Crypto Wallet Custody License Gibraltar Crypto License: Crypto Wallet Custody License Gibraltar: Your 2026 Guide
Gibraltar has established itself as a leading jurisdiction for blockchain and crypto businesses, particularly through its Distributed Ledger Technology (DLT) Provider framework. For firms offering crypto wallet custody services, obtaining a Gibraltar crypto license is a strategic move to access a well-regulated European gateway. The Gibraltar Financial Services Commission (GFSC) oversees this regime, which is designed to balance innovation with strong consumer protection.
This guide covers everything you need to know about the crypto wallet custody license in Gibraltar: who needs it, the regulator, capital requirements, tax treatment, step-by-step application process, and how Consulting24 can advise and coordinate your application. While we deliver directly in Estonia, Lithuania, and Panama, for Gibraltar we provide expert advisory and coordination services to help you navigate the regulatory landscape.
What is the Gibraltar Crypto Wallet Custody License?
The Gibraltar crypto wallet custody license is a regulatory authorisation issued by the GFSC under the Financial Services (Distributed Ledger Technology Providers) Regulations 2017 (as amended). It allows firms to provide custodial wallet services for digital assets, including storing, safeguarding, and administering private keys on behalf of clients. The license is part of Gibraltar's DLT Provider framework, which is one of the earliest comprehensive regimes for blockchain businesses in Europe.
Key features of the license include:
- Authorisation to hold and control client crypto assets in custody.
- Compliance with anti-money laundering (AML) and counter-terrorist financing (CTF) obligations.
- Adherence to the GFSC's Principles for DLT Providers, which cover governance, risk management, and consumer protection.
- Ongoing supervision and reporting requirements.
Gibraltar's approach is principles-based, meaning the GFSC focuses on outcomes rather than prescriptive rules. This gives firms flexibility in how they achieve compliance, but also requires a strong internal control framework. For a comparison with other jurisdictions, see our jurisdictions page.
Who Needs a Gibraltar Crypto Wallet Custody License?
Any firm that provides custodial wallet services for digital assets in or from Gibraltar must hold a DLT Provider license. This includes:
- Crypto exchanges that offer wallet custody to their users.
- Dedicated custody service providers (e.g., institutional-grade custodians).
- Wealth management platforms that hold client crypto assets.
- Any business that stores private keys on behalf of third parties.
If your business involves holding or controlling client crypto assets, you likely need this license. The GFSC also considers whether the service is provided to retail or professional clients, as this affects capital requirements and conduct rules. Firms that only provide non-custodial wallet software (where the client controls their own keys) may not need a license, but it is advisable to seek legal advice. Consulting24 can help you determine if your activities fall within the scope of the DLT Provider regime.
License Type and Regulator
The regulatory body for crypto wallet custody licenses in Gibraltar is the Gibraltar Financial Services Commission (GFSC). The license type is a DLT Provider License, which covers a range of activities including custody, exchange, and payment services using distributed ledger technology.
Under the DLT Provider Regulations, there is a single license category, but the GFSC may impose specific conditions based on the nature and scale of your business. For example, a firm offering only custody services may have different requirements than one also operating an exchange. The GFSC evaluates each application on its merits, considering factors such as the business model, risk profile, and management competence.
Gibraltar is not part of the EU, but it has a strong reputation for regulatory compliance and is on the FATF's white list. As of 2026, the GFSC continues to align its standards with international best practices, including the FATF recommendations on virtual assets. For more on other regulatory frameworks, see our comparison with Lithuania.
Cost and Timeline
The cost and timeline for obtaining a Gibraltar crypto wallet custody license vary depending on the complexity of your application and the readiness of your compliance framework. Below is an indicative table based on typical market data for 2026. Exact figures are confirmed during a consultation.
| Item | Estimated Cost (EUR) | Notes |
|---|---|---|
| GFSC application fee | 2,000 - 5,000 | Non-refundable; varies by activity |
| GFSC annual fee | 5,000 - 20,000 | Based on revenue and complexity |
| Legal and advisory fees | 15,000 - 40,000 | Includes drafting policies, AML manuals |
| Compliance officer salary (annual) | 50,000 - 80,000 | Must be a local resident or engaged locally |
| Audit and reporting costs (annual) | 5,000 - 15,000 | Requires GFSC-approved auditor |
| Total first-year cost (approx.) | 75,000 - 160,000 | Includes setup and first year fees |
Timeline: The application process typically takes 4 to 8 months from submission to approval, assuming all documents are in order. Pre-submission preparation can add 2-4 months. The GFSC aims to process complete applications within 6 months. For a faster route, consider our Panama program at a flat EUR 6,000.
