Gibraltar Gambling Licence 2026: Why Tier-1 Operators Choose the Rock Over MGA

Gibraltar’s remote gambling sector operates under a framework that was comprehensively renewed on 1 April 2026, when the Gambling Act 2025 (Act.2026-04) repealed and replaced the Gambling Act 2005 that had governed the territory for two decades. Compliance teams evaluating a Gibraltar licence against Malta Gaming Authority alternatives will find material differences across the fiscal structure, AML architecture, and regulatory posture, differences that the headline licence-fee comparison consistently understates.

The bottom line for operators weighing the two jurisdictions: Gibraltar offers a 10% general corporation tax rate (as of 2025), a capped gaming duty structure, and a single-regulator supervisory model administered by the Gambling Commissioner, making it structurally more cost-efficient for high-GGR operators than Malta’s combined 5% gaming tax plus tiered compliance contribution model. The post-Brexit loss of UK whitelisting is real and requires a parallel UKGC licence for any operator targeting British players, but it does not negate Gibraltar’s advantages for operators whose primary customer base sits outside Great Britain.

The Legislative Transition: Gambling Act 2025

The Gambling Act 2025 entered force on 1 April 2026. The transition is confirmed in the consolidated text of the now-repealed Gambling Act 2005, which records the repeal by “Act.2026-04 as from 1.4.2026” and directs readers to Schedule 8 of the Gambling Act 2025 for transitional provisions. Licence holders that held remote gambling licences under the 2005 Act continued to operate under those transitional arrangements, with the Gambling Commissioner overseeing migration to the new framework.

The 2025 Act preserves the core architecture of the 2005 framework, including the Gambling Commissioner as the principal supervisory authority and the requirement that at least one piece of remote gambling equipment used in the provision of gambling facilities be physically situated in Gibraltar. What it adds is express statutory recognition of new product categories, most visibly prediction markets, now regulated as a distinct activity class under a bespoke regime. Gibraltar published the prediction markets regulations in the Gibraltar Gazette in mid-2026, describing an activity-based and risk-based approach covering market integrity, participant protection, financial crime prevention, governance, operational resilience, and objective settlement. Minister for Justice, Trade and Industry Nigel Feetham described the framework as a product of “extensive engagement with industry professionals, prospective operators and investors” and positioned it as a model for other jurisdictions debating whether prediction markets constitute gambling or financial instruments.

Why Tier-1 Operators Stay: The Fiscal Architecture

Gibraltar’s gravitational pull for established operators rests on a fiscal structure that has remained deliberately competitive. The territory applies a 10% corporation tax rate as its general rate (as of 2025), contrasting with Malta’s 35% headline corporate tax rate, which operators typically reduce to an effective rate of around 5% through the Maltese imputation refund system. Achieving that reduction requires compliance with specific group structure and distribution requirements that carry their own administrative costs and should be modelled with qualified tax counsel.

On the gaming duty side, Gibraltar has historically applied a capped gaming duty model that limits total annual liability regardless of GGR volume, making it structurally advantageous for the highest-revenue operators. An operator generating £500 million or more in annual GGR faces a materially different effective tax burden under Gibraltar’s structure than under Malta’s tiered compliance contribution model, which scales with revenue. Operators must model the full stack, not just the headline rates, and consult qualified tax counsel before making jurisdictional decisions on the basis of any single metric.

The UK’s decision to raise Remote Gaming Duty from 21% to 40% from 1 April 2026, documented in HMRC’s Finance Bill 2025-26, has sharpened this fiscal comparison. According to iGamingBusiness, Bet365 announced plans to cut approximately 340 jobs in September 2026, attributing the restructuring explicitly to “increased regulatory and tax-related costs” including the UK RGD increase, with affected offices spanning Stoke-on-Trent, Malta, and Gibraltar. The episode illustrates why large operators treat their Gibraltar and Malta operational presences not as alternatives to UKGC licensing but as components of a multi-jurisdiction structure designed to manage the total tax and regulatory cost of serving different player markets.

