Financial Integrity Monitor
Sign in

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Financial Integrity Monitor

Gibraltar GIB

Domains covered
8 of 8
Sources
192
Role actions
8
Horizon <90d
0
Jurisdiction profile
FATF status: Clean Tier: B Risk direction: Decreasing Enablement vs enforcement: Mixed

Gibraltar (British Overseas Territory) runs its own AML/CFT/CPF regime under the Proceeds of Crime Act 2015, Terrorism Act 2018 and Sanctions Act 2019, supervised by the GFSC and GFIU.

MoreIt was removed from FATF increased monitoring in Feb 2024 and the EU high-risk list in June 2025, but retains structural exposure via its offshore-facing insurance, gaming and DLT/crypto sectors and a historically porous Spain frontier.

Key deficiencies
  • Sanctions imposed by supervisors historically assessed as not proportionate or dissuasive across the majority of AML/CFT cases
  • Weak outgoing mutual legal assistance activity relative to Gibraltar's cross-border exposure to complex international ML cases
  • No PF-related targeted financial sanctions asset freezes have ever been executed, alongside low private-sector (especially DNFBP) awareness of proliferation-financing TFS obligations
  • Complex ownership structures and trusts remain a weak spot for beneficial-ownership identification among banks and some other reporting entities
Recent developments (18m)
  • FATF/MONEYVAL removed Gibraltar from the 'Jurisdictions under Increased Monitoring' grey list on 23 February 2024, with MONEYVAL closing further reporting after a follow-up re-rating exercise
  • European Commission delisted Gibraltar from the EU list of high-risk third countries for AML/CFT purposes on 10 June 2025
  • OFSI issued a wind-down General Licence (Feb 2026) for Maritime Mutual Association Limited ('Maritime Mutual Gibraltar'), a Gibraltar-domiciled marine insurer with Russia-sanctions exposure
  • UK-Gibraltar transitional financial-services market access arrangements extended by a further 12 months to 16 December 2026 pending finalisation of the long-term Gibraltar Authorisation Regime (GAR)
Brief

Lead signal

Lead Signal

Gibraltar presents, as at November 2026, a mature and autonomously legislated anti-money-laundering, counter-terrorist-financing and sanctions architecture whose current standing position is confirmed across four firm-level enforcement actions concluded in the 2023 to 2025 period and a formal exit from enhanced monitoring by the regional mutual-evaluation body. The Gibraltar Financial Services Commission imposed penalties on Tap Global Limited of 150,000 pounds for suspicious-activity-reporting failures, on Blacktower Financial Management (International) Limited of 294,479 pounds for customer due diligence and sanctions-screening deficiencies, and on Alvar Financial Services Limited and Argon Financial Limited of 186,038.52 pounds and 71,281 pounds respectively for control and management failures. In parallel, Gibraltar achieved a rating of Largely Compliant or Compliant on all forty FATF Recommendations following a 2024 re-rating of Recommendation 36, bringing the enhanced follow-up procedure maintained by the regional evaluation body to a close. Read together, the enforcement record and the compliance re-rating describe a jurisdiction where the architecture is not merely declaratory: obligations under the Proceeds of Crime Act 2015 are actively tested against firms spanning crypto-asset, payments and investment-management activity, and the supervisory body has shown a willingness to levy penalties running into the hundreds of thousands of pounds.

Read full brief

Lead Signal

Gibraltar presents, as at November 2026, a mature and autonomously legislated anti-money-laundering, counter-terrorist-financing and sanctions architecture whose current standing position is confirmed across four firm-level enforcement actions concluded in the 2023 to 2025 period and a formal exit from enhanced monitoring by the regional mutual-evaluation body. The Gibraltar Financial Services Commission imposed penalties on Tap Global Limited of 150,000 pounds for suspicious-activity-reporting failures, on Blacktower Financial Management (International) Limited of 294,479 pounds for customer due diligence and sanctions-screening deficiencies, and on Alvar Financial Services Limited and Argon Financial Limited of 186,038.52 pounds and 71,281 pounds respectively for control and management failures. In parallel, Gibraltar achieved a rating of Largely Compliant or Compliant on all forty FATF Recommendations following a 2024 re-rating of Recommendation 36, bringing the enhanced follow-up procedure maintained by the regional evaluation body to a close. Read together, the enforcement record and the compliance re-rating describe a jurisdiction where the architecture is not merely declaratory: obligations under the Proceeds of Crime Act 2015 are actively tested against firms spanning crypto-asset, payments and investment-management activity, and the supervisory body has shown a willingness to levy penalties running into the hundreds of thousands of pounds.

The standing core of this architecture rests on the Proceeds of Crime Act 2015, which established the Gibraltar Financial Intelligence Unit and sets out, in Part III, customer due diligence, record-keeping and suspicious-activity-reporting duties, underpinned by criminal penalties for money-laundering offences of up to fourteen years imprisonment. Firms report suspicion of money laundering, terrorist financing or proliferation financing to the Financial Intelligence Unit without delay once a money-laundering reporting officer determines the grounds for suspicion are satisfied, subject to a consent and sixty-working-day moratorium regime where consent is withheld. These are not new measures: they are the settled operating rules against which both the 2025 enforcement actions and the rising volume of suspicious-activity reports described below are now measured.

Other Developments

Suspicious-activity reporting volumes rose sharply in 2025. The Financial Intelligence Unit recorded more than 5,800 suspicious-activity reports for the year, a 17.5 percent increase on the prior year's total of 4,950, with the virtual-asset-service-provider sector contributing a near-doubling of its own disclosures. Separately, Financial Intelligence Unit statistics for the second quarter of 2025 show 194 requests for consent to proceed despite a suspicion of money laundering, of which 166, or 86 percent, were granted.

The penalty architecture underpinning supervisory enforcement is set out in the Supervisory Bodies (Powers etc.) Regulations 2017. A supervisory body may impose an administrative penalty on a relevant person for breach of Proceeds of Crime Act obligations up to the higher of twice the benefit derived or 1 million euros for most relevant persons, rising to 5 million euros or 10 percent of total annual turnover for credit and financial institutions. A possible successor instrument dated 2025 carrying a comparable 1 million euro cap has been identified as a research lead but has not yet been independently confirmed as superseding the 2017 Regulations.

An Unexplained Wealth Order regime took effect in October 2024. Amendments to the Proceeds of Crime Act allow the Supreme Court to require an individual, typically a politically exposed person or a person suspected of serious crime, to explain how property worth more than 50,000 pounds was acquired where known lawful income appears insufficient; making a false statement in response carries a penalty of up to two years imprisonment.

Cross-Monitor Connections

The virtual-asset dimension of Gibraltar's suspicious-activity-reporting increase, in which the sector's disclosures nearly doubled, connects directly to the jurisdiction's standing digital-asset regulatory perimeter and merits attention from monitors tracking crypto-sector money-laundering exposure. The Unexplained Wealth Order regime and its politically-exposed-person framing connect to monitors tracking conflict finance and state-capture typologies, since the explanatory-order mechanism is the principal domestic tool available where suspect wealth cannot otherwise be traced to a predicate offence. The rise in suspicious-activity-report volume alongside an 86 percent consent-grant rate for the second quarter of 2025 may also be of interest to monitors assessing the throughput and capacity of financial-intelligence-unit consent regimes more broadly.

Outlook

Gibraltar's compliance posture, having just closed out enhanced monitoring by the regional evaluation body, now faces its sixth-round mutual evaluation, with an on-site visit provisionally scheduled for October 2027 and a Plenary discussion expected around May 2028; both dates remain provisional and should be treated as indicative rather than fixed. A consultation on enhanced customer due diligence obligations aligned with updated FATF Recommendation 16, targeting virtual-asset-service providers and correspondent banking, has been signalled by the supervisory body but carries no confirmed timetable and rests on a single source, so its shape and timing should be treated as unresolved rather than settled. The rising trajectory of suspicious-activity-report volumes, if sustained, points toward continuing pressure on the Financial Intelligence Unit's consent and triage capacity, a pattern worth monitoring through subsequent statistical releases rather than assuming to continue unchanged.

Earlier periodic briefs (6)

Periodic updates below are dated within the scope of the expert review (as at 27 Oct 2026).

25 Oct 2026 · fim-2026-10-25 Expert reviewed

Lead Signal

Gibraltar's standing in two architecture-level reviews moved in the same window. MONEYVAL re-rated Gibraltar from Partially Compliant to Largely Compliant on FATF Recommendation 36, which covers the application of international mutual-legal-assistance instruments, and terminated the enhanced follow-up procedure that had run under the fifth-round evaluation process since the December 2019 mutual evaluation report. Out of the forty FATF Recommendations, Gibraltar is now reported at twenty-three rated Compliant and seventeen rated Largely Compliant. In parallel, Gibraltar's domestic sanctions-enforcement architecture gained a new civil track: the Sanctions Civil Enforcement Regulations 2026 and the Sanctions Civil Enforcement Authority (Designation) Order 2026, both made 9 September 2026 under the enabling Sanctions (Amendment) Act 2026 of 9 July 2026, give a designated civil enforcement authority power to impose a monetary penalty on the balance of probabilities for a breach of a sanctions prohibition, recoverable as a civil debt, running alongside the existing criminal offence route.

Other Developments

A new digital-asset entity entered the GFSC-supervised population. Revolut Global Digital Assets Limited, a newly established Gibraltar entity, obtained a GFSC DLT Provider licence permitting virtual-asset order execution, custody and staking, announced 19 October 2026. The licence expands the population of GFSC-supervised virtual asset service providers that fall within Gibraltar's Proceeds of Crime Act 2015 travel-rule and AML perimeter. Gibraltar's AML/CFT architecture rests on the Proceeds of Crime Act 2015, with GFSC and GFIU as the supervisory and financial-intelligence structure assessed by MONEYVAL. That structure is reported unchanged in its substantive form; the movement is in the MONEYVAL rating applied to it, not in the underlying statute. Gibraltar continues to apply UK and EU-derived sanctions regimes alongside UN Security Council measures, and the new civil penalty track sits on top of that existing designations architecture rather than replacing it.

Cross-Monitor Connections

The Revolut licensing development and the associated resumption of electronic-money and payments onboarding touch the payments-sector monitor directly, since the new entity combines a digital-assets permission with a payments business presence under the same Gibraltar regulatory umbrella. The sanctions civil-enforcement track is architecture-level and jurisdiction-agnostic in its design, lowering the evidentiary bar for enforcement generally rather than targeting any single sector; firms assessed elsewhere for Gibraltar sanctions exposure should treat the civil route as a parallel channel to the criminal offence that already existed. No conflict-finance, enabler-jurisdiction, or beneficial-ownership findings specific to Gibraltar were located; this reflects a narrow research window and pooled search budget rather than a confirmed absence of activity in those areas.

Outlook

The substantive content of the Sanctions Civil Enforcement Regulations 2026, including penalty quanta and procedure, is assessed at Probable confidence pending consolidated GFSC/GFIU civil-penalty tariff guidance under the Sanctions Act 2019, and that detail will materially shape how the civil track is used in practice once tested. Gibraltar's re-rating on R.36 and termination of enhanced follow-up leaves it positioned among a small group of jurisdictions rated Compliant or Largely Compliant across the full FATF Recommendation set, a position that bears watching for whether it holds through any subsequent full re-evaluation cycle.

18 Oct 2026 · fim-2026-10-18 Expert reviewed

Lead Signal

MONEYVAL's follow-up report, published 9 October 2026, re-rated Gibraltar from Partially Compliant to Largely Compliant on FATF Recommendation 36, closing enhanced follow-up under the fifth evaluation round. Gibraltar now holds 23 Compliant and 17 Largely Compliant ratings out of 40 FATF Recommendations. This is a structural improvement in Gibraltar's assessed compliance architecture rather than an isolated enforcement incident, and it sits against a regime, POCA as amended, the Sanctions Act 2019, the Terrorism Act 2018 and the Crimes Act 2011, supervised by the Gibraltar Financial Services Commission with the Gibraltar Financial Intelligence Unit as the SAR and STR recipient, that is unchanged in its basic architecture this cycle. Gibraltar's next MONEYVAL technical-compliance submission is due March 2027, with an onsite visit in October 2027 and plenary discussion in May 2028, under Gibraltar's own standalone FATF-style assessment track, autonomous of the EU AML Package.

Other Developments

A civil sanctions-enforcement track has been established. Gibraltar enacted the Sanctions (Amendment) Act 2026 and Sanctions Civil Enforcement Regulations 2026 (LN.2026/332, LN.2026/333), designating a Sanctions Civil Enforcement Authority with power to impose a monetary penalty on a person under the Sanctions Act 2019. This runs in parallel to, but is legally distinct from, the UK's own single Sanctions List consolidation. Gibraltar's crypto travel-rule instrument has been revoked without a located successor. The Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021, in effect since March 2021, was revoked by LN.2026/134 effective 15 July 2026; the text of any successor instrument governing virtual-asset transfer reporting has not been retrieved, leaving a near-term coverage gap for AML obligations on virtual-asset transfers pending clarification. Gibraltar's tokenisation commercial ecosystem continues to develop. Bullish Group received GFSC approval to trade tokenised securities around late June 2026, and the Protected Cell Companies (Amendment) Act 2026, enacted 9 July 2026, creates a bespoke regime permitting tokenised Experienced Investor Fund cell shares; Gibraltar's fintech sector shows 452 million dollars in cumulative venture and private-equity funding across 32 companies as of September 2026, though no GFSC primary-source notice formalising the Bullish Group approval was independently retrieved this cycle, and the finding rests on the company's own announcement.

Cross-Monitor Connections

The revocation of Gibraltar's crypto travel-rule instrument without a located successor is a direct architecture-level signal for any crypto or digital-asset monitor tracking Gibraltar's virtual-asset AML posture, since the gap concerns the reporting infrastructure for virtual-asset transfers specifically. The tokenisation commercial developments, the Bullish Group approval and the Protected Cell Companies Act, connect to payments and digital-infrastructure monitoring tracking Gibraltar's fintech and DLT commercial landscape. The new sanctions civil-enforcement track, distinct from the UK's consolidated list, is relevant to any monitor tracking divergence between UK and Gibraltar sanctions implementation as the two jurisdictions' frameworks continue to run in parallel rather than as a single regime.

Outlook

Gibraltar's compliance trajectory under FATF Recommendation 36 is now improving, with the next formal assessment milestones, technical-compliance submission in March 2027, onsite visit in October 2027, and plenary discussion in May 2028, setting the schedule for whether this improvement is sustained across the broader 40-Recommendation framework. The most immediate open item is the content of the successor instrument to the revoked virtual-asset transfer regulations; until that text is identified, the practical AML coverage for virtual-asset transfers in Gibraltar remains unconfirmed.

6 Oct 2026 · fim-2026-10-06 Expert reviewed

Lead Signal

Gibraltars anti-money-laundering architecture this cycle resolves into a clearer, more granular picture of how the Proceeds of Crime Act 2015 (POCA) actually constrains customer due diligence at the point where theory meets practice. The headline finding is structural rather than episodic: Gibraltar has no numerical electronic-money purse-limit derogation from simplified due diligence (SDD), and whatever SDD latitude section 16 of POCA otherwise allows is overridden by section 16(5) geographic-risk precedence under the 2025 National Risk Assessment (NRA v1.3). The practical effect is unambiguous. A regulated entity can never treat Spain as a Low Risk country, and no customer with a residency, nationality or economic-activity connection to Spain may be given SDD, regardless of product type or transaction value. Morocco sits under a parallel constraint, with funds from either jurisdiction required to be categorised as high risk and subjected to additional risk-based controls. This is not a blanket prohibition on serving Spain-connected customers, nor does it mandate automatic enhanced due diligence for every such relationship; it is a floor beneath which the risk rating cannot fall, which is a materially different and more precise instrument than either extreme would suggest.

The second pillar of this weeks lead signal is the commencement of the Funds (Transfer) Regulations 2026 (LN 2026/134) on 15 July 2026, which revokes the onshored text of Regulation (EU) 2015/847 and replaces it with a travel-rule regime that, notably, extends to virtual asset transfers. Payment service providers and virtual asset service providers alike must now attach originator and beneficiary information to transfers, verify that information before execution, and retain records for five years; a reduced-information threshold applies to unlinked transfers up to EUR 1,000 equivalent. This is an architecture-over-incident development in the fullest sense: it does not respond to a single enforcement failure but resets the entire information-accompaniment baseline for funds movement through Gibraltar, fiat and virtual alike.

Other Developments

The PEP continuing-obligations regime diverges from UK practice in a way firms applying UK Money Laundering Regulations logic to Gibraltar accounts could easily miss. Under POCA sections 20A, 20B and 20(2), the test for a politically exposed person is the prominent public function itself, with no foreign/domestic distinction, and once a PEP leaves office a Gibraltar relevant financial business must continue risk-sensitive measures for at least twelve months, a duty that extends to family members and known close associates as though they too were PEPs. UK treatment, by contrast, drops the family/associate extension once the PEP exits office. A firm porting UK PEP-exit logic onto a Gibraltar book of business would under-apply continuing obligations precisely where Gibraltar law requires more.

The UK-EU Agreement in respect of Gibraltar, signed 14 July 2026 and provisionally applied from the same date, inserts a non-regression commitment at Article 198(2): the UK, in respect of Gibraltar, must not weaken AML/CFT measures below the levels set out in the EU instruments listed at Annex 17, which include Directive 2015/849 as amended, the AML Regulation (2024/1624), the sixth AML Directive (2024/1640), the AMLA Regulation (2024/1620), and the funds-transfer Regulation (2023/1113). Critically, this commitment creates no EU market access or passporting right; it is a floor obligation without a corresponding single-market benefit, and European Parliament consent remains pending with an indicative plenary vote of 14 December 2026.

Risk ownership and CDD liability under POCA sections 9B, 10, 13, 15, 20 through 20B, 23 and 26 rests squarely with the Gibraltar legal entity providing the account; reliance on a third party for CDD measures does not discharge that liability, which remains with the relying Gibraltar firm under section 23. Where the entity in question is a Gibraltar branch of a UK company, the risk-owning legal person for UK Money Laundering Regulations purposes shifts to the UK parent under regulation 20, a distinction that matters for groups structuring cross-border compliance functions.

Cross-Monitor Connections

The Funds (Transfer) Regulations 2026 sit at a natural junction between this monitors AML/CTF reading and the digital-asset and payments architecture that World Payments Monitor and crypto-focused trackers follow separately: a single instrument now governs both fiat payment-service-provider transfers and virtual-asset-service-provider transfers under one travel-rule standard, with the same five-year retention and restrictive-measures-policy obligations applying across both rails. The UK-EU Agreements AML non-regression clause likewise connects to enabler-jurisdiction analysis elsewhere in the fleet: Gibraltar now carries an externally-imposed floor referencing the EU AML Package without the offsetting benefit of EU market access, a hybrid posture worth tracking alongside any state-capture or conflict-finance signal that touches UK-aligned offshore centres.

Outlook

The near-term question is less whether Gibraltars standing AML/CTF baseline will move and more whether the UK-EU Agreements non-regression commitment survives European Parliament consent as scheduled for 14 December 2026, and if so, how the Annex 17 reference list is monitored and updated as the underlying EU instruments themselves evolve. The Funds (Transfer) Regulations 2026 travel-rule baseline, now in force, positions Gibraltar ahead of many comparable small jurisdictions on VASP-inclusive information-accompaniment requirements; whether GFSC supervisory practice develops a track record of enforcement against that baseline, or whether the regime remains principally a statement of obligation absent observed enforcement activity, is itself an analytically significant question this monitor will continue to track.