Capital Requirement
Gibraltar does not prescribe a fixed minimum capital requirement for DLT Provider licenses in the regulations. Instead, the GFSC requires that firms maintain adequate financial resources proportionate to the nature, scale, and complexity of their business. This is assessed on a case-by-case basis during the application.
In practice, the GFSC expects firms to have sufficient capital to cover operational costs, potential liabilities, and to ensure the safe custody of client assets. For a custody-only business, a common benchmark is EUR 50,000 to 100,000 in initial capital, but this can be higher if you also operate an exchange or handle large volumes. The GFSC may also require a surety bond or professional indemnity insurance.
It is important to note that capital must be held in liquid form and cannot be used for trading or other purposes. The GFSC will review your business plan and financial projections to determine an appropriate level. Consulting24 can help you prepare a strong financial plan that meets the GFSC's expectations.
Tax Treatment
Gibraltar offers a favourable tax regime for crypto businesses. Key points:
- Corporate tax rate: 12.5% on profits, one of the lowest in Europe.
- No capital gains tax: Gibraltar does not levy capital gains tax, which is beneficial for crypto trading profits.
- No VAT on crypto services: The supply of digital assets is generally exempt from VAT.
- No withholding tax: No withholding tax on dividends or interest paid to non-residents.
- Stamp duty: Low or nil on most transactions.
Gibraltar also has a tax exemption for certain investment income, and companies can benefit from a participation exemption on dividends from subsidiaries. However, firms must ensure they have substance in Gibraltar (e.g., a physical office, local directors) to avoid being considered tax resident elsewhere. The GFSC also expects firms to maintain proper accounting records and file annual returns. For a comparison with other tax-friendly jurisdictions, see our cost analysis.
Allowed Activities
A Gibraltar DLT Provider license for custody allows the following activities:
- Safekeeping and administration of crypto assets on behalf of clients.
- Holding of private keys or seed phrases.
- Facilitating the transfer of crypto assets between wallets.
- Providing wallet recovery services.
- Offering staking or lending services (if specifically authorised).
The license does not automatically cover exchange or payment services; those require separate authorisation or a broader DLT license scope. If you plan to offer multiple services, you should apply for a license that covers all intended activities. The GFSC may impose conditions, such as requiring client assets to be held in segregated accounts and regular audits.
Gibraltar also allows firms to passport services into the UK under the Gibraltar (Financial Services) Act, but this is limited to certain activities. For EU access, you may need to consider a Lithuania crypto license under MiCA.
Step-by-Step Application Process
Obtaining a Gibraltar crypto wallet custody license involves several stages. Consulting24 advises and coordinates each step.
- Pre-application assessment: We review your business model, target market, and regulatory readiness. This includes a gap analysis of your AML/CFT policies, governance structure, and financial projections.
- Company incorporation: You must incorporate a Gibraltar company with a registered office and local directors. The company must have substance, including a physical office (can be serviced) and local staff (e.g., compliance officer).
- Document preparation: Drafting of policies and procedures: AML manual, risk assessment, business continuity plan, data protection policy, and custody agreement templates. Also prepare financial statements and a detailed business plan.
- Appoint key personnel: Hire a local compliance officer, MLRO, and at least one director (can be the same person). These individuals must pass the GFSC's fit and proper test.
- Submit application: File the application with the GFSC, including all supporting documents and the application fee. The GFSC will acknowledge receipt and may request additional information.
- Review and interview: The GFSC reviews the application and may conduct interviews with key personnel. They will assess the firm's compliance culture and operational readiness.
- Approval and licensing: If satisfied, the GFSC grants the license with specific conditions. You must then pay the annual fee and begin operations under supervision.
- Ongoing compliance: Submit regular reports (AML, financial, audit), maintain capital, and update policies as needed. The GFSC conducts periodic inspections.
The entire process typically takes 6-12 months. For a faster and simpler alternative, consider our Panama license at a flat EUR 6,000.
Banking and Payment Services
Opening a bank account for a Gibraltar DLT provider can be challenging due to the perceived risk of crypto businesses. However, Gibraltar has a number of banks that are open to licensed firms, provided they have a strong compliance framework. Options include:
- Local Gibraltar banks: e.g., Gibraltar International Bank, Jyske Bank (Gibraltar).
