{
 "jurisdiction_id": "GI",
 "jurisdiction": "Gibraltar",
 "url": "https://payments.gi/jurisdictions/gibraltar/",
 "generator": "render_jid v13.3.0",
 "date_modified": "2026-08-11",
 "schema_version": "world-payments-v1",
 "counts": {
  "modules": 14,
  "sourced_findings": 54,
  "source_register": 96
 },
 "modules": [
  {
   "code": "W1a",
   "name": "Licensing, Authorisation & Market Access",
   "confidence": "Confirmed",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w1a-licensing-authorisation-market-access",
   "standing_position": "Gibraltar runs a GFSC-supervised non-bank PI/EMI regime distinct from the UK's, anchored in the Financial Services Act 2019 and the Financial Services (Electronic Money) Regulations 2020 plus the Payment Services Regulations. EMIs (authorised and registered) and PSPs are authorised by the GFSC; credit institutions and EMIs do not need a separate payment-service permission. UK market access for Gibraltar PIs/EMIs runs on a separate transitional track (PSRs Schedule 7 / EMRs reg 74A) pending absorption into the permanent Gibraltar Authorisation Regime (GAR).",
   "findings": [
    {
     "finding": "E-money issuance in Gibraltar is regulated under the Financial Services (Banking) Act 1992 framework and specifically the Financial Services (Electronic Money) Regulations 2011/2020; the GFSC authorises and supervises EMIs.",
     "instrument_type": "regulation",
     "source": "Valsen Corporate / GFSC eMoney pages",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Two EMI types exist: authorised and registered; registered EMIs cannot passport. EMIs may appoint agents (registered with GFSC) and distributors (notified to GFSC); neither may issue e-money.",
     "instrument_type": "regulator_guidance",
     "source": "GFSC (fsc.gi) Electronic Money Institutions page",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "Authorised Credit Institutions or Electronic Money Issuers are not required to apply for a separate payment-service permission, but must ensure they carry payment services under their authorisation and comply with payment-services requirements; applications follow a Staged Application for Authorisation approach.",
     "instrument_type": "regulator_guidance",
     "source": "GFSC (fsc.gi) Payment Service Provider page",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "Under the Gibraltar Authorisation Regime (GAR) UK market access is via notification (not fresh UK authorisation); payment/e-money activities currently rely on separate transitional provisions — PSRs Schedule 7 and EMRs reg 74A — granting sector-specific temporary permission rather than FSMA deemed authorisation, with HMT yet to decide whether to fold them into Schedule 2A.",
     "instrument_type": "law_firm_commentary",
     "source": "Ramparts (ramparts.gi) GAR & UK Market Access",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "GFSC raises minimum prudential thresholds: under Schedule 2 paras 15-16 of the Electronic Money Regulations, the minimum requirements of EMD2 (2009/110/EC) are directed to be increased by 20%.",
     "instrument_type": "regulator_guidance",
     "source": "GFSC (fsc.gi) Electronic Money Institutions page",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W1b",
   "name": "Conduct, Safeguarding & Financial Promotions",
   "confidence": "Confirmed",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w1b-conduct-safeguarding-financial-promotions",
   "standing_position": "Safeguarding is governed by the Financial Services (Electronic Money) Regulations 2020 (Regs 31-32: segregation option 1 / insurance-or-guarantee option 2), with safeguarded funds forming a priority asset pool on an insolvency event. Conduct is governed by the GFSC Consumer Duty (Core Principles and Consumer Duty Regulations 2024, in force 9 May 2024, UK-aligned). Financial promotions are tightened by the Financial Services (Restricted Promotions) Regulations 2025 (in force 1 May 2025) restricting promotion of speculative illiquid securities to retail clients.",
   "findings": [
    {
     "finding": "The Financial Services (Electronic Money) Regulations 2020 require EMIs to keep relevant funds segregated (safeguarding option 1) or covered by insurance/guarantee (safeguarding option 2), set out insolvency-event provisions, and give the GFSC power to exclude assets and sanctioning/administrative-penalty powers.",
     "instrument_type": "regulation",
     "source": "Gibraltar Laws (gibraltarlaws.gov.gi) — Financial Services (Electronic Money) Regulations 2020",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar's Consumer Duty is set out in the Financial Services (Core Principles and Consumer Duty) Regulations 2024, effective 9 May 2024, replicating the UK FCA Consumer Duty; it currently applies to firms serving UK retail customers (excluding DLT providers) and is to be extended to all retail customers by ministerial appointment (anticipated 2026-2027).",
