The Crypto First Gibraltar Can Claim, and the Two It Cannot

28 September 2026 Last checked 2026-09-28

You will read that Gibraltar was the first country to regulate crypto. It is not a country, and New York, the Isle of Man and Japan all got there earlier. The real first is narrower.

The claim is everywhere, and two thirds of it is wrong. Gibraltar was not the first country in the world to regulate crypto. It is not a country, and it was not first.

What it did do, on 1 January 2018, is narrower than the headline and more interesting than it. Gibraltar wrote the first purpose built licensing regime for firms that use distributed ledger technology to hold or move value belonging to somebody else. That claim is defensible. The bigger one is not, and the government's own agencies have quietly stopped making it.

Below is what the law actually says, what a licence costs, how long it takes, and why the process puts founders physically in Gibraltar for weeks at a time. Every figure links to the document it came from. Where we could not verify something, we say so instead of guessing.

Start with the word country

Gibraltar is a British Overseas Territory of 37,936 people at the 2022 census. It has its own parliament, its own courts and its own financial services legislation, and it is a member state of nothing. Calling it a country is the shorthand that makes a superlative sound bigger than it is. We have written at length on what Gibraltar's status actually is.

The right word is jurisdiction. It matters here, because the jurisdictions Gibraltar was racing on timing were a US state, a Crown Dependency and a G7 economy.

Three jurisdictions got there before Gibraltar

New York was the earliest of the three. The state's Department of Financial Services adopted its virtual currency regulation, 23 NYCRR Part 200, the rule everyone calls the BitLicence, and it took effect on 24 June 2015. The DFS still licenses virtual currency businesses under it, across five categories of activity from custody to exchange to issuance. It is a state regime rather than a national one, and that is the only thing standing between New York and the outright title.

The Isle of Man moved in 2015 as well, pulling convertible virtual currency businesses into its anti money laundering regime under the Designated Businesses (Registration and Oversight) Act 2015. The Isle of Man Financial Services Authority's own sector guidance is careful about what that means: registration and oversight for money laundering purposes, not a financial services licence. The distinction is genuine, and it is what leaves room for Gibraltar's claim.

Japan is the awkward one. The amended Payment Services Act came into force in April 2017, nine months ahead of Gibraltar, and it was never only an AML measure. The Japanese Financial Services Agency's own account of the reform lists minimum capital requirements, mandatory disclosure to customers, segregation of customer assets and secure systems management alongside the registration system for crypto asset exchange service providers. That is prudential regulation, and it predates Gibraltar.

Read across that table and Gibraltar's position is clear enough. Fourth by date. First by design.

What Gibraltar actually did first

The regulations were published on 12 October 2017 and came into force on 1 January 2018. They did not regulate an asset. They regulated a technology used in one particular way, which is why the framework has outlasted eight years of the market underneath it changing shape three or four times. The instrument in force now is the Financial Services (Distributed Ledger Technology Providers) Regulations 2020, LN.2020/012, which commenced on 15 January 2020 and has been amended four times since.

The official language has drifted, and the drift is the tell. In September 2020 the government wrote that Gibraltar became the very first jurisdiction globally to introduce legislation around distributed ledger technology, in a press release about refreshing the framework. Gibraltar Finance now calls the regulations one of the first pieces of legislation worldwide that specifically caters to DLT. One of the first. Somebody in the Finance Centre checked.

Fourth to regulate. First to write a rulebook for the technology instead of the coin.

The trigger is narrower than the word crypto

Under Schedule 2, Part 16, paragraph 139 of the Financial Services Act 2019, the regulated activity is using DLT for storage or transmission of value belonging to another. The GFSC's scope guidance note spells out the consequence: any firm carrying that on by way of business, in or from Gibraltar, needs authorisation as a DLT Provider.

The word doing the work is another. Value belonging to you is your problem. Value belonging to somebody else is the regulator's. The GFSC gives the example itself: a bank using DLT in its back end processes is unlikely to need separate authorisation, while the same bank offering virtual asset wallets almost certainly will.

The guidance lists what sits inside the perimeter. Custodial virtual asset wallet providers. Virtual asset ATM operators, the machines people call Bitcoin kiosks. Spot exchanges, custodial or not. Virtual asset derivatives exchanges. OTC and brokerage desks, where DLT is used in storing or transmitting somebody else's value. It is a list of activities rather than a list of coins, and that is the entire design.

