Gibraltar Gambling Licence: Jurisdiction Profile for Tier-1 Remote Operators

Gibraltar’s gambling regulatory framework entered a new era on 1 April 2026, when the Gambling Act 2025 (Act 2026-04) came into force, formally repealing the Gambling Act 2005 that had governed the jurisdiction for nearly two decades. The Gambling Division has confirmed that existing licensees are grandfathered under transitional provisions set out in Schedule 8 of the 2025 Act, and that new categories of licence holder have a six-month window from commencement to complete licensing under the new regime. For compliance officers who have been operating under the legacy framework, the structural obligations they know, physical presence, equipment certification, fit and proper assessment, AML/CFT controls, carry forward. What has changed is the regulatory architecture and the scope of what Gibraltar is willing to license.

Regulatory Structure: The Gambling Commissioner, Not the GRA

A persistent source of confusion in market commentary is the attribution of gambling supervision to the Gibraltar Regulatory Authority (GRA). The GRA, established under the Gibraltar Regulatory Act in October 2000, no longer oversees gambling. Gambling regulation in Gibraltar sits with two distinct bodies: the Licensing Authority, which is the designated Minister for gambling, and the Gambling Commissioner, who serves as the operational regulator. Both are supported administratively by the staff of the Gambling Division, based at Suite 912, Europort, Gibraltar. The GRA today covers electronic communications, radio, broadcasting, and data protection. Any compliance documentation, SAR filings, or licence queries must go to the Gambling Division, not the GRA.

The Gambling Division’s website confirms the dual-entity structure explicitly: “The Gambling Act provides for two separate entities to oversee the licensing and regulation of the gambling industry in Gibraltar, namely the Licensing Authority who is the designated Minister and the gambling regulator who is the Gambling Commissioner.” Licence applications are now handled via the Gambling Division’s digital licensing portal at gamblingdivision.gov.gi, with primary correspondence through gamblinglicensing@gibraltar.gov.gi and gamblingregulators@gibraltar.gov.gi.

What Does a Gibraltar Remote Gambling Licence Require?

Under Part VI of the Gambling Act 2005, provisions carried forward in principle into the 2025 Act, any person who conducts or provides facilities for remote gambling in or from within Gibraltar must hold a current remote gambling licence. The nexus test is equipment-based: a person is regarded as conducting remote gambling in or from within Gibraltar if at least one piece of remote gambling equipment used in the provision of the facilities is situated in Gibraltar. That equipment definition is broad, covering servers that register participation, present virtual games or events, determine results, accept payments, or authorise payout of winnings. Licence holders serving the UK market typically house their primary platform servers in Gibraltar while operating point-of-consumption licences elsewhere for regulated markets.

Physical presence is not merely a filing requirement. The Gambling Act 2005 explicitly listed failure to maintain a physical presence in Gibraltar as a named ground for licence suspension or revocation. Compliance teams should treat the Gibraltar office not as a brass-plate arrangement but as a substantively staffed operation capable of satisfying the Gambling Commissioner on inspection.

Fit and Proper Assessment

The Licensing Authority has traditionally only considered licensing blue-chip companies with a proven track record in gambling in other jurisdictions. The Gambling Division’s own guidance states this explicitly while noting that appropriately funded start-ups and expanding operations proposing to relocate wholly or partly from other jurisdictions will also be considered. In practice this means the fit and proper assessment carries real weight.

Under Schedule 1 of the Gambling Act 2005, the Licensing Authority assesses applicants, and each associated person with control or management of the business, across seven dimensions: character, honesty and integrity, business reputation, current financial position and financial background, the business plan in respect of the licensed activities, experience of conducting the relevant gambling activity, conduct under comparable licences granted in other jurisdictions, and the actual or proposed ownership and structure of the business. Adequate working capital and financial reserves to meet prize payouts and ongoing obligations are a threshold requirement, not a post-licensing comfort.