Parameter	Gibraltar (Gambling Act 2025)	MGA (Gaming Act, Cap. 583)
Primary legislation	Gambling Act 2025 (in force 1 April 2026)	Gaming Act (Cap. 583), in force August 2018
Regulatory authority	Gambling Commissioner (single body)	Malta Gaming Authority + FIAU (AML)
Corporation tax (as of 2025)	10% general rate	35% headline (effective ~5% via imputation)
Gaming tax / duty	Capped annual gaming duty model	5% gaming tax + tiered compliance contribution
AML supervisor	Gambling Commissioner / GFIU	MGA / FIAU (split supervisory model)
SAR filing destination	GFIU via Themis portal	FIAU
Prediction markets	Licensed under bespoke regime (2026)	Not expressly licensed under current framework
EU access / passporting	None (non-EU jurisdiction)	EU member state, no direct passporting for gambling

AML Framework: POCA, the Code of Practice, and the GFIU

Gibraltar’s AML regime for remote gambling is governed by the Proceeds of Crime Act 2015 (POCA) and given operational content by the Gambling Commissioner’s Code of Practice for the Remote Gambling Industry: Anti-Money Laundering, Countering the Financing of Terrorism and Counter Proliferation Financing Arrangements, at version 1.0.2026, issued on 8 January 2026. This version updates links and references in light of Gibraltar’s 2025 National Risk Assessment for ML/TF/PF.

“This Code applies to all transactions and processes undertaken by Licence Holders in Gibraltar or any other place under the authority of a Gibraltar gambling licence, including those transactions and processes that are additionally licensed by another regulatory authority as well as those associated with places which have no relevant gambling or AML/CFT regulation.”, Gibraltar AML Code of Practice, v.1.0.2026, Section 1.3

The extraterritorial scope of Section 1.3 is one of the most operationally significant provisions in the Code, and it is frequently underweighted in licensing due diligence. A licence holder operating under a Gibraltar licence must apply Gibraltar’s POCA-based AML standards to customer transactions regardless of where those customers are located or whether a separate local regulatory regime also applies. Where Gibraltar standards diverge from local requirements, the Code instructs licence holders to apply Gibraltar standards as a minimum.

The organisational requirements are precise. Under Section 5.1 of the Code, read with s.9B POCA, licence holders must appoint a director or senior manager with strategic responsibility for AML/CFT compliance. The Code requires that this individual’s ability to oversee AML/CFT obligations must not be compromised by commercial responsibilities or conflicts of interest. This is a structural independence requirement, not merely a job-title obligation. The board must receive at least an annual report on AML/CFT activities from the MLRO, including a refreshed corporate risk assessment.

Suspicious activity reports are filed directly to the Gibraltar Financial Intelligence Unit via the Themis online portal. The Code introduces a specific protocol for consent or defence SARs involving British customers: these are dual-reported, with the initial submission going to the UK Financial Intelligence Unit and the GFIU notified once consent has been granted or the seven-day implied-consent period has elapsed. Non-consent SARs concerning British customers continue to be submitted to the UKFIU with a dual report to the GFIU. This arrangement reflects Gibraltar’s post-Brexit cooperative relationship with UK law enforcement, preserving practical interoperability despite the formal separation of jurisdictions. For a broader treatment of AML obligations across regulated iGaming jurisdictions, the AML and Financial Compliance hub covers FATF alignment, transaction monitoring, and source-of-funds requirements across multiple regulators.

Customer Due Diligence Obligations

The Code prohibits anonymous or nominal account records without exception. Section 6.18 states that licence holders are not permitted to host anonymous or ‘nom de plume’ accounts, any existing anonymous accounts must be subjected to appropriate due diligence to establish the identity and bona fides of the account holder. On ongoing monitoring, Section 6.10 requires all active accounts to be subject to a structured data-refresh cycle that must not exceed two years, regardless of account activity frequency. This obligation exists in parallel with the account reactivation alert requirement: licence holders must implement systems that flag dormant account reactivations and trigger enhanced monitoring on such accounts.

The standard for assessing whether a licence holder has met its AML obligations is framed by Section 4.15 of the Code, which applies a civil balance-of-probabilities test. The Gambling Commissioner will consider whether an honest and reasonable person working in the gambling sector, with access to the factual circumstances or reliable information that was reasonably accessible to the licence holder, should have known or suspected that a customer was engaged in money laundering. Persistent over-liberal interpretation of suspicious circumstances or unjustified deferral of enhanced due diligence are cited as specific grounds that will count against a licence holder in an inspection.