4 Oct 2026 · fim-2026-10-04 Expert reviewed

Lead Signal

Gibraltar has moved its Ultimate Beneficial Ownership Register to free, fully public access, alongside strengthened oversight and increased enforcement activity, a step the Government of Gibraltar itself has framed explicitly as safeguarding the jurisdiction's international reputation in preparation for a forthcoming MONEYVAL assessment. This is a structural transparency upgrade rather than an incident-driven response, and it arrives alongside two supporting legislative amendments: the Register of Ultimate Beneficial Owners, Nominators and Appointors (Amendment) Regulations 2026, made 14 July 2026, and Proceeds of Crime (Amendment) Regulations 2026, made 3 July 2026. The Gibraltar Financial Services Commission intends to carry out supervisory inspections relating to the UBO Regulations across 2026, indicating that the transparency upgrade is being paired with active supervisory follow-through rather than left as a standing rule with no enforcement behind it.

Other Developments

Gibraltar's AML/CTF architecture remains autonomous from the EU framework. Gibraltar's own Parliament legislates its anti-money-laundering regime through the Proceeds of Crime Act 2015, supervised by the Gibraltar Financial Services Commission and assessed by MONEYVAL rather than through the EU AML Package instruments. Gibraltar is not bound by the AML Regulation, the sixth AML Directive, or the AMLA Regulation, reflecting its status outside the EU/EEA post-Brexit. The 2024 FATF follow-up report states that no further reporting is required under MONEYVAL's current round of evaluations, a standing position that has not changed this cycle.

Cross-Monitor Connections

The UBO transparency upgrade sits adjacent to the crypto monitor's coverage of Gibraltar's DLT and Virtual Asset Arrangement framework, where beneficial-ownership visibility questions can also arise for corporate structures engaged in virtual-asset activity; that domain-specific detail is addressed under the crypto monitor rather than analysed further here. The reputational framing around a forthcoming MONEYVAL assessment is also a signal worth tracking for any correspondent-banking or enabler-jurisdiction dynamics that a stronger transparency posture may affect, though no such connection has surfaced as a specific finding this cycle.

Outlook

The scheduling of Gibraltar's next MONEYVAL mutual evaluation round is referenced in the Government of Gibraltar's own communications as the driver behind the recent UBO transparency work, but has not yet been publicly confirmed with a specific date; general industry practice of intensifying beneficial-ownership transparency and enforcement ahead of an evaluation cycle is consistent with what has been observed here. Whether a claimed removal of Gibraltar from an EU high-risk list, currently resting on a single secondary law-firm summary rather than direct confirmation via the EU Official Journal, is corroborated by a primary source is a separate item to watch. The GFSC's stated 2026 supervisory inspection programme relating to the UBO Regulations is the clearest near-term indicator of how seriously the transparency upgrade is being enforced in practice.

5 Sep 2026 · fim-2026-08-21 Expert reviewed

Lead Signal

Gibraltar's ultimate beneficial ownership register has undergone a bifurcation that is likely to draw sustained scrutiny. Following an eighteen-month programme that culminated in free, open access to the register (announced February 2026), two legal notices, LN 147/2026 and LN 220/2026, restored open access for corporate and legal-entity beneficial ownership while carving express trusts out of public inspection entirely. Gibraltar remains one of three UK Overseas Territories with a fully public beneficial-ownership register for corporate entities, but the express-trust carve-out creates a residual channel through which beneficial ownership held via Gibraltar trust structures can now sit outside public view even as corporate transparency is reaffirmed. Read as architecture rather than incident, the pattern is consistent with a jurisdiction calibrating a genuine transparency commitment against a preserved secrecy channel for trust structures, a balance that regulators elsewhere have found difficult to sustain under increasing international scrutiny. This is assessed, not confirmed; sourcing rests on secondary commentary rather than the underlying legal text of LN 147 and LN 220, but the direction of travel, transparency for companies, opacity preserved for trusts, is a structural signal likely to attract scrutiny at Gibraltar's next MONEYVAL mutual evaluation, scheduled for 2027.

Other Developments

Sanctions screening obligations confirmed in force. Gibraltar's Sanctions Act 2019, as amended by the Sanctions (Amendment) Act 2024 (enacted 23 December 2024), requires relevant financial businesses to conduct sanctions screening as part of customer due diligence, maintain supporting policies and controls, and report matches or freeze assets, with non-compliance constituting a criminal offence. This sits atop Gibraltar's existing automatic-recognition mechanism for UN, EU, and UK sanctions regimes. Gibraltar's sanctions architecture continues to rely on automatic recognition of UN, EU, and UK designations under section 6(2)(b) of the Sanctions Act 2019, with no material divergence between those regimes identified this cycle. No designation deltas or enforcement actions were identified this cycle; the finding is the confirmed existence of the screening architecture rather than a new enforcement event.

Virtual Asset Arrangements brought within the financial-services perimeter. The Financial Services (Regulated Activities) (Amendment) Regulations 2025 extended the Financial Services Act 2019 to bring Virtual Asset Arrangements, meaning fiat-to-crypto and crypto-to-crypto exchange services, within Part 16 Schedule 2 of the Act from 27 October 2025, requiring explicit permission under Part 7 of the Act alongside legacy DLT Provider status. This is assessed to close a perimeter gap for exchange-type activity, but the finding rests on a single Tier 4 vendor source; it is capped at low confidence pending confirmation from a primary Gibraltar Financial Services Commission publication.

UK-EU Gibraltar Treaty carries AML commitments without single-market extension. The 2026 UK-EU Gibraltar Treaty, provisionally applied from 15 July 2026, carries AML/CTF and tax-transparency commitments but does not extend EU financial-services single-market instruments to Gibraltar. Gibraltar's AML/CTF regime therefore continues to operate as an autonomous framework rather than one bound by the EU AML Package.

AML/CTF regime of record. Gibraltar's AML/CTF framework rests on the Proceeds of Crime Act 2015, with the Gibraltar Financial Services Commission as supervisor and the Gibraltar Financial Intelligence Unit as the designated financial intelligence unit; the customer due diligence threshold is EUR 15,000, and MONEYVAL is the assessment body. Gibraltar was removed from the FATF grey list in February 2024 and remains off that list, with the next MONEYVAL mutual evaluation scheduled for 2027. As an autonomous jurisdiction, Gibraltar's AML/CTF regime is not derived from any supranational EU legislative competence post-Brexit.

Cross-Monitor Connections

The UBO register bifurcation is directly relevant to any World Payments Monitor assessment of Gibraltar's corporate on-boarding environment, since payment institutions and e-money issuers conducting customer due diligence will need to account for the trust carve-out as a residual opacity channel. The Virtual Asset Arrangements extension similarly intersects with the crypto monitor's licensing coverage of Gibraltar's DLT Provider regime, since the new Part 7 permission requirement sits alongside, rather than replacing, the legacy DLT framework that the crypto monitor tracks directly. Gibraltar's continued autonomy from the EU AML Package, confirmed again this cycle via the UK-EU Gibraltar Treaty's narrow AML-only scope, is a standing structural fact relevant to any advennt assessment of Gibraltar's gambling-sector AML exposure, since gambling operators in Gibraltar sit within the same Proceeds of Crime Act 2015 regime described above rather than any EU-derived instrument. Enablement is itself a signal worth surfacing here: no enforcement action or supervisory sanction tied to the register bifurcation was identified this cycle, and the absence of visible enforcement around a structural transparency rollback of this kind is analytically significant in its own right, not merely a gap in the evidence base.

Outlook

The next material test for Gibraltar's AML/CTF architecture is the MONEYVAL mutual evaluation scheduled for 2027, which will assess the jurisdiction's supervisory effectiveness against the revised FATF Standards. The UBO trust carve-out is likely to be a specific focus of that evaluation given the residual opacity channel it preserves. On the crypto side, primary GFSC confirmation of the Virtual Asset Arrangements permission regime, and the precise legal text of LN 147 and LN 220, are the two gaps most likely to sharpen or revise this cycle's findings once closed. Coverage of D3 (Enabler Jurisdictions) and D4 (Conflict Finance) remained quiet for Gibraltar this cycle; both domains are structurally low-signal for this jurisdiction at present, consistent with Gibraltar's registered-agent-mediated corporate services model rather than indicating any change in exposure.

10 Aug 2026 · fim-2026-08-08 Expert reviewed

Lead Signal

Gibraltar has moved its Ultimate Beneficial Ownership register to free, unhindered public search this cycle, government and supervisory sources confirm, explicitly pairing the change with enhanced oversight and increased enforcement capacity. The government's own announcement commits to providing "free and unhindered access to the UBO Register," and this is corroborated independently by a Gibraltar Financial Services Commission supervisory notice, giving the finding a high-confidence, dual-Tier-1-source basis. For Gibraltar-licensed banks, payment institutions, and cross-sector obliged entities, the GRA's and GFSC's supervisory framework has not itself changed, but the underlying transparency infrastructure their due-diligence teams rely on has become materially easier to corroborate independently. The timing is analytically significant: Gibraltar has been off the FATF grey list since February 2024, and this cycle's UBO enhancement is explicitly framed as preparation for a forthcoming MONEYVAL assessment rather than a reactive response to any adverse finding. Read architecturally rather than as a single event, the move signals proactive effectiveness-focused compliance ahead of assessment, the kind of anticipatory posture that FATF-style mutual evaluations reward, rather than a minimum-compliance reflex adopted only after a critical report.

Other Developments

Autonomous sanctions architecture confirmed. Gibraltar, together with Bermuda, sits outside the Russia (Sanctions)(Overseas Territories) Order 2020 that extended to the UK's other Overseas Territories, and instead operates its own Sanctions Act 2019 regime. The Gibraltar Financial Intelligence Unit confirms, in its own words, that "currently, there are no designations in place" domestically, with UK- and OFSI-notified measures implemented through Gibraltar's own THEMIS system rather than automatic Order-based extension. This is a structural finding corroborated by two independent Tier-1 sources, and it creates a genuine, if narrow, implementation-timing distinction between Gibraltar and Order-bound Overseas Territories — an autonomous but UK-aligned posture rather than a directly derivative one, with a latent evasion-window risk that has not, on current evidence, been exploited.

Tokenised fund-share legislation published. The Government of Gibraltar has published the Protected Cell Companies (Amendment) Bill 2026, which would require prior Gibraltar Financial Services Commission approval before any experienced-investor-fund cell can issue tokenised shares. This is an incremental but concrete widening of Gibraltar's distributed-ledger-technology regulatory perimeter into fund infrastructure, layering the existing Proceeds of Crime Act 2015 anti-money-laundering perimeter onto a new tokenisation vector. Independent corroboration of the downstream AML implications specifically remains limited, and the finding is assessed rather than high-confidence pending further primary detail on how GFSC approval conditions will operationalise AML controls for tokenised-share issuance.

Cross-Monitor Connections

The Protected Cell Companies (Amendment) Bill 2026 is a shared reference point across monitors this cycle: it is the same instrument the crypto monitor reads as a new tokenised-fund-share licensing pathway, and the same instrument world-payments reads as a product-innovation development for Gibraltar's funds infrastructure. From a financial-integrity perspective, the relevant lens is the AML perimeter that attaches to any GFSC-approved issuance, since the Bill layers new activity onto the existing Proceeds of Crime Act 2015 supervisory structure rather than creating a parallel compliance regime. Separately, Gibraltar's gambling-sector legislative replacement, tracked in detail by the advennt monitor, is not itself an AML/CTF development, but the new Gambling Operator Support Services licensing category and widened business-to-business scope for overseas suppliers are the kind of structural change in a historically higher-risk sector that a future enabler-jurisdiction or professional-facilitator assessment may need to revisit.

Outlook

The forthcoming MONEYVAL assessment of Gibraltar, expected in 2027 on current general industry expectation, is the organising event for the coming cycles: continued enhancement of UBO-register effectiveness and enforcement pace should be read as preparation against that assessment rather than as isolated developments. On sanctions, the autonomous Sanctions Act 2019 regime combined with zero current domestic designations is a stable structural position, though implementation-timing lag against Order-bound Overseas Territories remains a latent watch item. On the crypto/digital-asset side, the Protected Cell Companies (Amendment) Bill 2026 remains a proposal; its passage and the specificity of the AML conditions GFSC attaches to tokenised-share approval will determine whether this becomes a durable new supervisory vector or a narrow niche product.

Domain intelligence (D1–D8)

D1 Sanctions

no_changestanding position (as at 8 Aug 2026)

Sanctions

Gibraltar's sanctions-enforcement architecture gained a new civil penalty track this cycle, sitting alongside the existing criminal offence route under the Sanctions Act 2019. The Sanctions Civil Enforcement Regulations 2026 and the Sanctions Civil Enforcement Authority (Designation) Order 2026, both made 9 September 2026 under the enabling Sanctions (Amendment) Act 2026 of 9 July 2026, give a designated sanctions civil enforcement authority power to impose a monetary penalty where it is satisfied, on the balance of probabilities, that a person has breached a sanctions prohibition. The penalty is recoverable as a civil debt. This is a lower evidentiary bar than the criminal route, which under the existing Sanctions Act 2019 framework can carry up to ten years' imprisonment on indictment but requires proof beyond reasonable doubt. The civil track does not replace the criminal route; it runs alongside it, giving the enforcement authority a choice of mechanism depending on the strength and nature of the evidence available in a given case.

Continue reading

Gibraltar's underlying sanctions designations continue to be drawn from UK and EU-derived regimes, applied alongside United Nations Security Council measures, a position that has not changed this cycle. What has changed is the enforcement toolkit available once a breach of one of those designations is suspected. For firms with sanctions-screening obligations touching Gibraltar, the practical effect of the new civil track is that enforcement exposure no longer depends solely on securing a criminal conviction; a civil monetary penalty is now available on a materially lower standard of proof.

Outlook

The substantive content of the Sanctions Civil Enforcement Regulations 2026, specifically the penalty quanta and the procedure by which a civil penalty is assessed and imposed, is assessed at Probable confidence pending consolidated GFSC/GFIU civil-penalty tariff guidance under the Sanctions Act 2019. That detail will determine how significant the new civil track proves in practice once the enforcement authority begins using it, and is the primary open item to watch going into the next quarter.

Cumulative analysis

Sanctions Architecture and Evasion — Cumulative Analysis

The sanctions-architecture profile of Gibraltar, as established through this baseline cycle, rests on a structural divergence from the rest of the UK Overseas Territories estate. Gibraltar implements United Nations, European Union and United Kingdom sanctions under its own domestic Sanctions Act 2019, rather than under the Russia (Sanctions) (Overseas Territories) Order 2020 applied elsewhere; only Gibraltar and Bermuda sit outside that standard mechanism. This is the foundational architectural fact against which every subsequent Gibraltar sanctions development in this coverage should be read: because Gibraltar administers its own designations, licences and enforcement outcomes independently, its sanctions posture cannot be inferred from developments elsewhere in the Overseas Territories estate, and each cycle Gibraltar-specific sanctions findings must be assessed on their own evidentiary basis.

That bespoke administrative track sits against an improving compliance-status backdrop established at the same baseline point. Gibraltar was removed from the FATF Jurisdictions under Increased Monitoring list on 23 February 2024, alongside Barbados, Uganda and the United Arab Emirates, closing a multi-year technical-compliance remediation track; the architecturally significant fact is the closure of that remediation track itself, evidenced by the parallel re-rating by MONEYVAL of Recommendation 36 from Partially Compliant to Largely Compliant at its 67th Plenary on 22 May 2024, rather than the delisting headline in isolation. The composite jurisdiction risk trajectory of Gibraltar, assessed across this baseline, is decreasing overall, driven principally by these delisting actions.

The clearest active sanctions-architecture development recorded at this baseline point is the Maritime Mutual Gibraltar wind-down. A Gibraltar-domiciled marine mutual insurer, Maritime Mutual Association Limited, together with a New Zealand-linked subsidiary, required an Office of Financial Sanctions Implementation wind-down General Licence, issued 24 February 2026, to unwind existing insurance and reinsurance policies written for vessel owners exposed to Russia sanctions; Russia-linked vessel owners had sought to retain hull, cargo and liability cover through Gibraltar-domiciled mutual insurers ahead of that designation and licence. This scheme illustrates, at the level most relevant to ongoing tracking, how offshore-adjacent marine insurance underwriting capacity domiciled in a British Overseas Territory intersects with dark-fleet oil-shipping sanctions-evasion typologies, and how continued insurability functions as an active enforcement lever against Russian oil exports carried above the price cap. An open completeness question attaches to this scheme going forward: it remains unclear whether the wind-down disrupted the underlying shadow-fleet insurance architecture or merely displaced coverage to alternative underwriters outside the reach of the licence, and this question should be treated as the single most important item for verification in subsequent cycles of this tracker.

The counter-proliferation-financing dimension of the domain is, at this baseline point, defined by absence rather than incident: Gibraltar has never executed a proliferation-financing targeted-financial-sanctions asset freeze, and private-sector awareness of proliferation-financing obligations, particularly among designated non-financial businesses and professions, is assessed as low relative to terrorist-financing-obligations awareness. Correcting for the volume bias that typically under-weights counter-proliferation-financing findings relative to anti-money-laundering ones, and given the structural role of Gibraltar as a transit and financial-services node adjacent to global trade and port flows, this absence is recorded here as a standing structural exposure to be tracked across future cycles rather than a closed question.

This baseline jurisdiction-risk assessment records the enforcement-versus-enablement balance for Gibraltar as mixed and the risk classification as structural rather than episodic, reflecting a British Overseas Territory whose central compliance metrics are improving while sector-specific exposures, insurance underwriting adjacent to sanctioned shipping and the proliferation-financing enforcement gap, diverge in direction. Future cycles of this tracker should preserve that mixed characterisation rather than allowing the positive grey-list and high-risk-third-country delisting narrative to subsume the sector-level and enforcement-gap findings that sit alongside it.

Outlook

The next mutual evaluation of Gibraltar, expected in the 2027 to 2029 window, will apply the tougher, effectiveness-focused fifth-round FATF methodology, and is the clearest dated forcing event against which the cumulative trajectory of this domain should be reassessed. Whether the Maritime Mutual wind-down proves to have disrupted or merely displaced the underlying shadow-fleet insurance architecture, and whether the proliferation-financing enforcement gap persists unaddressed, are the two structural threads this tracker will carry forward into subsequent cycles as the clearest tests of whether the improving compliance-status trajectory of Gibraltar is matched by improving enforcement substance.

domain_sub_briefs · D1 · Cumulative analysis
Standing baseline position

Sanctions Civil Enforcement Authority designated under LN.2026/332 and LN.2026/333

Gibraltar's sanctions enforcement architecture now includes a civil monetary penalty track (balance of probabilities), recoverable as a civil debt, alongside the pre-existing criminal offence route (up to 10 years' imprisonment on indictment), established via the Sanctions (Amendment) Act 2026 and implementing Sanctions Civil Enforcement Regulations 2026 and Sanctions Civil Enforcement Authority (Designation) Order 2026 (both 9 September 2026).

Periodic updates (4)

Periodic updates below are dated within the scope of the expert review (as at 27 Oct 2026).

25 Oct 2026 · fim-2026-10-25 Expert reviewed

Sanctions

Gibraltar's sanctions-enforcement architecture gained a new civil penalty track, sitting alongside the existing criminal offence route under the Sanctions Act 2019. The Sanctions Civil Enforcement Regulations 2026 and the Sanctions Civil Enforcement Authority (Designation) Order 2026, both made 9 September 2026 under the enabling Sanctions (Amendment) Act 2026 of 9 July 2026, give a designated sanctions civil enforcement authority power to impose a monetary penalty where it is satisfied, on the balance of probabilities, that a person has breached a sanctions prohibition. The penalty is recoverable as a civil debt. This is a lower evidentiary bar than the criminal route, which under the existing Sanctions Act 2019 framework can carry up to ten years' imprisonment on indictment but requires proof beyond reasonable doubt. The civil track does not replace the criminal route; it runs alongside it, giving the enforcement authority a choice of mechanism depending on the strength and nature of the evidence available in a given case.

