Calder Standard

Are you within the Distributed Ledger Technology Framework?

Work through the test the Gibraltar Financial Services Commission actually applies, and leave with a dated record of your position against each limb of it.

This records your position. It cannot tell you whether you are in scope.

Why it cannot, and what the regulator actually says

The regulator's own note says its examples are non-exhaustive, and that a firm seeking to show it is out of scope must be able to evidence the particular circumstances of its business (§10.1). What follows records your answers and your reasons, with the source for each limb, so you have something to evidence them with. It is not legal advice and it is not a determination by the Gibraltar Financial Services Commission.

any firm carrying on by way of business, in or from Gibraltar, the use of distributed ledger technology ("DLT") for storing or transmitting value belonging to others, needs to be authorised by the GFSC as a DLT Provider

Scope of the DLT Framework, §5.3 · Gibraltar Financial Services Commission · 2024-10-28
What happens to what you type

Your answers and your reasoning never leave your browser. The record is built here from what you enter, and disappears when you close the tab. We count which steps people reach and how long they spend, so we can fix the ones that confuse people. Never what you wrote, only how much. No cookie, no account, nothing stored on your device.

LimbIs the activity carried on by way of business?

The framework is aimed at activity conducted as a business, not at individual users of DLT. The regulator weighs the nature and scale of what is done, whether it is continuous, and whether there is a commercial element to it.

What the note says (2 references)
  • §6.2“The GFSC will also take into account the nature and scale of the activity being conducted in Gibraltar, the degree of continuity, and the existence of a commercial element to the activity.”
  • §6.4The FSA and DLT Regulations are not intended to capture individual users of DLT. Buying goods or services with virtual assets on your own behalf, a one-off exchange or transfer for a third party, investing privately, and paying wages in virtual assets are not intended to fall in scope.
  • How continuous is the activity: ongoing, or a one-off?
  • Is there a commercial element, such as a fee, spread or other consideration?
  • Is it done for others, or on the firm’s own behalf?
LimbIs it carried on in or from within Gibraltar?

Being incorporated or registered in Gibraltar is enough to be treated as carrying on the activity from within Gibraltar, even where the service is provided elsewhere. Authorisation also requires a Gibraltar office with the mind and management of the business conducted from it, and the firm must be able to evidence that.

What the note says (2 references)
  • §6.1A firm must be registered and have an office in Gibraltar, must ensure the mind and management of its business is conducted from that office, and must be able to evidence this.
  • §6.3“A firm that provides DLT services outside Gibraltar that is incorporated or registered in Gibraltar will be considered to be carrying on that activity from within Gibraltar.”
  • Where is the firm incorporated or registered?
  • Where are the decisions about the business actually taken?
  • If services are provided outside Gibraltar, is the firm nonetheless registered there?
LimbDoes the activity use distributed ledger technology?

DLT is defined in statute as a database system in which information is recorded and consensually shared and synchronised across multiple nodes, and all copies are regarded as equally authentic. The regulator says it will read this broadly, so as to capture emerging applications. It does not regulate the technology itself, nor those who develop open-source software or protocols, but those developing and using it commercially.

What the note says (3 references)
  • §7.1“a database system in which: a) information is recorded and consensually shared and synchronised across a network of multiple nodes; and b) all copies of the database are regarded as equally authentic.”
  • §7.3The GFSC will interpret DLT broadly, in order to capture businesses adopting emerging applications of DLT and blockchain technology.
  • §7.4The legislation does not seek to regulate the technology itself, or those who develop open-source software or protocols using DLT, but those developing and using the technology for commercial purposes.
LimbDoes it involve storing or transmitting value belonging to someone else?

Value is defined widely, covering assets, holdings and other forms of ownership, rights or interests, and is wider than the FATF definition of virtual assets. Storage means being able to exercise control over access to another party’s value to the extent that it could be compromised by your actions; holding or having direct access to a client’s private keys clearly meets it. Transmission means having control, or an element of control, over sending a client’s value elsewhere, changing its ownership, or destroying it. A firm essential to a multi-signature transfer is in scope even if it cannot complete a transaction alone.