Post-Brexit Market Access: What Changed and What Did Not

Does a Gibraltar gambling licence allow you to take bets from UK players?

No. Since the Gambling (Licensing and Advertising) Act 2014, any operator wishing to advertise to or accept bets from consumers in England, Wales, or Scotland must hold a separate UKGC remote operating licence. A Gibraltar licence alone is not sufficient for UK market access, and this was the case before Brexit as well as after it.

The Gibraltar Betting and Gaming Association formally opposed the 2014 proposals at the time. Before that Act, operators holding a Gibraltar licence could advertise gambling and take bets from consumers in Great Britain without a separate UKGC licence. From 2014 onwards, that position was reversed. Brexit did not change this obligation, the domestic licensing requirement had already superseded the whitelist arrangement four years before the UK left the EU.

What Brexit did alter is Gibraltar’s relationship with EU frameworks. Gibraltar was the only British Overseas Territory inside the EU single market before Brexit, and the territory lost that position at the end of the transition period. For gambling, this means Gibraltar licence holders cannot rely on any form of European passporting to serve EU member state consumers. Gambling was never subject to EU-level harmonisation in the way that financial services are, and no such passporting mechanism existed for gambling licences even during EU membership. In practice, operators serving EU markets from Gibraltar were always required to hold local licences or operate under local regulatory carve-outs in each member state where they accepted customers.

Where Brexit has had a practical effect is in employment and the free movement of personnel. Gibraltar-based operators can no longer rely on free movement of EU nationals for staffing, which has increased the administrative complexity of recruiting from EU member states. This is an operational rather than a licensing-law consideration, but it is one that compliance teams overseeing Gibraltar operations should factor into workforce planning.

Responsible Gambling Obligations Under the Gibraltar Framework

The responsible gambling framework under the Gambling Act 2005, carried into the 2025 Act, imposes several baseline obligations on remote gambling licence holders. Under Section 27 of the 2005 Act, every remote gambling website operated by or on behalf of a licence holder must contain on its home page a direct link to at least one organisation dedicated to assisting problem gamblers. The same section requires licence holders to maintain systems enabling player self-exclusion, to designate a named person responsible for formulating responsible gambling policies and staff training, and to warn players against gambling beyond their means.

The Gambling Commissioner retains power to receive and act on self-exclusion data provided by licence holders, and the Act provides for cooperation obligations when the Commissioner is investigating any matter related to responsible gambling compliance. Licence holders must also ensure that their websites and advertising materials include a statement that persons under the minimum permitted age are not permitted to participate in their gambling activities, and display the full name of the licence holder and confirmation of Gibraltar licensure. Compliance teams seeking a cross-jurisdictional view of self-exclusion register models and player-protection standards will find the Responsible Gambling Compliance hub a useful reference point.

Enforcement Powers and Sanctions

The Supervisory Bodies (Powers, etc.) Regulations 2017 provide the enforcement framework for AML/CFT breaches. The Gambling Commissioner may impose financial penalties, suspend or withdraw a licence, issue directions, and impose temporary bans from managerial positions. Before any sanction is imposed, the Commissioner must issue a warning notice and allow the licence holder 14 days to make representations.

For broader gambling licence breaches, Sections 43 and 44 of the Gambling Act 2005 set out suspension and revocation grounds. Section 47 creates an offence of failing to fulfil obligations, and Section 48 provides for penalties and forfeitures. These provisions are carried over in substance into the Gambling Act 2025. Under Section 38 of the 2005 Act, all licence holders must maintain records and provide audited accounts as required, under Section 39, they must maintain approved banking and payment processing arrangements. Failure to comply with either requirement constitutes a licence condition breach.

“The Gambling Commissioner must adopt a risk-based approach” in exercising enforcement and sanctioning powers under the Supervisory Bodies (Powers, etc.) Regulations 2017, a standard consistent with FATF Recommendation 26 for supervisory bodies in the gambling sector.

Gibraltar vs MGA: Where the Practical Differences Land

The MGA operates a split supervisory model in which the MGA holds primary gambling regulatory authority while the Financial Intelligence Analysis Unit (FIAU) has independent AML/CFT supervisory responsibility over MGA licensees. A Malta-licensed operator is subject to two distinct regulators with separate inspection cycles, separate reporting channels, and, in some cases, divergent interpretations of what constitutes adequate AML procedures. Gibraltar’s single-regulator model, where the Gambling Commissioner supervises both gambling compliance and AML/CFT under a unified framework coordinating with the GFIU, is a practical simplification for operators with compliance teams stretched across multiple jurisdictions. Whether that simplification outweighs the MGA’s deeper product-licensing granularity and larger peer community of licensed operators depends heavily on the specific operator’s product vertical and target markets.

