Home › Crypto Regulation › Gibraltar

Quick answer — Gibraltar, 2026

• Legal: Legal to own and use, not legal tender
• Tax: No capital gains tax or VAT; income or corporation tax can apply
• Buying: Via GFSC-authorised DLT providers or well-regulated international exchanges

Gibraltar is a British Overseas Territory at the southern tip of the Iberian Peninsula with its own government, courts and financial-services regulator. It was one of the first jurisdictions in the world to build a purpose-made regulatory regime for blockchain businesses: its Distributed Ledger Technology (DLT) framework took effect on 1 January 2018. Rather than banning crypto or leaving it unregulated, Gibraltar chose to license firms that store or transmit value for others, supervising them through the Gibraltar Financial Services Commission. This, combined with a low-tax environment and no capital gains tax, has made the territory a notable home for digital-asset companies.

This page explains the current legal status of Bitcoin and other cryptocurrencies in Gibraltar, who regulates the sector, how digital-asset businesses are licensed and taxed, and what individuals and businesses should know in practice. This is general information as of 2026 and is NOT legal, tax, or financial advice. Crypto laws change quickly, so verify any specific point with the Gibraltar Financial Services Commission or a qualified local professional before acting. For background, see our overview of crypto regulation.

Next: How crypto is taxed · Sending crypto safely
Nearby: Andorra · Cyprus · Greece · Italy
All countries: browse the 205 country guides

On this page: Legal status · Who regulates it · Taxes · How to buy · Mining

Yes. Owning, buying, selling and using Bitcoin and other cryptocurrencies is legal in Gibraltar. There is no prohibition on individuals holding digital assets, and the territory has deliberately positioned itself as a regulated home for crypto and fintech firms rather than banning the sector.

Legal does not mean unregulated, and it does not mean official money. Bitcoin is not legal tender in Gibraltar. The territory uses the Gibraltar pound, which is issued locally and pegged at par to the British pound sterling. Cryptocurrencies are treated as assets, not as currency, and any business that uses distributed ledger technology to store or transmit value belonging to others must be authorised by the Gibraltar Financial Services Commission as a DLT Provider.

For an ordinary resident or visitor, the practical takeaway is straightforward: you can legally use crypto, but you should expect the platforms you use to ask for identity verification and to operate under authorisation.

The principal regulator for digital assets is the Gibraltar Financial Services Commission (GFSC). The GFSC authorises and supervises firms that carry on DLT activities in or from Gibraltar, applies fit-and-proper standards, and enforces conduct, consumer-protection and systems-and-controls requirements. Any firm that uses distributed ledger technology for storing or transmitting value belonging to others, by way of business in or from Gibraltar, must be authorised by the GFSC as a DLT Provider.

Other authorities play supporting roles. HM Government of Gibraltar sets policy and legislation, the Income Tax Office administers tax, and the Gibraltar Financial Intelligence Unit (GFIU) receives suspicious-activity reports under the anti-money-laundering regime. Gibraltar Finance, part of the government, promotes the jurisdiction and publishes background on the DLT framework.

You can confirm the regulator and its published guidance directly at the Gibraltar Financial Services Commission and read the government's overview of the framework at Gibraltar Finance.

The cornerstone of crypto regulation in Gibraltar is the Financial Services Act 2019 together with the subsidiary regulations made under that Act, originally titled the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 and since renamed the Financial Services (DLT Providers and VAA Providers) Regulations 2020 to reflect supervision of both DLT Providers and Virtual Asset Arrangement (VAA) Providers. The underlying DLT regulatory framework first came into force on 1 January 2018 and was widely described as the world's first purpose-built regime for businesses using blockchain or DLT.

A defining feature is that the regime is principles-based rather than a long list of prescriptive rules. DLT Providers must comply with ten core regulatory principles set by the GFSC, which include conducting business with honesty and integrity, paying due regard to the interests and needs of customers, maintaining adequate financial and other resources, managing risk and protecting client assets, having effective systems and controls, and protecting against financial crime. A tenth principle on market integrity was added to require providers to maintain or enhance the integrity of the markets in which they participate, addressing issues such as market manipulation and insider dealing.