Operator Obligations: The Core Compliance Framework

Part VII of the Gambling Act 2005 sets out the obligations applicable to all licence holders. These are not principles-based aspirations, they are conditions of the licence, breach of which constitutes an offence.

Licence holders must maintain procedures and internal controls adequate to the scale and nature of their operations. Record keeping must be sufficient to produce audited accounts as required by the Gambling Commissioner. Approved banking and payment processing arrangements are a standing obligation, the regulator’s approval is required for the arrangements, not merely notification. Complaints procedures must be maintained and made accessible to customers.

Website and advertising disclosure requirements are specific: the home page of any remote gambling website must carry a link to a page showing the licence holder’s full name and address, a statement of Gibraltar licensing and regulation, and a minimum age warning in the prescribed form.

Equipment integrity is subject to a certification obligation. Licence holders must furnish the Gambling Commissioner at prescribed intervals with a certificate that the integrity of computer equipment used in the licensed activities has been properly tested by a body approved by the Minister in consultation with the Gambling Commissioner. The certificate must name the owner of the equipment and the testing body, and include a declaration as to the testing outcome.

Responsible Gambling Requirements

Section 27 of the Gambling Act 2005 establishes the foundational responsible gambling obligations for remote licence holders. Every remote gambling website must carry on its home page a direct link to the website of at least one organisation dedicated to assisting problem gamblers. Beyond this baseline, licence holders must maintain systems capable of enabling a person to request self-exclusion, must designate a named person responsible for formulating responsible gambling policies including staff training, and must warn customers against gambling beyond their means.

The responsible gambling obligation extends to cooperation with the Licensing Authority on matters related to problem gambling. If a licence holder’s systems detect what appears to be illegal activity interrupting a transaction, the licence holder must immediately inform the Gambling Commissioner and, where a recurrence is likely, suspend further transactions pending the Commissioner’s direction. These controls sit alongside AML/CFT obligations rather than in place of them. For a broader cross-jurisdictional view of responsible gambling programme requirements, the Responsible Gambling Compliance hub covers self-exclusion, deposit limits, and customer interaction obligations across 17 regulated markets.

AML/CFT/CPF: POCA, the Code, and the GFIU

Gibraltar’s AML framework for remote gambling licence holders is governed by the Proceeds of Crime Act 2015 (POCA) and given operational effect through the Gambling Commissioner’s AML Code of Practice for the Remote Gambling Industry, updated to version 1.0.2026 on 8 January 2026. The 2026 update reflects amendments to cross-references following publication of Gibraltar’s 2025 National Risk Assessment for ML/TF/PF, which formally identifies the use of remote gambling facilities as one of the jurisdiction’s recognised risk vectors.

The Code is issued by the Gambling Commissioner under the authority of section 6(6)(f) of the Gambling Act 2005, approved by the Minister for Gambling. Its scope is explicitly extraterritorial: section 1.3 of the Code states that it applies to all transactions and processes undertaken by licence holders in Gibraltar or any other place under the authority of a Gibraltar gambling licence, including those additionally licensed by another regulatory authority, and those associated with places that have no relevant gambling or AML/CFT regulation.

“Up until Gibraltar left the EU, Gibraltar law in this area gave effect to incremental EU directives and regulations on AML/CFT. Whilst broad principles are still likely to be followed, there may be some divergence from EU law without any weakening of requirements or any departure from international standards.”

That passage from section 1.4 of the Code is a direct Brexit consequence notice. Multi-jurisdictional operators holding both a Gibraltar licence and an MGA or other EU-regulated licence must track potential divergence between Gibraltar’s POCA-based regime and the EU’s successive AML directives, as Gibraltar is no longer bound to implement EU AML updates automatically.

