The Gibraltar Gambling Act 2025 and Corporate Implications

Summary

The Gambling Act 2025 (Act No. 2026-04) replaced the Gambling Act 2005 with effect from 1 April 2026. It is a substantial piece of legislation — 178 sections and 9 schedules — and it does considerably more than modernise the 2005 framework.

The four changes that matter most in practice are:

1. The licensing perimeter has widened substantially. The Act moves from an entity-based model to one defined by regulated activities. It introduces a Gambling Operator Support Services (GOSS) licence covering marketing, ownership positions above 25%, and customer-fund holding; brings contracted-out compliance, fraud-prevention, ID-verification and CRM services inside the B2B perimeter; and creates a separate approval regime for content providers. Businesses that have never held a Gibraltar gambling licence may now require one.
2. The cost of authorisation is set out in a separate Legal Notice. The Gambling (Duties and Licence Fees) Regulations 2026 (LN.2026/065), made under sections 155(1) and 175 and in force from 1 April 2026, revoke the 2018 Regulations entirely. Any cost model built before April 2026 is out of date.
3. Supervision and enforcement have been rebuilt. Licensing sits with the Licensing Authority (the responsible Minister); supervision and enforcement sit with the Gambling Commissioner, supported by the Gambling Division. The Commissioner has new investigatory powers and a new administrative sanctions toolkit, with appeals to a purpose-built Gambling Appeals Tribunal.
4. The personal accountability regime is enacted but not yet in force. Part 5 (Regulated Functions and Regulated Individuals, sections 55–77) was expressly excluded from commencement and awaits a separate ministerial notice.

Much of the remaining operational detail — including responsible gambling requirements and reporting cadence — sits in codes of practice issued by the Commissioner rather than in the Act itself.

Commencement status

The Act was assented on 23 March 2026. Notice of Commencement LN.2026/064 brought it into operation on 1 April 2026, with one carve-out: the Notice commenced the Act "all except sections 55–77".

The practical consequence of the Part 5 carve-out is set out under Regulated individuals below. It is the single most commonly misstated feature of the new regime.

Regulatory architecture

The 2025 Act separates functions that were previously more consolidated:

• The Licensing Authority — the responsible Minister — grants, varies, and refuses licences, and determines change-of-control notices and content-provider approvals.
• The Gambling Commissioner — supported by the Gambling Division of HM Government of Gibraltar — supervises licence holders, issues codes of practice, and exercises investigatory and enforcement powers.
• The Gambling Appeals Tribunal — established under section 141 — hears appeals against specified decisions, a dedicated route that did not exist under the 2005 Act.

For licence holders this means regulatory relationships are now split. Licensing applications, variations, and control notices go to the Authority; supervisory engagement, information requirements, and enforcement correspondence come from the Commissioner.

The licensing perimeter: section 30

Section 30 is the provision that most often determines whether a business is newly in scope. It is deliberately two-directional, capturing regulated services supplied inbound — from any location to a Gibraltar-licensed operator — and outbound — from Gibraltar to any gambling operator, wherever that operator is licensed.

The inbound limb is not confined to supplies made to Gibraltar B2C operators; it captures supplies into Gibraltar-licensed holders generally. The outbound limb means a business physically operating from Gibraltar can be caught by reference to the services it provides, even where its customers are operators licensed elsewhere.

Section 30 works alongside the Act's substance requirements. Licence holders are expected to demonstrate genuine management and control in Gibraltar rather than relying on the location of technical infrastructure — a shift away from the server-location logic of the earlier regime.

A note on enforcement posture: Gibraltar's cooperation channels under the expanded perimeter are principally inbound and supervisory, supported by mature regulator-to-regulator alignment with the United Kingdom. The Act does not signal an offensive outbound enforcement campaign against offshore operators. The trajectory is nonetheless one of increasing reach as the section 30 perimeter is applied in practice.

The licence categories

The Act establishes three principal operator licence categories under section 17(6)–(8), organised by relationship to the customer and to the operator, not by product vertical. Licences are issued under section 37(2).

There is no Category A to Category D scheme under the Act and no product-vertical category numbering.

Contracted-out services are the quiet expansion

The fee schedules confirm that outsourced compliance and operational functions are now licensable B2B activities in their own right. A business providing fraud prevention or risk management, customer due diligence or compliance services, ID verification, or customer relationship management to gambling operators requires a B2B licence, at £50,000 annually in each case. This catches a population of service providers — including some intra-group shared-service arrangements — that had no previous licensing exposure.

