reports with the GFIU
- Retain records for a minimum of five years
The framework was aligned with the EU Anti-Money Laundering Directives, transposed into local law before Brexit. Since then the territory has kept an EU-equivalent regime while also applying UK sanctions.
Gibraltar Incorporation Pricing
See transparent pricing to incorporate and maintain a company in Gibraltar.
Follow-Up Reports, Action Plans and Remediation Progress
The grey-listing on 17 June 2022 came with an unusually narrow remediation list. Out of the original 78 recommended actions, the FATF identified only two points requiring increased monitoring, which HM Government of Gibraltar understood to be the shortest action plan of any jurisdiction subjected to the process.
The two items were specific: applying effective, proportionate, and dissuasive sanctions for AML/CFT breaches among non-bank financial institutions and DNFBPs, and pursuing final confiscation judgments commensurate with the territory's risk profile.
In October 2023 the FATF made an initial determination that the action plan was substantially complete and warranted an on-site assessment; in February 2024 it confirmed the strategic deficiencies were resolved and removed the territory from the grey list.
A complication followed on the EU side. The European Commission proposed removing Gibraltar from the EU's high-risk third-country AML list in March 2024, but the European Parliament vetoed the proposal, leaving the EU list out of step with the FATF position for more than 18 months.
The consequence was practical: even after FATF delisting confirmed global AML compliance, European financial institutions remained obliged to apply enhanced due diligence to Gibraltar-connected business while the EU listing stood. The second Enhanced Follow-up Report of May 2024 confirmed no further reporting is required under MONEYVAL's current evaluation round, with a separate instruction to report back on progress in two years.
What FATF Alignment Means in Practice for a Non-Resident Owner or Adviser
Exit from the increased-monitoring list in 2024 is a material change in standing, and it removes the single most visible flag a foreign counterparty or correspondent bank would screen against. The FATF does not itself mandate enhanced due diligence for grey-listed jurisdictions; it asks member states to factor the information into their own risk analysis.
The EU situation deserves attention in due diligence planning. While the EU high-risk listing persisted, European banks applied enhanced due diligence regardless of the FATF position, and removal from that EU list reduces friction and cost for clients routing activity through the territory.
Operating through a Gibraltar-regulated entity carries fixed compliance duties under the GFSC-supervised regime: risk-based CDD, an appointed MLRO, suspicious activity reporting to the GFIU, and five-year record retention. A non-resident owner should treat these as baseline operating costs, not optional extras.
Sanctions screening is a dual-track exercise. The territory applies both UK and EU sanctions, and advisers must reconcile the two regimes when clearing parties and transactions.
The 2019 evaluation noted sound risk understanding among regulated sectors, including fund managers, DLT providers, e-money firms, and bureaux de change, which is a useful signal when assessing counterparties. Set against that, the enforcement framework is real: up to 14 years' imprisonment and unlimited fines for money-laundering offences, plus the GFSC's licensing and penalty powers, belong in any compliance plan.
The Outlook for Gibraltar's Ongoing FATF Engagement
With all 40 Recommendations now at largely compliant or compliant and the increased-monitoring exit secured, the immediate pressure has eased. The FATF has asked the territory to keep working with MONEYVAL to sustain those gains, and HM Government of Gibraltar has set out a three-year plan aimed at remaining on the FATF white list.
MONEYVAL launched its sixth evaluation round in 2024, so a fresh full mutual evaluation under updated methodology will follow in due course. The emphasis is shifting from whether the laws exist to whether they produce results, meaning assessors will probe substantive outcomes such as disruptions, prosecutions, and asset recovery rather than paper procedures.
An early move into virtual-asset regulation gives the territory a head start in an area the sixth round will examine more closely. The continuing need to align with an EU-equivalent framework while applying UK sanctions remains a dual-track complexity that future evaluations are likely to test.
Conclusion
A Gibraltar entity now sits inside a regime that meets the global AML/CFT standard and has cleared the FATF's increased-monitoring process. For a foreign owner, that means lower headline risk at the screening stage, balanced against real and ongoing obligations: due diligence, an MLRO, reporting to the GFIU, and dual UK and EU sanctions screening. The forward question is no longer whether the framework exists but whether it performs, and the next MONEYVAL round will be judged on exactly that.
How Expanship Can Help Your Business in Gibraltar
Expanship supports foreign-owned entities in meeting their AML/CFT obligations under the GFSC-supervised regime, from customer due diligence and MLRO arrangements to GFIU reporting and record retention, and extends that into the full set of services a non-resident business needs to establish and run a company in the territory.
- Company formation and structuring for non-resident owners
- Registered agent and registered office provision
- Tax registration and ongoing filing
- AML/CFT and regulatory compliance management
- Accounting and bookkeeping
- Introductions to banking partners
To discuss your requirements, contact Expanship Gibraltar.
Frequently Asked Questions
No. The territory is assessed through MONEYVAL, a permanent monitoring body of the Council of Europe, rather than holding direct FATF membership, having been permitted to join MONEYVAL's processes in 2015. It is nonetheless measured against the same 40 FATF Recommendations applied worldwide.
No. The FATF added the territory to its list of jurisdictions under increased monitoring in June 2022 and removed it at the Plenary held in Paris on 21 to 23 February 2024, confirming the strategic deficiencies had been resolved. No further reporting is required under MONEYVAL's current evaluation round.
The FATF identified only two outstanding action items out of the original 78 recommended actions: applying effective, proportionate sanctions for AML breaches among non-bank financial institutions and DNFBPs, and pursuing final confiscation judgments matched to the territory's risk. HM Government of Gibraltar considered this the shortest action plan of any jurisdiction placed under increased monitoring.
A regulated entity must conduct risk-based customer due diligence, appoint a Money Laundering Reporting Officer, file suspicious activity reports with the Gibraltar Financial Intelligence Unit, and keep records for at least five years. These duties flow from the Proceeds of Crime Act 2015 and are supervised by the Gibraltar Financial Services Commission.
For a period after the February 2024 FATF delisting, yes. The European Commission proposed removing the territory from the EU high-risk third-country list in March 2024, but the European Parliament vetoed the proposal, leaving European financial institutions obliged to apply enhanced due diligence and the EU list out of step with the FATF position for more than 18 months.
MONEYVAL opened its sixth evaluation round in 2024, so a new full mutual evaluation under updated methodology will follow in due course. That round will focus more on whether AML/CFT systems achieve measurable results such as prosecutions and asset recovery, rather than only on whether the laws and procedures exist.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
