Gibraltar Gambling Licence 2025: Operator Requirements Under the New Gambling Act

Gibraltar’s Gambling Act 2025 (Act 2026-04) came into force on 1 April 2026, repealing the Gambling Act 2005 that had governed the jurisdiction’s remote gambling sector for two decades. The timing is not incidental. The same date on which Gibraltar’s new statutory framework took effect is the date HMRC’s Remote Gaming Duty rate rose from 21% to 40% for operators serving UK-resident players, sharpening the commercial argument for structuring international operations through Gibraltar rather than maintaining a sole UKGC licence. For compliance officers evaluating or reviewing a Gibraltar remote gambling licence, understanding precisely what the Gambling Commissioner now requires under the new Act is an immediate operational necessity.

Who Actually Regulates Gambling in Gibraltar?

A persistent source of confusion in operator documentation is the term “GRA licence.” The Gibraltar Regulatory Authority (GRA), established under the Gibraltar Regulatory Act in October 2000, regulates electronic communications, data protection, and broadcasting. It does not regulate gambling and has not done so for many years. Gambling in Gibraltar is regulated by the Gambling Commissioner, operating under the authority of the Minister for Justice, Trade and Industry, through the Gambling Division. When the industry refers to a “GRA licence,” the phrase functions as informal shorthand for a Gibraltar remote gambling licence, the issuing body is the Gambling Commissioner, not the GRA. Applications, compliance submissions, AML notifications, and enforcement correspondence all route through the Gambling Commissioner’s office at Suite 912 Europort, Gibraltar.

The Licensing Authority for Gibraltar gambling purposes is the Minister, who may appoint another individual or body in that role. Under the Gambling Act 2005, the Minister was the Licensing Authority for remote gambling, and the Gambling Commissioner served as the day-to-day supervisory and enforcement function. The Gambling Act 2025 extends and modernises that architecture, adding explicit provisions for novel product verticals and an expanded regulatory perimeter. Licence holders operating under the 2005 Act transitioned to the 2025 Act from 1 April 2026 pursuant to the transitional provisions set out in Schedule 8 of the Gambling Act 2025.

Licence Types Under the Gibraltar Framework

The Gambling Act 2005 established seven classes of licence, each with distinct scope. Remote gambling was addressed separately in Part VI of that Act (sections 23 to 33). Under section 23(1), any person who “in or from within Gibraltar conducts or provides facilities for remote gambling of any description” commits an offence unless they hold a current remote gambling licence authorising gambling of that description. That provision survives into the 2025 Act’s framework.

The principal licence classes that applied under the 2005 Act, and which carry forward under the 2025 framework, are:

Licence Class	Scope	Remote Variant
Bookmaker’s licence	Non-remote betting	Extendable to telephone/remote betting under s.4(2)
Betting intermediary’s licence	Acting as intermediary for bets	Remote intermediary activities
Gaming operator’s licence	Provision of gaming facilities	Remote gaming licence (Part VI)
Gaming machine licence	Gaming machines	Remote gaming machine operations
Lottery promoter’s licence	Lottery promotion	Telephone/remote lottery sale extensions
Pools promoter’s licence	Pool betting operations	Remote pools activities
Remote gambling licence	All forms of remote gambling	Primary instrument for online operators

The Gambling Act 2025 adds a dedicated prediction markets licence category, making Gibraltar the first jurisdiction globally to establish a standalone statutory regime for this product vertical. The framework was published in the Gibraltar Gazette in July 2026 under the new Act’s authority, adopting an activity-based and risk-based approach covering market integrity, participant protection, financial crime prevention, and governance. ADI Predictstreet (licensed as a betting intermediary in March 2026 under the old Act) and Wire Markets (approved in principle) were the first two operators positioned under this new regime.

What Is the Jurisdictional Trigger for a Gibraltar Remote Gambling Licence?

Section 24(1) of the Gambling Act 2005, carried into the 2025 framework, defines the jurisdictional test precisely: a person is regarded as conducting or providing facilities for remote gambling “in or from within Gibraltar if and only if at least one piece of remote gambling equipment used in the provision of the facilities is situated in Gibraltar.” This is a physical presence test, not an incorporation or management-and-control test. Remote gambling equipment covers systems used to register participation, present virtual games or events, determine results, accept payments, or authorise payment of winnings.

