Gibraltar’s regulatory standards and framework for the regulation of virtual asset service providers (VASPs) in the fast-paced and dynamic world of distributed ledger technology (DLT) has been central to the success of Gibraltar’s developed DLT industry.
While DLT is still a relatively nascent technology, Gibraltar understood the need for proactive and purpose-built regulation for operators in the space, with the government of Gibraltar approaching this emerging industry with a receptive and innovative attitude as far back as 2014. It is this progressive approach that has allowed Gibraltar to position itself as a global standard-setting jurisdiction for reputable DLT firms that want to take advantage of the numerous benefits this technology offers, but that want to do so in a safe and (appropriately) regulated environment.
The jurisdiction has taken, and continues to take, the steps required to maintain its position. Its regulatory approach allows DLT firms to grow whilst ensuring that they are regulated to a higher standard than is currently required by EU standards and also keeping up-to-date with Financial Action Task Force (FATF) recommendations.
Gibraltar’s DLT Regime
Gibraltar’s DLT regime was fully enacted in January 2018 through the Financial Services (Distributed Ledger Technology Providers) Regulations 2017, now the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 (the “DLT Regulations”). The introduction of the DLT Regulations meant that any firm using DLT for storing or transmitting value belonging to others, in or from Gibraltar, needs to be authorised by the Gibraltar Financial Services Commission (GFSC) as a DLT provider.
Gibraltar’s DLT framework was the world’s first purpose-built regulatory framework for businesses using DLT. By operating through a risk-based nine-principle approach, rather than rigid rules, the framework is able to evolve with the fast-moving industry. It further enables firms to use innovative solutions, provided that they are able to satisfy the GFSC that they meet the regulatory obligations. The effect of such an innovative approach has meant that, whilst other jurisdictions are lagging behind, and struggling to legislate at the rate that technology is developing, Gibraltar remains ahead of the pack and for the most part is anticipating and legislating far in advance of FATF recommendations and worldwide threshold requirements.
Gibraltar’s risk-based principled approach has enabled the GFSC to maintain an added layer of supervisory oversight that permits it to take a view on the adequacy of new technologies used to support its customer due diligence (CDD) and/or know your customer (KYC) requirements as well as building in requirements around the traceability of transactions relating to any customer. This includes records and identifiers of devices and network connections, transaction monitoring processes and transaction history analysis.
All of this was facilitated through the requirements imposed on DLT firms in Gibraltar to have specific systems designed to detect and disclose financial crime risks. The effect was that Gibraltar’s DLT firms and DLT Regulations remained largely unaffected by the enactment of the Fifth Anti-Money Laundering Directive (5AMLD) earlier in 2020.
Upon releasing 5AMLD, the European Commission issued the following statement: “we are today marking an important step in fighting against financial crime.” Upon first reading this quote, one may think that 5AMLD had dramatically moved the goalposts. Indeed, in relation to the DLT sphere, 5AMLD has introduced requirements for digital wallet providers and crypto-asset/cryptocurrency exchanges to be subject to registration and supervision for AML compliance.
Many authorities will dramatically increase the regulatory control and supervision of DLT firms operating from their jurisdictions. In fact, most authorities that regulate DLT do so specifically and solely in relation to AML/CFT, so falling in line with 5AMLD. This includes financial services hubs such as the United Kingdom, which is often regarded as operating one of the most tightly regulated financial services markets in the world.
Many jurisdictions may have been forced to react and introduce legislation or regulations that encompass the requirements of 5AMLD in respect of virtual assets only this year. In contrast, Gibraltar’s regulatory approach has meant that, in this context, Gibraltar has been 5AMLD compliant since 2017 – two years before the 5AMLD was transposed and given effect. Similarly, the activity captured within the DLT framework is wider and captured certain activity in the space that is carved out of 5AMLD. The reason these businesses have been required to operate within these compliance standards for so long is because under the DLT Regulations, DLT firms became “Relevant Financial Businesses” within the context of Gibraltar’s Proceeds of Crime Act 2015 (POCA), and accompanying Anti Money Laundering Guidance notes. In essence, DLT firms were subject to exactly the same standard as all existing financial services businesses, with additional requirements within the guidelines specific to DLT businesses.
Thus, the registration and supervision that is now faced by DLT firms in jurisdictions such as the United Kingdom has been in place in Gibraltar since 2017. This affirms that Gibraltar’s stance strikes the right balance between enabling DLT firms in Gibraltar to grow in a far more secure and more regulated environment.
Indeed, this is also the case with the 2019 Financial Action Task Force recommendations, which has caused the legislation of many jurisdictions (only recently enacted) to arguably become outdated or inconsistent with the Financial Action Task Force’s recommendations.
Financial Action Task Force
In October 2018 the Financial Action Task Force adopted changes to its recommendations to explicitly clarify that they apply to Financial Activities involving "virtual assets" and added two new definitions relating to "Virtual Assets" and "Virtual Asset Service Providers". The FATF adopted its interpretative note at its June Plenary last year to clarify how the FATF requirements should apply, in particular in respect of the application of a risk-based approach to virtual asset activities and VASP operations, with supervision or monitoring for AML/CFT purposes, licensing or registration, preventative measures such as CDD, record-keeping, suspicious transaction reporting and other sanctions and enforcement measures. Gibraltar has had the regulation and licensing of VASPs in place for a few years and continues to work on the adoption and interpretation of Recommendation 16, better known as the Travel Rule, upon which Gibraltar’s Minister for Digital and Financial Services, Albert Isola, has already announced Gibraltar is intending on acting.