Gibraltar's underlying sanctions designations continue to be drawn from UK and EU-derived regimes, applied alongside United Nations Security Council measures, a position that has not changed. What has changed is the enforcement toolkit available once a breach of one of those designations is suspected. For firms with sanctions-screening obligations touching Gibraltar, the practical effect of the new civil track is that enforcement exposure no longer depends solely on securing a criminal conviction; a civil monetary penalty is now available on a materially lower standard of proof.

Outlook

The substantive content of the Sanctions Civil Enforcement Regulations 2026, specifically the penalty quanta and the procedure by which a civil penalty is assessed and imposed, is assessed at Probable confidence pending consolidated GFSC/GFIU civil-penalty tariff guidance under the Sanctions Act 2019. That detail will determine how significant the new civil track proves in practice once the enforcement authority begins using it, and is the primary open item to watch going into the next quarter.

18 Oct 2026 · fim-2026-10-18 Expert reviewed

Sanctions

Gibraltar's sanctions architecture now carries a dedicated civil-enforcement track. The Sanctions (Amendment) Act 2026, together with the Sanctions Civil Enforcement Regulations 2026 designated under LN.2026/332 and LN.2026/333, establishes a Sanctions Civil Enforcement Authority empowered under the Sanctions Act 2019 to impose a monetary penalty on a person. This is a structural addition to Gibraltar's sanctions implementation infrastructure, distinct from criminal enforcement routes, and it runs in parallel to, but is legally separate from, the UK's own single Sanctions List consolidation effort. The two jurisdictions' sanctions regimes continue to diverge procedurally even where their substantive designations may overlap.

From an architecture-over-incident perspective, the significance of this development lies less in any particular enforcement action, none has yet been recorded under the new authority, and more in the fact that Gibraltar has built out a domestic civil-penalty capability independent of the UK's consolidated approach. This reflects Gibraltar's broader pattern of maintaining autonomous financial-crime infrastructure, assessed on its own track by MONEYVAL rather than folded into either the UK's or the EU's frameworks. A civil-enforcement track, as distinct from criminal prosecution, typically lowers the evidentiary bar for a finding of breach and allows faster, more proportionate responses to sanctions non-compliance, which is itself a meaningful enablement signal for how seriously Gibraltar intends to pursue sanctions compliance going forward, even absent any recorded cases to date.

The practical question for firms operating in or through Gibraltar is how designations will flow between the UK's and Gibraltar's parallel but distinct sanctions lists, and what procedural differences the new Gibraltar-specific civil-enforcement authority introduces relative to enforcement routes firms may already be familiar with from UK sanctions practice. No primary guidance addressing those practical mechanics was located this cycle.

Outlook

The Sanctions Civil Enforcement Authority is newly designated and has not yet generated a recorded enforcement action; its first cases, when they occur, will be the clearest signal of how the civil-penalty track operates in practice relative to the UK's consolidated list approach. Divergence between the UK and Gibraltar sanctions regimes is worth monitoring as both frameworks continue to evolve independently, particularly where designations differ or timing of list updates diverges between the two jurisdictions.

5 Sep 2026 · fim-2026-08-21 Expert reviewed

Sanctions Architecture and Evasion

Gibraltar's sanctions architecture layers a general recognition mechanism with a specific compliance obligation on regulated financial businesses. The Sanctions Act 2019 automatically recognises United Nations, European Union, and United Kingdom sanctions designations, and the Sanctions (Amendment) Act 2024, enacted 23 December 2024, added a mandatory screening layer: relevant financial businesses must now conduct sanctions screening as part of customer due diligence, maintain supporting policies and controls, and report matches or freeze assets, with non-compliance a criminal offence.

No designation deltas and no enforcement actions tied to this architecture were identified this cycle. From an enablement perspective, that absence is itself worth noting: a formalised screening obligation exists on the books, but the evidence base for this cycle does not show it being tested through an actual enforcement action, meaning the operational rigour of the obligation in practice remains unverified from public sourcing. The finding this cycle is best read as confirmation that the architecture is now formally complete rather than as evidence of active supervisory testing.

Sourcing for the screening-obligation description rests on a single Tier 3 secondary source (a law-firm country update); the underlying Sanctions (Amendment) Act 2024 text was not independently retrieved this cycle, so this finding should be treated as assessed rather than confirmed pending direct verification of the amending Act's text.

Outlook

Continued monitoring should watch for any designation delta affecting Gibraltar-linked persons or entities, and for the first enforcement action testing the 2024 screening-obligation amendment. No specific regulatory horizon item was identified for D1 this cycle; the 2027 MONEYVAL mutual evaluation is the nearest scheduled event with potential D1 relevance, given its assessment of the broader AML/CFT and sanctions-compliance architecture.

10 Aug 2026 · fim-2026-08-08 Expert reviewed

Sanctions

Gibraltar's sanctions architecture is structurally autonomous from the wider set of UK Overseas Territories, a distinction confirmed by two independent Tier-1 sources this cycle. Gibraltar, together with Bermuda, was excluded from the Russia (Sanctions)(Overseas Territories) Order 2020, the instrument that extended UK Russia-sanctions measures to the UK's other Overseas Territories; Gibraltar instead operates its own Sanctions Act 2019 regime. The Gibraltar Financial Intelligence Unit confirms, in its own words, that "currently, there are no designations in place" domestically, with UK- and OFSI-notified sanctions measures implemented through Gibraltar's own THEMIS system rather than through automatic extension of a UK Order.

This combination — autonomous statutory basis, zero current domestic designations, and a UK-aligned-but-not-derivative implementation mechanism — creates a coherent but distinctive posture. It is UK-aligned in substance, since THEMIS is understood to operationalise UK/OFSI-notified measures, but autonomous in form, since Gibraltar's own Sanctions Act 2019 rather than a UK Order is the vehicle. The analytically significant risk this structure creates is implementation-timing lag: a designation notified in London does not reach Gibraltar's domestic list through the same automatic Order-extension mechanism that applies to other Overseas Territories, and any gap between UK notification and Gibraltar's own THEMIS implementation is a potential evasion window, however narrow, that Order-bound territories do not share in the same way.

There is no evidence this cycle of any exploited gap or enforcement failure connected to this structural distinction; the finding is presented as an architecture-level observation, not an incident. Financial institutions and payment-service providers with Gibraltar exposure should nonetheless treat Gibraltar's sanctions-screening posture as requiring its own verification rather than assuming full derivative equivalence with UK Overseas Territories bound directly by the 2020 Order.

Outlook

Watch for any published timing data on THEMIS implementation lag relative to UK/OFSI notification, which would convert this cycle's structural observation into a measurable operational-risk metric. No forthcoming legislative change to the Sanctions Act 2019 architecture itself was identified this cycle.

D2 Beneficial Ownership

no_changestanding position (as at 8 Aug 2026)

Beneficial Ownership and Corporate Transparency

Gibraltar sits outside the evolving anti-money-laundering supervisory perimeter of the European Union as a matter of structural fact, so the transparency developments most directly relevant to the own regulatory exposure of this jurisdiction are domestic ones. Gibraltar operates its own Register of Ultimate Beneficial Owners, and an assessment by MONEYVAL found that trust and company service providers show a good understanding of beneficial-ownership concepts; the same evaluation found that this is not always the case for other reporting entities, including banks, particularly when complex ownership structures or trusts are involved. This is the primary beneficial-ownership signal for Gibraltar this cycle: a functioning register paired with inconsistent bank-level identification practice once ownership layering or trust structures are introduced, creating a residual opacity vector for illicit proceeds notwithstanding the existence of the register.

Continue reading

Globally, the EU AML Package sets the structural direction for beneficial-ownership and corporate-transparency supervision across the European Economic Area; in Gibraltar, that package is not the primary subject matter, because as a post-Brexit British Overseas Territory Gibraltar sits entirely outside its supervisory perimeter, with neither the AML Regulation, the sixth AML Directive, nor the AMLA Regulation extending to it directly or indirectly. The only formal linkage of Gibraltar to the EU AML architecture is the high-risk third country delegated-regulation mechanism, from which Gibraltar was delisted via a delegated regulation adopted 10 June 2025, entering legal effect 5 August 2025.

As standing structural context for readers assessing beneficial-ownership and corporate-transparency architecture generally, the EU AML Package itself comprises three distinct instruments that recur across the European coverage of this Monitor: the AML Regulation, or AMLR (Regulation (EU) 2024/1624), which applies directly across Member States without national transposition; the sixth AML Directive, or 6AMLD, which each Member State transposes individually into national law; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority itself. The AMLA Regulation creates a direct-and-indirect supervision perimeter under which the Authority takes direct supervisory responsibility for a defined set of higher-risk cross-border obliged entities while continuing to coordinate indirectly with national supervisors for the remainder, shifting the European supervisory model from a purely national architecture toward a hybrid EU-level regime. This is durable structural backdrop against which any EU-side beneficial-ownership development is read; it does not itself apply to Gibraltar, which sits outside the perimeter altogether, and it should be read here as context for the broader European direction of travel rather than as a Gibraltar-specific development.

Returning to the own exposure of Gibraltar: the inconsistent bank-level beneficial-ownership identification practice for trusts and complex ownership structures is the more analytically significant gap than the absence of EU-package application, precisely because it sits inside a functioning domestic transparency architecture rather than outside a foreign one. A register that exists but is inconsistently populated or verified at the point of onboarding by non-TCSP reporting entities carries a different risk profile than the absence of any register at all, and it is this distinction, rather than the jurisdictional-perimeter question, that should drive ongoing monitoring of the beneficial-ownership architecture of Gibraltar.

Outlook

The beneficial-ownership architecture of Gibraltar is not currently subject to any dated horizon item forcing near-term change, and its trajectory is assessed as stable. The most likely forcing event remains the next mutual evaluation of Gibraltar, expected in the 2027 to 2029 window, which will test beneficial-ownership identification practice under the more rigorous, effectiveness-focused fifth-round FATF methodology rather than the technical-compliance standard under which the current Register of Ultimate Beneficial Owners was assessed favourably. Whether banks and other non-TCSP reporting entities close the identification gap for trusts and complex structures before that assessment window opens will be the clearest test of whether the transparency architecture of Gibraltar matches its compliance-status profile.

Cumulative analysis

Beneficial Ownership and Corporate Transparency — Cumulative Analysis

The beneficial-ownership and corporate-transparency baseline of Gibraltar, established through this cycle, centres on a structural contrast between a functioning domestic register and inconsistent identification practice at the point where that register is used. Gibraltar operates its own Register of Ultimate Beneficial Owners, and an assessment by MONEYVAL found that trust and company service providers show a good understanding of beneficial-ownership concepts; the same evaluation found that this is not always the case for other reporting entities, including banks, particularly when complex ownership structures or trusts are involved. This is the primary domestic beneficial-ownership finding at this baseline point, and it is the finding most directly relevant to the own regulatory perimeter and exposure of Gibraltar, because it describes a gap inside a functioning domestic architecture rather than an absence of architecture altogether.

The relationship of Gibraltar to the beneficial-ownership and corporate-transparency architecture of the European Union is, as a structural matter, one of exclusion rather than partial alignment. As a post-Brexit British Overseas Territory, Gibraltar sits entirely outside the EU AML Package, with neither the AML Regulation, the sixth AML Directive, nor the AMLA Regulation extending to it directly or indirectly. The only formal linkage of Gibraltar to that European architecture is the high-risk third country delegated-regulation mechanism, from which Gibraltar was delisted via a delegated regulation adopted by the European Commission on 10 June 2025, entering legal effect 5 August 2025. This baseline records that Gibraltar voluntarily tracks EU risk-assessment methodology in its own national risk assessments without formal obligation to do so, a policy choice rather than a legal requirement, and this voluntary alignment should be distinguished clearly, in every future cycle of this tracker, from formal supervisory perimeter membership, which Gibraltar does not have.

As standing structural context carried forward across the European coverage of this Monitor, and read here as backdrop rather than as a Gibraltar-specific development, the EU AML Package itself comprises three distinct instruments: the AML Regulation, or AMLR (Regulation (EU) 2024/1624), directly applicable across Member States without national transposition; the sixth AML Directive, or 6AMLD, transposed individually by each Member State; and the AMLA Regulation (Regulation (EU) 2024/1620), establishing the Anti-Money Laundering Authority. The direct-and-indirect supervision perimeter of the AMLA Regulation gives the Authority direct supervisory responsibility over a defined set of higher-risk cross-border obliged entities while continuing indirect coordination with national supervisors for the remainder, moving the European supervisory model from a purely national architecture toward a hybrid EU-level regime. This durable structural fact frames every EU-side beneficial-ownership development this Monitor tracks; because Gibraltar sits outside its perimeter entirely, it functions here purely as comparative backdrop against which the own domestic architecture of Gibraltar, and its own gaps, should be read and distinguished.

At this baseline point, the trajectory of the domain is assessed as stable, and the identification gap for trusts and complex ownership structures at non-TCSP reporting entities, principally banks, is the item this tracker will monitor most closely across subsequent cycles, because it represents the clearest lever by which the beneficial-ownership architecture of Gibraltar could either close or widen independent of any EU-perimeter question.

Outlook

The beneficial-ownership architecture of Gibraltar carries no dated near-term horizon item forcing change; the most likely forcing event remains the next mutual evaluation of the jurisdiction, expected 2027 to 2029, under the more rigorous effectiveness-focused fifth-round FATF methodology, which will test beneficial-ownership identification practice directly rather than relying on the technical-compliance standard under which the current register was assessed favourably. This tracker will carry forward, as its central open question across subsequent cycles, whether banks and other non-TCSP reporting entities close the identification gap for trusts and complex structures ahead of that assessment window.

domain_sub_briefs · D2 · Cumulative analysis
Standing baseline position

Gibraltar's public UBO register provides open access for corporate/legal entities; express trusts are carved out of public inspection per LN 147/2026 and LN 220/2026.

Periodic updates (4)

Periodic updates below are dated within the scope of the expert review (as at 27 Oct 2026).

6 Oct 2026 · fim-2026-10-06 Expert reviewed

Beneficial Ownership and Corporate Transparency

Gibraltar sits outside the EU AML Package direct perimeter, but a durable structural fact of that Package remains relevant backdrop for reading any beneficial-ownership and corporate-transparency signal touching UK-aligned offshore centres such as Gibraltar. Globally, the EU AML Package now comprises three distinct instruments: the AML Regulation (AMLR, Regulation (EU) 2024/1624), which is directly applicable across EU Member States without transposition; the sixth AML Directive (6AMLD, Directive (EU) 2024/1640), which each Member State transposes into its own domestic law; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and shifts supervision of higher-risk cross-border obliged entities from purely national competent authorities toward a hybrid EU-level regime combining direct AMLA supervision of designated entities with indirect AMLA oversight of national supervisors generally. Gibraltar, not being an EEA member, has no direct transposition obligation under 6AMLD and no entities subject to direct AMLA supervision; its connection to this architecture runs instead through the UK-EU Agreement in respect of Gibraltar, under which the UK commits, in respect of Gibraltar, not to weaken AML/CFT measures below the levels set by the Annex 17 list of EU instruments, which names the AMLR, 6AMLD, the AMLA Regulation and the funds-transfer Regulation 2023/1113 specifically. This is a floor obligation, not a transposition duty, and it carries no corresponding EU market access or passporting benefit; European Parliament consent to the Agreement remains pending, with an indicative plenary vote of 14 December 2026.

Against that backdrop, the directly relevant beneficial-ownership and customer-transparency signal for Gibraltar this cycle concerns its politically-exposed-person regime, which operates as a proxy for broader beneficial-ownership risk sensitivity in practice. Under POCA sections 20A, 20B and 20(2), the PEP test turns on whether a natural person is or has been entrusted with a prominent public function, explicitly including heads of state, heads of government, ministers, and deputy or assistant ministers, while expressly excluding middle-ranking or more junior officials; there is no foreign-versus-domestic distinction, so EEA residence confers no concession equivalent to the UK domestic-PEP treatment. Once a PEP ceases to hold that prominent public function, a relevant financial business must, for at least twelve months, continue to take into account the continuing risk the person poses and apply appropriate and risk-sensitive measures until satisfied no further PEP-specific risk remains. Section 20(2) extends this entire regime, including the twelve-month continuing-obligation period, to family members and persons known to be close associates of PEPs as though those persons were themselves PEPs. This is a materially stricter position than the UK Money Laundering Regulations, which drop the family/associate extension once the PEP leaves office; a group applying UK PEP-exit logic mechanically to its Gibraltar-regulated entities would under-apply the continuing obligation precisely where Gibraltar law demands more scrutiny, not less.

Outlook

The PEP continuing-obligations divergence from UK practice is likely to remain a live compliance-trap vector for cross-border groups rather than a one-off finding, given how naturally UK and Gibraltar AML policies get drafted from shared templates. On the broader architecture, the open question is whether the UK-EU Agreements Annex 17 non-regression list is read as a static snapshot of the AML Package as it stood at provisional application, or as a dynamic reference that tracks future amendments to the AMLR, 6AMLD and AMLA Regulation as the EU-level supervisory architecture matures; that question will likely sharpen once European Parliament consent is resolved around the indicative December 2026 timeline.

4 Oct 2026 · fim-2026-10-04 Expert reviewed

Beneficial Ownership and Corporate Transparency

Gibraltar has moved its Ultimate Beneficial Ownership Register to free, fully public access, with strengthened oversight and increased enforcement activity, in a step the Government of Gibraltar has explicitly framed as safeguarding the jurisdiction's international reputation ahead of a forthcoming MONEYVAL assessment. This is a structural transparency upgrade, not an incident-driven response, and it is supported by two legislative amendments made within days of each other in July 2026: the Register of Ultimate Beneficial Owners, Nominators and Appointors (Amendment) Regulations 2026, made 14 July 2026, and the Proceeds of Crime (Amendment) Regulations 2026, made 3 July 2026. Both instruments sit within the Proceeds of Crime Act 2015 framework that underpins Gibraltar's beneficial-ownership regime. The Gibraltar Financial Services Commission has stated its intention to carry out supervisory inspections relating to the UBO Regulations across 2026, which is a material signal that this transparency step is paired with active supervisory follow-through rather than standing as an unenforced rule change.

Standing behind this jurisdiction-specific development is the broader architecture of the EU AML Package, which comprises three distinct instruments: the AML Regulation (AMLR, Regulation (EU) 2024/1624), directly applicable in EU Member States; the sixth AML Directive (6AMLD), transposed individually by each Member State; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and is shifting supervision of certain obliged entities from purely national authorities toward a hybrid EU-level regime. Gibraltar, however, sits outside this perimeter entirely: as an autonomous jurisdiction outside the EU/EEA post-Brexit, it is not bound by the AMLR, 6AMLD, or the AMLA Regulation. Gibraltar's own Parliament legislates its AML regime directly through the Proceeds of Crime Act 2015, supervised domestically by the GFSC and assessed externally by MONEYVAL rather than by any EU instrument or the incoming AMLA. The EU AML Package architecture is therefore durable global context for reading Gibraltar's transparency signal, but it is not the primary regulatory driver of the jurisdiction's own UBO reform; the primary driver, on Gibraltar's own account, is the forthcoming MONEYVAL evaluation.