- UK and EU banks: Some may accept Gibraltar-licensed firms, but expect enhanced due diligence.
- EMI accounts: Electronic money institutions like Revolut, Payoneer, or specialised crypto-friendly EMIs.
To facilitate banking, you should have a clear business plan, audited financials, and a strong AML program. The GFSC may also provide a letter of comfort to banks. Consulting24 can introduce you to banking partners who understand the crypto space. For payment processing, you may need to partner with a payment gateway that supports crypto-to-fiat conversions. See our requirements page for more details.
Benefits of a Gibraltar Crypto Wallet Custody License
Gibraltar offers several advantages for crypto custody businesses:
- Regulatory clarity: The DLT framework is well-established, with clear principles and guidance from the GFSC.
- Tax efficiency: Low corporate tax, no capital gains tax, and no VAT on crypto services.
- International reputation: Gibraltar is a respected financial centre, enhancing trust with clients and partners.
- Access to UK market: Under the Gibraltar (Financial Services) Act, DLT providers can passport into the UK for certain services.
- Flexible regulation: Principles-based approach allows innovation without excessive red tape.
- Strong legal framework: English common law system with a strong court system.
However, the cost and timeline are higher than some other jurisdictions. For a more affordable and faster option, consider Panama (flat EUR 6,000) or Lithuania under MiCA. Consulting24 can help you compare and choose the best jurisdiction for your needs.
Compliance and Trust
Compliance is at the heart of the Gibraltar DLT regime. The GFSC expects firms to adhere to the following core principles:
- Integrity and honesty in all dealings.
- Competence and proper governance.
- Risk management and internal controls.
- Protection of client assets (segregation, insurance).
- Transparency and fair treatment of clients.
- Effective AML/CFT measures.
Firms must appoint a compliance officer and MLRO, both of whom must be approved by the GFSC. Regular training for staff is mandatory. The GFSC also requires an annual audit by an approved auditor and submission of financial statements. Non-compliance can result in fines, suspension, or revocation of the license.
Consulting24 advises on building a compliance framework that meets GFSC standards. Note: This is general guidance, not legal advice. You should engage a local lawyer for legal opinions.
Common Mistakes to Avoid
Many applicants face delays or rejection due to avoidable errors. Common mistakes include:
- Inadequate substance: The GFSC requires a physical presence in Gibraltar. Relying on virtual offices or remote staff without local substance is a red flag.
- Poor AML/CFT documentation: Generic policies copied from other jurisdictions will not pass scrutiny. They must be tailored to your business model and Gibraltar's requirements.
- Unrealistic financial projections: Overly optimistic revenue forecasts or insufficient capital can lead to rejection.
- Lack of local expertise: The compliance officer and MLRO must have relevant experience and be based in Gibraltar.
- Ignoring ongoing obligations: Some firms think the license is a one-time event, but ongoing reporting and audits are critical.
To avoid these pitfalls, work with an experienced advisor like Consulting24. We have helped numerous firms navigate the Gibraltar process. For a simpler alternative, see our Panama program.
Alternatives and Comparison
Gibraltar is not the only option for a crypto wallet custody license. Below is a comparison with Panama and Lithuania (under MiCA).
| Feature | Gibraltar | Panama | Lithuania (MiCA) |
|---|---|---|---|
| Regulator | GFSC | No dedicated crypto regulator (law pending) | Bank of Lithuania |
| License type | DLT Provider | No specific license (operate as a company) | CASP (MiCA) |
| Minimum capital | EUR 50k-100k (case-by-case) | None (EUR 6,000 flat fee for company setup) | EUR 50k / 125k / 150k by service |
| Corporate tax | 12.5% | 0% on foreign-source income | 15% |
| Timeline | 6-12 months | 2-4 weeks | 3-6 months |
| Cost (first year) | EUR 75k-160k | EUR 6,000 flat | EUR 20k-50k |
| EU passporting | Limited (UK only) | No | Full EU (MiCA) |
For firms seeking a low-cost, fast entry, Panama is ideal. For EU market access, Lithuania under MiCA is better. Gibraltar suits those who want a reputable, regulated environment with UK access. Consulting24 can advise on the best fit. See our El Salvador and Switzerland pages for more options.
Why Choose Consulting24?