For a detailed cost modelling of MGA versus UKGC total cost of ownership across a five-year horizon, including the impact of the April 2026 Remote Gaming Duty increase to 40%, see UKGC vs MGA in 2026: Which Licence Actually Costs More to Maintain. For operators evaluating Curaçao as a third-tier alternative, the post-LOK transition framework is analysed in the Curaçao LOK Framework transition guide.

Gibraltar’s advantage is most pronounced for operators already committed to the jurisdiction, with existing physical infrastructure and employment structures in place. The territory’s regulatory reputation, built over two decades of licensing globally recognised brands, provides payment processor recognition and banking access that newer or smaller jurisdictions cannot match. For new entrants considering Gibraltar as a primary jurisdiction without an existing operational footprint there, the setup costs, including the physical equipment presence requirement, should be modelled carefully against the fiscal benefits before a licensing decision is made. To assess whether Gibraltar is the right fit for your operation, review the Gibraltar licensing and operational readiness checklist, which walks through market fit, cost modelling, and post-licence compliance workflows.

Frequently Asked Questions

What legislation now governs Gibraltar gambling licences?

The Gambling Act 2025 (Act.2026-04) entered force on 1 April 2026, repealing the Gambling Act 2005. Transitional provisions are set out in Schedule 8 of the 2025 Act. The AML Code of Practice was updated to v.1.0.2026 on 8 January 2026, incorporating references to Gibraltar’s 2025 National Risk Assessment for ML/TF/PF.

What is the AML supervisory structure for Gibraltar-licensed operators?

The Gambling Commissioner supervises AML/CFT compliance under the Proceeds of Crime Act 2015 and the AML Code of Practice v.1.0.2026. Suspicious activity reports are filed by licence holders directly to the Gibraltar Financial Intelligence Unit via the Themis portal. For consent SARs involving British customers, a dual-reporting protocol applies: the initial report goes to the UKFIU, with the GFIU notified after the consent determination.

Is Gibraltar on the FATF grey list?

As of the research date for this article, Gibraltar is not on the FATF grey list. The territory aligns its AML/CFT framework with FATF standards and the AML Code explicitly references international standards as the baseline for its requirements. Compliance teams should monitor FATF plenary outcomes and Gibraltar’s own NRA publications, the most recent being the 2025 NRA referenced in the January 2026 Code update, for any material changes to the jurisdiction’s FATF standing.

What is the physical presence requirement for a Gibraltar remote gambling licence?

Under the Gambling Act 2005 and carried into the 2025 Act, a person is regarded as conducting or providing facilities for remote gambling in or from within Gibraltar only if at least one piece of remote gambling equipment used in the provision of those facilities is situated in Gibraltar. This equipment-presence obligation is a hard licensing condition, not a best-practice recommendation.

Key Resources

Gibraltar Gambling Act 2025 (Act.2026-04), Gibraltar Laws Index, gibraltarlaws.gov.gi. In force from 1 April 2026, Schedule 8 contains transitional provisions from the repealed 2005 Act.

Gibraltar AML Code of Practice for Remote Gambling, v.1.0.2026, issued by the Gambling Commissioner, 8 January 2026. The operative AML/CFT/CPF guidance document for all remote gambling licence holders. Available at the Gibraltar government Gambling Division website.

Gibraltar Gambling Act 2005 (consolidated, repealed), Act No. 2005-72, assented 22 December 2005, in force 26 October 2006. Provides the foundational structure carried into the 2025 Act, relevant for understanding transitional obligations.

Supervisory Bodies (Powers, etc.) Regulations 2017, Gibraltar. The enforcement and sanctioning framework applicable to AML/CFT failings by licence holders supervised by the Gambling Commissioner.

Gambling (Licensing and Advertising) Act 2014 (UK), legislation.gov.uk. The statute that ended Gibraltar’s whitelisted status and introduced the point-of-consumption UKGC licence requirement for operators advertising to or accepting bets from British consumers.