Our approach

The GFSC takes a risk-based approach to all aspects of the authorisation process and we ask that applicants take time to consider key risks before submitting an application. It is helpful, both to us and to applicants, if applicants familiarise themselves with the GFSC’s risk based approach with particular reference to the following documents:  

• The Risk Governance Framework;
• The Risk Outlook;
• The Risk Appetite Statements. 

When an application is received, we will assess the key risks based upon the information provided and aim to advise applicants on whether there are sufficient controls set out to manage those risks. Applicants should ensure they are in a position to provide clear details of any key risks and the steps that will be put in place to mitigate them before they submit their application.

When we do identify key risks we need to be satisfied that the applicant understands the risk and has appropriate controls in place, for example, financial resourcing, contingency planning or succession planning.

We welcome innovative proposals. Some innovation may, however, carry increased risk. It is not the GFSC’s role to prevent businesses from failing but we will work with applicants to seek assurance that they have tested their business model thoroughly to reduce this risk. Applicants should consider potential implications for consumers, should the business experience financial difficulty, and ensure that they have adequate systems and controls in place to minimise impact on consumers and the reputation of Gibraltar.

Applying for a permission

Who should apply?

The GFSC is responsible, under Part 3 of the Financial Services Act 2019 (the Act), for considering and determining applications for permissions, recognitions and registrations wishing to conduct regulated activity under the Act and secondary regulations.

If you wish to carry out a regulated financial services activity, by way of business, in or from Gibraltar, you will need to be authorised by the GFSC. 

How to apply?

As a first step. we welcome applicants to contact the Authorisation team to arrange a meeting to discuss the application proposal, business model and type of activity you wish to undertake. This forms part of the Pre-Application Process.

Threshold Conditions

Mind and Management

The GFSC has established criteria for mind and management that applicants must satisfy to be successful in securing and retaining a regulated activity permission. We will not approve a permission unless we are satisfied that the applicant meets the criteria set out below.

Regulated Firms must ensure that the mind and management of the business is conducted from its office in Gibraltar, and the firm should be able to evidence this. Where firms provide services to customers in jurisdictions outside Gibraltar, the firm should be able to continue to demonstrate that its Gibraltar office complies with our mind and management requirements. This is an ongoing requirement that will be continually assessed by the relevant supervisory team.

To ensure that the mind and management principle is being complied with, the firm must evidence that the following are being conducted from its Gibraltar office on an ongoing basis:

• Decision making pertaining to the running of business on a day to day basis.
• Approval of operational policy and guidelines.
• Approval of key deviations from standard company policy and guidelines.
• Approval of significant expenditure items.
• Approval and sign off of key contracts, including outsourcing arrangements.
• Approval of all major expenditure incurred by the company.

In addition, they must:

• have access to all accounting records of the firm at all times and oversee the production of management accounts and statutory returns; and
• be able to furnish the GFSC with information that it requires regarding the day-to-day running of the company in a timely manner, including information processed by other parties under any outsourcing agreement.

Four-eyes

The overriding requirement is that the four-eyes (two individuals) criterion is to be met on a continual basis and that individuals assigned to fulfil these roles do so over the entire operations of the firm.  It is not therefore possible to satisfy this criterion when a number of different individuals look over other parts of a firm’s operations. 

These provisions are designed to ensure that at least two minds are applied to both or errors leading to difficulties for the business as a whole are less likely to occur.  They must also have sufficient experience and knowledge of the business and the necessary authority to detect and deal with any imprudence, dishonesty or other irregularities in the firm.

In determining whether a firm meets the four-eyes criterion, we will consider:

• The seniority and authority of the person. 
• Whether the individuals are conducting their roles on a day-to-day basis within Gibraltar. 
• Experience and knowledge of the individuals. 

A non-executive director, for example, would automatically be excluded from performing this role. Similarly, non-resident executive directors or non-resident executive managers would normally fail to meet this requirement. A person who is permanently employed in Gibraltar and discharges that employment in Gibraltar but resides in close proximity in Spain, will, for the purposes of this criterion, be considered “resident”.

Fit and Proper

We will not approve a permission unless we are satisfied that the applicant, and the Regulated Individuals associated with it, are fit and proper to undertake the regulated activity. 

Submitting an application

The Authorisation team will agree with the applicant an appropriate point at which the completed application pack can be submitted.