Outlook

The GFSC's stated 2026 supervisory inspection programme relating to the UBO Regulations is the clearest near-term indicator of enforcement follow-through to watch. The scheduling of Gibraltar's next MONEYVAL mutual evaluation round remains referenced in government communications but not yet publicly confirmed with a specific date; its eventual confirmation would clarify the timeline against which this transparency upgrade is being measured.

5 Sep 2026 · fim-2026-08-21 Expert reviewed

Beneficial Ownership and Corporate Transparency

Gibraltar's beneficial-ownership transparency regime has undergone the most significant bifurcation identified this cycle. Following an eighteen-month programme culminating in free, open access to the beneficial-ownership register (announced February 2026), two legal notices, LN 147/2026 and LN 220/2026, restored open access to the register for corporate and legal-entity beneficial ownership while carving express trusts out of public inspection entirely. Gibraltar remains one of three UK Overseas Territories that maintains a fully public beneficial-ownership register for corporate entities, a status that continues to distinguish it from many comparable small international finance centres. The express-trust carve-out, however, creates a residual channel through which beneficial ownership held via Gibraltar trust structures now sits outside public inspection even as corporate transparency is reaffirmed. This is a material bifurcation of the transparency regime: the jurisdiction is simultaneously deepening transparency for one class of legal vehicle while withdrawing it for another.

The rapid enactment-then-partial-reversal pattern, open register announced, then narrowed by LN 147 and LN 220, signals a jurisdiction actively calibrating its transparency commitments against a preserved secrecy channel for trusts, a bifurcation that is likely to attract scrutiny at Gibraltar's next MONEYVAL mutual evaluation, scheduled for 2027. Sourcing for the precise legal text of LN 147 and LN 220 was not independently retrieved this cycle; the finding rests on Tier 3 secondary commentary corroborated by a Tier 1 Gibraltar Government press release confirming the underlying register programme. The specific carve-out mechanics should therefore be treated as assessed pending direct retrieval of the legal notices themselves.

Standing architecturally, the durable backdrop against which any Gibraltar beneficial-ownership finding should be read is the European Union's AML Package, even though Gibraltar itself sits outside its direct perimeter as an autonomous, non-EU jurisdiction post-Brexit. That package comprises three distinct instruments: the AML Regulation, or AMLR (Regulation (EU) 2024/1624), which is directly applicable across EU member states without domestic transposition; the sixth AML Directive, or 6AMLD, which each EU member state transposes individually into national law; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and progressively shifts supervision of higher-risk obliged entities from purely national authorities toward a hybrid EU-level regime combining AMLA direct supervision with continued national supervision for the remainder of the sector. Gibraltar is not bound by the AMLR, 6AMLD, or the AMLA Regulation; the 2026 UK-EU Gibraltar Treaty, provisionally applied from 15 July 2026, carries AML/CTF and tax-transparency commitments but explicitly does not extend EU financial-services single-market instruments, including the AML Package, to Gibraltar. This structural autonomy means Gibraltar's own beneficial-ownership calibration proceeds independently of the EU's parallel move toward centralised AML supervision, even as both are likely to be read by evaluators as part of the same global transparency conversation.

Outlook

The 2027 MONEYVAL mutual evaluation is the clearest forthcoming test of Gibraltar's beneficial-ownership bifurcation, and the trust carve-out specifically is likely to draw evaluator attention given the residual opacity channel it preserves. Closing the sourcing gap around the precise text of LN 147 and LN 220 would allow a more confident assessment of exactly which trust structures and disclosures are affected. No indication of further beneficial-ownership legislative activity beyond this bifurcation was identified this cycle.

10 Aug 2026 · fim-2026-08-08 Expert reviewed

Beneficial Ownership

Gibraltar's own beneficial-ownership perimeter is the primary story for this jurisdiction this cycle, not the European Union's parallel architecture. HM Government of Gibraltar has moved the Ultimate Beneficial Ownership register to free, unhindered public search, a change corroborated independently by a Gibraltar Financial Services Commission supervisory notice describing enhanced oversight and increased enforcement capacity attached to the register. The government's own language commits to providing "free and unhindered access to the UBO Register," a materially different access posture from the restricted or legitimate-interest-gated access models some comparable jurisdictions retain. This is a high-confidence, dual-Tier-1-sourced finding, and it sits inside a broader structural context: Gibraltar has been off the FATF grey list since February 2024, and the UBO enhancement is explicitly framed, in the government's own materials, as preparation for a forthcoming MONEYVAL assessment rather than as a response to any adverse finding or external pressure. That sequencing — voluntary enhancement ahead of assessment — is itself an analytically significant signal, distinct from the more common pattern of jurisdictions upgrading transparency infrastructure only after a grey-listing or a critical mutual-evaluation report.

Globally, the EU AML Package sets the structural direction for beneficial-ownership and corporate-transparency supervision across the continent: the AML Regulation (Reg (EU) 2024/1624, the AMLR) applies directly across Member States without national transposition, the sixth AML Directive (6AMLD) is transposed individually by each Member State, and the AMLA Regulation (Reg (EU) 2024/1620) establishes the Anti-Money Laundering Authority with a direct and indirect supervision perimeter that shifts the centre of gravity in EU AML supervision away from purely national authorities toward a hybrid EU-level regime. Gibraltar, however, sits outside this perimeter. As a British Overseas Territory, Gibraltar is not bound by the AMLR, 6AMLD, or the AMLA Regulation; its beneficial-ownership regime is instead assessed through its own FATF/MONEYVAL evaluation track as a UK Overseas Territory, running on a parallel but distinct assessment timeline from EU Member States. The EU Package is therefore relevant to Gibraltar only as comparative structural backdrop — an illustration of where transparency regulation is heading regionally — rather than as a body of law that reaches Gibraltar's own UBO register directly.

The enforcement dimension attached to the UBO change deserves separate note: the GFSC's supervisory notice frames the public-access move as paired with enhanced oversight and enforcement, though the evidence available this cycle does not specify particular sanctions, penalty scales, or enforcement case counts attached to the upgraded register. The finding should therefore be treated as a directional signal of institutional commitment rather than a quantified enforcement track record.

The practical consequence for financial institutions and obliged entities transacting with Gibraltar-incorporated structures is that beneficial-ownership verification now has a materially lower-friction public data source available, which should ease customer-due-diligence corroboration work for counterparties who previously had to rely on Gibraltar company-service-provider representations alone. It does not, on the evidence available this cycle, change the underlying legal ownership-disclosure obligations imposed on Gibraltar companies themselves.

Outlook

The forthcoming MONEYVAL assessment, expected on current general industry expectation in 2027 though without a published specific timetable, is the organising event to watch. Continued enhancement of UBO-register effectiveness metrics and visible GFSC enforcement activity in the coming cycles should be read as further preparation against that assessment. A genuine gap remains around Gibraltar's enabler-jurisdiction and professional-facilitator exposure — no GI-specific finding on the role of the jurisdiction's fund and company-services sector as a facilitator channel was located this cycle, and that should be treated as a research priority rather than a stable null finding.

D3 Enabler Jurisdictions

no_changestanding position (as at 8 Aug 2026)

Enabler Jurisdictions and Professional Facilitators

The standing of Gibraltar as an enabler jurisdiction improved on paper this cycle, but the improvement is concentrated in list-status outcomes rather than in the enforcement-capacity gaps that determine whether professional-facilitator risk is actually contained. Gibraltar was removed from the FATF Jurisdictions under Increased Monitoring list on 23 February 2024, alongside Barbados, Uganda and the United Arab Emirates, and was subsequently delisted from the European Union anti-money-laundering high-risk third country list via a delegated regulation adopted by the European Commission on 10 June 2025, entering legal effect 5 August 2025. Both delistings close a multi-year technical-compliance remediation track and represent the clearest positive signal in this baseline.

Continue reading

Set against that improving list-status trajectory, two structural gaps persist that are independent of technical-compliance ratings. Organised criminal groups operating on the Gibraltar-Spain frontier generate high cash volumes through duty-differential tobacco smuggling, an active scheme layering cash proceeds through cash-intensive local businesses on both sides of the border; this is a persistent, MONEYVAL-documented channel rather than a new development, and its continuation alongside an improving compliance-status profile is itself an architecture-over-incident finding, since a clean technical-compliance rating does not, on its own, close an active cross-border cash-laundering channel. Separately, Gibraltar authorities make a low number of outgoing mutual legal assistance requests relative to the cross-border, complex nature of proceeds of crime affecting the jurisdiction, a capacity gap that limits the ability to trace and confiscate proceeds of foreign predicate offences layered through the local financial and corporate services sector, including proceeds that may pass through the tobacco-smuggling channel itself.

Professional and financial-services access of Gibraltar to the UK market also continues to run on a transitional rather than settled basis. The UK-Gibraltar transitional financial-services market access arrangement has been extended a further twelve months, to 16 December 2026, pending finalisation of the Gibraltar Authorisation Regime. The recurring annual extension without full finalisation of that Regime leaves open a structural question about the durability of the alignment-based supervisory cooperation model underpinning the market access of Gibraltar to the UK, a question that sits alongside, rather than is resolved by, the improving FATF and EU list-status of Gibraltar.

Read together, these three findings describe an enabler-jurisdiction profile in which the compliance-status headline and the enforcement-capacity substrate are moving, or at least persisting, on largely independent tracks. The delistings address the technical-compliance dimension that FATF and EU list-status mechanisms are designed to measure; they do not, on the evidence available this cycle, address the frontier cash-laundering channel, the MLA capacity gap, or the durability of the UK market-access relationship.

Outlook

The next mutual evaluation of Gibraltar, expected in the 2027 to 2029 window, will apply the tougher, effectiveness-focused fifth-round FATF methodology, which is likely to test precisely the gap this cycle identifies between improving list-status and persistent enforcement-capacity limitations, including outgoing MLA volume and the tobacco-smuggling channel. Separately, the 16 December 2026 expiry of the transitional UK-Gibraltar market access arrangement is the more immediate dated forcing event: whether it is superseded by a finalised Gibraltar Authorisation Regime, or extended again on the existing annual basis, will be the clearest near-term signal of whether the alignment-based cooperation model is converging toward a settled long-term footing.

Cumulative analysis

Enabler Jurisdictions and Professional Facilitators — Cumulative Analysis

The enabler-jurisdiction profile of Gibraltar, as established through this baseline, is one in which list-status improvement and enforcement-capacity limitation move on largely independent tracks, and the central task of this tracker across future cycles will be to keep both tracks visible rather than allowing the more positive of the two to dominate the overall characterisation of the jurisdiction. Gibraltar was removed from the FATF Jurisdictions under Increased Monitoring list on 23 February 2024, alongside Barbados, Uganda and the United Arab Emirates, and was subsequently delisted from the European Union anti-money-laundering high-risk third country list via a delegated regulation adopted 10 June 2025, entering legal effect 5 August 2025. Both delistings close a multi-year technical-compliance remediation track and represent, at this baseline point, the clearest positive signal in the overall risk profile of Gibraltar.

Set against that improving list-status trajectory, this baseline records two structural gaps that are independent of technical-compliance ratings and that this tracker will carry forward as standing items. Organised criminal groups operating on the Gibraltar-Spain frontier generate high cash volumes through duty-differential tobacco smuggling, an active, MONEYVAL-documented scheme layering cash proceeds through cash-intensive local businesses on both sides of the border; its persistence alongside an improving compliance-status profile is itself an architecture-over-incident finding, because a clean technical-compliance rating does not, on its own, close an active cross-border cash-laundering channel. Separately, Gibraltar authorities make a low number of outgoing mutual legal assistance requests relative to the cross-border, complex nature of proceeds of crime affecting the jurisdiction, a capacity gap that limits the ability to trace and confiscate proceeds of foreign predicate offences layered through the local financial and corporate services sector, potentially including proceeds passing through the tobacco-smuggling channel itself.

Professional and financial-services access of Gibraltar to the UK market also remains, at this baseline point, on a transitional rather than settled footing. The UK-Gibraltar transitional financial-services market access arrangement has been extended a further twelve months, to 16 December 2026, pending finalisation of the Gibraltar Authorisation Regime. The recurring annual-extension pattern, without full finalisation of that Regime, leaves open a structural question about the durability of the alignment-based supervisory cooperation model underpinning the market access of Gibraltar to the UK, a question this tracker will carry forward independently of the FATF and EU list-status of Gibraltar.

Read as a single cumulative picture, the enabler-jurisdiction profile of Gibraltar at this baseline point combines an improving compliance-status headline with persistent enforcement-capacity substrate limitations; both threads should be preserved together in every future cycle of this tracker, consistent with the mixed enforcement-versus-enablement characterisation of the jurisdiction as a whole in this Monitor.

Outlook

The next mutual evaluation of Gibraltar, expected 2027 to 2029, will apply the tougher, effectiveness-focused fifth-round FATF methodology, and is likely to test precisely the gap this baseline identifies between improving list-status and persistent enforcement-capacity limitations, including outgoing mutual-legal-assistance volume and the tobacco-smuggling channel. The more immediate dated forcing event is the 16 December 2026 expiry of the transitional UK-Gibraltar market access arrangement; whether it is superseded by a finalised Gibraltar Authorisation Regime, or extended again on the existing annual basis, will be the clearest near-term signal, carried forward into subsequent cycles of this tracker, of whether the alignment-based cooperation model is converging toward a settled long-term footing.

domain_sub_briefs · D3 · Cumulative analysis
Standing baseline position

The UK-EU Agreement in respect of Gibraltar, signed 14 July 2026 and provisionally applied from 15 July 2026, requires the UK, in respect of Gibraltar, not to weaken AML/CFT measures below the levels of the EU AML Package instruments listed in Annex 17 (Directive 2015/849 as amended, AMLR 2024/1624, AMLD6 2024/1640, AMLA Regulation 2024/1620, Regulation 2023/1113) as in force at the (provisional) entry-into-force date. The Agreement creates no EU market access or passporting right for Gibraltar financial firms and imposes no direct obligations on firms. European Parliament consent remains pending (indicative plenary 14 December 2026).

Periodic updates (1)

Periodic updates below are dated within the scope of the expert review (as at 27 Oct 2026).

6 Oct 2026 · fim-2026-10-06 Expert reviewed

Enabler Jurisdictions and Professional Facilitators

Gibraltars standing as a UK-aligned enabler jurisdiction gained a new and somewhat paradoxical external constraint this cycle: an AML/CFT non-regression commitment anchored in EU law, arriving without any accompanying EU market-access benefit. The UK-EU Agreement in respect of Gibraltar was signed on 14 July 2026 and provisionally applied from the same date under Article 336(4). Article 198(2) of that Agreement states the objective plainly: to support and strengthen action by the Union and by the United Kingdom, in respect of Gibraltar, to prevent and combat money laundering and terrorist financing, and specifically commits that the United Kingdom, in respect of Gibraltar, shall not weaken or reduce its anti-money-laundering and terrorist-financing measures below the levels set out in the Union acts listed in Annex 17, in force at the date of entry into force of the Agreement. Annex 17 names Directive (EU) 2015/849 as amended, the AML Regulation (2024/1624), the sixth AML Directive (2024/1640), the AMLA Regulation (2024/1620) establishing the Anti-Money Laundering Authority, and the funds-transfer Regulation (2023/1113).

The architectural significance of this arrangement is that it creates a floor without a ceiling benefit: Gibraltar is bound to maintain AML/CFT standards referencing an EU instrument set it has no vote in amending and no corresponding passporting right to exploit, a position distinct from both full EU membership and from a jurisdiction with no EU-referenced AML commitment at all. This is precisely the kind of structural finding this framework privileges over single-incident analysis: it is not a response to a specific enforcement failure or designation, but a standing treaty-level commitment reshaping the external reference points against which Gibraltars domestic AML drafting will be measured going forward. European Parliament consent to the Agreement remains pending, with an indicative plenary vote scheduled for 14 December 2026, meaning the Agreements full legal status, and by extension the binding force of the Article 198(2) commitment, carries a degree of procedural uncertainty that a reader should track rather than assume resolved.

This non-regression commitment should also be read alongside the absence, this cycle, of any new sanctions-architecture or sanctions-divergence development: Gibraltars Sanctions Act 2019, consolidated to 9 September 2026, continues to function as the domestic implementing framework without structural change, meaning the UK-EU Agreements AML-specific non-regression clause is, for now, the dominant enabler-jurisdiction signal rather than one strand among several moving in parallel.

Outlook

The principal forward-looking question for Gibraltars enabler-jurisdiction profile is whether European Parliament consent to the UK-EU Agreement proceeds on the indicative 14 December 2026 timeline, and if so, how UK domestic implementation translates the Article 198(2) non-regression duty into enforceable Gibraltar-facing supervisory expectations, given that Annex 17 references instruments (the AMLR, 6AMLD and AMLA Regulation) that are themselves still in their early implementation phase across the EU. A jurisdiction bound to a moving external reference point, without a vote in how that reference point moves, is a structural position worth continued attention independent of any single enforcement event.

D4 Conflict Finance

no_changestanding position (as at 8 Aug 2026)

Conflict Finance and Extractive-Industry Integrity

No Gibraltar-specific conflict-finance or extractive-industry integrity material was identified in this baseline cycle. The jurisdiction-risk profile of Gibraltar this cycle is built from sanctions-architecture, beneficial-ownership, enabler-jurisdiction, digital-asset and compliance-technology findings; none of the evidence gathered for this baseline surfaced a Gibraltar-linked financial flow sustaining armed conflict or an extractive-industry corruption channel routed through the jurisdiction. The standing global D4 coverage of this Monitor, tracking Russian war-economy financing, Sahel minerals and Democratic Republic of Congo governance, is carried forward unchanged and is not itself part of this Gibraltar-specific baseline.

Continue reading

Honesty over coverage governs this entry: rather than construct a Gibraltar-specific conflict-finance narrative from adjacent findings, principally the Maritime Mutual Gibraltar Russia-sanctions wind-down, which belongs analytically to the sanctions-architecture domain rather than to conflict finance as this Monitor defines it, this baseline records the absence directly. That absence is itself a useful baseline marker: any future cycle in which Gibraltar-linked conflict-finance material does emerge should be read against this recorded absence as a genuinely new signal rather than continuation of an existing pattern.

Outlook

No dated horizon item currently ties Gibraltar to this domain. The domain will remain on standing-coverage status for this jurisdiction until Gibraltar-specific evidence emerges; the most plausible future connective tissue, based on the findings of this cycle elsewhere in the baseline, would run through the marine-insurance and shipping sector already surfaced under sanctions architecture, should any conflict-finance-relevant cargo or vessel-ownership pattern be identified in that sector in a future cycle.

Cumulative analysis

Conflict Finance and Extractive-Industry Integrity — Cumulative Analysis

At this baseline point, no Gibraltar-specific conflict-finance or extractive-industry integrity material has been identified, and the cumulative record of this tracker for Gibraltar begins, and currently remains, an explicit absence rather than a developed narrative. The overall jurisdiction-risk profile of Gibraltar in this coverage is built from sanctions-architecture, beneficial-ownership, enabler-jurisdiction, digital-asset and compliance-technology findings; none of the evidence gathered for this baseline, or carried into this cumulative record, surfaces a Gibraltar-linked financial flow sustaining armed conflict or an extractive-industry corruption channel routed through the jurisdiction. The standing global D4 coverage of this Monitor, tracking Russian war-economy financing, Sahel minerals and Democratic Republic of Congo governance, continues unchanged and sits outside this Gibraltar-specific cumulative record.