Board-Level Accountability and the MLRO

Section 9B POCA requires licence holders to appoint a director or senior manager with strategic responsibility for AML/CFT issues. Section 5.1 of the AML Code is explicit that this post holder’s ability to oversee AML/CFT obligations must not be compromised by commercial responsibilities or conflicts of interest. The MLRO function is a separate designation, responsible for receiving internal suspicious activity reports and making external disclosures. The board must receive at least an annual report on AML/CFT activities from the MLRO, including a refreshed corporate risk assessment.

Suspicious activity reports must be submitted to the Gibraltar Financial Intelligence Unit (GFIU) electronically via the online Themis portal. There is a dual reporting obligation: the Gambling Commissioner is also a recipient of SAR intelligence, with separate intelligence-sharing arrangements existing between the GFIU and the Gambling Commissioner. The AML Code acknowledges this can create confusion and duplication but confirms both channels remain active.

CDD, EDD, and PEP Controls

Customer Due Diligence applies on a risk-based basis consistent with POCA Part II. Enhanced Due Diligence is mandatory for politically exposed persons: section 20 POCA requires PEP accounts to be evaluated for specific approval to continue, with source of funds and source of wealth established, and enhanced ongoing monitoring applied throughout the relationship. Senior manager sign-off, by the MLRO or a designated representative, is required for PEP account opening. Anonymous accounts are expressly prohibited under the Code, the Gambling Commissioner will not accept nominal or pseudonymous account records.

An independent audit function is required under section 26(1A) POCA to test AML/CFT policies, controls and procedures on a basis proportionate to the nature and size of the business. The 2026 Code notes that an in-house audit function is acceptable, there is no requirement to engage an external firm, provided independence from the functions being tested is maintained.

Licence holders extending commercial relationships to B2B counterparties must conduct internal due diligence to establish ultimate beneficial ownership and control of both suppliers and users of gambling services. The Licensing Authority requires that all customer-facing joint venture B2B relationships are submitted for approval and subject to ongoing monitoring.

AML/CFT Obligation	Primary Authority	Key Requirement
Board accountability	POCA s.9B	Director or senior manager with dedicated AML/CFT oversight
MLRO appointment	POCA / AML Code s.5	Designated MLRO, free from commercial conflicts of interest
Annual AML board report	AML Code s.5.2	Includes refreshed corporate risk assessment
SAR submission	POCA / AML Code s.7	GFIU via Themis portal, written notification to Gambling Commissioner within 24 hours where ML/TF/PF suspected
PEP enhanced due diligence	POCA s.20 / AML Code s.8.2	Senior manager approval, source of funds, enhanced ongoing monitoring
Independent audit	POCA s.26(1A)	Testing of AML/CFT policies and controls, in-house function acceptable
Anonymous accounts	AML Code s.6.18	Prohibited, existing nominal accounts must be subject to CDD

The Post-Brexit, Post-2014 UK Market Reality

Before 2014, a Gibraltar remote gambling licence provided access to the British market without requiring a separate UK Gambling Commission licence. That changed when the Gambling (Licensing and Advertising) Act 2014 introduced a mandatory point-of-consumption licensing requirement, effective from November 2014. Any company wishing to advertise gambling services to and accept bets from consumers in England, Wales, or Scotland must hold a remote operating licence issued by the UK Gambling Commission, regardless of where the operator is incorporated or where its servers are located.

Gibraltar operators serving the UK market therefore operate under a dual-licence structure: a Gibraltar remote gambling licence satisfying the local regulatory nexus, and a UKGC remote operating licence covering the GB consumer base. The Gibraltar Betting and Gaming Association formally opposed the 2014 change. The change was made regardless. Every material operator based on the Rock that takes GB bets is subject to the full UKGC Licence Conditions and Codes of Practice, the Remote Technical Standards, and the statutory levy obligation that came into effect in April 2025. For a detailed cost comparison of UKGC versus MGA licensing obligations, see the analysis at UKGC vs MGA licence costs in 2026.