To help us process applications expeditiously, applicants should submit comprehensive and well-constructed application packs. We will work with all applicants at the pre-application stage to provide guidance on the documents that require submission as part of their specific application. We expect to receive some of the following documents as part of an application pack:

• Completed Application Forms –applicants should complete the requisite Application Form for their specific regulated activity. Applicants should also ensure that any documents referred to in the Application are referenced clearly;
• Regulated Individuals Form –applicants should complete this for all individuals who will be carrying out a Regulated Individual function;
• Controller Form - applicants should complete this for all Controllers of the company; including the ultimate beneficial owner of the business together with any voting rights, this includes individuals, corporate vehicles and trusts;
• Governance Structure –applicants should provide a governance structure outlining relevant roles and reporting lines; and
• Financial Information - Returns –applicants should provide detailed financial information demonstrating how any minimal financial and capital requirements will be met both initially and on an ongoing basis.

Each regulated activity type also has its own individual regulatory requirements and statutory criteria that need to be met. Applicants should identify and address any sector specific requirements as part of their application.

Ahead of submission please:

• Read the specific guidance for your proposed activity carefully. Remember that it is advisable to contact us ahead of the application and hold a pre-meeting;
• Complete the correct forms and answer all relevant questions;
• Finalise your application. We do not accept draft applications;
• Provide us with any other information you think we should be aware of. Whilst we provide comprehensive guidance, you are encouraged to submit any information that you believe we  should take into consideration;
• Be open and honest with us and if you are unsure, please disclose it to us. This is particularly important as if the GFSC finds that an applicant has deliberately withheld information or provided false or incomplete information this could seriously impact our decision; and
• Ensure you submit the correct application fee.

Please send your completed application to the Authorisation team at:

The Authorisation Team

Gibraltar Financial Services Commission

PO Box 940

Suite 3, Ground Floor

Atlantic Suites

Europort Avenue

Gibraltar

What happens next?

Once your application has been submitted, an authorisation officer will be assigned to your application. You will have the opportunity to work closely with the authorisation officer to ensure that he/she understands your business. We will confirm your authorisation officer at the same time we confirm receipt of your application.

If your application is complete, we will assess the application, including the risks the proposed activity presents to the GFSC's objectives. As part of this assessment, we will ensure that consumers are protected along with the reputation of Gibraltar. We may contact you to obtain additional information which will help us consider your application. If an applicant does not answer all the relevant questions or provide all relevant information, the application may be returned and may not be processed until a properly completed version is submitted.

If the application is eligible and complete, we will assess associated risks. We will determine how to conduct the application based on our assessment of the risks and we will also identify and request any additional information required as part of this assessment.

During the final stages of the authorisation process, a formal decision will be made and communicated to the applicant. To ensure that we deliver consistent, fair and efficient decision-making we will only make decisions based upon the information we hold and the information provided by applicants during the application process. This process may include the consideration of a report at one of the GFSC’s internal panels or committees. The report will summarise the application’s key risks and information and make a formal recommendation to the decision maker. This recommendation will generally fall within one of the following three categories:

• Approval without conditions;
• Approval with conditions;  
• Refusal.

Where the decision maker has confirmed that they are intending to approve an application (with or without requirements) we will contact the applicant to inform them of the recommendation. 

Where the GFSC is minded to refuse the application, we will contact the applicant to inform them of the recommendation. Applicants can then make representations to the Decision Making Committee. Where a final decision to refuse is entered, the decision will be kept on record and the applicant will be required to disclose the decision as part of any future application made to either the GFSC or other regulators. We will always look to exercise discretion in eligible cases to give applicants the opportunity to withdraw their application before a formal recommendation for refusal is made.

How long will an application take?

We will process and consider applications as swiftly as possible. The time taken to process the application will be dependent on the quality of the application pack. To ensure your application is processed in a timely manner, it is important you submit all necessary forms and supporting documentation as accurately as possible. We expect applicants to have an understanding of the requirements for authorisation and the regulated activity that they wish to apply for.

Where can I get help with an application?

If you have a query relating to an application please contact the Authorisation team.

We are not able to make business assessments on behalf of applicants nor are we able to provide advice to applicants on the criteria for regulated activity. It is at all times the responsibility of individuals to ensure that they act in accordance with legislative requirements and should you wish to have the position clarified at any stage, then we recommend you seek professional advice.