Nine principles became ten, and one GFSC document has not caught up

The framework runs on core principles rather than rules, on the stated reasoning that rigid rules in a fast moving technology go stale. The Schedule to the 2020 Regulations sets them out: honesty and integrity; fair treatment and clear communication; adequate financial and non financial resources; effective management with due skill, care and diligence; protection of customer assets and money; effective corporate governance; high standards for systems and security access; systems to prevent, detect and disclose financial crime; and resilience with contingency plans for an orderly wind down.

That is nine, and nine is what the framework launched with. A tenth arrived on 27 April 2022 through LN.2022/102: a DLT Provider must conduct itself in a manner which maintains or enhances the integrity of any markets in which it participates. The government's press release that month framed it as setting the highest standards for market integrity across a diverse asset class. In plain terms it is the anti market manipulation principle, and it took four years to arrive.

One thing to know if you are applying. The GFSC's published application process document, still the live link for the fee schedule, asks applicants to present evidence of how they will meet the nine regulatory outcomes and principles. There are ten. The document was written in 2017 and the law moved in 2022. Prepare for ten.

What it costs and how long it takes

The published ladder opens with a non refundable initial application assessment fee of 2,000 pounds. The GFSC then has two weeks to place the firm in a complexity category, weighing whether it will hold client assets, whether smart contracts add complexity, whether the customers are retail or institutional, and how exposed the model is to money laundering risk.

The category sets the price. The GFSC's application process and fee structure document gives 10,000 pounds for complexity category 1, 20,000 for category 2 and 30,000 for category 3, with 8,000, 18,000 and 28,000 of that payable when the full application goes in. The annual fee then matches the application fee at each level. Application fees are non refundable. The service level standard for the whole thing, from initial assessment to licence, is three months.

An honest caveat on those numbers. That document is dated 4 October 2017, and fee levels now sit in the Financial Services (Fees) Regulations 2020, which get amended. We could not confirm from a primary source that the 2026 figures are unchanged, so treat the ladder above as the shape of the cost and ask the GFSC for the current number before you budget against it.

The presentation is why founders keep turning up in person

Most licensing regimes are paperwork. This one has a step that is not. Once the full application is in and the balance of the fee is paid, the GFSC invites the applicant to deliver a presentation, and its own document is explicit that this is an integral part of the authorisations process rather than a formality.

The room is not junior either. GFSC staff present are expected to include the Risk and Innovation team, whichever members of the Panel of Experts the application needs, and key GFSC decision makers. The applicant covers the background of the individuals driving the business, the business plan and group structure, financial projections, and evidence of how the firm will meet the principles. After the licence is granted there is an onsite visit, to check that what was presented works in practice.

Add it up from the applicant's side. Pre application engagement with the Risk and Innovation team, two weeks of categorisation, a full application, a presentation in front of the decision makers, then an onsite visit, across a three month standard. Named individuals do not do that from another time zone. Gibraltar is 6.7 square kilometres, the regulator and the advisers and the banks are a ten minute walk apart, and the whole model assumes you are in the room.

What a Gibraltar licence does not get you

It does not get you the European Union. Gibraltar left the EU alongside the United Kingdom, so the Markets in Crypto Assets Regulation does not apply here and a Gibraltar DLT licence carries no EU passport. Groups that want both markets generally hold both authorisations. Anyone telling you a Gibraltar licence is a side door into MiCA is selling something.

We also cannot tell you how many DLT providers hold a licence today, and we would rather say that than repeat a number. The most recent figure we can find from the government itself is 13 licensed firms, in that September 2020 press release, and it has been recycled across the web ever since as though it were current. Six years is a long time in this sector. The live answer is the GFSC register of DLT providers at fsc.gi, which blocked our automated check. Open it in a browser and trust that, not a blog, this one included.

Where you stay while a three month process runs

The licensing timetable is the accommodation problem. A three month service standard means a project team on and off the Rock across a quarter, and the expensive weeks are the ones around the presentation and the onsite visit, when the people who have to be here are the ones whose time costs most. A hotel room is a poor place to rehearse a board presentation, and a poor place to put three people who need a kitchen and a table.

Victory Suites runs 100+ apartments in Gibraltar on Devils Tower Road, on the isthmus, about ten minutes' walk from the frontier. Rates are in GBP and the apartments are listed across 300+ booking channels, but for a licensing project it is worth talking to us about a longer stay rather than booking night by night. If the move is bigger than a project, our guides to temporary accommodation while you relocate and to taking a job in Gibraltar's gaming sector cover ground the licensing documents never will.