Honesty over coverage governs this tracker at this baseline point: rather than construct a Gibraltar-specific conflict-finance narrative from adjacent findings, principally the Maritime Mutual Gibraltar Russia-sanctions wind-down, which belongs analytically to the sanctions-architecture domain of this Monitor rather than to conflict finance as defined here, this cumulative record states the absence directly and will continue to do so until Gibraltar-specific evidence emerges. That absence is itself a useful baseline marker carried forward: any future cycle in which Gibraltar-linked conflict-finance material does emerge should be read against this recorded absence as a genuinely new signal, not as the continuation of an existing pattern that this tracker does not, at this point, contain.

Outlook

No dated horizon item currently ties Gibraltar to this domain, and this tracker will remain on standing-coverage status for the jurisdiction until Gibraltar-specific evidence emerges. Based on the findings of this baseline elsewhere, the most plausible future connective tissue would run through the marine-insurance and shipping sector already surfaced under sanctions architecture, should any conflict-finance-relevant cargo or vessel-ownership pattern be identified in that sector in a subsequent cycle; this tracker will monitor for that possibility without asserting it as a current finding.

domain_sub_briefs · D4 · Cumulative analysis

D5 Crypto / Digital Assets / Financial Innovation

no_changestanding position (as at 8 Aug 2026)

Crypto / Digital Assets / Financial Innovation

Revolut Global Digital Assets Limited, a newly established Gibraltar entity, obtained a Gibraltar Financial Services Commission DLT Provider licence for virtual-asset order execution, custody and staking, announced 19 October 2026. The grant expands the population of GFSC-supervised virtual asset service providers that sit within Gibraltar's Proceeds of Crime Act 2015 travel-rule and anti-money-laundering perimeter. Because the new entity is licensed directly by the GFSC rather than operating through an unregulated channel, its virtual-asset activity becomes subject to the same supervisory and reporting structure that already applies to other GFSC-licensed DLT providers in Gibraltar.

Continue reading

The addition is notable less for its individual scale than for what it signals about the trajectory of GFSC-supervised digital-asset activity in Gibraltar: a well-known payments and e-money group establishing a dedicated Gibraltar vehicle specifically to hold a virtual-asset custody and execution permission indicates continued use of Gibraltar's licensing regime as a base for combined digital-asset and payments propositions. For the purposes of the jurisdiction's AML/CFT exposure, each new GFSC-licensed virtual asset service provider represents an incremental addition to the population subject to travel-rule obligations under the Proceeds of Crime Act 2015, rather than a change to the underlying rule itself.

Outlook

Whether additional digital-asset entities follow a similar path of establishing dedicated Gibraltar vehicles for virtual-asset permissions is the principal item to watch. The substance of ongoing supervisory engagement between the GFSC and its licensed virtual-asset population, including how travel-rule compliance is tested in practice, was not confirmed this cycle and remains an open area for future observation.

Cumulative analysis

Crypto, Digital Assets, and Financial Innovation — Cumulative Analysis

The digital-asset architecture of Gibraltar, as established through this baseline, centres on a light-touch, principles-based licensing model that now faces its first substantive multilateral test. The Gibraltar Financial Services Commission operates a distributed ledger technology and virtual-asset-service-provider licensing regime built on ten outcomes-focused principles rather than prescriptive rules, applied to the use of distributed ledger technology for the storage or transmission of value belonging to another as a regulated activity. This model sits outside the scope of the Markets in Crypto-Assets Regulation of the EU, and this baseline records it as a structural regulatory-arbitrage vector: entities can seek Gibraltar authorisation to access UK and international markets under a lighter outcomes-focused supervisory burden than comparable EU regimes impose. This is the primary digital-asset finding relevant to the own regulatory perimeter of Gibraltar, and it is the lead story for this jurisdiction rather than the crypto-asset framework of the EU, from which Gibraltar sits outside as a matter of structural fact.

That first substantive test of the model at this baseline point comes from outside the own perimeter of Gibraltar. The FATF February 2026 Plenary approved a report on offshore virtual asset service providers exploiting regulatory gaps, together with targeted guidance on stablecoins and unhosted wallets. This guidance is directly relevant to light-touch offshore hub jurisdictions such as Gibraltar, because it tests whether principles-based, outcomes-focused frameworks of the kind Gibraltar operates provide protection equivalent to more prescriptive rules-based regimes. Globally, the Markets in Crypto-Assets Regulation and the virtual-asset standards of FATF set the structural direction of travel for digital-asset supervision; for Gibraltar specifically, the immediately relevant question, carried forward as the central item of this tracker, is whether the ten-principles framework of the GFSC will be judged to need tightening in response to this guidance, not whether Gibraltar adopts MiCA, an EU instrument it has no obligation to apply as a non-EEA British Overseas Territory.

This baseline assesses the trajectory of the domain as worsening, not because a specific enforcement failure has been identified at this point, but because the structural gap between the model of Gibraltar and hardening global standards is widening at the same time the compliance-status delistings elsewhere in the profile of Gibraltar are improving. This divergence, an early-mover light-touch licensing jurisdiction moving closer to the frontier of what post-2026 FATF standards may treat as an under-supervised offshore-VASP channel, is the central item this tracker will monitor across subsequent cycles. This baseline also notes, without asserting a combined finding, that the digital-asset licensing hub of Gibraltar sits alongside a jurisdiction that has never executed a proliferation-financing asset freeze and where private-sector proliferation-financing awareness is assessed as low; this combination of vectors, though not yet formally joined in the evidence available, is flagged here for continued cross-domain monitoring.

Outlook

The clearest forcing event carried into subsequent cycles of this tracker is not a dated legislative deadline but a determination still to be made: whether the GFSC concludes that its existing ten-principles framework meets the bar set by the offshore-VASP and stablecoin guidance of FATF, or whether it requires tightening. General industry practice suggests virtual asset service providers licensed under light-touch offshore frameworks should anticipate closer alignment with hardening global standards on unhosted wallets and stablecoins. Whether Gibraltar moves toward that alignment, or continues to compete on its lighter supervisory burden, will be the clearest signal, tracked across subsequent cycles, of whether the overall improving compliance-status trajectory of Gibraltar extends to its most structurally exposed sector.

domain_sub_briefs · D5 · Cumulative analysis
Standing baseline position

GFSC-approved DLT tokenisation extended to experienced-investor-fund shares under the PCC (Amendment) Bill 2026 (proposed).

Revoked effective 2026-07-15 by LN.2026/134; successor instrument not yet confirmed

Periodic updates (4)

Periodic updates below are dated within the scope of the expert review (as at 27 Oct 2026).

18 Oct 2026 · fim-2026-10-18 Expert reviewed

Crypto / Digital Assets / Financial Innovation

Gibraltar's dedicated AML travel-rule instrument for virtual-asset transfers, the Proceeds of Crime Act 2015 (Transfer of Virtual Assets) Regulations 2021, in effect since March 2021, has been revoked by LN.2026/134 effective 15 July 2026. The text of any successor instrument has not been retrieved this cycle, leaving the substantive AML content governing virtual-asset transfer reporting in Gibraltar unconfirmed. From a financial-integrity architecture perspective, this is a notable gap: a jurisdiction with an active and growing virtual-asset licensing ecosystem has, at least temporarily and as far as this cycle's research can confirm, lost its dedicated travel-rule instrument without a visible replacement, creating uncertainty about whether FATF Recommendation 15 obligations for virtual-asset service providers continue to be met through some other mechanism or have a genuine coverage gap.

This sits alongside continued commercial expansion in Gibraltar's tokenisation space. Bullish Group received GFSC approval to trade tokenised securities around late June 2026, and the Protected Cell Companies (Amendment) Act 2026, enacted 9 July 2026, creates a bespoke regime allowing Experienced Investor Funds structured as protected cell companies to issue cell shares as DLT share tokens. Neither of these commercial developments has a confirmed independent GFSC primary-source notice; the Bullish Group finding rests on the company's own announcement, a limitation worth bearing firmly in mind when weighing the strength of that specific claim.

The juxtaposition is analytically significant: a jurisdiction expanding its virtual-asset and tokenisation commercial footprint while simultaneously experiencing an apparent AML-instrument gap in exactly that same sector is the kind of structural mismatch that typically generates elevated illicit-finance risk, independent of any observed enforcement activity. Enablement without confirmed enforcement infrastructure is itself a significant signal in this domain, and the absence of any located enforcement action under the prior travel-rule regime, or any announced replacement, should not be read as an absence of risk.

Outlook

Identifying the successor instrument, if one exists, to the revoked Transfer of Virtual Assets Regulations 2021 is the single most consequential open item in Gibraltar's crypto/digital-asset AML posture. Until that text is located and its substantive content confirmed, Gibraltar's practical compliance with FATF Recommendation 15 for virtual-asset transfers cannot be assessed with confidence. Continued commercial growth in the tokenisation space, absent confirmation of the underlying AML infrastructure, should be read as a widening, not a narrowing, of this gap.

6 Oct 2026 · fim-2026-10-06 Expert reviewed

Crypto, Digital Assets, and Financial Innovation

Gibraltars own crypto and virtual-asset AML perimeter was materially reshaped this cycle, directly within Gibraltars own regulatory architecture rather than as a derivative of any global standard-setting exercise. The Funds (Transfer) Regulations 2026 (LN 2026/134) commenced 15 July 2026 and revoke, in full, the onshored text of Regulation (EU) 2015/847 together with the prior Proceeds of Crime Act 2015 (Transfer of Virtual Assets) provisions that had governed virtual-asset transfer information requirements. In their place, the new Regulations establish a single travel-rule baseline covering both fiat payment-service-provider transfers and virtual-asset-service-provider transfers. Regulations 6 and 8 require payer and payee information, including name and payment account number, to accompany transfers and to be verified before execution; regulation 25 requires payment service providers and virtual asset service providers alike to maintain internal policies, procedures and controls to implement restrictive measures when performing transfers of funds and virtual assets; and regulation 28 imposes a five-year record-retention obligation on originator and beneficiary information for virtual-asset-service-provider transfers specifically, mirroring the retention standard applied to fiat transfers. A reduced-information carve-out applies where all payment service providers in a transfer chain are established in Gibraltar and the transfer falls within the unlinked, lower-value category.

The structural significance of this instrument is that it deems fiat-referenced e-money tokens to be virtual assets for its own purposes, closing what might otherwise have been a product-classification gap between e-money regulation and virtual-asset regulation at the travel-rule layer specifically. This positions Gibraltars VASP-inclusive travel-rule coverage ahead of many comparably sized jurisdictions that have not yet extended fiat transfer-regulation architecture to cover virtual-asset transfers on an equivalent informational footing. It is also a clean illustration of architecture over incident: the change responds to no single enforcement failure in the virtual-asset space but instead resets the entire information-accompaniment and record-retention baseline for a product category, fiat-referenced e-money tokens, that sits at the boundary between traditional payments regulation and crypto-asset regulation.

The revocation of the prior Transfer of Virtual Assets provisions under POCA, alongside the onshored EU Funds Transfer Regulation, also simplifies Gibraltars legal architecture in this space: rather than maintaining two parallel instruments for fiat and virtual-asset transfers, Gibraltar now operates a single consolidated regime, which is itself a structural simplification worth noting independent of the substantive obligations it imposes.

Outlook

The open question for this domain is less about the substance of the new travel-rule baseline, which is now in force and reasonably detailed, and more about how GFSC supervisory practice will evidence compliance with the virtual-asset-specific obligations, particularly the restrictive-measures policy requirement under regulation 25 and the five-year retention duty under regulation 28, given that no enforcement record yet exists against this specific instrument. Whether the deeming of fiat-referenced e-money tokens as virtual assets for travel-rule purposes is extended, by future amendment or guidance, into other areas of Gibraltars financial-services regulatory architecture is also worth tracking as a potential template for how the jurisdiction treats boundary-category digital-asset products more broadly.

5 Sep 2026 · fim-2026-08-21 Expert reviewed

Crypto, Digital Assets, and Financial Innovation

Gibraltar's financial-services perimeter was extended this cycle to bring Virtual Asset Arrangements, meaning fiat-to-crypto and crypto-to-crypto exchange services, within scope. The Financial Services (Regulated Activities) (Amendment) Regulations 2025 inserted this coverage into Part 16 Schedule 2 of the Financial Services Act 2019 with effect from 27 October 2025, requiring firms carrying on Virtual Asset Arrangements to hold explicit permission under Part 7 of the Act, in addition to any legacy DLT Provider status they already hold. Read architecturally, this closes what had been a gap in Gibraltar's AML/CFT perimeter for exchange-type crypto activity that fell outside the scope of the original DLT Provider licensing regime, which was framed around custody and transmission of value belonging to others rather than exchange services specifically.

This finding rests on a single Tier 4 vendor source; no primary Gibraltar Financial Services Commission publication describing the Virtual Asset Arrangements permission regime was retrieved this cycle. Confidence is accordingly capped at low, and the finding should be treated as a signal to verify rather than a confirmed structural fact pending GFSC primary-source confirmation. No Gibraltar-specific stablecoin, staking, or DeFi-specific finding was identified this cycle within this domain; the Virtual Asset Arrangements extension is the sole D5-relevant development.

Outlook

Primary-source confirmation from the Gibraltar Financial Services Commission of the Virtual Asset Arrangements permission regime, its precise scope, and its relationship to legacy DLT Provider status is the single highest-value close-out item for this domain. Until that confirmation is obtained, this finding should be treated as provisional.

10 Aug 2026 · fim-2026-08-08 Expert reviewed

Crypto / Digital Assets / Financial Innovation

The Government of Gibraltar has published the Protected Cell Companies (Amendment) Bill 2026, a Tier-1-sourced legislative proposal that would require prior Gibraltar Financial Services Commission approval before any protected cell authorised as an experienced-investor fund can issue tokenised shares. This is an incremental but concrete widening of Gibraltar's distributed-ledger-technology regulatory perimeter into fund infrastructure specifically, layering new activity onto the jurisdiction's existing Proceeds of Crime Act 2015 anti-money-laundering perimeter rather than creating a standalone AML regime for tokenised instruments. The assessed, rather than high, confidence rating reflects a specific limitation in this cycle's evidence base: independent corroboration of the downstream AML implications of the Bill — as opposed to the headline requirement for prior GFSC approval — remains limited to the government's own announcement.

The practical significance for financial-integrity purposes is that GFSC approval, once the Bill is enacted, becomes the compliance gate through which any tokenised experienced-investor-fund share issuance must pass, meaning the existing supervisory relationship between GFSC and fund administrators extends automatically to this new instrument type rather than requiring a parallel licensing track. This is architecturally significant even though, on the evidence in hand this cycle, no enforcement action or supervisory finding has yet tested how that approval gate will operate in practice. No comparable Gibraltar crypto-specific AML enforcement action was identified this cycle, consistent with the jurisdiction's broader pattern of architecture-first, enforcement-second regulatory sequencing in the digital-asset space.

Outlook

Watch for the Bill's enactment status and, more importantly, for any GFSC guidance specifying the AML/CDD conditions attached to tokenised-share approval; that guidance, once published, would be the point at which this shifts from a proposed architectural vector to an operative compliance requirement worth escalating in materiality.

D6 Compliance Technology & Active Defence

no_changestanding position (as at 8 Aug 2026)

Compliance Technology and Active Defence

The approach of Gibraltar to digital-asset supervision doubles as the clearest illustration this cycle of the proactive-versus-tick-box compliance debate within the D6 domain of this Monitor. The Gibraltar Financial Services Commission applies ten outcomes-focused principles to distributed ledger technology and virtual-asset-service-provider activity rather than prescriptive rules, a supervisory design that in principle should allow the regulator to respond dynamically to novel typologies without waiting for legislative amendment. Whether that design translates into consistent case-level supervisory outcomes, however, is difficult to verify externally.

Continue reading

That verification difficulty is itself the second finding of the domain this cycle. The Gibraltar Financial Services Commission does not maintain a highly visible public enforcement-notices archive relative to comparator regulators, and open-source coverage of firm-level enforcement outcomes over the prior eighteen months is thin. This is recorded here as a gap in available open-source intelligence coverage of GFSC enforcement outputs specifically, rather than as any finding about the internal control environment of any regulated firm; no corroborating source was identified confirming either the presence or absence of underlying enforcement activity, only the absence of its public surfacing.

The combination of these two findings is what makes this a D6, active-defence-relevant observation rather than a simple transparency complaint. A principles-based, outcomes-focused supervisory model depends more heavily than a prescriptive rules-based one on visible enforcement outcomes to demonstrate that the principles are being applied with real consequence; in the absence of a visible enforcement record, external assessors, including this Monitor, cannot distinguish between a genuinely light-touch-but-effective regime and one that is light-touch because enforcement is not occurring. This is a structural gap in the assessment architecture itself, not a statement about the underlying supervisory performance of Gibraltar.

This verification gap sits alongside the principles-based digital-asset licensing regime of Gibraltar, discussed in the D5 coverage of this Monitor, which similarly relies on outcomes-focused judgement calls rather than prescriptive checklists. The same feature that makes the compliance-technology posture of Gibraltar forward-leaning in principle, discretion exercised by the regulator rather than compliance with fixed rules, is also what makes real-world application hardest to verify from outside the institution, whether the object of assessment is DLT/VASP licensing or broader firm-level enforcement.

Read across the three pillars this Monitor tracks, the D6 profile of Gibraltar this cycle is anti-money-laundering-weighted by default, because the enforcement-transparency gap and the principles-based licensing model are both AML/CFT-facing observations; no CTF- or CPF-specific compliance-technology signal was identified for Gibraltar this cycle, an absence that is itself worth noting given the separately assessed low private-sector awareness of proliferation-financing obligations documented elsewhere in this baseline.

Outlook

Absent a comparator-style public enforcement-notices archive, comparable to peer regulators such as the Guernsey Financial Services Commission, external verification of the principles-based supervisory model of Gibraltar will remain constrained between MONEYVAL assessment cycles. The trajectory of the domain is assessed as one to watch rather than one showing a clear direction, precisely because the underlying supervisory model may be functioning well without that functioning being externally visible. The next dated test will be the fifth-round mutual evaluation of Gibraltar, expected 2027 to 2029, which will assess supervisory effectiveness directly rather than relying on public enforcement-notice visibility as a proxy.

Cumulative analysis

Compliance Technology and Active Defence — Cumulative Analysis

The compliance-technology profile of Gibraltar, as established through this baseline, turns on a single structural tension carried forward as the central item of this tracker: a principles-based, outcomes-focused supervisory model that in principle should respond dynamically to novel typologies, set against a public enforcement-transparency record too thin to verify externally whether that responsiveness translates into consistent case-level outcomes. The Gibraltar Financial Services Commission applies ten outcomes-focused principles to distributed ledger technology and virtual-asset-service-provider activity rather than prescriptive rules, illustrating the proactive-versus-tick-box compliance debate this domain tracks across jurisdictions. Whether that design delivers consistent supervisory outcomes in practice is, at this baseline point, not verifiable from available open-source material.

The verification gap is itself the second and equally significant finding of this baseline. The Gibraltar Financial Services Commission does not maintain a highly visible public enforcement-notices archive relative to comparator regulators, and open-source coverage of firm-level enforcement outcomes over the prior eighteen months is thin. This is recorded, and will continue to be recorded in subsequent cycles, as a gap in available open-source intelligence coverage of GFSC enforcement outputs specifically, rather than as any finding about the internal control environment of any regulated firm; no corroborating source was identified confirming either the presence or the absence of underlying enforcement activity, only the absence of its public surfacing.