An operator holding a Gibraltar remote gambling licence must maintain at least one server or qualifying piece of equipment physically on the Rock. Many licensees operate primary server infrastructure in Gibraltar with secondary or tertiary infrastructure elsewhere, the single-piece threshold is a minimum, not a ceiling. Equipment must be secured against unauthorised physical and electronic access under section 25 of the 2005 Act.

Does the Gambling Act 2025 Change Existing Licence Conditions?

Compliance officers reading documentation dated before 1 April 2026 will encounter the Gambling Act 2005. Documentation from that date onward references the Gambling Act 2025. Existing licence conditions granted under the 2005 Act remain valid pursuant to Schedule 8 transitional provisions, licence holders do not need to reapply. The Commissioner applies the new Act’s expanded framework to all supervision, inspection, and enforcement activities from 1 April 2026 forward. Any compliance programme built around the 2005 Act framework should be reviewed against the 2025 Act’s additional provisions, including the broader igaming sector definition and the expanded supervisory powers available to the Commissioner.

“A new licence has been issued, notwithstanding that the new Gambling Act had not yet been brought into force and the new licence had to be issued under the previous legislation. This represents record timing for the issuing of a regulatory licence in Gibraltar.”, Gibraltar Minister for Justice, Trade and Industry Nigel Feetham KC MP, speaking in Gibraltar Parliament, March 2026.

Core Operator Obligations Under Part VII

Part VII of the Gambling Act 2005 (sections 34 to 41) establishes obligations applicable to all licence holders, regardless of licence class. These provisions carry forward into the 2025 Act framework. The obligations are non-negotiable baseline requirements, not aspirational standards.

Internal controls and procedures. Section 36 requires licence holders to maintain documented procedures and internal controls. The scope of this obligation, combined with the Commissioner’s inspection powers under section 42, means that a licence holder without a current, documented control framework is immediately exposed to regulatory action. Any material update to internal controls must be notifiable where it affects the nature or scope of licensed activities.

Minimum age. Section 37 prohibits any form of gambling activity with persons below the minimum permitted age. Licence holders must maintain age-verification systems adequate to prevent underage access across all remote channels.

Record keeping and accounts. Section 38 mandates record keeping and the provision of audited accounts. Licence holders must be in a position to produce audited financial accounts to the Commissioner on request. This obligation is distinct from, and additional to, AML record-keeping requirements under the Proceeds of Crime Act 2015 (POCA).

Banking and payment arrangements. Section 39 requires licence holders to maintain approved banking and payment processing arrangements at all times. Loss of banking relationships without prompt remediation is a potential ground for licence review.

Financial adequacy. A licence holder must at all times have adequate financing available to pay all current and reasonably estimated prospective prize payout obligations and ensure adequate working capital for ongoing operations. This obligation, derived from section 23A as amended in 2018, operates as a continuous solvency test rather than a point-in-time capitalisation requirement.

Equipment integrity certification. Under section 25(3), a licence holder must furnish to the Gambling Commissioner, at the intervals specified by the Commissioner, a certificate confirming that the integrity of computer equipment used in licensed activities has been properly tested by a body approved by the Minister in consultation with the Commissioner. The certificate must identify the equipment owner, the testing body, the testing methodology, and any qualifications or deficiencies. Failure to maintain current certification is itself an offence under section 47.

Remote Gambling-Specific Requirements

Section 27 of the 2005 Act establishes the responsible gambling framework for remote licence holders, and these obligations carry forward under the 2025 Act. Three requirements are absolute.

The remote gambling website’s home page must contain a direct link to at least one organisation dedicated to assisting problem gamblers. This is a minimum threshold, not a best-practice aspiration.

A licence holder must have systems in place to enable a person to request self-exclusion from gambling with that licence holder. The self-exclusion system must be operable and accessible, the Commissioner treats non-functional or obstructed self-exclusion as a compliance failure rather than a technical deficiency.

A named individual must be designated as responsible for formulating responsible gambling policies, including training staff on implementation. The Commissioner expects clear individual accountability rather than a shared or dual-role arrangement.

Section 32 governs information requirements for remote gambling websites. The home page must display the licence holder’s full name and business address, a statement that the licence holder is licensed by the Gibraltar Licensing Authority and regulated under the relevant Gambling Act, and the prescribed statement that persons under the minimum permitted age may not participate. Failure to maintain compliant website displays is an offence. For specific guidance on these requirements, contact the Gambling Commissioner’s Compliance Unit at gcompliance@gibraltar.gov.gi or consult the latest Commissioner guidance note on website disclosure obligations.