The 2020 Regulations have since been broadened to capture additional virtual-asset activity. The regime covers both DLT Providers and Virtual Asset Arrangement (VAA) Providers. VAA Provider's business is the regulated activity in paragraph 139A of Schedule 2 to the Financial Services Act 2019, inserted by LN 2025/254 with effect from 27 October 2025: exchanging, or making arrangements with a view to the exchange of, virtual assets for money, money for virtual assets, or one virtual asset for another. Since 23 July 2026, paragraph 142A excludes from that activity anything carried on in the course of the business for which they are authorised by collective investment schemes within the meaning of Part 18, pension funds, or the depositaries and managers of those entities. Because the detail is technical and has been amended, businesses in particular should take local legal advice rather than rely on summaries. See our general guide to crypto regulation for wider context.

Under the Financial Services Act 2019 and the DLT Providers Regulations, any firm that, by way of business in or from Gibraltar, uses DLT to store or transmit value belonging to others must be authorised by the GFSC as a DLT Provider. In practice this typically captures cryptocurrency exchanges, custodians and wallet providers that hold or move clients' assets.

The application is rigorous and assesses not only documentation but the firm's actual governance, client protection and operational resilience against the ten principles. Applicants must demonstrate fit-and-proper management, adequate resources, robust systems and controls, and effective financial-crime defences. The GFSC assesses DLT Provider applications through a staged authorisation process, and the time taken depends on the complexity of the business and the quality of the submission, so applicants should plan for a substantial review period and confirm current timelines with the GFSC.

Authorisation involves fees. Reported figures suggest application and supervisory costs can run into the tens of thousands of euros depending on the licensable activities, but you should confirm current fee schedules directly with the GFSC rather than rely on third-party estimates. Before depositing funds with any platform, check that it is genuinely authorised; the GFSC publishes information about regulated firms and warnings about unauthorised ones on its website.

That lighter registration route has been closed. The Financial Services (Regulated Activities) (Amendment) Regulations 2025 (LN 2025/254), in force on 27 October 2025, omitted regulation 4(1)(d) of the Proceeds of Crime Act 2015 (Relevant Financial Business) (Registration) Regulations 2021, and instead made providing virtual asset arrangements a regulated activity requiring full GFSC Part 7 permission. Firms already registered on the old basis had to inform the GFSC in writing within 14 days and apply for permission within six months of the appointed day, that is by 27 April 2026, and could continue trading while their application was determined. One registration category does remain, in regulation 4(1)(c): an undertaking that receives, on its own account or on behalf of another, proceeds in any form from the sale of tokenised digital assets involving the use of DLT, and is not subject to supervision by a relevant supervisory authority, must still be entered on the GFSC register.

In 2024 Gibraltar also introduced the Financial Services (Core Principles and Consumer Duty) Regulations 2024. These set out core principles and a consumer-duty standard for regulated financial services in Gibraltar. The precise scope of the consumer-duty standard is defined in the regulations and has been the subject of ongoing clarification, so a firm should confirm how it applies to its own activities. In broad terms, the direction of travel reinforces the expectation that authorised firms treat customers fairly, communicate clearly, and act in customers' interests, alongside the ten DLT principles. Because the boundaries between DLT Provider authorisation and VASP registration are technical and have been amended, a firm should confirm which route applies to it with the GFSC or a local adviser rather than assume.

Gibraltar is a well-known low-tax jurisdiction. It does not levy capital gains tax, and it has no value-added tax (VAT), no wealth tax and no dividend or withholding tax of the kind seen in many countries. As a result, an individual generally does not face a specific Gibraltar capital gains charge simply for selling cryptocurrency at a profit.

That headline should not be mistaken for crypto being entirely tax-free. Several points matter:

• Gibraltar does levy income tax and corporation tax. There is no crypto-specific tax legislation, so general tax principles apply. Whether crypto activity is taxable income often turns on the traditional badges of trade test: if buying and selling crypto amounts to carrying on a trade, profits can be taxable as income; if it does not, a disposal is more likely to be treated as a non-taxable capital gain.
• The standard rate of corporation tax rose to 15 percent from 1 July 2024 (from 12.5 percent), and applies to companies on profits accrued in or derived from Gibraltar. Crypto businesses operating in or from Gibraltar are subject to this in the normal way.
• If you are tax-resident in another country, your home jurisdiction may tax your crypto gains or income regardless of Gibraltar's rules.