The enforcement consequence of the dual-licence structure is direct. In June 2026, Petfre (Gibraltar) Limited, the operator of Betfred’s online gambling business, agreed to pay £900,000 following a UKGC licence review that identified significant failings in its safer gambling controls, according to iGamingBusiness, 30 June 2026. The Gibraltar incorporation provided no insulation from UKGC sanctions. Compliance officers at Gibraltar-based operators must treat UKGC LCCP obligations as a parallel compliance stream of equal weight to the Gibraltar domestic framework.

Gibraltar incorporation does not insulate an operator from UKGC sanctions where GB consumers are served. The dual-licence structure means dual enforcement exposure.

Enforcement Posture: What the Gambling Commissioner Expects

In April 2026, the Gambling Division published notice of a regulatory settlement agreed between the Gambling Commissioner and a licence holder in respect of sanctions screening deficiencies. The thematic review on sanctions screening, published as guidance and learning points in June 2026, signals that sanctions compliance is an area of active supervisory focus, not merely a checklist item referenced in the AML Code.

The AML Code describes the Gambling Commissioner’s enforcement philosophy in direct terms: “When considering any enforcement action, where an operator self-identifies issues and implements appropriate and prompt remedial action, this will be taken into account by the Gambling Commissioner.” The self-disclosure incentive is explicit, but the Code’s broader framework is equally clear that the role of the Gambling Division is to monitor and evaluate the efficacy of operator systems and controls and to use a range of regulatory tools to ensure high standards are maintained. The sanctions screening settlement and its associated public guidance represent that range in action.

The Gambling Commissioner is also actively recruiting a successor to Andrew Lyman, who served as Executive Gambling Director for over six years. The vacancy specification published by the Ministry of Justice, Trade and Industry required a minimum of five years’ senior executive, regulatory, or strategic experience in gambling, recognised tax qualification or fiscal policy expertise, proven advocacy before UK regulatory authorities, and Gibraltar residency. The emphasis on UK public affairs experience reflects the continued operational importance of the UKGC relationship to Gibraltar’s gambling economy.

Why Gibraltar Still Works: The Competitive Case in 2026

The jurisdiction’s appeal to tier-1 operators rests on several structural factors that remain intact after Brexit and the 2025 legislative update. Gibraltar’s corporate tax environment has historically been competitive for gambling businesses, and the government’s publicly stated policy is to maintain Gibraltar as an attractive hub for international remote gambling businesses. The Gambling Division explicitly positions the jurisdiction as open to blue-chip operators and appropriately funded new entrants with relocation plans.

Regulatory quality is a genuine differentiator. The Gambling Commissioner’s AML Code, the fit and proper threshold, and the active enforcement posture all contribute to a reputational signal that Gibraltar-licensed operators are held to substantive standards. That signal matters to payment processors and banking counterparties, who increasingly distinguish between licence jurisdictions on the basis of supervisory credibility. The Gambling Division website notes that the Licensing Authority has traditionally considered only blue-chip companies with a proven track record, a filter that functions as a reputational guarantee for those who clear it.

The Gambling Act 2025 adds a further competitive argument: Gibraltar is the first jurisdiction globally to establish a bespoke statutory category for prediction markets. Regulations published in the Gibraltar Gazette in July 2026 under the authority of Minister Nigel Feetham established an activity-based, risk-based framework covering market integrity, participant protection, financial crime prevention, governance, operational resilience, and objective settlement. ADI Predictstreet and WagerWire were among the first licensed operators. For businesses in the prediction markets sector facing regulatory uncertainty across most of Europe, Gibraltar now offers an operational path that no other European jurisdiction currently provides.

Corporate Structuring and the Physical Presence Requirement

The physical presence obligation is the structural constraint that most directly shapes how operators use Gibraltar. Under both the 2005 Act and its 2025 successor, maintaining a physical presence in Gibraltar is a condition of the licence, failure to do so is a named ground for revocation. This is not satisfied by a registered office alone. The Gambling Commissioner expects substantive operations: the Licensing Authority assesses the actual or proposed ownership and structure of the business as part of the fit and proper determination, and the AML Code requires that compliance functions, including the MLRO and AML board accountability, are genuinely embedded rather than managed remotely.