AML Obligations: The 2026 Code of Practice

The Gibraltar Gambling Commissioner issued a revised AML Code of Practice for the Remote Gambling Industry (v.1.0.2026) on 8 January 2026. The Code applies to all transactions and processes undertaken by licence holders in Gibraltar or under the authority of a Gibraltar gambling licence, including operations additionally licensed by other regulatory authorities. The Code explicitly states that even where a licence holder serves players in a jurisdiction with its own AML requirements, Gibraltar standards apply as a minimum.

Post-Brexit, the Code notes that Gibraltar AML law no longer automatically tracks EU directives, though the broad principles of successive EU anti-money-laundering directives remain reflected in Gibraltar’s Proceeds of Crime Act 2015 (POCA). Operators running multi-jurisdictional businesses must monitor divergences between Gibraltar law and EU AML obligations, the Code does not permit a licence holder to apply EU standards in preference to POCA where Gibraltar’s requirements are higher.

Board-level accountability. Section 9B of POCA requires licence holders to appoint a director or senior manager to oversee compliance with Part II of POCA, covering CDD, EDD, PEPs, and record-keeping. The Code specifies that this post-holder’s ability to perform their AML oversight function must not be compromised by commercial responsibilities or conflicts of interest. A compliance director who also carries a revenue responsibility is precisely the arrangement the Commissioner scrutinises in onsite assessments.

Annual AML/CFT board report. The MLRO must deliver at least an annual report to the board on AML/CFT activities and issues, including an annual refresh of the corporate risk assessment and a summary of the MLRO function’s work during the period.

Formal business risk assessment. Section 25A of POCA creates a statutory obligation for licence holders to undertake or review a dedicated ML/TF/PF risk assessment covering their relevant gambling activities, customers, areas of operation, products, and transaction methods. This assessment must take into account Gibraltar’s National Risk Assessment (2025 version) and the Gambling Commissioner’s own Sectoral Risk Assessment. The business risk assessment is a live document that must be updated when new products, new technologies, or new markets are introduced.

Customer Due Diligence and Enhanced Due Diligence. All depositing remote gambling customers are subject to an EDD process “as soon as practicable” on a risk-based approach, pursuant to sections 13, 17, and 18 of POCA. EDD is CDD plus at least one additional due diligence measure. For non-face-to-face customers, section 18 of POCA applies specific additional requirements. The Code requires licence holders to demonstrate that they can identify and differentiate higher and lower risk customers by both the value and velocity of transactions.

Ongoing monitoring and data accuracy. All active accounts must be subject to a structured refresh of customer identification data at intervals not exceeding two years. The Code treats this as a “data accuracy” obligation, distinct from transaction monitoring, and both apply in parallel.

Independent AML audit. Section 26(1A) of POCA requires an independent audit function to test AML/CFT policies, controls, and procedures. The audit function’s scope and frequency must reflect the nature and size of the licence holder’s operations.

SAR submission. Suspicious activity reports must be submitted directly to the Gibraltar Financial Intelligence Unit (GFIU) electronically via the Themis online portal. Licence holders are not required to copy SARs to the Gambling Commissioner, but must separately notify the Commissioner as soon as reasonably practicable of any third-party law enforcement or administrative investigation involving their business. Where a licence holder becomes aware or has reason to suspect money laundering, terrorist financing, or proliferation financing, the obligation under section 42(2) of the Gambling Act to notify the Gambling Commissioner within 24 hours or as soon as reasonably practicable is separate from, and additional to, the SAR obligation to GFIU.

For a broader treatment of AML transaction monitoring and source-of-funds obligations across regulated markets, the AML and Financial Compliance hub covers FATF alignment, FIAU frameworks, and FinCEN comparisons relevant to operators holding licences in multiple jurisdictions.

The Post-Brexit Commercial Calculus: Gibraltar vs Malta vs UKGC

Gibraltar’s relationship with the United Kingdom following Brexit differs structurally from Malta’s position within the European Union. Malta-licensed operators serving EU member state players benefit, in principle, from the EU internal market framework under Article 56 TFEU, though that framework is contested in practice by point-of-consumption licensing regimes across multiple EU member states. Gibraltar, as a British Overseas Territory outside the EU, does not carry EU passporting rights. Its commercial advantage rests on different foundations.