Consulting24 (X24Consulting OU, Tallinn, Estonia) has obtained over 500 crypto licenses worldwide. We deliver directly in Estonia, Lithuania, and Panama, and for Gibraltar we provide expert advisory and coordination services. Our team includes former regulators, compliance specialists, and legal experts who understand the nuances of each jurisdiction.
We offer:
- End-to-end support from company formation to license approval.
- Tailored AML/CFT documentation and compliance manuals.
- Introduction to local service providers (lawyers, auditors, banks).
- Ongoing compliance monitoring and reporting assistance.
Our flat-fee Panama package (EUR 6,000) is the most cost-effective option for crypto custody. Contact us via WhatsApp or book a consultation to discuss your project.
Frequently asked questions
What is the difference between a Gibraltar DLT license and a CASP license under MiCA?
A Gibraltar DLT license is issued under local regulations (2017) and is not automatically recognised in the EU. MiCA (Markets in Crypto-Assets) is an EU-wide regulation that allows passporting across member states. Gibraltar is not in the EU, so a DLT license does not provide EU passporting rights, though it does offer access to the UK under a bilateral agreement.
Can I apply for a Gibraltar crypto custody license if my company is based outside Gibraltar?
Yes, but you must incorporate a Gibraltar subsidiary with a physical office and local directors. The GFSC requires that the licensed entity be a Gibraltar company with substance there. Consulting24 can assist with the incorporation and substance setup.
How long does the Gibraltar crypto license application take?
The GFSC aims to process complete applications within 6 months, but the total timeline from preparation to approval is typically 6-12 months. Pre-submission preparation (company incorporation, policy drafting) can take 2-4 months. For a faster option, consider Panama (2-4 weeks).
What are the ongoing compliance requirements for a Gibraltar DLT provider?
Firms must submit annual audited financial statements, AML reports, and conduct regular risk assessments. They must also maintain capital adequacy, appoint a local compliance officer, and undergo periodic GFSC inspections. Non-compliance can lead to fines or license revocation.
Is Gibraltar a good jurisdiction for crypto custody services?
Yes, for firms targeting the UK market or seeking a reputable, well-regulated environment. Gibraltar offers tax advantages and a principles-based regulatory approach. However, the cost and timeline are higher than some alternatives like Panama or Lithuania.
What is the minimum capital for a Gibraltar crypto custody license?
There is no fixed minimum in the regulations, but the GFSC expects firms to hold adequate financial resources. In practice, EUR 50,000 to 100,000 is common for custody-only businesses. The exact amount is determined during the application based on your business plan.
Can a Gibraltar DLT provider serve clients in the EU?
Not directly, as Gibraltar is not in the EU. However, you can serve clients globally, including the EU, on a reverse solicitation basis. For active marketing to EU clients, you would need a MiCA license from an EU member state, such as Lithuania.
What activities are not covered by a Gibraltar custody license?
The custody license does not automatically cover exchange services, payment processing, or proprietary trading. If you plan to offer these, you must apply for a broader DLT license or separate authorisation. The GFSC will specify the scope in your license conditions.
How much does it cost to maintain a Gibraltar DLT license annually?
Annual costs include the GFSC fee (EUR 5,000-20,000), compliance officer salary (EUR 50,000-80,000), audit fees (EUR 5,000-15,000), and office rent (EUR 10,000-30,000). Total annual maintenance is typically EUR 70,000-150,000.
Does Gibraltar require a local director?
Yes, the GFSC requires that at least one director be a Gibraltar resident (or a professional director firm). The compliance officer and MLRO must also be based in Gibraltar. This ensures the firm has local oversight and accountability.
Can I use a Gibraltar license to passport into the UK?
Yes, under the Gibraltar (Financial Services) Act, DLT providers can passport certain services into the UK. However, this is limited to activities covered by the UK's equivalent regime. You should seek legal advice on the specific scope.
What happens if my Gibraltar license application is rejected?
The GFSC will provide reasons for rejection. You can address the deficiencies and reapply, but there is no formal appeal process. Common reasons include insufficient substance, poor AML controls, or unfit personnel. Consulting24 can help you strengthen your application before submission.
Related jurisdictions
Talk to a crypto-licensing expert
500+ licenses across Estonia, Lithuania, Panama and beyond. Tell us your model and we'll map the right route — honestly.
💬 Talk to an expertFree consultationGeneral guidance, not legal advice. Rules and fees evolve — we confirm current requirements for your case.