The combination of these two findings is what makes the Gibraltar entry of this tracker a genuine active-defence-relevant observation rather than a simple transparency complaint, and it is the combination this tracker will carry forward across subsequent cycles. A principles-based, outcomes-focused supervisory model depends more heavily than a prescriptive rules-based one on visible enforcement outcomes to demonstrate that its principles carry real consequence; in the absence of a visible enforcement record, external assessors, including this Monitor, cannot distinguish between a genuinely light-touch-but-effective regime and one that is light-touch because enforcement is not occurring. Read across the three pillars this Monitor tracks, the D6 profile of Gibraltar at this baseline point is anti-money-laundering-weighted by default, because both findings are AML/CFT-facing; no counter-terrorist-financing or counter-proliferation-financing-specific compliance-technology signal has yet been identified for Gibraltar, an absence worth carrying forward given the separately assessed low private-sector awareness of proliferation-financing obligations of the jurisdiction.

Outlook

Absent a comparator-style public enforcement-notices archive, comparable to peer regulators such as the Guernsey Financial Services Commission, external verification of the principles-based supervisory model of Gibraltar will remain constrained between MONEYVAL assessment cycles, and this tracker will continue to record that constraint as a standing item rather than resolving it. This baseline assesses the trajectory of the domain as one to watch rather than one showing a clear direction, because the underlying supervisory model may be functioning well without that functioning being externally visible. The next dated test carried into subsequent cycles will be the fifth-round mutual evaluation of Gibraltar, expected 2027 to 2029, which will assess supervisory effectiveness directly rather than relying on public enforcement-notice visibility as a proxy.

domain_sub_briefs · D6 · Cumulative analysis

D7 AML/CTF Regime

no_change

AML/CTF Regime

Gibraltar's anti-money-laundering and counter-terrorist-financing regime, as it currently stands, is anchored in the Proceeds of Crime Act 2015, which establishes the Gibraltar Financial Intelligence Unit and sets out, in Part III, the customer due diligence, record-keeping and suspicious-activity-reporting duties applicable to relevant financial businesses. A relevant financial business must apply customer due diligence measures before establishing a business relationship or occasional transaction, applying an occasional-transaction threshold of 15,000 euros for non-financial-sector relevant persons. Where the money-laundering reporting officer determines that grounds for knowledge or suspicion of money laundering, terrorist financing or proliferation financing are satisfied, the matter must be reported to the Financial Intelligence Unit without delay; where the Unit refuses consent to a prospective transaction, a sixty-working-day moratorium period applies before the firm may proceed. Disclosing that a suspicious-activity report has been made, or that an investigation is contemplated or under way, where that disclosure is likely to prejudice the investigation, is a separate criminal offence, subject to statutory exceptions including disclosure to the Financial Intelligence Unit, police or customs. Money-laundering offences under the Act carry criminal penalties of up to fourteen years imprisonment and unlimited fines. Documents and information obtained through customer due diligence, together with records of due diligence measures and ongoing monitoring, must be retained for five years from the date an occasional transaction is completed or a business relationship ends.

Continue reading

Supervisory enforcement of this regime sits with the Gibraltar Financial Services Commission, which under the Supervisory Bodies (Powers etc.) Regulations 2017 may impose an administrative penalty on a relevant person for default or breach of Proceeds of Crime Act obligations up to the higher of twice the benefit derived or 1 million euros for most relevant persons, rising to 5 million euros or 10 percent of total annual turnover for credit and financial institutions. A possible successor instrument dated 2025, carrying a comparable 1 million euro cap, has been identified as a research lead but has not been independently confirmed as superseding the 2017 framework, and should be treated as unconfirmed pending further verification. Against this penalty architecture, the Commission concluded four firm-level settlements in the 2023 to 2025 period: Tap Global Limited paid 150,000 pounds for failing to follow internal suspicious-activity-reporting procedures between April 2023 and June 2024; Blacktower Financial Management (International) Limited paid 294,479 pounds following two 2023 onsite reviews that found customer due diligence, sanctions-screening, monitoring and training failures; and Alvar Financial Services Limited and Argon Financial Limited paid 186,038.52 pounds and 71,281 pounds respectively for failing to demonstrate effective control and management between April 2021 and May 2024.

Separately, sanctions obligations sit alongside the core anti-money-laundering framework under the Sanctions Act 2019, which provides automatic recognition in Gibraltar of United Nations, United Kingdom and European Union sanctions together with autonomous domestic designations, and the Sanctions (Amendment) Act 2024, which recast the screening-related provisions previously found at section 8(3) and (4) of the 2019 Act. An Unexplained Wealth Order regime, introduced by amendments to the Proceeds of Crime Act that took effect in October 2024, allows the Supreme Court to require a respondent, typically a politically exposed person or person suspected of serious crime, to explain how property worth more than 50,000 pounds was acquired where known lawful income appears insufficient; making a false statement in response to such an order is an offence carrying up to two years imprisonment.

On the international-assessment dimension, Gibraltar's 2024 second enhanced follow-up report re-rated Financial Action Task Force Recommendation 36 to Largely Compliant, bringing all forty Recommendations to a rating of either Compliant or Largely Compliant and terminating the enhanced follow-up procedure that the regional mutual-evaluation body, the Committee of Experts on the Evaluation of Anti-Money Laundering Measures, had previously maintained with Gibraltar following its 2019 mutual evaluation report. Gibraltar's 2025 National Risk Assessment, the first full update since 2020, identifies company management, cross-border finance, virtual assets and cyber-enabled fraud as priority high-risk areas, and flags Spain and Morocco as higher-risk neighbouring jurisdictions.

Outlook

Gibraltar's sixth-round mutual evaluation is provisionally scheduled, with an on-site visit indicated for October 2027 and a Plenary discussion around May 2028; these dates are provisional per the regional evaluation body's own published schedule and should not be treated as fixed. A consultation on enhanced customer due diligence obligations aligned with an updated Financial Action Task Force Recommendation 16, targeting virtual-asset-service providers and correspondent banking, has been signalled by the Gibraltar Financial Services Commission but rests on a single source with no confirmed date, and its scope and timetable remain unresolved. The question of whether a 2025 instrument has in fact superseded the 2017 supervisory penalty framework is likewise unresolved and warrants confirmation before being treated as the current position.

Cumulative analysis

AML/CTF Regime

Gibraltar's anti-money-laundering and counter-terrorist-financing regime rests on the Proceeds of Crime Act 2015 as its governing statute, with the Gibraltar Financial Services Commission acting as supervisory authority for regulated entities and the Gibraltar Financial Intelligence Unit serving as the jurisdiction's reporting financial-intelligence unit for suspicious-activity disclosures. Gibraltar has been off the FATF grey list since February 2024, and, as a British Overseas Territory, its AML/CFT effectiveness is assessed through MONEYVAL rather than through a Member-State FATF-style regional body process. GFSC-supervised entities include banks, insurers, fund administrators, payment institutions and other regulated financial-services providers, all of which fall within scope of the Proceeds of Crime Act 2015 reporting and customer-due-diligence obligations administered through GFIU. This is the current standing architecture as at this cycle's collection date, sourced to the GFSC's own AML supervisory material, and it forms the baseline against which this cycle's beneficial-ownership and sanctions developments should be read. No new instrument, threshold, or designated-reporting-entity change to this baseline was identified this cycle; it is presented here as the current standing position rather than as a development, since it has not previously been collected in this form. This baseline sits alongside, but is analytically distinct from, the sanctions architecture under the separate Sanctions Act 2019 and the beneficial-ownership transparency regime administered through Gibraltar's UBO register.

Outlook

The forthcoming MONEYVAL assessment, on current general industry expectation targeted for 2027, will test this standing architecture's practical effectiveness against FATF's Immediate Outcomes rather than its formal statutory completeness; the beneficial-ownership and sanctions developments tracked elsewhere this cycle are best understood as inputs into that same evaluation process.

MONEYVAL 6th Round Mutual Evaluation launch training (23–24 September 2026) & UK-EU Treaty EP consent calendar (14 December 2026). MONEYVAL and HM Government of Gibraltar completed the official 6th-round Mutual Evaluation launch training in Gibraltar on 23–24 September 2026; downstream evaluation milestones (illustrative onsite window ~2027 and plenary discussion ~2028) remain indicative pending formal publication of the updated MONEYVAL 6th-round schedule. Separately, under Annex 17 of the UK-EU Agreement in respect of Gibraltar (signed 14 July 2026), the European Parliament consent plenary is indicatively scheduled for 14 December 2026, with a post-vote re-run trigger to verify formal ratification and definitive entry into force.

domain_sub_briefs · D7 · Cumulative analysis
Standing baseline position

Gibraltar is rated Largely Compliant on FATF Recommendation 36 (up from Partially Compliant); MONEYVAL has terminated its 5th-round enhanced follow-up procedure with Gibraltar.

Largely Compliant

Periodic updates (4)

Periodic updates below are dated within the scope of the expert review (as at 27 Oct 2026).

18 Oct 2026 · fim-2026-10-18 Expert reviewed

AML/CTF Regime

Gibraltar's standing AML/CTF regime rests on the Proceeds of Crime Act, as amended, the Sanctions Act 2019, the Terrorism Act 2018, and the Crimes Act 2011. The Gibraltar Financial Services Commission supervises obliged entities across the financial sector, and the Gibraltar Financial Intelligence Unit is the designated recipient of suspicious activity and transaction reports. This architecture is autonomous of the EU's AML Regulation, sixth Anti-Money Laundering Directive, and the Anti-Money Laundering Authority, none of which have binding legislative effect in Gibraltar, which sits outside the EU and EEA. Instead, Gibraltar is assessed on its own FATF-style compliance track by MONEYVAL, the Council of Europe's mutual-evaluation body, which periodically reviews the jurisdiction's implementation of the FATF's 40 Recommendations.

As at the most recent MONEYVAL follow-up report, published 9 October 2026, Gibraltar holds 23 Compliant and 17 Largely Compliant ratings across the 40 Recommendations, with FATF Recommendation 36 specifically re-rated from Partially Compliant to Largely Compliant, closing Gibraltar's enhanced follow-up procedure under the fifth MONEYVAL evaluation round. Gibraltar's next assessment milestones under this standalone track are a technical-compliance submission due March 2027, an onsite evaluation visit in October 2027, and a plenary discussion in May 2028.

The practical shape of this regime for an obliged entity operating in or through Gibraltar is therefore one of a nationally supervised, FATF-aligned framework assessed independently of the EU's harmonised architecture, with GFSC as the primary supervisor and GFIU as the reporting authority, and with MONEYVAL's periodic mutual evaluation serving as the external benchmark of the regime's effectiveness.

Outlook

Gibraltar's compliance trajectory under this framework is currently improving, as reflected in the FATF Recommendation 36 re-rating. The jurisdiction's next formal checkpoint is the technical-compliance submission due in March 2027, followed by the onsite visit in October 2027 and the plenary discussion in May 2028, which will together determine whether the current improving trajectory is sustained across the full 40-Recommendation framework.

6 Oct 2026 · fim-2026-10-06 Expert reviewed

AML/CTF Regime

Gibraltars AML/CTF regime rests on the Proceeds of Crime Act 2015 (POCA), as amended, and is supplemented by Gibraltar Financial Services Commission (GFSC) guidance notes covering customer due diligence, customer risk assessment, and ongoing monitoring. The regime places the customer due diligence and enhanced due diligence decision, and the risk attaching to it, on the Gibraltar legal entity itself: under POCA sections 9B, 10, 13, 15, 20 through 20B, 23 and 26, a relevant financial business must appoint a director, senior manager or partner with the duty of ensuring compliance, and where that business relies on a third party to apply customer due diligence measures, section 23 provides that the relying Gibraltar firm remains liable for any failure in those measures notwithstanding the reliance; subsection (1A) confirms this is not to be construed as permitting reliance on a third party of a kind that would defeat this liability rule. Where the Gibraltar entity in question is a branch of a UK company rather than a Gibraltar-incorporated entity in its own right, the risk-owning legal person shifts to the UK parent company under the UK Money Laundering Regulations 2017, regulation 20, a distinction that matters for groups operating both structures.

Simplified due diligence under section 16 and Schedule 6 is available in principle but is structurally constrained by geographic risk factors identified in the 2025 National Risk Assessment (NRA v1.3): a regulated entity can never treat the country risk of Spain as Low Risk, and no customer with a residency, nationality or economic-activity connection to Spain may be given simplified due diligence; funds received from either Spain or Morocco must be categorised as high risk and subjected to additional risk-based controls under each entitys risk-based approach. There is no fixed numerical purse-limit derogation permitting simplified due diligence for products such as certain electronic money by reference to transaction value alone; the geographic-risk constraint takes precedence over any such product-based carve-out. Where a customer has not been physically present for identification purposes, section 18 requires a relevant financial business to take specific and adequate measures to compensate for the higher risk this presents, for example through additional documentary verification, certification of documents by an appropriate person, or requiring the first payment to be carried out through an account opened in the customers name at a credit institution.

Ongoing monitoring obligations under sections 12, 17(3) and 10(ca) require relevant financial businesses to scrutinise transactions throughout a business relationship to ensure consistency with the businesss own knowledge of the customer and the customers risk profile, with particular attention to transactions that are unusually large, conducted in an unusual pattern, or lack an apparent economic or lawful purpose; monitoring obligations are enhanced where the customer is a politically exposed person. A statutory sanctions check obligation sits alongside this monitoring duty at section 10(ca). Tipping-off provisions at sections 5 and 11(5) and (5A) make it an offence for a person to disclose matters that would prejudice an investigation where the information disclosing that matter came to the person in the course of a business or activity covered by the Act. Where a relevant financial business is unable to apply the required customer due diligence measures, it must not carry out a transaction with or for the customer through a bank account and must not establish a business relationship or carry out an occasional transaction with that customer. Records, including copies of customer due diligence documentation and transaction records, must be retained for a period of five years beginning on the date an occasional transaction is completed or the date the business relationship ends, after which personal data must be deleted unless retention is required by another enactment or the Minister has by order provided for its continued retention.

Outlook

As this is the first cycle in which Gibraltars standing AML/CTF baseline under POCA has been collected and set out in this detail, the immediate point of continuity to track is how this baseline interacts with the newly in-force Funds (Transfer) Regulations 2026 travel-rule regime and with the UK-EU Agreements AML non-regression commitment, both of which layer additional obligations onto the same underlying customer due diligence and ongoing monitoring architecture described above.

4 Oct 2026 · fim-2026-10-04 Expert reviewed

AML/CTF Regime

Gibraltar's anti-money-laundering and counter-terrorist-financing regime is legislated by Gibraltar's own Parliament through the Proceeds of Crime Act 2015. The Gibraltar Financial Services Commission supervises compliance with this regime domestically. Gibraltar is assessed externally by MONEYVAL rather than by any EU AML instrument: it is not bound by the AML Regulation, the sixth AML Directive, or the AMLA Regulation, reflecting its status as an autonomous jurisdiction outside the EU/EEA following Brexit. The 2024 FATF follow-up report on Gibraltar states that no further reporting is required under MONEYVAL's current round of evaluations, indicating a standing position of compliance under the most recent completed evaluation cycle.

This autonomous, MONEYVAL-assessed structure is the framework against which all of Gibraltar's AML/CTF-relevant activity should be read, including the beneficial-ownership transparency work addressed separately under this jurisdiction's D2 coverage. A new MONEYVAL mutual evaluation round is anticipated, referenced in the Government of Gibraltar's own public communications as a factor motivating recent transparency-focused legislative activity, though the round's scheduling and scope have not yet been publicly confirmed. A separate claim that Gibraltar has been removed from an EU list of high-risk third countries rests on a single secondary law-firm summary and has not yet been confirmed via the EU Official Journal or another primary source; this should be treated as unconfirmed pending such corroboration, consistent with the register's designation vocabulary rather than any Gibraltar-specific risk grade.

Outlook

Confirmation of the scheduling for Gibraltar's next MONEYVAL evaluation round, and primary-source corroboration of the claimed EU high-risk-list status change, are the two clearest items that would update the standing position set out above.

5 Sep 2026 · fim-2026-08-21 Expert reviewed

AML/CTF Regime

Gibraltar's anti-money-laundering and counter-terrorist-financing regime of record is the Proceeds of Crime Act 2015. The Gibraltar Financial Services Commission is the supervisory authority for the financial sector, and the Gibraltar Financial Intelligence Unit is the designated financial intelligence unit responsible for receiving and analysing suspicious activity reports. Customer due diligence obligations apply above a threshold of EUR 15,000. MONEYVAL is the assessment body responsible for evaluating Gibraltar's AML/CFT effectiveness against the FATF Standards, and Gibraltar was removed from the FATF grey list in February 2024, with the jurisdiction's next MONEYVAL mutual evaluation scheduled for 2027 under the revised FATF Standards.

As an autonomous jurisdiction, Gibraltar's AML/CFT framework is not derived from, and is not bound by, any supranational EU legislative competence; this remains the position following the UK's departure from the European Union, and the 2026 UK-EU Gibraltar Treaty's AML/CTF commitments, provisionally applied from 15 July 2026, do not alter this autonomous status.

Outlook

The 2027 MONEYVAL mutual evaluation is the principal forthcoming assessment of this regime, and will test Gibraltar's supervisory effectiveness against the revised FATF Standards. No change to the underlying statutory basis is expected before that evaluation.

D8 Commercial Activity

no_change

Commercial Activity

As at November 2026, the operational throughput of Gibraltar's financial-intelligence reporting architecture provides the current standing picture of commercial-sector engagement with the anti-money-laundering regime. The Gibraltar Financial Intelligence Unit received more than 5,800 suspicious-activity reports over the course of 2025, an increase of 17.5 percent on the prior year's total of 4,950, which the Unit itself characterised as a landmark year for reporting volume. Within that increase, the virtual-asset-service-provider sector's own disclosures nearly doubled, indicating that crypto-asset businesses operating under Gibraltar's distributed-ledger-technology and virtual-asset-service-provider frameworks are a growing contributor to the jurisdiction's overall suspicious-activity-reporting flow, alongside banking, payments, investment and gambling-sector reporting entities.

Continue reading

Alongside the reporting-volume data, the Financial Intelligence Unit's statistics for the second quarter of 2025 show the operation of the consent mechanism that sits beneath the suspicious-activity-reporting regime: 194 requests for consent to proceed with a transaction despite a suspicion of money laundering were received in that quarter, of which 166, representing 86 percent, were granted. This grant rate describes the practical day-to-day interaction between regulated firms and the Financial Intelligence Unit where a reporting entity has identified a transaction that may be connected to money laundering, terrorist financing or proliferation financing but wishes to continue dealing with the underlying funds or relationship. The consent and moratorium mechanism which governs this process, found in the Proceeds of Crime Act 2015, provides that where consent is refused a sixty-working-day moratorium period applies before a firm may proceed, a structural feature that frames the context in which the 86 percent grant rate for the second quarter of 2025 should be read.

Taken together, these figures describe a financial-intelligence apparatus processing a reporting volume that has grown meaningfully year on year, across a commercial base that spans traditional banking, payments, investment, gambling and virtual-asset activity, with a consent-request grant rate that suggests the large majority of requests to proceed despite a flagged suspicion are being resolved in favour of the reporting entity within the quarter examined. No equivalent commercial-activity statistics beyond these two data points, drawn from the suspicious-activity-reporting and deferred-action consent channels, have been identified for the current reporting position.

Outlook

Whether the 17.5 percent year-on-year rise in suspicious-activity-report volume recorded for 2025 represents a sustained upward trajectory or a single landmark year, as the Financial Intelligence Unit itself described it, is not yet established from the data available, and subsequent quarterly and annual statistical releases will be needed to determine whether reporting volume continues to climb, particularly within the virtual-asset-service-provider sector where disclosures nearly doubled. Continued growth in reporting volume, if it occurs, would be expected to place additional demands on the Financial Intelligence Unit's consent-processing capacity, a dimension on which only a single quarter of data, that for the second quarter of 2025, is currently available.