Gibraltar-based operators serving UK-resident players must hold a UKGC remote operating licence under the point-of-consumption doctrine established by the 2014 UK regulatory reforms. A Gibraltar licence does not substitute for a UKGC licence when UK players are involved. Where Gibraltar’s advantage becomes material is in the tax treatment of non-UK gross gaming revenue and in corporate tax on Gibraltar-source profits.

Dimension	Gibraltar	Malta (MGA)	UK (UKGC)
Corporate / gaming tax	10% corporate income tax	5% GGY gaming tax + compliance contribution	40% Remote Gaming Duty (from April 2026)
Remote gaming duty on UK players	UKGC licence required, HMRC RGD applies regardless	UKGC licence required, HMRC RGD applies regardless	40% RGD on gross gaming yield
EU market access	No passporting, bilateral trade arrangements	EU passporting in principle, contested by PoC states	No EU passporting post-Brexit
Regulatory framework	Gibraltar Gambling Act 2025, Gambling Commissioner	Gaming Act 2018 (Cap. 583); MGA	Gambling Act 2005 (UK); UKGC LCCP + RTS
AML supervisor	Gambling Commissioner / GFIU	MGA / FIAU (split jurisdiction)	UKGC (primary); HMRC (secondary)
Prediction markets	Dedicated framework under Gambling Act 2025	No dedicated framework as of 2026	No dedicated framework as of 2026

For operators generating substantial non-UK, non-EU gross gaming revenue, Gibraltar’s 10% corporate income tax rate is materially lower than Malta’s combined gaming tax and compliance contribution, and dramatically lower than the UK’s 40% RGD. The UK Budget in November 2025 announced the duty increase to 40% effective 1 April 2026, a change that SBC News reported in December 2025 was already prompting Gibraltar to fast-track its Gambling Bill to shield locally-based operators from consequential disruption. The simultaneity of the new Act and the new UK duty rate was not accidental, Gibraltar’s legislative calendar was adjusted precisely to provide a settled regulatory home for operators reassessing their UK exposure.

Operators that hold both a Gibraltar licence and a UKGC licence should note that the UKGC’s Licence Conditions and Codes of Practice (LCCP) apply to all activities directed at UK customers, regardless of where the operator is incorporated or where its remote gambling equipment is located. For a detailed cost comparison of UKGC and MGA licence obligations, compliance officers can consult our analysis of UKGC vs MGA licence costs in 2026.

Enforcement Powers and Grounds for Licence Action

Part VIII of the Gambling Act 2005 (sections 42 to 49) sets out Gibraltar’s enforcement framework, and these provisions are expanded under the Gambling Act 2025. The Gambling Commissioner holds powers of investigation, entry, and reporting under section 42. Grounds for suspension or revocation of a licence under section 44 include failure to comply with licence conditions, conduct that is not consistent with a fit and proper person holding the licence, financial incapacity to meet obligations, and any criminal conviction or regulatory finding that the Commissioner considers relevant.

Offences under section 47 (failing to fulfil obligations) and section 48 (penalty provisions) carry financial penalties and potential forfeiture of assets. Section 49 extends corporate liability to bodies corporate, so that officers, directors, and managers who consented to or connived in a breach can be personally liable alongside the corporate entity.

The Commissioner’s supervisory approach, as described in the AML Code of Practice, includes both desk-based reviews of policies and procedures and onsite assessments. Desk-based reviews focus on AML/CFT policy documentation, the annual MLRO board report, and independent audit function outputs. Onsite visits are triggered by identified risk indicators or as part of the Commissioner’s scheduled inspection programme. Licence holders that cannot produce current, documented AML policies and a completed business risk assessment during a desk-based review should expect escalation to onsite assessment.

The Commissioner applies a civil “balance of probabilities” test when assessing whether licence holders should have known or suspected money laundering activity, expressly including consideration of “any persistent overly liberal interpretation of events, any unreasonable delay or any failure to apply recognised safeguards.” The standard is objective, not subjective.

The Prediction Markets Dimension: A Signal About Gibraltar’s Direction

Gibraltar’s decision to create a world-first dedicated prediction markets regulatory framework under the Gambling Act 2025 is directly relevant to the compliance calculus for operators in adjacent verticals. The framework, published in the Gibraltar Gazette in July 2026, applies an activity-based and risk-based approach to governing event contracts. It establishes requirements for market integrity, event contract approval, objective settlement, prevention of market manipulation, and protections against contracts related to criminal conduct, terrorism, or armed conflict.