What the note says (6 references)
  • §8.1“assets, holdings and other forms of ownership, rights or interests, with or without related information, such as agreements or transactions for the transfer of value or its payment, clearing or settlement.”
  • §9.2“the GFSC interprets storage as the ability for one party to exercise control over access to another’s value to the extent that the value could be compromised as a result of the former’s actions.”
  • §9.3Holding or having direct access to private keys enabling control over a virtual asset on behalf of a client, during any business activity, clearly meets the definition of storage.
  • §9.4A firm essential to transferring a client’s value in a multi-signature arrangement falls in scope even where it cannot complete transactions without a key held by another party, including where loss of the key it holds would make the client’s value irrecoverable.
  • §9.5Transmission covers control, or an element of control, over passing a client’s value to a different wallet or address, changing its ownership by other means, or destroying it.
  • §9.12Non-fungible tokens are likely to fall within the definition of value.
  • Does the firm hold, or have access to, private keys belonging to clients?
  • Could a failure or error by the firm result in a client’s value being compromised?
  • Is the firm a necessary party to any transfer, including in a multi-signature arrangement?
ExclusionDoes the activity already fall within another regulated activity under Schedule 2 of the FSA?

Where it does, it continues to be regulated under those provisions rather than as a DLT service.

What the note says (1 reference)
  • §5.4The framework applies unless the activities fall within scope of any of the other regulated activities set out in Schedule 2 of the FSA, which continue to be regulated under the relevant sections.
ExclusionIs the firm already authorised for other regulated activities, and using DLT only within them?

A firm with existing permissions that uses DLT to improve its controls, procedures and processes does not need separate authorisation. The note gives the example that a bank using DLT in its back-end processes is unlikely to require it, while the same bank offering virtual asset wallets likely will.

What the note says (1 reference)
  • §5.5Firms with permission to conduct other regulated activities that use DLT to improve their controls, procedures and processes, or otherwise in the course of those activities, do not need separate authorisation. The requirement is triggered only when the firm provides DLT services in the manner prescribed by the FSA.
ExclusionIs the activity conducted on the firm’s own account only?

Whether authorisation is needed depends on how the virtual assets are used and for whose benefit. A person not engaging as a business for or on behalf of another is not conducting a regulated activity.

What the note says (2 references)
  • §11.2“A person not engaging as a business for or on behalf of another natural or legal person will not be conducting a regulated activity.”
  • §11.3Proprietary trading, purchasing goods and services with virtual assets, investing for private purposes, one-off exchanges or transfers for a third party, and paying salaries in virtual assets fall outside the framework.

Activities the note names

Both lists are explicitly non-exhaustive, and resembling one settles nothing on its own. They are here because recognising your own business in a list is a useful prompt for the reasoning above.

Given as in scope

  • §10.2 Custodial virtual asset wallet providers
  • §10.3 Virtual asset ATM operators
  • §10.4 Spot virtual asset exchanges, custodial and non-custodial
  • §10.5 Virtual asset derivatives exchanges
  • §10.6 Brokerage desks
  • §10.8 Virtual asset borrowing and lending platforms
  • §10.9 Virtual asset managed investment services
  • §10.10 Operators and administrators of smart contracts
  • §10.15 Stablecoin offerings

Given as out of scope

  • §11.3 Proprietary trading and own-account activity
  • §11.4 Non-custodial wallet services and hardware wallet manufacturers
  • §11.5 Peer to peer platforms
  • §11.6 Investment advice
  • §11.7 Non-custodial arrangers
  • §11.8 Research, development and outsourcing
  • §11.9 Validating transactions
  • §11.10 Non-custodial OTC and brokerage desks
  • §11.11 Virtual asset account signatories
Where control is unclear: the factors the regulator weighs

the GFSC will consider whether the level of control or influence that the individual or firm in question exerts over the storage or transmission of value belonging to others is sufficient to bring it within scope. §9.8

  • Whether an identifiable individual or firm derives economic benefit from the smart contract, DApp, DEX or stablecoin.
  • The extent of influence or control over it, for example by holding an administrative key that can set or adjust parameters.
  • Whether there is a legal requirement for the firm to effect the transmission of value.
  • Whether there is a legal requirement for the firm to deploy or administer it.
  • Whether external inputs, such as an oracle, are controlled or significantly influenced by the firm or a linked party.
  • Whether use of a particular virtual asset associated with the firm is required, and whether the firm controls a majority of the consensus mechanism.
  • Whether a failure or error by the firm would result in customer value being compromised.

Scope of the DLT Framework, issued 2024-10-28. Read it in full. This page summarises it and does not replace it.