     "instrument_type": "regulation",
     "source": "GFSC (fsc.gi) Consumer Duty page / Triay Lawyers",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "The Financial Services (Restricted Promotions) Regulations 2025 (in force 1 May 2025) tighten promotion of speculative illiquid securities, restricting promotions to general retail clients and removing the 'excluded communications' exemption; promotions limited to high-net-worth / sophisticated investors providing signed declarations.",
     "instrument_type": "regulation",
     "source": "Triay Lawyers / Europa Group",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "GFSC published Guidance Notes on Consumer Duty and the Fair Treatment of Vulnerable Customers (following consultation closing 14 Aug 2024) and conducted a thematic review of Consumer Duty Board Reports released March 2025.",
     "instrument_type": "regulator_guidance",
     "source": "GFSC (fsc.gi) news / Ramparts",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W2",
   "name": "Stablecoins & Digital Money",
   "confidence": "High",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w2-stablecoins-digital-money",
   "standing_position": "Gibraltar was the first jurisdiction to regulate DLT, via the Financial Services (Distributed Ledger Technology) Regulations 2020 (subsidiary to the Financial Services Act 2019), built on nine/ten regulatory principles. DLT providers storing or transmitting value for others require GFSC authorisation (FSA 2019 s.139). Gibraltar is outside the EU so MiCA does not formally apply and a Gibraltar authorisation does not confer MiCA passporting, though the GFSC is progressively aligning the DLT framework with MiCA. Stablecoin/reserve and clearing-and-settlement reforms are in train (Digital Clearing & Settlement Framework, May 2025; Virtual Asset Arrangements amendments, Oct 2025).",
   "findings": [
    {
     "finding": "Gibraltar became the first jurisdiction to provide a comprehensive regulatory framework for blockchain/crypto with the Financial Services (Distributed Ledger Technology) Regulations, subsidiary legislation to the Financial Services Act 2019; the GFSC regulates DLT firms including exchanges and wallet providers.",
     "instrument_type": "regulation",
     "source": "Global Legal Insights — Blockchain & Cryptocurrency Laws 2026 (Gibraltar)",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "FSA 2019 s.139 makes DLT-provider activities (using DLT to store or transmit value belonging to others, in or from Gibraltar) regulated activities requiring GFSC authorisation.",
     "instrument_type": "statute",
     "source": "Ramparts (ramparts.gi) — Gibraltar crypto-asset regulatory regime",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar is not in the EU so MiCA does not formally apply within its territory; a Gibraltar authorisation does not create MiCA passporting rights into the EEA, but the GFSC is progressively aligning the DLT framework with MiCA standards and firms serving EU users must comply with MiCA.",
     "instrument_type": "analysis",
     "source": "Key2Law / Regulated United Europe (rue.ee)",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Pending stablecoin reforms: announced DLT-regime updates include stronger stablecoin regulation (reserve requirements and custody standards), rules for DEX/smart contracts with a central operator, and tighter cybersecurity/third-party risk requirements; draft legislation expected per Minister Feetham (Consensus HK, Feb 2026).",
     "instrument_type": "policy_horizon",
     "source": "Key2Law / company.gi DLT licence guide",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W3",
   "name": "Operational Resilience & Critical Infrastructure",
   "confidence": "High",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w3-operational-resilience-critical-infrastructure",
   "standing_position": "Gibraltar has implemented a UK-equivalent Operational Resilience regime: the GFSC published Operational Resilience, Outsourcing/Third-Party Risk Management and Liquidity Risk Management Guidance Notes in 2024 following industry consultation. Firms identify important business services and set impact tolerances (deadline 13 July 2024), with full compliance expected after 13 July 2026. DORA applies indirectly to firms that are part of EU groups. Gibraltar may set requirements differing from both FCA and PRA given its smaller market.",
   "findings": [
    {
     "finding": "The GFSC published Guidance Notes on Operational Resilience, Outsourcing/Third-Party Risk Management and Liquidity Risk Management following an industry consultation that concluded 12 January 2024; the outsourcing note complements the Operational Resilience Regulations and Guidance Note, aligned with UK approaches.",
     "instrument_type": "regulator_guidance",
     "source": "GFSC (fsc.gi) news — Guidance Notes publication",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "Firms must have identified important business services and set impact tolerances by 13 July 2024, hold a prioritised plan by 13 July 2026, and after 13 July 2026 have comprehensive strategies to remain within impact tolerances in severe-but-plausible disruption.",
     "instrument_type": "analysis",
     "source": "PwC Gibraltar — Operational Resilience",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "The GFSC implemented a UK-equivalent Operational Resilience regime and UK-equivalent Consumer Duty regime as part of legislative amendments enhancing regulatory alignment with the UK (GFSC Annual Report 2023/24).",
     "instrument_type": "analysis",
     "source": "Isolas (gibraltarlawyers.com) — GFSC Annual Report 2023/24",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "The EU's DORA applies indirectly to Gibraltar-presence firms that are part of EU groups or operate a Brexit solution via an EU subsidiary; the GFSC is likely to have different operational-resilience requirements to both the FCA and PRA given the smaller market.",
     "instrument_type": "analysis",
     "source": "Sicsic Advisory / Grant Thornton Gibraltar",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W4",
   "name": "Scheme & Network Compliance",
   "confidence": "Assessed",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w4-scheme-network-compliance",
   "standing_position": "Gibraltar PSPs/acquirers operate under the international four-party card-scheme rules (Visa/Mastercard), PCI DSS (PCI SSC), and — given Gibraltar's UK-aligned post-Brexit posture and SEPA reachability — interchange/scheme-fee economics broadly tracking the UK/EU model. Gibraltar has no domestic card scheme; compliance flows through scheme rulebooks and PCI DSS rather than a bespoke Gibraltar interchange regulation. Searched: GFSC card-scheme/interchange instruments — no Gibraltar-specific interchange cap instrument identified; scheme/PCI obligations apply via the international schemes.",
   "findings": [
    {
     "finding": "Card acquiring in Gibraltar runs on standard four-party scheme economics: interchange is paid by the acquirer to the issuer per transaction, set by Visa/Mastercard, with acquirers passing scheme fees and interchange to merchants; PCI DSS compliance and scheme-mandated technical standards apply to acquirers/PSPs.",
     "instrument_type": "scheme_rule",
     "source": "ECB Occasional Paper No 131 (interchange) / industry (Stored, Justt)",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar-based merchants/PSPs are served by acquirers requiring PCI DSS compliance and adherence to card-scheme rules; acquirers must be defined as such by a payment brand and are subject to payment-brand rules and merchant-compliance procedures.",
     "instrument_type": "scheme_rule",
     "source": "Quadrapay (Gibraltar payment gateway) / UCSB PCI glossary",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar is a SEPA-reachable territory, so euro instant/credit-transfer scheme rails (SCT/SCT Inst) and the ISO 20022 message standard are accessible to Gibraltar-domiciled euro accounts.",
     "instrument_type": "scheme_rule",
     "source": "WorldFirst (SEPA countries list)",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W5",
   "name": "Payment Corridor Dynamics",
   "confidence": "Assessed",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w5-payment-corridor-dynamics",
   "standing_position": "Gibraltar's principal payment corridors are euro (via SEPA, in which Gibraltar is reachable) and sterling (UK-aligned, via UK market-access arrangements). Cross-border euro settlement runs through SEPA mechanisms (TARGET2/EURO1) typically accessed indirectly via correspondent/sponsor banks since only regulated credit/PI/EMI entities can participate. Gibraltar's crypto/stablecoin sector adds digital-asset remittance corridors (stablecoin payments providers established locally).",
   "findings": [
    {
     "finding": "Gibraltar is part of the SEPA zone (listed among overseas territories included in SEPA), enabling euro credit transfers and direct debits to/from Gibraltar-domiciled euro accounts under the SEPA scheme.",
     "instrument_type": "corridor_rail",
     "source": "WorldFirst (SEPA bank transfers)",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "SEPA euro settlement runs via TARGET2 (ECB) and EURO1 (EBA CLEARING); only regulated EMIs, PIs or credit institutions can participate in SEPA, so smaller Gibraltar PSPs typically access via indirect participation or a sponsor/correspondent bank.",
     "instrument_type": "corridor_rail",
     "source": "Payment Labs / UniCredit GTB",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar hosts stablecoin-payments and remittance providers among its DLT-licensed firms (e.g. a Gibraltar-founded stablecoin payment solutions provider also holding a MiCA licence in Europe), adding digital-asset cross-border corridors.",
     "instrument_type": "market_signal",
     "source": "company.gi Gibraltar Crypto Directory",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W6",
   "name": "Industry Structure & Commercial Dynamics",
   "confidence": "Assessed",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w6-industry-structure-commercial-dynamics",
   "standing_position": "Gibraltar's payments/fintech market is concentrated in EMIs, PSPs and DLT firms, with the DLT regime driving global attention and a maturing pool of licensed firms. The sector spans e-money institutions, virtual-asset exchanges, custodians and stablecoin payments providers. Industry bodies (Gibraltar Electronic Money Association, Gibraltar Bankers Association, Gibraltar Association for New Technologies, GFIA) provide formal policy channels. The market skews toward crypto/DLT and e-money rather than a large domestic bank-acquiring base.",
   "findings": [
    {
     "finding": "The DLT Regulations have increased global attention with a growing pool of licensed firms; established e-money and payment-services firms have moved into fintech, and offerings span virtual-asset custody, exchanges, EMIs, PSPs, MiFID firms and crypto-funds.",
     "instrument_type": "analysis",
     "source": "Mondaq — Gibraltar FinTech Comparative Guide",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Industry associations including the Gibraltar Electronic Money Association, Gibraltar Bankers Association, Gibraltar Association of Compliance Officers and Gibraltar Association for New Technologies act as formal channels between policymakers and the private sector.",
     "instrument_type": "analysis",
     "source": "Mondaq — Gibraltar FinTech Comparative Guide",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Market-mapping data indicates a sizeable fintech population in Gibraltar (a directory lists roughly 87 fintech startups, ~32 funded with ~13 at Series A+), including names such as Xapo Bank, INX and eToroX, indicating a private-company-heavy structure.",
     "instrument_type": "market_signal",
     "source": "Tracxn — Gibraltar fintech startups",
     "source_url": null,
     "source_tier": "4",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W7",
   "name": "Legal & Litigation",
   "confidence": "Assessed",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w7-legal-litigation",
   "standing_position": "GFSC enforcement is risk-based, with effective and proportionate use of enforcement powers (including sanctioning/administrative penalties under the EMR 2020) as a stated regulatory objective. No landmark Gibraltar payments-sector litigation or major published GFSC enforcement action against a payments/EMI firm was surfaced for the baseline window; UK safeguarding-insolvency case law (recent UK court judgments on PI/EMI insolvency) is materially relevant given Gibraltar's UK-aligned regime. Searched: GFSC enforcement register / Gibraltar payments penalties 2025-2026 — no Gibraltar-specific payments enforcement action confirmed; note: large 'GFSC' fines in search results were the Guernsey FSC (different regulator), not Gibraltar.",
   "findings": [
    {
     "finding": "The GFSC describes itself as a risk-based regulator for which effective and proportionate use of enforcement powers is instrumental to its regulatory objectives; the EMR 2020 provide GFSC sanctioning powers and maximum administrative penalty amounts.",
     "instrument_type": "regulator_guidance",
     "source": "GFSC (fsc.gi) Enforcement Strategy / EMR 2020",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "Recent UK court judgments have created legal uncertainty over the framework applying when a payment/e-money firm safeguarding funds enters insolvency — directly relevant to Gibraltar's UK-aligned safeguarding regime and a key legal-infrastructure watch item.",
     "instrument_type": "case_law",
     "source": "Gibson Dunn (FCA safeguarding proposals)",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W8",
   "name": "Merchant Acquiring & Risk",
   "confidence": "Possible",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w8-merchant-acquiring-risk",
   "standing_position": "Merchant acquiring for Gibraltar businesses is served largely by international/offshore acquirers and PSPs operating under card-scheme rules and PCI DSS, with anti-fraud rules engines, chargeback/dispute handling and high-risk-merchant treatment managed at the acquirer/scheme level rather than via a bespoke Gibraltar acquiring statute. Gibraltar's high-risk verticals (notably iGaming) shape acquirer risk appetite. Searched: Gibraltar acquiring regime / GFSC merchant-acquiring rules — no Gibraltar-specific acquiring instrument distinct from PSP authorisation + scheme/PCI rules identified.",
   "findings": [
    {
     "finding": "Gibraltar-based businesses obtain card acceptance via acquirers/PSPs offering merchant accounts and payment gateways with anti-fraud rules engines and customer-monitoring tools to identify and eliminate fraudulent transactions and protect the merchant account.",
     "instrument_type": "market_signal",
     "source": "Quadrapay (Gibraltar payment gateway)",
     "source_url": null,
     "source_tier": "4",
     "retrieved_at": null
    },
    {
     "finding": "Offshore acquiring (relevant to Gibraltar's high-risk verticals such as iGaming) operates under scheme rules, interchange and issuer-approval logic with KYC/AML and PCI DSS compliance; settlement involves payout cadence, currency conversion and reserves.",
     "instrument_type": "market_signal",
     "source": "NowG.net (offshore merchant processing)",
     "source_url": null,
     "source_tier": "4",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W9",
   "name": "Product Innovation & Market Development",
   "confidence": "High",
   "moved_this_cycle": true,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w9-product-innovation-market-development",
   "standing_position": "Gibraltar positions itself as an innovation-forward fintech hub. Headline 2025 developments: the Digital Clearing and Settlement Framework (May 2025), developed with the GFSC and Bullish, positioned as the world's first dedicated regime for crypto clearing and settlement of virtual-asset derivatives via regulated CCPs; Virtual Asset Arrangements amendments (October 2025); and the Restricted Promotions Regulations 2025. Draft DLT-framework legislation is expected per Minister Feetham (Consensus HK, Feb 2026). The market also shows neobank/digital-banking and RegTech build-out.",
   "findings": [
    {
     "finding": "The Digital Clearing and Settlement Framework (May 2025), developed with the GFSC and exchange Bullish, is positioned as the world's first dedicated regulatory regime for crypto clearing and settlement, covering risk management, asset safeguarding and settlement finality for virtual-asset derivatives.",
     "instrument_type": "policy_framework",
     "source": "Gibraltar International Magazine (gibraltarfinance.com) / company.gi",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Recent DLT-related developments include Virtual Asset Arrangements amendments (October 2025) and Restricted Promotions Regulations (May 2025); draft DLT-framework legislation expected 'within the next few months' per Minister Nigel Feetham at Consensus Hong Kong (Feb 2026), likely bringing VASP registrations within the DLT Regs.",
     "instrument_type": "policy_horizon",
     "source": "company.gi DLT licence blog / Triay Lawyers",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar has committed to implementing the OECD Crypto-Asset Reporting Framework (CARF), and the Financial Services (Regulated Activities) (Amendment) Regulations 2025 make the provision of virtual asset arrangements a regulated activity under FSA 2019.",
     "instrument_type": "regulation",
     "source": "company.gi / Gibraltar AML Country Update 2026",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar is attracting neobank/digital-banking and RegTech activity, with the GFSC continuing to refine its framework to keep pace with technology and the territory positioned as a hub for compliance-technology innovation.",
     "instrument_type": "market_signal",
     "source": "fintech.gi",
     "source_url": null,
     "source_tier": "4",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W10",
   "name": "Consumer Protection & APP Fraud",
   "confidence": "High",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w10-consumer-protection-app-fraud",
   "standing_position": "Consumer protection rests on the GFSC Consumer Duty (Core Principles and Consumer Duty Regulations 2024, in force 9 May 2024, UK-aligned, outcomes-based). Crucially, on APP fraud Gibraltar has NO equivalent of the UK's mandatory reimbursement regime: under the Financial Services (Payment Services) Regulations 2020, PSPs must only reimburse 'unauthorised' payments, so APP-fraud victims (who authorise the payment) are not guaranteed reimbursement — a material divergence from the UK PSR mandatory reimbursement regime introduced October 2024. The GFSC issues consumer fraud-awareness alerts.",
   "findings": [
    {
     "finding": "Under the Financial Services (Payment Services) Regulations 2020, Gibraltar PSPs are only required to reimburse consumers for 'unauthorised' payments; because APP fraud involves the victim voluntarily making the payment, such transactions fall outside the PSR Regulations and victims are not guaranteed reimbursement.",
     "instrument_type": "regulation",
     "source": "Isolas (gibraltarlawyers.com) — APP Fraud",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar's position contrasts with the UK Mandatory Reimbursement Regime introduced October 2024; no equivalent regime presently exists in Gibraltar, so PSPs are not legally obligated to reimburse APP-fraud victims.",
     "instrument_type": "analysis",
     "source": "Isolas (gibraltarlawyers.com) — APP Fraud",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "The Consumer Duty is an outcomes-focused standard of care (Four Outcomes + Cross-Cutting Rules) under the Financial Services (Core Principles and Consumer Duty) Regulations 2024; the GFSC commenced thematic reviews of firms' compliance from Q3 2024.",
     "instrument_type": "regulation",
     "source": "GFSC (fsc.gi) Consumer Duty / Triay Lawyers",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "The GFSC issues consumer fraud-awareness alerts, including on rising APP fraud where fraudsters impersonate banks or the Royal Gibraltar Police to induce victims to make payments.",
     "instrument_type": "regulator_guidance",
     "source": "GFSC (fsc.gi) Consumer Alert",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W11",
   "name": "AML/CFT & Financial Crime",
   "confidence": "High",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w11-aml-cft-financial-crime",
   "standing_position": "sentinel. Gibraltar's AML/CFT framework for the payments context is anchored in the Proceeds of Crime Act 2015 (POCA), the Terrorism Act 2018 and subsidiary regulations, supervised by the GFSC (for financial firms) with the GFIU as FIU and the OFT for certain DPMS sectors. The crypto Travel Rule is in force via POCA (since 22 March 2021). A 2025 National Risk Assessment was completed; MONEYVAL last evaluated Gibraltar in 2019 (terminating 5th-round follow-up after substantial AML/CFT enhancements, contributing to EU/grey-list removal), with the next MONEYVAL evaluation due 2027. Carried as Sentinel position; no original illicit-finance analysis performed.",
   "findings": [
    {
     "finding": "sentinel. POCA 2015 designates the GFSC among supervisory bodies; obliged entities owe CDD and risk-based verification duties; the GFIU gathers and disseminates financial-crime intelligence under POCA, the Terrorism Act 2018 and the Drug Trafficking Act 1995.",
     "instrument_type": "statute",
     "source": "MemberCheck (AML/CFT Gibraltar) / GFSC AML page",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "sentinel. The crypto Travel Rule has been in effect in Gibraltar since 22 March 2021 (entry into force of POCA provisions), with the GFSC monitoring compliance; an 18-month grace period ran to September 2022.",
     "instrument_type": "regulation",
     "source": "Notabene (Travel Rule Gibraltar)",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "sentinel. Gibraltar completed its most recent National Risk Assessment for AML/CFT/PF in 2025 and is preparing for the next MONEYVAL evaluation in 2027 under revised FATF standards; it was last evaluated by MONEYVAL in 2019.",
     "instrument_type": "national_risk_assessment",
     "source": "HM Government of Gibraltar 2025 NRA / Financial Crime portal",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "sentinel. Following substantial AML/CFT enhancements, MONEYVAL terminated 5th-round follow-up reporting and the European Commission concluded Gibraltar meets standards, supporting its removal from the grey list; the Sanctions Act 2019 and Terrorism Act 2018 (incl. proliferation-financing offence) form part of the framework.",
     "instrument_type": "analysis",
     "source": "Gibraltar AML Country Update 2026 (Thomson Reuters)",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Gibraltar (British Overseas Territory) runs its own AML/CFT/CPF regime under the Proceeds of Crime Act 2015, Terrorism Act 2018 and Sanctions Act 2019, supervised by the GFSC and GFIU. It was removed from FATF increased monitoring in Feb 2024 and the EU high-risk list in June 2025, but retains structural exposure via its offshore-facing insurance, gaming and DLT/crypto sectors and a historically porous Spain frontier.",
     "instrument_type": "assessment",
     "source": "FIM (sentinel.gi) per-JID baseline profile — Gibraltar",
     "source_url": null,
     "source_tier": null,
     "retrieved_at": null
    },
    {
     "finding": "Gap: sourcing-thinness",
     "instrument_type": "gap",
     "source": "FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004)",
     "source_url": null,
     "source_tier": null,
     "retrieved_at": null
    },
    {
     "finding": "Sanctions: OFSI wind-down",
     "instrument_type": "sanctions_change",
     "source": "FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-001)",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "Enforcement: OFSI (HM Treasury) — Maritime Mutual Association Limited (Maritime Mutual Gibraltar) and subsidiaries",
     "instrument_type": "enforcement_action",