The Minister for Justice, Trade and Industry described the philosophy explicitly: Gibraltar’s approach is to assess whether a novel product can be regulated proportionately from an integrity, AML, and consumer protection perspective, rather than defaulting to prohibition. This stands in contrast to the response of eight European gambling regulators, including those in Belgium, France, Germany, Italy, the Netherlands, Poland, Portugal, and Spain, who coordinated cross-market action against prediction market operators in June 2026, characterising them as incompatible with existing gambling frameworks.

For operators in sports betting, casino, or B2B supply functions, the prediction markets episode signals that Gibraltar’s Gambling Commissioner is willing to engage with novel product structures and issue licences under existing or newly created instruments where the risk profile is manageable. That regulatory agility is a structural characteristic of a small jurisdiction where government, the Gambling Commissioner, and industry operate in close proximity. Compliance teams should not assume that the Gibraltar framework is a static rulebook, the Commissioner expects dialogue when operators introduce new products or business models.

Fit and Proper: What the Commissioner Looks For

Gibraltar does not publish a formal fit and proper assessment matrix comparable to the UKGC’s key events framework, but the Gambling Act’s licence conditions (Schedule 1 of the 2005 Act, carried into the 2025 framework) establish disclosure obligations for applicants and holders. Licence holders and applicants must notify certain changes and occurrences as set out in Schedule 1. Material changes that require notification include changes to beneficial ownership, changes in directors or senior management, criminal convictions or regulatory findings involving the licence holder or key individuals, and any material change in the licence holder’s financial position.

The Commissioner exercises discretion over licence applications and renewals, Gibraltar has not operated an open-market model where any qualifying applicant receives a licence. The Gambling Division has historically maintained a selective approach, prioritising operators with established compliance infrastructure and reputational standing. This is consistent with Gibraltar’s positioning as a jurisdiction where regulatory credibility functions as a commercial differentiator, not a drag on market entry. Operators seeking a new Gibraltar licence should anticipate a substantive application process, not a formulaic registration exercise.

Compliance officers planning an application should consult qualified legal counsel experienced in Gibraltar gambling law before submitting documentation, given that the Gambling Act 2025 introduced new provisions that had not been tested through the Commissioner’s application process as of the date of publication.

Responsible Gambling: Structural Requirements

Beyond the section 27 home-page link and self-exclusion system requirements, licence holders must maintain systems designed to warn persons that they should not gamble beyond their means and to discourage them from doing so. The licence holder must also cooperate with the Commissioner on responsible gambling matters, including any programme or register that the Commissioner establishes or endorses for problem gamblers.

Gibraltar does not operate a centralised national self-exclusion register comparable to GAMSTOP in the UK or ROFUS in Denmark. Each licence holder is responsible for maintaining its own self-exclusion systems. Where a licence holder operates multiple brands, the Commissioner expects those brands’ self-exclusion systems to be operationally linked so that a self-exclusion request on one brand is recognised across others operated by the same licence holder. Licence holders that also hold UKGC licences must satisfy GAMSTOP integration requirements for UK-facing operations independently of Gibraltar’s self-exclusion framework. For a comprehensive view of self-exclusion obligations across regulated markets, the Responsible Gambling Compliance hub covers the operator-level model that Gibraltar uses alongside national register models in the UK, Sweden, and Denmark.

Key Resources

Gibraltar Gambling Act 2025 (Act 2026-04), Primary legislation in force from 1 April 2026. Available via the Gibraltar Laws index at www.gibraltarlaws.gov.gi.

Gibraltar Gambling Act 2005 (Act 2005-72, consolidated, repealed), The predecessor framework, relevant for understanding transitional provisions and existing licence conditions. Available at www.gibraltarlaws.gov.gi.

Gibraltar AML Code of Practice for Remote Gambling, v.1.0.2026, Issued 8 January 2026 by the Gambling Commissioner, governs all AML/CFT/CPF obligations for remote gambling licence holders. Contact: gcreports@gibraltar.gov.gi.

Gibraltar Proceeds of Crime Act 2015 (POCA), Primary AML statute, sections 9B, 10, 11, 13, 17, 18, 21, 25, 25A, and 26(1A) are directly cited in the AML Code of Practice as the statutory basis for CDD, EDD, business risk assessment, and independent audit obligations.

HMRC Remote Gaming Duty guidance, Covers the 40% RGD rate effective 1 April 2026 for operators providing remote gaming to UK-resident customers. Available at www.gov.uk/guidance/rates-and-allowances-betting-and-gaming-duties.