Content providers: approval, not licensing

The Regulations create a distinct, lighter-touch route for content providers. A content provider is defined in regulation 2 as a person who develops, supplies, or makes available games, software, or other gambling content supplied to a licence holder through an aggregation platform, and who does not themselves hold a licence authorising direct supply to licence holders.

Such a person requires approval from the Licensing Authority rather than a licence, at a fee of £1,000 under Schedule 5. The fee must be paid before the Authority commences its assessment. For game studios distributing exclusively through aggregators, this is a materially cheaper route than a B2B licence — and identifying which side of the line a business falls on is worth doing carefully.

The GOSS licence deserves particular attention

GOSS is where the Act reaches businesses with no historic gambling-licensing exposure:

• Marketing and affiliate businesses. Marketing activity conducted in or from Gibraltar now requires authorisation for the first time.
• Ownership positions above 25%. Holding more than 25% of a Relevant Company is itself a licensable support service. This has direct implications for holding structures, trustees, foundations, and fiduciary shareholders — an ownership position previously a purely corporate matter may now carry a licensing obligation in its own right.
• Holding or managing customer funds. Non-bank businesses holding player funds are inside the perimeter; licensed credit institutions are carved out.

Groups should map their ownership chain and intra-group service arrangements against the GOSS definitions, not only their operating entities.

Fees and duties: LN.2026/065

The fee schedule is not in the Act. It sits in LN.2026/065, in force from 1 April 2026, which revokes the Gambling (Duties and Licensing Fees) Regulations 2018 by regulation 12(2). A "licensing year" runs from 1 April to 31 March.

Duties

Four points on duty are easy to miss and commercially significant:

• The intermediary duty has no exemption. Betting intermediaries and agents pay from the first pound of commission, unlike betting and gaming operators.
• Promotional costs are not deductible. In calculating gross betting or gaming profit, the value of free bets, free spins, bonuses, and other promotional incentives must not be deducted. Relevant chargebacks may be deducted. Bonus-heavy acquisition models therefore carry a duty cost that does not appear in net revenue.
• Duty is paid quarterly. Instalments fall due on 1 April, 1 July, 1 October, and 1 January, each payable no later than the last day of the month in which it falls due.
• Duty liability can reach individuals. Where a person is determined by court proceedings to have acted as a bookmaker, gaming operator, or intermediary without a necessary licence, the duty provisions apply to that person — and also to the director or ultimate beneficial owner of a company in that position. Unlicensed operation is therefore not only a regulatory and criminal exposure but a personal fiscal one.

Note also the terminology gap: duties are charged on gross betting, gaming, or intermediary profit, while the B2C annual fee bands are set by reference to annual gross yield. The two should not be assumed interchangeable when modelling.

Application fees

Application fees under Schedule 2 are non-refundable and payable on submission. Where a single application covers multiple related activities, a single fee is charged in respect of the principal activity.

Annual licence fees

Annual fees under Schedule 3 are due on 1 April and must be paid no later than 30 April each licensing year. Where a licence is granted part way through a year, the fee is apportioned from the beginning of the calendar quarter in which the licence takes effect.

Where an operator holds both betting and gaming licences, the total annual fee is the sum applicable to each vertical. This is the reverse of the application-fee position, where related activities attract a single principal fee — so a dual-vertical operator pays one application fee but two annual fees.

That said, regulation 6(6) gives the Licensing Authority discretion: where a single licence holder conducts multiple regulated activities, the Authority may determine how annual licence fees apply, taking account of the scope and scale of those activities. Multi-activity groups should engage with the Authority on fee treatment rather than assuming pure summation.

No double charge arises where a business performs both platform and aggregation functions; the higher principal fee applies. Direct-integration tiers are defined precisely:

• Tier 1 — unrestricted direct integrations to Gibraltar B2C licence holders, subject to regulatory approval.
• Tier 2 — less than £550,000 gross sales in respect of Gibraltar licence holders, or no more than three approved integrations with Gibraltar B2C licence holders.
• Tier 3 — less than £200,000 in respect of Gibraltar licence holders, or no more than two approved integrations with Gibraltar B2C licence holders.

The £65,000 step between Tier 3 and Tier 1 means integration count and Gibraltar-facing sales are worth monitoring deliberately rather than allowing to drift across a threshold.

The Relevant Company ownership fee is £5,000 annually on an £8,000 application — modest against the operator categories. The licensing obligation, not the fee, is the material consequence for fiduciary and holding structures: application, disclosure, ongoing supervision, and change-of-control exposure all follow.