This section is informational only and not tax advice. We deliberately avoid quoting personal-tax bands or thresholds, as these change and should be checked against official sources. Confirm your position with the Gibraltar Income Tax Office or a qualified adviser. For general background, see our guide to crypto taxes.

Anti-money-laundering and counter-terrorist-financing (AML/CFT) obligations apply to authorised DLT and virtual-asset firms. The core statute is the Proceeds of Crime Act 2015 (POCA) and its supporting regulations, alongside GFSC guidance. Firms must apply customer due diligence and KYC procedures, assess and manage money-laundering and terrorist-financing risk, monitor activity, and report suspicious transactions to the Gibraltar Financial Intelligence Unit. Gibraltar has aligned its rules with international standards, including the Financial Action Task Force (FATF) recommendations.

Gibraltar implements the FATF Travel Rule for crypto-asset transfers through the Funds (Transfer) Regulations 2026 (LN 2026/134), which came into operation on 15 July 2026 and, by regulation 47, revoked the earlier Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021. This requires firms to collect and pass on identifying information about the originator and beneficiary of certain transfers. Since 15 July 2026 there is no minimum threshold. Regulation 16 of the Funds (Transfer) Regulations 2026 requires full originator and beneficiary information on every transfer of virtual assets between service providers, verified beforehand against a reliable and independent source, and regulation 16(8) provides that a provider must not allow the initiation of, or execute, a transfer before ensuring full compliance. The EUR 1,000 figure now applies only to self-hosted wallets: under regulation 16(5), for a transfer exceeding the sterling equivalent of EUR 1,000 to a self-hosted address, the provider must take adequate measures to assess whether that address is owned or controlled by the originator. Separately, section 19A of the Proceeds of Crime Act 2015, inserted with effect from the same date, requires firms to risk-assess self-hosted address transfers in both directions.

For users, the practical effect is that any compliant platform serving Gibraltar will require full identity verification when you open an account, fund it, or withdraw, and may ask about the source of funds and the destination of larger transfers.

Residents and visitors can buy crypto through international exchanges and through firms authorised locally. Any platform that uses DLT to hold or move clients' assets by way of business in or from Gibraltar is expected to hold DLT Provider authorisation from the GFSC.

A typical path looks like this, and is a general guide rather than an endorsement of any provider:

• Choose a platform. Prefer a reputable exchange that is transparent about its regulatory status, ideally authorised by the GFSC or in another well-regulated jurisdiction.
• Create and verify your account. Expect to provide identity documents and proof of address to satisfy KYC requirements.
• Fund your account. Deposit pounds or euros by the methods the platform supports; Gibraltar uses the Gibraltar pound at par with sterling.
• Place your order after reviewing fees and the exchange rate.
• Secure your holdings. For anything beyond small amounts, consider moving funds to a wallet you control, such as a hardware wallet, and keep your recovery phrase offline and private.

Be alert to scams: unrealistic returns, pressure to act quickly, and unsolicited investment managers are common red flags. Using an authorised platform offers more protection than dealing with an unregulated one, but it does not remove market risk.

Gibraltar is a small territory of around 30,000 people, and the number of cryptocurrency ATMs is correspondingly limited; the territory installed its first Bitcoin ATM in 2017. There is no separate ATM-specific crypto statute. Instead, whether a crypto ATM is a regulated activity depends on the general DLT framework: an operator that uses distributed ledger technology to store or transmit value belonging to others, by way of business, can fall within the scope of DLT Provider authorisation.

If you use a crypto ATM in Gibraltar, expect identity-verification steps for larger amounts as part of AML compliance, and check the fees and exchange rate carefully, since machine rates and spreads are often less favourable than online exchanges. Availability can change, so do not assume a machine seen previously is still operating.

There is no specific Gibraltar law that bans cryptocurrency mining, and the DLT framework is focused chiefly on storing and transmitting value for others rather than on mining as an activity. As a result, mining is generally not a licensable activity in its own right. That said, the way a mining operation is structured should still be analysed: if a miner exercises meaningful control over a network or protocol, or effectively stores or transmits value belonging to third parties, licensing questions could arise.

The bigger constraint is practical. Gibraltar is a small, densely built territory with limited land and relatively high electricity costs, and it is not a notable destination for large-scale, energy-intensive mining. Anyone considering mining should model electricity costs carefully and check local rules on power supply, business licensing, planning and the import of equipment.

Two strands of change stand out in this period. First, tax transparency for crypto: in January 2025 (press release 15/2025) HM Government of Gibraltar confirmed that the territory is among the jurisdictions committed to the OECD Crypto-Asset Reporting Framework (CARF), which extends the automatic exchange of tax information to crypto-assets. Gibraltar is listed by the OECD among the jurisdictions committed to begin exchanges by 2027. In line with that first wave, crypto firms in participating jurisdictions are expected to start collecting the required customer information from 1 January 2026, with the first automatic exchange of that data taking place in 2027. Reporting obligations for crypto businesses are therefore being phased in rather than being fully in force earlier.

Second, refinement of the DLT regime: the standard corporation-tax rate rose to 15 percent from 1 July 2024, and Gibraltar introduced the Financial Services (Core Principles and Consumer Duty) Regulations 2024, which came into effect in 2024 and set out core principles and a consumer-duty standard for regulated financial services in Gibraltar. The DLT Providers Regulations have been amended repeatedly and the changes are now dated and in force rather than anticipated. LN 2025/040 recast the authorisation application requirements from 1 April 2025; LN 2025/254 renamed the Regulations as the Financial Services (DLT Providers and VAA Providers) Regulations 2020 and extended them to VAA Providers from 27 October 2025; LN 2026/053 added regulation 5A, requiring 30 days notice to the GFSC before any dividend or capital distribution, from 26 March 2026; and LN 2026/231 extended the core principles in the Financial Services (Core Principles and Consumer Duty) Regulations 2024 to VAA Providers from 23 July 2026. Because the framework is technical and still evolving, the most reliable way to track changes is to monitor GFSC and government publications directly rather than relying on secondary summaries.

Gibraltar offers a comparatively developed regulatory environment for digital assets, but real risks remain that users should weigh:

• Market volatility. Crypto prices can move sharply, and losses can be significant and rapid.
• Platform and counterparty risk. Even authorised firms can fail. Use platforms that segregate client assets and are genuinely authorised, and check the GFSC's registers and warnings.
• Regulatory change. The DLT framework has been amended more than once and continues to be refined, and CARF tax-reporting obligations are on the way.
• Limited compensation. Holding crypto is not the same as holding bank deposits; do not assume crypto balances are covered by any depositor-protection scheme.
• Scams and fraud. Pseudonymous, irreversible transactions are attractive to fraudsters, so be sceptical of unsolicited offers and guaranteed returns.

Authorisation by the GFSC offers more protection than dealing with an unregulated platform, but no regulation removes the underlying market risk. Apply the same caution you would anywhere: verify, diversify, secure your keys, and confirm anything legal or tax-related with official sources. This page is informational only and is not legal, tax, or financial advice.

Crypto rules evolve, so always confirm specific points with primary, official sources rather than third-party summaries. The most authoritative references for Gibraltar are:

• Gibraltar Financial Services Commission (GFSC), the regulator that authorises and supervises DLT and virtual-asset firms.
• Gibraltar Laws portal: Financial Services (DLT Providers and VAA Providers) Regulations 2020, the text of the core subsidiary legislation made under the Financial Services Act 2019.
• Gibraltar Income Tax Office for income tax, corporation tax and tax administration.
• Gibraltar Finance: Distributed Ledger Technology for the government's overview of the framework.

To verify whether a specific platform is permitted to serve you, check the GFSC's published information on regulated firms and its warnings about unauthorised firms. This is general information as of 2026 and is not legal advice; for your particular situation, confirm with the named regulator or a qualified Gibraltar professional. You can also browse our wider regulation hub for other jurisdictions.

Facts reviewed: 13 August 2026. Page updated: 13 August 2026.

More countries in the region

• Crypto regulation in San Marino
• Crypto regulation in Spain
• Crypto regulation in Malta
• Crypto regulation in Monaco
• Browse all 205 country guides

Practical guides

• How crypto is taxed
• Setting up a hardware wallet
• Why exchange custody is risky