Digital Payments & Fintech · Gibraltar
Fintech & payments regulation in Gibraltar (2026)
Gibraltar shaded by its digital payments & fintech status
Fintech and digital payments in Gibraltar: licensing regime.
FrameworkFinancial Services Act 2019 with the Financial Services (Payment Services) Regulations 2020 and Financial Services (Electronic Money) Regulations 2020 (transposing PSD2 / EMD2), plus the DLT Regulatory Framework (2018) and Virtual Asset Arrangement (VAA) Regulations (in force 27 October 2025) — all administered by the Gibraltar Financial Services Commission (GFSC).
Gibraltar operates a mature, in-force licensing regime for digital payments and fintech under the consolidated Financial Services Act 2019, with GFSC-issued 'Part 7' permissions covering payment institutions, electronic-money institutions, DLT providers and (since October 2025) virtual asset arrangement providers. PSD2 has been transposed, giving effect to strong-customer-authentication and open-banking (AISP/PISP) rules, and Gibraltar is one of the first jurisdictions worldwide to license DLT-based value transfer and is now developing bespoke rules for clearing/settlement of crypto derivatives. BNPL is not yet subject to a dedicated Gibraltar-specific regime; the sector relies on general consumer-credit and payments law while UK-aligned reform proceeds.
Key points
The Gibraltar Financial Services Commission (GFSC) is the single competent authority for authorising and supervising payment institutions, e-money institutions, DLT providers and VAA providers under the Financial Services Act 2019.
The Financial Services (Payment Services) Regulations 2020 transpose PSD2 and require any firm carrying on payment-service business in or from Gibraltar to hold a GFSC Part 7 permission specifying the payment services it may provide.
The Financial Services (Electronic Money) Regulations 2020 govern the authorisation of EMIs to issue and redeem e-money (including pre-paid cards and online e-money accounts), with EMIs also able to provide payment services under their existing authorisation.
Because PSD2 is transposed, AISPs and PISPs are formally regulated third-party providers and the payments RTS on strong customer authentication and secure communication apply, with GFSC-published PSD II guidance for firms.
Gibraltar's DLT Regulatory Framework (effective 1 January 2018) requires firms using DLT to store or transmit value on behalf of others to be authorised by the GFSC against ten principles; from 27 October 2025 exchange activity (crypto↔fiat and crypto↔crypto) also requires a GFSC Part 7 permission as a regulated Virtual Asset Arrangement.
Gibraltar does not yet have a bespoke BNPL/Deferred-Payment-Credit regime; providers rely on general Gibraltar consumer-credit and payment-services rules while the UK's FCA is bringing DPC into its perimeter from 15 July 2026 under an approach Gibraltar is expected to track.
Timeline - major decisions & events
Gibraltar amended the Financial Services Act 2019 (new paras 139A/139B, Part 16 Sch 2) so that exchanging virtual assets for fiat or other virtual assets now requires Part 7 GFSC permission, moving VASPs from mere AML registration to full prudential licensing.
GFSC ↗The Government and GFSC unveiled what they describe as the world's first regulatory framework for clearing and settling crypto derivatives, addressing settlement finality, counterparty risk and custody to bolster market integrity.
HM Government of Gibraltar ↗Following a Government/GFSC Market Integrity Working Group convened in January 2021, a tenth core regulatory principle was added requiring DLT providers to maintain or enhance market integrity and guard against price/market manipulation.
HM Government of Gibraltar ↗The Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021 imposed originator/beneficiary information-sharing on VASPs for transfers of EUR 1,000 or more, with full compliance mandatory after an 18-month grace period (by 22 Sept 2022).
Gibraltar Laws (Official Gazette) ↗After consultation begun in 2019, the GFSC updated its DLT Providers guidance to better distinguish virtual assets from higher-risk virtual-asset-denominated instruments and tighten onboarding/risk tests for digital asset exchanges.
HM Government of Gibraltar ↗The Legislative Reform Programme consolidated ~90 financial services instruments (including DLT, e-money and payment services rules) into a single Financial Services Act 2019 plus 41 sets of regulations, creating the unified licensing architecture used today.
HM Government of Gibraltar ↗Gibraltar transposed the EU Second Payment Services Directive, introducing licensing/authorisation for payment institutions and the new payment-initiation and account-information service providers, with strengthened security and consumer protection.
GFSC ↗The Financial Services (Distributed Ledger Technology Providers) Regulations 2017 took effect on 1 Jan 2018, making Gibraltar one of the first jurisdictions to require firms storing or transmitting value via DLT to obtain a GFSC licence under nine (later ten) core principles.
GFSC ↗Gibraltar's Financial Services (Electronic Money) Regulations 2011 (later re-enacted as the 2020 Regulations) created the GFSC authorisation regime for electronic money institutions, a foundational pillar of the jurisdiction's payments licensing.
GFSC ↗Gibraltar - other topics
Digital Payments & Fintech in other countries
Last verified 9/16/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →