Gibraltar

Together these developments mean Gibraltar-licensed banks and non-bank payment and e-money institutions face a market-access environment that is open and functioning but time-bound and contingent on two unresolved processes: completion of the permanent GAR before the transitional bridge expires at the end of 2026, and the absence, confirmed by the Treaty, of any EU-market-access channel opening through the broader UK-EU Gibraltar settlement. The distinction between bank and non-bank market participants is not separately addressed in the evidence available this cycle; both categories are captured by the same transitional-extension and Treaty findings, and no differential treatment for e-money institutions or payment institutions relative to banks has been identified in Gibraltar's current market-access architecture. Gibraltar's post-Brexit financial-services market access has, since 2021, relied on a series of successive transitional instruments rather than a single settled framework, and this cycle's confirmed extension to 31 December 2026 continues that pattern rather than breaking from it.

For firms structuring new EMI or payment-institution licensing applications, or renewing existing UK market-access reliance, the practical planning horizon is therefore bounded by 31 December 2026 rather than open-ended, and the absence of a published GAR text or implementation timetable this cycle should be treated as an open planning gap rather than a settled certainty about what conditions the permanent regime will impose.

Outlook

The GAR's publication timetable and substantive content are the central watch items for Gibraltar market access into 2027; until that text is available, firms cannot fully assess whether the permanent regime will preserve, tighten, or loosen the market-access terms currently available under the transitional bridge. The 31 December 2026 expiry date is a hard deadline against which any GFSC or HM Government of Gibraltar announcement should be read.

On conduct, Gibraltar's Consumer Duty under the Financial Services (Core Principles and Consumer Duty) Regulations 2024, in force 9 May 2024, replicates the UK FCA Consumer Duty. It is outcomes-based, built on the Four Outcomes plus Cross-Cutting Rules, and currently applies to firms serving UK retail customers, excluding DLT providers. The GFSC commenced thematic reviews in Q3 2024 and released a Board Reports thematic review in March 2025. The regime is to be extended to all retail customers by ministerial appointment, anticipated in 2026-2027 — a forward expansion that widens the conduct perimeter beyond the UK-facing book and applies to both bank and non-bank firms.

On promotions, the Financial Services (Restricted Promotions) Regulations 2025, in force 1 May 2025, tighten promotion of speculative illiquid securities, restrict promotions to general retail clients, remove the 'excluded communications' exemption, and limit promotions to high-net-worth or sophisticated investors providing signed declarations. This constrains retail distribution channels for high-risk products and affects the marketing posture of Gibraltar-based investment and crypto promoters. Financial-promotion enforcement is a methodology under-indexed area, and no enforcement outcomes under the 2025 regulations have yet been evidenced — only the rule's entry into force is documented.

Outlook

The Consumer Duty extension to all retail customers, expected by ministerial appointment across 2026-2027, is the main forward conduct development and will broaden the perimeter materially. Enforcement signal under the Restricted Promotions Regulations remains thin and should be treated as under-confident pending higher-tier corroboration. The safeguarding regime's interaction with insolvency case law is tracked separately under W7.

The critical market-access constraint is the MiCA gap. Gibraltar is outside the EU, so MiCA does not formally apply within its territory, and a Gibraltar authorisation does not create MiCA passporting rights into the EEA. The GFSC is nonetheless progressively aligning the DLT framework with MiCA standards, and firms serving EU users must independently comply with MiCA. Operators wanting EEA reach must therefore dual-license, and the Gibraltar/MiCA gap directly shapes domicile decisions.

Forward reform is concentrated on stablecoin reserve and custody standards. Announced DLT-regime updates include stronger stablecoin regulation through reserve requirements and custody standards, rules for decentralised exchanges and smart contracts with a central operator, and tighter cybersecurity and third-party risk requirements. Draft legislation is expected per Minister Feetham at Consensus Hong Kong in February 2026. These reserve and custody standards directly affect stablecoin-issuer and payments-provider operating models domiciled in Gibraltar.

Outlook

The draft DLT-framework legislation, expected in the second half of 2026 with half-year uncertainty, is the defining forward item. Stablecoin reserve and custody standards will reshape issuer economics, while the persistent Gibraltar-licence-does-not-equal-EEA-passport reality continues to push EEA-facing operators toward dual licensing. The reserve/custody dimension carries a cross-reference to FIM for potential illicit-finance use beyond WPM's instrument-trust scope.

The 13 July 2026 full-compliance milestone is the single most imminent regulatory pinch-point for all GFSC-regulated payments firms in the jurisdiction, and the regulatory horizon records it as in-force-pending with quarter-level certainty.

Outlook

With the 13 July 2026 deadline now within the immediate window, the operational-resilience milestone dominates the near-term compliance calendar for every GFSC-regulated firm. After that date, the supervisory expectation shifts from preparation to demonstrated capability to remain within impact tolerances under severe-but-plausible disruption. EU-group firms carry the parallel indirect DORA expectation.

Outlook

Scheme and network compliance is a stable module. Gibraltar firms will continue to track changes to the international Visa and Mastercard rulebooks and PCI DSS, since these — not any domestic instrument — govern card-acquiring obligations. No domestic interchange or scheme development is in prospect, and the module is carried as monitored rather than active.

Outlook

The euro corridor's indirect-access structure keeps sponsor-bank dependency central to corridor risk. As a small jurisdiction reliant on intermediated SEPA participation, Gibraltar's corridor stability is bound up with the correspondent-banking access dynamics tracked under W12. No discrete corridor-rule change is in prospect this cycle; the module is carried as established.

Outlook

The structural skew toward non-bank crypto and e-money operators is a durable feature of the Gibraltar market and underpins both its competitive draw and its de-risking exposure. Higher-tier corroboration of the private-company population would sharpen the picture; until then, the structural read is more reliable than the specific counts. Discrete commercial events are carried separately under W13.

For payment and financial-services firms operating under Gibraltar licences, the practical legal implication is one of continuity rather than change: the Treaty's careful preservation of Gibraltar's constitutional status alongside its explicit non-restoration of passporting means that firms' existing legal analysis of their market-access position, built around the transitional GAR-bridge framework, does not need to be revisited on account of the Treaty itself. The Treaty closes off, rather than opens, one avenue of legal argument that might otherwise have been available — namely, that the broader UK-EU Gibraltar settlement could be read as restoring some form of financial-services market access by implication.

Outlook

Firms and their counsel should watch for the full Treaty text and any Gibraltar-specific implementing legislation, since the 'without prejudice' framing, while confirmed as a starting characterisation, would benefit from primary-text verification once the complete Treaty documentation is available beyond the current briefing-level sourcing.

Outlook

Merchant acquiring is carried as a dashboard-tier, stable module. The dominant variable is iGaming risk appetite at the acquirer and scheme level rather than any domestic statutory development. Better-tier sourcing would be required before any firmer read on Gibraltar acquiring structure could be offered.

Separately, the Prediction Market Regulations 2026 (LN.2026/176) came into force on 13 July 2026, requiring operators of the new prediction-market product vertical to meet an AML/CTF and client-money framework equivalent to the Gambling Act 2025 Part 4 standard from their first day of operation. This is a genuinely new product category for Gibraltar rather than a regulatory update to an existing one, and the client-money framework requirement in particular has direct payments-market relevance: prediction-market operators will need client-money segregation and safeguarding arrangements analogous to those required of conventional gambling operators, which in turn shapes the payment-processing and account-structuring services such operators will require from Gibraltar-based or Gibraltar-servicing payment providers.

Both developments should be read as incremental extensions of Gibraltar's existing regulatory infrastructure — DLT licensing on one hand, gambling-sector client-money standards on the other — into adjacent product categories, rather than as the creation of wholly new regulatory frameworks.

Outlook

Watch for the Bill's enactment status and any GFSC-published conditions specifying the operational detail of tokenised-share approval, and for the first prediction-market operators' practical experience of meeting the Part 4-equivalent AML/client-money standard, both of which will determine how quickly these innovation vectors translate into measurable payments-market activity.

Outlook

The APP-fraud reimbursement divergence is a durable structural feature unless and until Gibraltar adopts an equivalent regime, of which there is no current signal. The lower fraud-liability exposure is a competitive consideration for PSP domicile, balanced against the consumer-protection gap relative to the UK. The trajectory is recorded as divergent rather than converging.

Also per Sentinel, the crypto Travel Rule has been in force in Gibraltar via POCA since 22 March 2021, with an 18-month grace period to September 2022. Gibraltar completed its most recent National Risk Assessment in 2025 and is preparing for the next MONEYVAL evaluation in 2027 under revised FATF standards; MONEYVAL terminated its 5th-round follow-up after substantial AML/CFT enhancements, supporting Gibraltar's grey-list removal. The AML supervisory structure underpins correspondent-banking access and the jurisdiction's reputational standing.

Outlook

The next MONEYVAL evaluation in 2027 under revised FATF standards is the defining forward AML item, following the completed 2025 NRA. Grey-list removal and the improving compliance trajectory support correspondent-banking and counterparty acceptance. These threads carry illicit-finance significance flagged to FIM, which holds original analytical responsibility; WPM carries only the Sentinel position.

Outlook

Structural access risk dominates the module. With no domestic central bank and intermediated euro and sterling settlement, the jurisdiction's payments operations remain exposed to correspondent-bank de-risking decisions over which Gibraltar firms have limited control. This exposure is partly offset by grey-list removal and the improving AML trajectory tracked under W11, but the trajectory is recorded as constrained. The correspondent-access dependency carries cross-monitor significance flagged to FIM.

Outlook

With no new M&A or funding event identified this cycle, the commercial-intelligence line for Gibraltar remains a watch item tied to the size of the licensed gambling-operator base as the demand driver for EMI/PSP high-risk processing capacity.