Regulatory horizon
No dated horizon items this cycle. 1 item tracked without a confirmed date.
1 pending date · baseline fim-2026-07-05
Role action cards
MLRO

The Gibraltar Financial Intelligence Unit recorded a 17.5 percent year-on-year rise in suspicious-activity reports for 2025, with virtual-asset-sector disclosures nearly doubling.

Reporting officers overseeing Gibraltar-regulated entities, particularly those in the virtual-asset-service-provider sector, operate within a reporting environment where overall volume and crypto-sector share are both rising; the consent and sixty-working-day moratorium mechanism under the Proceeds of Crime Act 2015 remains the operative framework for transactions subject to a pending suspicion.

3 evidence refs
Compliance

Four Gibraltar Financial Services Commission settlements concluded between 2023 and 2025 found customer due diligence, sanctions-screening, suspicious-activity-reporting and control failures across crypto, investment and payments firms.

The settlements with Tap Global, Blacktower, Alvar and Argon collectively demonstrate active supervisory testing of core control-framework elements, including internal reporting procedures, sanctions screening and effective management, with penalties reaching into the hundreds of thousands of pounds.

4 evidence refs
Legal

An Unexplained Wealth Order regime, in effect since October 2024, allows the Supreme Court to require explanation of property exceeding 50,000 pounds where lawful income appears insufficient.

Counsel advising on Gibraltar wealth-structuring or politically-exposed-person matters should treat the Unexplained Wealth Order mechanism, and the associated false-statement offence carrying up to two years imprisonment, as a live enforcement tool under the amended Proceeds of Crime Act 2015.

1 evidence refs
Board

Gibraltar achieved Largely Compliant or Compliant ratings on all forty FATF Recommendations in 2024, ending enhanced monitoring by the regional mutual-evaluation body, while supervisory enforcement activity continued through 2025.

The combination of a positive international compliance rating and continued active enforcement signals a jurisdiction maintaining reputational standing through visible supervisory action rather than through an absence of findings; a sixth-round mutual evaluation is provisionally scheduled for 2027 to 2028.

4 evidence refs
CTO

Virtual-asset-service-provider suspicious-activity-report disclosures nearly doubled in 2025, within a regime requiring Part 7 authorisation for distributed-ledger-technology providers and Travel Rule compliance at a 1,000 euro threshold.

Technology functions supporting Gibraltar-licensed crypto-asset operations should note the authorisation requirement under the 2020 Distributed Ledger Technology Providers Regulations and the originator/beneficiary information-transmission duty under the Travel Rule, against a backdrop of rising sector-specific reporting volume and at least one enforcement settlement, Tap Global, concerning internal reporting-procedure failures.

2 evidence refs
Risk

Gibraltar's 2025 National Risk Assessment identifies company management, cross-border finance, virtual assets and cyber-enabled fraud as priority high-risk areas, with Spain and Morocco flagged as higher-risk neighbouring jurisdictions.

Risk functions should weigh the National Risk Assessment's priority areas alongside the observed concentration of enforcement actions in investment-management and crypto-payments firms, and the rising suspicious-activity-report trajectory, when calibrating exposure assessments tied to Gibraltar-domiciled counterparties.

1 evidence refs
Operations

Second-quarter 2025 data shows 194 consent requests received and 166, or 86 percent, granted under the deferred-action mechanism.

Operational teams handling transaction screening and consent requests tied to Gibraltar reporting entities can reference this single-quarter grant-rate figure as a baseline for current throughput, noting that only one quarter of data is available and the moratorium period of sixty working days applies where consent is refused.

2 evidence refs
Audit

Documents and information obtained through customer due diligence must be retained for five years from the end of a business relationship or completion of an occasional transaction, under the Proceeds of Crime Act 2015.

Audit functions testing control adequacy for Gibraltar-regulated entities should confirm that the five-year record-retention requirement is being met, and may wish to cross-reference the control and management deficiencies identified in the Alvar and Argon settlements as a benchmark for documentation-gap risk.

2 evidence refs
Scenario sketches

Supervisory capacity under rising suspicious-activity-report volume

An illustrative orientation only: if suspicious-activity-report volume in a small jurisdiction continues to climb at a rate comparable to the 17.5 percent year-on-year increase observed for 2025, with virtual-asset-sector disclosures growing fastest, a financial intelligence unit of fixed size could face a widening gap between report intake and triage capacity. This could plausibly manifest as lengthening time-to-decision on consent requests, or a shift toward higher automatic-grant rates as a release valve, neither of which is observed in the data examined and both of which remain speculative illustrations of a structural pressure, not a prediction of Gibraltar's actual trajectory.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Sanctions Regimestable
T2 · Beneficial Ownership Transparencystable
T3 · Enabler Jurisdiction Riskstable
T4 · Conflict Finance Exposureno_change
T5 · Sanctions Regime Divergenceno_change
T6 · Compliance Technology and Active Defenceno_change
Registers

Enforcement actions

  • 6 Oct 2025
  • 20 Feb 2025
  • 20 Feb 2025
  • 20 Feb 2025

List status & mutual evaluation

  • 23 Feb 2024
  • 22 May 2024
  • 10 Jun 2025

Sanctions changes

  • 24 Feb 2026
  • 23 Apr 2026
  • 1 Jun 2026
  • 16 Jun 2026
  • 24 Feb 2026
  • OFSI General Licence INT/2026/8893924 authorised wind-down of Maritime Mutual Gibraltar insurance policies affected by Russia sanctions designations, permitting an orderly unwind rather than abrupt policy termination. 24 Feb 2026
  • European Commission delegated regulation removed Gibraltar from the EU list of AML/CFT high-risk third countries requiring mandatory enhanced due diligence by EU obliged entities. 10 Jun 2025
  • Structural point confirmed via UK secondary legislation: all British Overseas Territories except Bermuda and Gibraltar have UK Russia sanctions extended to them via the Russia (Sanctions) (Overseas Territories) Order 2020; Gibraltar and Bermuda instead implement sanctions under their own domestic legislative arrangements (Gibraltar's Sanctions Act 2019), meaning designation timing, licensing and enforcement in Gibraltar run on a jurisdiction-specific track rather than automatic extension of UK statutory instruments. 17 Apr 2024

Regulatory horizon (register)

  • European Parliament consent on UK-EU Gibraltar Agreement
  • Sanctions Civil Enforcement Regulations 2026 substantive provisions to be tested
  • MONEYVAL 6th-round mutual evaluation of Gibraltar
  • GFSC CDD consultation aligned with FATF R.16
  • MONEYVAL sixth-round mutual evaluation of Gibraltar
  • Possible supersession of Supervisory Bodies (Powers etc.) Regulations 2017 enforcement framework

Active schemes

  • Gibraltar-domiciled marine insurance wind-down for Russia-exposed vessels
  • Cross-frontier tobacco smuggling and cash-intensive laundering
  • Gibraltar DLT/virtual-asset licensing as light-touch crypto hub
  • Trust and complex-ownership structuring via Gibraltar TCSPs
Sources
  1. UK Financial Sanctions FAQs - GOV.UK
  2. HM Government of Gibraltar
  3. Gibraltar Financial Services Commission
  4. Council of Europe / MONEYVAL
  5. FATF
  6. Gibraltar Financial Intelligence Unit
  7. House of Commons Library
  8. company.gi
  9. GOV.UK
  10. https://www.fatf-gafi.org/en/countries/detail/Gibraltar.html
  11. https://www.coe.int/en/web/moneyval/-/moneyval-welcomes-gibraltar-s-removal-from-the-from-fatf-s-grey-list-1
  12. https://www.gibraltar.gov.gi/press-releases/ultimate-beneficial-ownership-register-1112026-11724
  13. https://signaturelitigation.com/elliott-phillips-and-chris-edwards-discuss-gibraltars-new-ubo-register-in-thomson-reuters-regulatory-intelligence/
  14. https://www.gibraltarlaw.com/media/2026/03/Country-Update-Gibraltar-AML-2026.pdf
  15. https://www.gibraltar.gov.gi/sanctions
  16. https://www.fsc.gi/aml
  17. https://ramparts.gi/the-gibraltar-authorisation-regime-gar-uk-market-access/
  18. https://committees.parliament.uk/writtenevidence/92/html/
  19. https://bit2me.com/cryptocurrencies/gibraltar
  20. https://www.coe.int/en/web/moneyval
  21. https://www.coe.int/en/web/moneyval/assessment-calendar
  22. https://www.gbc.gi/news/govt-holds-constructive-talks-with-council-of-europe-moneyval-team-ahead-of-gibraltar-evaluation
  23. https://www.gibraltarlaws.gov.gi/legislations/funds-transfer-regulations-2026-8478/download
  24. https://company.gi/guide/prediction-markets/financial-crime
  25. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202501184
  26. https://www.gibraltarlaws.gov.gi/uploads/legislations/financial-services/2019-26/2025=254.pdf
  27. https://www.gibraltarlaws.gov.gi/legislations/proceeds-of-crime-act-2015-2348/download
  28. https://www.gibraltar.gov.gi/uploads/Financial-Crime/2025NRA%20v1.3.pdf
  29. https://www.fsc.gi/uploads/aml/4%20-%20Customer%20Risk%20Assessment.pdf
  30. https://assets.publishing.service.gov.uk/media/6a56149a6d6d5c7e2845c8d1/MS_9.2026_Agreement_Gibraltar_UK_EU_EAEC_v1of2.pdf
  31. Council of Europe / MONEYVAL
  32. Council of Europe / MONEYVAL
  33. Government of Gibraltar
  34. Government of Gibraltar
  35. Government of Gibraltar
  36. Gibraltarlaw.com (law firm)
  37. Bullish Group (company announcement)
  38. Tracxn
  39. https://rm.coe.int/moneyval-2024-5-gib-5thround-2ndenhfur/1680b06419
  40. https://www.chronicle.gi/moneyval-experts-say-gibraltar-has-improved-measures-for-tackling-money-laundering-and-terrorist-financing/
  41. https://www.gibraltarlaws.gov.gi/legislations/sanctions-act-2019-4573/download
  42. https://gibraltarlaws.gov.gi/legislations?topic=416
  43. https://www.theblock.co/news/regulation/2026-10-19-revolut-secures-gibraltar-crypto-licence-to-support-international-expansion-plans-418889
  44. Gibraltar Financial Intelligence Unit
  45. Gibraltar Financial Intelligence Unit
  46. Government of Gibraltar
  47. National Coordinator for AML/CFT, HM Government of Gibraltar
  48. Gibraltarlaw.com / Thomson Reuters
  49. Gibraltar Finance / Government of Gibraltar
  50. Resilience Group
  51. Gibraltar Financial Services Commission
  52. Gibraltar Financial Services Commission
  53. Government of Gibraltar (gibraltarlaws.gov.gi)
  54. HM Government of Gibraltar, National Coordinator for AML/CFT
  55. Office of Fair Trading, HM Government of Gibraltar
  56. Government of Gibraltar
  57. Gibraltar Financial Services Commission
  58. Notabene
  59. Government of Gibraltar
  60. Parliament of Gibraltar
  61. Gibraltar Financial Services Commission
  62. GBC News
  63. GBC News
  64. FATF
  65. National Coordinator for AML/CFT, HM Government of Gibraltar
  66. Gibraltar Chronicle
  67. World Offshore Banks
  68. Signature Litigation
  69. FATF / MONEYVAL
  70. Gibraltar Financial Services Commission
  71. Government of Gibraltar (gibraltarlaws.gov.gi)
  72. Gibraltar Gambling Commissioner
  73. Government of Gibraltar (gibraltarlaws.gov.gi)
  74. GBC News
  75. Gibraltar Financial Intelligence Unit (GFIU)
  76. Government of Gibraltar (gibraltarlaws.gov.gi)
  77. Gibraltar Regulatory Authority
  78. British Overseas Territory of Gibraltar
  79. Gibraltar
  80. Fatf-gafi
  81. Gibraltar's progress in strengthening measures to tackle money laundering and terrorist financing
  82. Gibraltar's measures to combat money laundering and terrorist financing
  83. 1 Anti-money laundering and counter-terrorist financing measures Gibraltar
  84. Assessments
  85. Mutual Evaluations
  86. Consolidated assessment ratings
  87. Publications
  88. Gibraltar Assessment
  89. Money laundering and terrorist financing risks
  90. FATF launches National Risk Assessment toolkit to help countries identify greatest money laundering risks
  91. Commission updates list of high-risk countries to strengthen international fight against financial crime - Finance
  92. July 2025 National Risk Assessment of Money Laundering and
  93. Legislation
  94. Gibraltar Country Guide | Elliptic
  95. The Financial Services (Gibraltar) (Amendment) (EU Exit) Regulations 2025
  96. The Financial Services (Gibraltar) (Amendment) (EU Exit) ...
  97. Market access arrangements for financial services between the UK and Gibraltar
  98. The Financial Services (Gibraltar) (Amendment) (EU Exit) Regulations 2024
  99. Petfre (Gibraltar) Limited - Regulatory sanctions
  100. Enforcement Actions | FinCEN.gov
  101. 2025 Crypto Regulatory Round-Up
  102. Global Crypto Policy Review Outlook 2025/26 Report | TRM Labs
  103. Crypto-assets - Finance - European Commission
  104. How crypto regulation changed in 2025: a global review
  105. DLT and tokenisation: paving the way for an ‘internet of value’ - European Commission
  106. Explanatory Framework for Adequacy Discussions Section I2: Gibraltar Adequacy
  107. Virtual Assets
  108. JULY 2025 The Road to Crypto Regulation
  109. Blockchain and Distributed Digital Ledger Technologies (RP2025) | Interoperable Europe Portal
  110. UK Maritime Services Ban and Oil Price Cap Industry Guidance - GOV.UK
  111. Russian Harmful Foreign Activities Sanctions | Office of Foreign Assets Control
  112. Civil Penalties and Enforcement Information | Office of Foreign Assets Control
  113. Office of Financial Sanctions Implementation – News and updates from the Office of Financial Sanctions Implementation
  114. Enforcement – Office of Financial Sanctions Implementation
  115. Recent Actions | Office of Foreign Assets Control
  116. General Licence – Publication Notice General licence - INT/2026/8893924
  117. Russia sanctions: statutory guidance - GOV.UK
  118. Sanctions Programs and Country Information | Office of Foreign Assets Control
  119. Office of Financial Sanctions Implementation - GOV.UK
  120. Tobacco smuggling between Gibraltar and Tangier: call for strengthening of customs service | The National Archives
  121. Organized Crime Plundering West Africa, Says UNODC Report
  122. Cigarette Smuggling Still Booming | OCCRP
  123. Big Tobacco Smuggling - ICIJ
  124. Tobacco companies linked to criminal organizations in lucrative cigarette smuggling - ICIJ
  125. Philip Morris’ Mafia connections - ICIJ
  126. Big Tobacco Smuggling Archives - ICIJ
  127. The Financial Services (Miscellaneous Amendments) ...
  128. The Financial Services (Gibraltar) (Amendment) (EU Exit) ...
  129. 1 Anti-money laundering and counter-terrorist financing measures Guernsey
  130. Financial Services Act 2021
  131. The Gibraltar (Miscellaneous Amendments) (EU Exit) Regulations 2019 No. 680
  132. lfg real estate (uk) limited - Companies House
  133. Gibraltar: Sharing beneficial ownership information - GOV.UK
  134. GIBRALTAR (UK) LTD overview - Companies House - GOV.UK
  135. MONOLAT VENTURES LIMITED persons with significant control - Find and update company information - GOV.UK
  136. buttonwood holdings limited - Companies House
  137. GIBRALTAR DIRECT LIMITED overview - Companies House
  138. BP (GIBRALTAR) LIMITED overview - Companies House
  139. gibraltar general partner limited - Companies House - GOV.UK
  140. RAPID (GIBRALTAR) overview - Companies House - GOV.UK
  141. RIKAS LIMITED persons with significant control ... - Companies House
  142. Money Laundering Advisory Notice: High Risk Third Countries - GOV.UK
  143. ECSH31555 - Schedule 3ZA - High-Risk Third Countries - HMRC internal manual - GOV.UK
  144. HM Treasury Advisory Notice: High Risk Third Countries - GOV.UK
  145. High-risk third countries
  146. Money Laundering Advisory Notice: June 2026 - GOV.UK
  147. HM Treasury publish updated list of high risk third jurisdictions
  148. The Money Laundering and Terrorist Financing (High-Risk Countries) (Amendment) Regulations 2023
  149. The Money Laundering and Terrorist Financing (High-Risk ...
  150. ECSH64830 - Schedule 3ZA - High-Risk Third Countries - HMRC internal manual - GOV.UK
  151. Rank Interactive (Gibraltar) Limited - Licence summary
  152. Search results for gambling businesses
  153. LiveScore Betting and Gaming (Gibraltar) Limited - Licence summary
  154. Gambling Commission website
  155. Remote sector guidance
  156. News - Gambling Commission
  157. Petfre (Gibraltar) Limited - Licence summary
  158. Remote gambling and software technical standards (RTS)
  159. KPMG Gibraltar eSummit - Sarah Gardner speech
  160. HM Treasury national risk assessment 2025
  161. Rank Interactive (Gibraltar) Limited - Domain names
  162. National risk assessment of money laundering and terrorist financing 2025 - GOV.UK
  163. HM Treasury’s national risk assessment of proliferation financing
  164. Anti-money laundering responsibilities for gambling businesses
  165. The money laundering and terrorist financing risks within the British gambling industry - Executive Summary
  166. Local area risk assessments
  167. Outcomes FATF Plenary, 11-13 February 2026
  168. Outcomes FATF Plenary, 22-24 October 2025
  169. Committee of Experts on the Evaluation of Anti-Money Laundering Measures (MONEYVAL)
  170. Mutual Evaluations
  171. Outcomes of meetings
  172. The FATF Recommendations
  173. Jurisdictions under Increased Monitoring - 13 February 2026
  174. The Russia (Sanctions) (EU Exit) (Amendment) Regulations 2025
  175. The Sanctions (EU Exit) (Miscellaneous Amendments) Regulations 2025
  176. The Russia (Sanctions) (EU Exit) (Amendment) Regulations 2022
  177. Russia: list of designations and sanctions notices - GOV.UK
  178. 2022 No. 1338 OVERSEAS TERRITORIES SANCTIONS
  179. The Russia (Sanctions) (Overseas Territories) Order 2020
  180. The Russia (Sanctions) (Overseas Territories) (Amendment) Order 2024
  181. Legislation
  182. UK Financial Sanctions FAQs - GOV.UK
  183. Gibraltar Financial Intelligence Unit (GFIU) — Financial Sanctions Guidance
  184. Gibraltar Financial Intelligence Unit (GFIU) — Financial Sanctions Guidance
  185. HM Government of Gibraltar
  186. FATF/MONEYVAL
  187. FATF
  188. European Commission
  189. OFSI / HM Treasury
  190. UK Government (legislation.gov.uk)
  191. Elliptic
  192. UK Government (legislation.gov.uk)
Coverage gaps
fim-int-2026-07-07-G001: Primary FATF publication title and …
fim-int-2026-07-07-G001: Primary FATF publication title and URL specific to the 23 February 2024 grey-list removal announcement should be confirmed to replace the generic country-page citation currently used. [resolved]
fim-int-2026-07-07-G002: A single authoritative source joint…
fim-int-2026-07-07-G002: A single authoritative source jointly confirming both the European Commission adoption date (10 June 2025) and the legal entry-into-force date (5 August 2025) for the Gibraltar EU high-risk delisting would remove the current two-source reconciliation dependency. [resolved]
fim-int-2026-07-07-G003: Evidence is needed on whether the M…
fim-int-2026-07-07-G003: Evidence is needed on whether the Maritime Mutual Gibraltar insurance wind-down has fully concluded or whether alternative underwriters have filled the resulting Russia-exposed vessel coverage gap. [resolved]
fim-int-2026-07-07-G004: A searchable public GFSC enforcemen…
fim-int-2026-07-07-G004: A searchable public GFSC enforcement-notices archive, comparable to peer regulators such as the Guernsey Financial Services Commission, would allow continuous verification of case-level supervisory outcomes between MONEYVAL assessment cycles. [resolved]
fim-int-2026-07-07-G005: Primary-source confirmation of the …
fim-int-2026-07-07-G005: Primary-source confirmation of the specific 17 April 2024 UK secondary-legislation instrument cited for the Gibraltar Overseas Territories Order carve-out would strengthen the structural sanctions-divergence claim. [resolved]
fim-int-2026-07-13-G001: No sourced material located for Mex…
fim-int-2026-07-13-G001: No sourced material located for Mexico (MX) this cycle in the Tier-D jurisdiction sweep. [resolved]
fim-int-2026-07-13-G002: No sourced material located for Col…
fim-int-2026-07-13-G002: No sourced material located for Colombia (CO) this cycle in the Tier-D jurisdiction sweep. [resolved]
fim-int-2026-07-13-G003: A second distinct TBML corridor bey…
fim-int-2026-07-13-G003: A second distinct TBML corridor beyond the historic Cambodia/Poipet corridor (e.g. UAE or LatAm trade-triangle) could not be freshly sourced this cycle. [resolved]
fim-int-2026-07-13-G004: No named enforcement action with a …
fim-int-2026-07-13-G004: No named enforcement action with a specific fine or DPA amount was located this cycle. [resolved]
fim-int-2026-07-13-G005: D6 (Compliance Technology and Activ…
fim-int-2026-07-13-G005: D6 (Compliance Technology and Active Defence) coverage remains thin — no fresh FinCEN, FCA/JMLSG or MAS RegTech guidance was located this cycle. [resolved]
fim-int-2026-08-08-G001: No GI-specific enabler-jurisdiction…
fim-int-2026-08-08-G001: No GI-specific enabler-jurisdiction (D3) finding located this cycle; professional-facilitator role in Gibraltar's fund/company services sector not assessed. [resolved]
fim-int-2026-08-08-G002: No GI-specific conflict-finance (D4…
fim-int-2026-08-08-G002: No GI-specific conflict-finance (D4) finding located this cycle. [resolved]
fim-int-2026-08-08-G003: Tier D jurisdiction checks (KH/LA/M…
fim-int-2026-08-08-G003: Tier D jurisdiction checks (KH/LA/MX/CO) awaiting primary source (transient, not a no-source structural gap) — not resolved this cycle given GI-bound dispatch scope. [resolved]
fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): The precise legal text of LN 147/LN 220 (trust carve-out from the UBO register) was not independently retrieved this cycle; only T3 secondary commentary corroborates the reversal. [resolved]
fim-int-2026-08-20-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-08-20-G002 ({'scheme': 'financial_integrity', 'value': 'D5'}): The Virtual Asset Arrangements extension of the Financial Services Act 2019 rests on a sole T4 vendor source; no primary GFSC publication was retrieved this cycle. [resolved]
fim-int-2026-08-20-G003: Tier-D watch jurisdictions (KH/LA/M…
fim-int-2026-08-20-G003: Tier-D watch jurisdictions (KH/LA/MX/CO) were not actively searched this cycle as the run was GI-scoped by union-dispatch design. [resolved]
fim-int-2026-08-20-G004 ({'scheme': 'financial_integrity', '…
fim-int-2026-08-20-G004 ({'scheme': 'financial_integrity', 'value': 'D3'}): No D3 (Enabler Jurisdictions) or D4 (Conflict Finance) material was identified this cycle for Gibraltar. [resolved]
fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): GFIU reporting-recipient, deadline and moratorium-period detail for VASP suspicion reporting was not reached within this cycle's search budget. [resolved]
fim-int-2026-10-04-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-04-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): Crypto-specific sanctions designation/freeze mechanics under Gibraltar's Sanctions Act 2019 (as amended 2024, 2026) were not independently verified this cycle. [resolved]
fim-int-2026-10-04-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-04-G003 ({'scheme': 'financial_integrity', 'value': 'D7'}): Substantive content of the Financial Services (Payment Services)/(Electronic Money) (Amendment) Regulations 2026 (2026/224, 2026/225) was not retrieved this cycle; only the instruments' existence and date are confirmed. [resolved]
fim-int-2026-10-06-G001: Open findings on EMI third-party re…
fim-int-2026-10-06-G001: Open findings on EMI third-party reliance (POCA s.23), eligible-introducer conditions (GFSC ch.5), and VASP transfer-regulation detail (LN 2026/134, LN 2026/147) lack verbatim-quote admission and were not promoted to structured_claims; a verbatim-source pass would allow Confirmed-tier claims on outsourcing liability and VASP perimeter scope. [resolved]
fim-int-2026-10-06-G002: GFSC AML/CFT/CPF Guidance Notes v13…
fim-int-2026-10-06-G002: GFSC AML/CFT/CPF Guidance Notes v13.0 (Dec 2022) formal withdrawal status is unconfirmed; several R-numbered guidance references (e.g. MLRO location) may be superseded by sectional updates (Oct 2024) but no GFSC statement of withdrawal was located. [resolved]
fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): The successor instrument (LN.2026/134) replacing GI's crypto travel-rule regulations (revoked effective 15 July 2026) was not retrieved this cycle; its substantive AML content for virtual-asset transfers is unconfirmed. [resolved]
fim-int-2026-10-18-G002: Tier D watch jurisdictions (KH, LA,…
fim-int-2026-10-18-G002: Tier D watch jurisdictions (KH, LA, MX, CO) were not reached this cycle because the pooled union search budget was concentrated on GI. [resolved]
fim-int-2026-10-18-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-18-G003 ({'scheme': 'financial_integrity', 'value': 'D8'}): No GFSC primary-source notice formalising the Bullish Group tokenised-securities approval was independently retrieved this cycle; the finding rests on the company's own announcement. [resolved]
fim-int-2026-10-25-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-25-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): No domain findings located this cycle for D2 (beneficial ownership), D3 (enabler jurisdictions) or D4 (conflict finance) specific to Gibraltar; treated as coverage gap given narrow 7-day window and pooled search budget, not confirmed no-change. [open]
fim-int-2026-10-25-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-25-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): Substantive content (penalty quanta, procedure) of the new Sanctions Civil Enforcement Regulations 2026 is assessed at Probable confidence pending consolidated GFSC/GFIU civil-penalty tariff guidance. [open]
fim-int-2026-10-25-G003: Tier-D (KH/LA/MX/CO) checks were no…
fim-int-2026-10-25-G003: Tier-D (KH/LA/MX/CO) checks were not performed this cycle; this is a budget-driven gap, not a finding of no material change. [open]
fim-int-2026-11-01-G010 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G010 ({'scheme': 'financial_integrity', 'value': 'D6'}): Compliance-technology supervisory expectations (CT1) could not be confirmed at a T1 source within search budget. [open]
fim-int-2026-11-01-G011 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G011 ({'scheme': 'financial_integrity', 'value': 'D4'}): Cross-firm fraud/mule-account duties (FRA1) could not be confirmed at a T1 source within search budget. [open]
fim-int-2026-11-01-G012 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G012 ({'scheme': 'financial_integrity', 'value': 'D7'}): Information-sharing gateways and UWO/production-order response deadlines (SAR3) could not be confirmed at a T1 source within search budget. [open]
fim-int-2026-11-01-G013 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G013 ({'scheme': 'financial_integrity', 'value': 'D7'}): Periodic AML-audit/vetting cycle specifics (GOV2) could not be confirmed at a T1 source within search budget. [open]
fim-int-2026-11-01-G014 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G014 ({'scheme': 'financial_integrity', 'value': 'D5'}): No research items found this cycle for D5 (Crypto/Digital Assets/Financial Innovation) or D8 (Commercial Activity) in the financial_crime domain research block. [open]
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', 'value': 'D6'}): Compliance-technology supervisory expectations (CT1) could not be confirmed at a T1 source within the search budget. [open]
fim-int-2026-11-01-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): Cross-firm fraud/mule-account duties (FRA1) could not be confirmed at a T1 source within the search budget. [open]
fim-int-2026-11-01-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G003 ({'scheme': 'financial_integrity', 'value': 'D7'}): Information-sharing gateways and UWO/production-order response deadlines (SAR3) could not be confirmed at a T1 source within the search budget. [open]
fim-int-2026-11-01-G004 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G004 ({'scheme': 'financial_integrity', 'value': 'D7'}): Periodic AML-audit/vetting cycle specifics (GOV2) could not be confirmed at a T1 source within the search budget. [open]
fim-int-2026-11-01-G005 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G005 ({'scheme': 'financial_integrity', 'value': 'D7'}): Supervisory Bodies (Sanctions) (Enforcement) Regulations 2025 may supersede the 2017 Powers Regulations; this consumer has not researched the successor instrument's enforcement/sanctions framework directly, only identified it as a candidate via an unrouted research lead. [open]
FIM-GAP-001 (D3): MONEYVAL's assessment found that in the ma…
FIM-GAP-001 (D3): MONEYVAL's assessment found that in the majority of cases, sanctions imposed by Gibraltar's supervisory authorities for AML/CFT breaches were not proportionate or dissuasive, undermining the deterrent effect of an otherwise technically-compliant framework.
FIM-GAP-002 (D1): Assessors found no evidence that Gibraltar…
FIM-GAP-002 (D1): Assessors found no evidence that Gibraltar has ever frozen assets or transactions as a result of proliferation-financing targeted financial sanctions, and private-sector (particularly DNFBP) awareness of PF-TFS obligations was assessed as low compared to terrorist-financing TFS awareness.
FIM-GAP-003 (D3): Gibraltar authorities were found to make a…
FIM-GAP-003 (D3): Gibraltar authorities were found to make a low number of outgoing mutual legal assistance requests relative to the cross-border, complex nature of the proceeds of crime affecting the jurisdiction, raising doubts about proactive pursuit of foreign-predicate asset recovery.
FIM-GAP-004 (D6): Publicly surfaced material on GFSC-specifi…
FIM-GAP-004 (D6): Publicly surfaced material on GFSC-specific enforcement actions (fines, licence revocations) against individual regulated firms within the last 18 months is thin in open-source reporting; the GFSC does not appear to maintain as visible a public enforcement-notices archive as comparator regulators (e.g. Guernsey FSC), limiting independent verification of granular supervisory outcomes for this baseline.