Gibraltar continues to position itself ahead of the curve and whilst many jurisdictions are now commencing steps to tackle their lack of regulations, and introduce simple-level VASP regulation that relates mostly to compliance, Gibraltar has had a far more detailed licensing regime in place since 2018.
One example of this is the suggestion from FATF that VASPs should be required to meet "registration criteria set by relevant authorities." The wording in the recommendations cites the fact that authorities should "impose such conditions on licensed or registered VASPs to be able to effectively supervise the VASPs. Such conditions should allow for sufficient supervisory hold and could potentially include, depending on the size, nature of the VASP activities, requiring a resident executive director, substantive management presence or specific financial requirements." Gibraltar-authorised VASPs are required to comply with principles relating to customer care and communication, adequate risk disclosure, specific suitability analysis in certain cases, regulatory capital adequacy requirements and financial and non-financial resources, business continuity, contingency and insurance requirements, specific governance arrangements, requirements around systems and security access protocols, including cybersecurity and IT vulnerability penetration testing, risk management, client asset protection and segregation, and, as mentioned previously, specific financial crime provisions.
One of the commonly referred-to risks within DLT and virtual assets revolves around the integrity of those markets. The International Organization of Securities Commissions (IOSCO) has identified several issues that merit consideration and that relate to transparency, custody, clearing and settlement, trading, security and systems integrity. It is also recognised that the fostering of innovation needs to be balanced with the appropriate level of regulatory oversight, especially in the context of a market that ultimately requires consumer confidence in this emerging market.
Of course, principles relating to all regulated secondary and other markets are well defined and relate in part to the integrity of trading through fair and equitable rules, regulation that promotes transparency of trading, which is designed to detect and deter manipulation and unfair trading and the management of large exposures, default risk and market disruption. Foreign exchange markets, stock markets and commodity brokers face or have faced market risks in the past but fall squarely within these rules and frameworks now. Whilst still possible on these traditional markets, such activity is certainly less prevalent than in the crypto markets, which by and large remain unregulated.
Market manipulation exists in the crypto sphere for a variety of reasons. Primarily, an exchange may wish to manipulate its trading volume in order to receive referrals from popular crypto websites, thus ensuring that more users who are new or entering into the crypto space decide to do business with themselves. The result is that these exchanges may increase their listing fees for users to list their tokens on an exchange. The effect of which is less liquidity on these exchanges, making the prices more volatile, which facilitates whaling, in which those traders with large capital or those holding a large amount of a specific coin are able to push the market in their favoured direction. This will ordinarily entail raising the coin's price and then selling off all of their coins once the price reaches its peak, causing a drastic fall in the value of the currency.
Other key ways that exchanges may manipulate the markets include freezing assets on their platform, staging system breakdowns that prevent investors from withdrawing their assets, and wash trading, which involves traders buying and selling the same security to mislead other traders. Whilst all these tactics may well have been utilised in the past in forex, commodity exchanges or the stock market in general, the fact is that they are now prevented from doing so under regulation.
Therefore, it is vital that DLT exchanges are adequately regulated in order to bring the DLT sphere into the mainstream and increase consumer confidence that their money is being traded fairly and not subject to any form of manipulation. As it stands, no jurisdiction in the world has properly defined market rules and frameworks for virtual asset exchanges.
However, as is becoming common practice in the market, Gibraltar is once again leading the way in this sector, with Minister Isola confirming in an interview with financial news outlet “The Banker” that, within the coming months Gibraltar is planning to introduce a tenth core principle to its DLT Regulations to develop market integrity standards for exchanges in this space. In so doing, Gibraltar will once again be leading the way in the crypto market and undoubtedly be setting an example for other jurisdictions to follow in its footsteps, as was the case in 2017 when Gibraltar’s DLT Regulations were first introduced.
Additionally, Minister Isola’s announcement shows that Gibraltar’s pioneering approach to regulate this sector by setting principles emphasises how modern problems require modern solutions. It should further instil confidence in the market, not only crypto but all emerging technologies, that Gibraltar is a good home, combining regulation with flexibility to innovate.
Gibraltar’s innovative approach to its DLT Regulations has most certainly enabled Gibraltar’s DLT industry to flourish whilst maintaining regulatory oversight and ensuring consumer protection. This has been facilitated through a novel approach of adopting principles in its regulation as opposed to a set of fixed rules that the DLT firms need to abide by.
The effect is that Gibraltar is two years ahead of international regulatory requirements and indeed regulates far beyond what the international community requires, as seen from Minister Isola’s statement on market integrity. The success Gibraltar has been able to achieve in its developed DLT industry serves as an example of how new markets require a novel approach to regulation, as opposed to "packaging" modern and innovative business activities within traditional frameworks that were not designed with these types of businesses in mind, and further demonstrates how Gibraltar is not only a pioneer in this space, but a leader in respect of DLT regulation and international standards.