In practice, tier-1 Gibraltar operators maintain trading floors, compliance teams, technical operations, and senior management in Gibraltar. The licensing nexus test, requiring at least one piece of remote gambling equipment to be situated in Gibraltar, is met by primary platform servers, but the compliance architecture built around those servers must be capable of satisfying the Gambling Commissioner on inspection and the Gambling Division’s desk-based review programme.

Multi-jurisdictional operators holding concurrent MGA licences face an additional layer of analysis. The AML Code’s extraterritorial scope means Gibraltar standards apply to all transactions conducted under the authority of the Gibraltar licence, whether or not another jurisdiction’s AML requirements also apply. Where another jurisdiction’s standards are more rigorous, those higher standards apply. Where they are less rigorous, Gibraltar standards must be applied as the minimum. Operators running parallel compliance programmes across UKGC and MGA licence requirements should consult the AML and Financial Compliance hub for cross-jurisdictional transaction monitoring and source of funds guidance.

Gaps, Risks, and Practical Considerations for Incoming Operators

The most significant structural uncertainty for incoming operators is the full implementation timeline for the Gambling Act 2025. The Gambling Division has indicated that new requirements beyond those in the Act and existing regulations will be subject to consultation before implementation, and that a period of pragmatic flexibility is expected during the transition. Compliance teams should monitor the Gambling Division website for new codes, guidance, and licence conditions as they are published.

Sanctions compliance is an identified supervisory priority, as the April 2026 regulatory settlement confirmed. Operators should ensure their sanctions screening programmes align with Gibraltar’s Sanctions Act 2019 and the applicable designations maintained by relevant authorities, and that screening coverage extends to all jurisdictions in which customers are based, not merely to Gibraltar’s own lists. The AML Code’s reference to the Gibraltar Financial Intelligence Unit’s AML/CFT/CPF Guidance Notes and the National Risk Assessment (2025) as supplementary reading for licence holders signals that the Gambling Commissioner expects familiarity with both documents.

For operators already registered in Ontario’s regulated market, the compliance infrastructure built to meet AGCO’s Registrar’s Standards for Internet Gaming, including AML monitoring, responsible gambling tools, and fit and proper documentation, will translate to much of what Gibraltar requires. The specific POCA obligations and the dual-reporting SAR architecture are Gibraltar-specific and require dedicated programme design regardless of other licences held.

Operators should seek qualified Gibraltar legal counsel before making any licensing decision, given that the Gambling Act 2025 is newly in force and secondary regulations, codes, and administrative guidance are still being finalised under the new framework. The Gambling Division has invited early engagement for preliminary applications, which is the appropriate entry point for any entity considering a new Gibraltar licence.

Key Resources

Gibraltar Gambling Division: gamblingdivision.gov.gi, primary portal for licence applications, regulatory guidance, and public statements including the list of current licensed operators.

Gibraltar Gambling Act 2005 (consolidated): gibraltarlaws.gov.gi, the legacy Act, repealed as of 1 April 2026, remains the reference for obligations that carried forward under transitional provisions.

Gibraltar AML Code of Practice for Remote Gambling, v.1.0.2026: Issued by the Gambling Commissioner, updated 8 January 2026. The primary operational reference for AML/CFT/CPF obligations. Available through the Gambling Division.

Gibraltar Gambling Act 2025 (Act 2026-04): The primary legislative instrument in force from 1 April 2026. Secondary regulations including prediction markets rules published under this Act are available from the Gibraltar Gazette.

Gibraltar Financial Intelligence Unit (GFIU): The designated recipient of suspicious activity reports via the Themis portal. AML/CFT/CPF Guidance Notes published by the GFIU are supplementary required reading under the AML Code.