Evidence

Confidence-tiered claims

No numerical e-money derogation exists; SDD under s.16 is constrained by s.16(5) NRA geographic precedence, barring SDD for customers connected to Spain. [Source 1]
Probable · 1 source
Spain can never be rated Low and no Spain-connected customer may receive SDD; Morocco may not be rated Low; funds from Spain or Morocco must be categorised as high risk subject to additional risk-based controls. [Source 1]
Probable · 1 source
Compensating measures mandatory where customer not physically present, e.g. additional documents, certification, or first payment through an account in the customer's name at a credit institution. [Source 1]
Probable · 1 source
Five years record retention covering CDD copies including eID data and transaction records. [Source 1]
Probable · 1 source
The Gibraltar legal entity providing an account owns the AML risk and CDD/EDD decision; reliance on a third party leaves the Gibraltar firm liable (s.23). A Gibraltar branch of a UK company has the UK company as the risk-owning legal person under UK MLRs reg 20. [Source 1]
Probable · 1 source
The PEP test is the prominent public function, not residence; no foreign/domestic distinction; middle-ranking and junior officials excluded; every PEP relationship treated as higher risk regardless of EEA residence. [Source 1]
Probable · 1 source
Commencing 15 Jul 2026, revokes onshored Regulation (EU) 2015/847; regs 6/8 require payer/payee details, verification before execution; unlinked transfers up to EUR 1,000 equivalent carry reduced info; reg 25 requires policies for restrictive measures; reg 28 requires 5-year record retention. [Source 1]
Probable · 1 source
Art 198(2): UK, in respect of Gibraltar, must not weaken AML/CFT measures below Annex 17 Union acts in force at entry into force (provisional application date under art 336(4)). Annex 17 lists Directive 2015/849 as amended, AMLR 2024/1624, AMLD6 2024/1640, AMLA Regulation 2024/1620, Regulation 2023/1113. No EU market access/passport created. European Parliament consent pending (indicative plenary 14 Dec 2026). [Source 1]
Probable · 1 source
Where a PEP leaves office, firm must for at least 12 months apply risk-sensitive measures until deemed no further PEP risk; s.20(2) extends s.20B to family members and known close associates as though themselves PEPs (unlike UK, which drops family/associates when the PEP leaves office). [Source 1]
Probable · 1 source
Ongoing monitoring requires scrutiny of transactions against knowledge of customer, business and risk profile; PEP monitoring enhanced (s.20(1)(c)); s.17(3) requires examination of complex/unusually large/unusual-pattern/no-apparent-purpose transactions; statutory sanctions check at s.10(ca); tipping-off duties at ss.5 and 11(5)/(5A). [Source 1]
Probable · 1 source
Largely Compliant on FATF Recommendation 36 (was Partially Compliant) [Source 1]
Probable · 1 source
Revoked by LN.2026/134 effective 15 July 2026 [Source 1]
Probable · 1 source
Sanctions Civil Enforcement Authority (Designation) Order 2026 (LN.2026/332; LN.2026/333) [Source 1]
Probable · 1 source
POCA (as amended), Sanctions Act 2019, Terrorism Act 2018, Crimes Act 2011, supervised by GFSC with GFIU as SAR/STR recipient; autonomous of EU AMLR/6AMLD/AMLA, assessed by MONEYVAL [Source 1]
Probable · 1 source
Bullish Group GFSC approval to trade tokenised securities; PCC Amendment Act 2026 creates tokenised EIF cell-share regime; GI fintech $452M cumulative VC/PE funding across 32 companies [Source 1]
Probable · 1 source
Largely Compliant on R.36 (up from Partially Compliant); 5th-round enhanced follow-up terminated [Source 1]
Probable · 1 source
Civil monetary penalty track for sanctions breaches (balance of probabilities), recoverable as civil debt, established via Sanctions Civil Enforcement Regulations 2026 and Sanctions Civil Enforcement Authority (Designation) Order 2026 (both 9 September 2026) under the enabling Sanctions (Amendment) Act 2026 (9 July 2026) [Source 1]
Probable · 1 source
GFSC DLT Provider licence for virtual-asset order execution, custody and staking, via a newly established Gibraltar entity [Source 1]
Probable · 1 source
Relevant firms must report frozen assets and suspected sanctions breaches promptly [Source 1]
Probable · 1 source
Holdings of multiple designated persons are aggregated for ownership/control purposes under the prescribed-interest test [Source 1]
Probable · 1 source
Gibraltar may apply trade sanctions on movement of goods, services or technology in addition to asset-freeze measures [Source 1]
Probable · 1 source
2021 amendments explicitly name proliferation financing (PF) alongside ML/TF throughout POCA, extending CDD, risk-assessment, reporting and screening to CPF [Source 1]
Probable · 1 source
2023 amendment regulations require relevant financial businesses to conduct international sanctions screening as part of CDD [Source 1]
Probable · 1 source
A UBO is a natural person owning/controlling more than 25%+1 share; otherwise Senior Managing Official is registered [Source 1]
Probable · 1 source
All discrepancies on the UBO Register must be reported to the GFSC [Source 1]
Probable · 1 source
The issue of new bearer shares is prohibited in Gibraltar [Source 1]
Probable · 1 source
Relevant financial businesses must obtain senior management approval, establish source of wealth/funds, and apply enhanced ongoing monitoring for PEPs [Source 1]
Probable · 1 source
EDD measures required for customers/transactions connected to EC/FATF high-risk third countries [Source 1]
Probable · 1 source
Full CDD not required where statutory simplified due diligence conditions are met for lower-risk customers/products [Source 1]
Probable · 1 source
Firms may rely on third-party CDD but remain ultimately liable for compliance [Source 1]
Probable · 1 source
OFT is the Supervisory Authority under POCA for High Value Goods Dealers, Art Market Participants and Real Estate/Letting Agents; TCSPs are licensed by GFSC [Source 1]
Probable · 1 source
Part 7 permission regime for all regulated financial-services activities including payment services and e-money [Source 1]
Probable · 1 source
DLT Provider's business requires a Part 7 permission; penalties capped at higher of 2x benefit, GBP 1,000,000 or 5% annual turnover [Source 1]
Probable · 1 source
VASPs must obtain and transmit originator/beneficiary info for transfers >= EUR 1,000 [Source 1]
Probable · 1 source
Establishes GFIU; Part III sets CDD, record-keeping, reporting duties; SAR/consent regime; criminal penalties up to 14 years imprisonment [Source 1]
Probable · 1 source
Automatic recognition of UN/UK/EU sanctions plus autonomous Gibraltar designations; screening duty amended 2024 [Source 1]
Probable · 1 source
Omits s.8(3)-(4) Sanctions Act 2019 screening-policy provisions, recasting the freezing/disclosure duty [Source 1]
Probable · 1 source
{'amount': 150000, 'currency': 'GBP'} [Source 1]
Probable · 1 source
{'amount': 294479, 'currency': 'GBP'} [Source 1]
Probable · 1 source
{'alvar_amount': 186038.52, 'argon_amount': 71281, 'currency': 'GBP'} [Source 1]
Probable · 1 source
All 40 FATF Recommendations rated LC/C following re-rating of R.36 [Source 1]
Probable · 1 source
Company management, cross-border finance, virtual assets and cyber-enabled fraud flagged as priority high-risk areas; Spain and Morocco flagged as higher-risk neighbouring jurisdictions [Source 1]
Probable · 1 source
GFSC signalled forthcoming consultation paper on enhanced CDD obligations aligned with FATF R.16 updates, targeting VASPs and correspondent banking [Source 1]
Uncertain · 1 source
Open access restored for corporate and legal entities; express trusts carved out from public inspection, effective 15 July 2026 [Source 1]
Probable · 1 source
On-site visit provisionally scheduled October 2027; Plenary discussion expected around May 2028 [Source 1]
Probable · 1 source
CDD measures applied prior to establishment of business relationship or occasional transaction [Source 1]
Probable · 1 source
Relevant persons must report suspicion of ML/TF/PF to GFIU without delay; consent/moratorium regime applies [Source 1]
Probable · 1 source
Disclosing a SAR/investigation likely to prejudice it is a criminal offence [Source 1]
Probable · 1 source
CDD records retained for 5 years from completion of occasional transaction or end of business relationship [Source 1]
Probable · 1 source
Penalty up to higher of 2x benefit derived or EUR 1 million (non-FI); up to EUR 5 million or 10% turnover (credit/financial institutions) [Source 1]
Probable · 1 source
Supreme Court may require explanation of property worth over GBP 50,000 where known lawful income insufficient; false statement offence up to 2 years imprisonment [Source 1]
Probable · 1 source
{'value': 5816, 'unit': 'count', 'period': '2025'} [Source 1]
Probable · 1 source
{'received': 194, 'granted': 166, 'period': 'Q2 2025'} [Source 1]
Probable · 1 source