     "source": "FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-004)",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "Gap: enforcement-absence",
     "instrument_type": "gap",
     "source": "FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002)",
     "source_url": null,
     "source_tier": null,
     "retrieved_at": null
    },
    {
     "finding": "Gap: capacity-deficit",
     "instrument_type": "gap",
     "source": "FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003)",
     "source_url": null,
     "source_tier": null,
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W12",
   "name": "Correspondent Banking, Settlement & Access",
   "confidence": "Assessed",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w12-correspondent-banking-settlement-access",
   "standing_position": "Gibraltar PSPs/EMIs access euro settlement indirectly via SEPA (TARGET2/EURO1) and sterling rails through UK-aligned/sponsor arrangements, since direct SEPA participation is limited to regulated credit/PI/EMI entities. As a small jurisdiction historically perceived as higher-risk, Gibraltar firms (and their crypto/iGaming exposure) face de-risking pressure in establishing/maintaining correspondent-banking relationships — a structural access constraint consistent with the global CPMI/BIS de-risking pattern affecting smaller jurisdictions. Searched: Gibraltar central-bank account access — Gibraltar has no central bank; settlement access is intermediated via UK/EU correspondent and sponsor banks.",
   "findings": [
    {
     "finding": "Smaller respondent banks in jurisdictions perceived as too risky are especially affected by reductions in correspondent-banking relationships ('de-risking'), per CPMI/BIS — a structural pressure relevant to Gibraltar's small, crypto-and-gaming-weighted financial centre.",
     "instrument_type": "standard_setter_report",
     "source": "BIS/CPMI — Correspondent banking report",
     "source_url": null,
     "source_tier": "1",
     "retrieved_at": null
    },
    {
     "finding": "SEPA euro settlement is via TARGET2 (ECB) and EURO1 (EBA CLEARING); since only regulated EMIs/PIs/credit institutions can participate, Gibraltar firms typically access settlement indirectly through a sponsor/correspondent bank acting as gateway.",
     "instrument_type": "settlement_infrastructure",
     "source": "Payment Labs / UniCredit GTB",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "De-risking is driven by correspondent banks bearing AML/CTF liability and regulatory/reputational risk for respondents, leading large banks to shed relationships with smaller banks in jurisdictions viewed as high-risk — directly constraining access for small-jurisdiction respondents.",
     "instrument_type": "analysis",
     "source": "Congress.gov CRS — Correspondent Banking and De-Risking",
     "source_url": null,
     "source_tier": "2",
     "retrieved_at": null
    }
   ]
  },
  {
   "code": "W13",
   "name": "Commercial Intelligence & Fintech",
   "confidence": "Assessed",
   "moved_this_cycle": false,
   "url": "https://payments.gi/jurisdictions/gibraltar/#w13-commercial-intelligence-fintech",
   "standing_position": "Trailing-12-month (approx. Jun 2025-Jun 2026) commercial/product signals in Gibraltar's payments/DLT space center on public-private framework launches (GFSC + Bullish digital clearing & settlement) and product/regulatory milestones (Virtual Asset Arrangements Oct 2025, Restricted Promotions May 2025) rather than large disclosed M&A. Discrete commercial events captured below; several values undisclosed.",
   "findings": [
    {
     "finding": "Gibraltar, the GFSC and exchange Bullish launched the Digital Clearing and Settlement Framework (May 2025) for crypto-derivative clearing/settlement via regulated CCPs — a flagship public-private product/regulatory event.",
     "instrument_type": "commercial_event",
     "source": "Gibraltar International Magazine / company.gi",
     "source_url": null,
     "source_tier": "3",
     "retrieved_at": null
    },
    {
     "finding": "Bullish — which operates from Gibraltar among other licences — is NYSE-listed (BLSH) with a reported ~$5.6B valuation and also owns CoinDesk, indicating significant capital-markets activity tied to a Gibraltar-connected crypto operator.",
     "instrument_type": "commercial_event",
     "source": "company.gi Gibraltar Crypto Directory",
     "source_url": null,
     "source_tier": "4",
     "retrieved_at": null
    },
    {
     "finding": "A Gibraltar-founded stablecoin payment solutions provider (one of the earliest DLT-licensed firms, ~55 employees) has expanded by also obtaining a MiCA licence in Europe — a product/market-expansion signal.",
     "instrument_type": "commercial_event",
     "source": "company.gi Gibraltar Crypto Directory",
     "source_url": null,
     "source_tier": "4",
     "retrieved_at": null
    }
   ]
  }
 ]
}