Change of control

Where a person intends to acquire control under section 82, or to increase control under section 83, and thereby triggers the section 79 notice provisions, the licence holder must pay a fee under Schedule 4:

• A £3,000 base fee, rising to a maximum of £30,000.
• The Authority assesses complexity case by case, according to the nature and level of effort required to determine the notice.
• The base fee must accompany the notice unless otherwise agreed.
• Following assessment, the Authority advises whether the balance is payable; if so, the notice is not regarded as complete until the balance is paid.
• The Authority will generally treat straightforward notices of an increase in control as not requiring a fee.

The practical risk in a transaction is not the quantum but the timing: a notice sits incomplete until any balance is paid, so fee assessment should be built into the deal timetable alongside regulatory approval itself.

Regulated individuals, duplicates, and anti-avoidance

Two general provisions deserve attention. Regulation 11 (anti-avoidance) allows the Authority to disregard an arrangement, or the parts of it, which eliminates or reduces duty or licence fees where the arrangement is artificial or fictitious or has artificial or fictitious elements. Fee-driven structuring — for example fragmenting activities across entities to sit in lower bands or tiers — should be tested against this provision before implementation.

Regulation 12(1) provides that a change in a licensee's status, including suspension or surrender of a licence, does not affect the obligation to pay a fee or duty already payable for the relevant period or activity. Exiting the market does not discharge accrued liability.

Transitional provisions: Schedule 8

Schedule 8 distinguishes two populations, and conflating them is a common source of error.

Existing licence holders

Businesses licensed under the 2005 Act are grandfathered. They are automatically treated as licensed under the 2025 Act and continue on that basis until a new licence is issued. There is no cliff-edge for incumbents on 1 October 2026, and the Commissioner has not published a category-mapping or migration notification exercise. Incumbents should expect to re-paper into the new framework in an orderly process rather than in response to a single deadline.

Businesses newly caught by the perimeter

A business carrying on, immediately before commencement, an activity requiring a licence under the 2025 Act but not under the repealed legislation is treated as holding a transitional licence:

• Valid for six months from commencement — the initial validity period, running from 1 April 2026 to on or about 1 October 2026.
• If a full and complete application is submitted within that period, the transitional licence is extended until the application is determined — either a licence is granted, or the application is refused and the applicant notified in writing.
• A partial or incomplete application does not secure the extension.

Read this alongside regulation 6(2): an application is not regarded as made unless the prescribed fee has been paid in full. A newly in-scope business that files by 1 October but has not paid the full application fee has not made an application at all, and its transitional cover is at risk. Fee payment is not an administrative afterthought; it is a condition of the filing.

The 1 October 2026 date is therefore an application deadline for newly in-scope businesses, not a general governance-conformity deadline for the market, and it does not defer the commencement of any enforcement power.

Prediction markets and event contracts

The Act does not define "prediction market". Order-book prediction markets are caught by the existing betting and betting exchange definitions: the activity is a betting exchange under section 2 and a regulated activity under section 17(1)(e). Operators should expect to be licensed as betting exchange or intermediary businesses within the B2C framework rather than under any bespoke category in the Act — which, on the Schedule 3 figures, means a £100,000 annual fee and intermediary duty at 0.15% with no £100,000 exemption.

Gibraltar has since published a dedicated framework, the Prediction Market Regulations 2026, in force from 13 July 2026, supplementing that analysis.

On precedent: Gibraltar became the first European jurisdiction to license a prediction market operator when Predict Street Ltd was authorised in early April 2026, launching on 9 April and announcing a multi-year FIFA partnership as FIFA's first official partner in the prediction market category ahead of the 2026 World Cup. Two points of precision matter for anyone citing this precedent: the licence was granted as a betting intermediary under the 2005 Act, before the 2025 Act came into force, and the dedicated Prediction Market Regulations followed in July 2026. It is accurate to describe Predict Street as Gibraltar's first prediction market licensee; it is not accurate to describe it as the first licence granted under the 2025 Act or under the Prediction Market Regulations.

Supervision and enforcement

Investigatory powers

Under Part 7 the Commissioner's powers include requiring production of documents and information, conducting on-site inspections, entry under warrant, and commissioning reports from skilled persons. Failure to comply carries consequences both as an offence and as a supervisory matter.

Administrative sanctions

Part 8 introduces a sanctions regime that does not depend on prosecution:

• Administrative penalties, recoverable as a civil debt.
• Public statements — regulatory censure with reputational effect.
• Cease-and-desist orders.
• Suspension of a licence.
• Prohibition orders.

This is a material change from the 2005 regime's more limited toolkit. Operators should assume a supervisory failing can now be met with a financial sanction and a published statement without any criminal process. The calculation methodology for penalties is a matter for the Commissioner's published approach; operators should not assume a particular percentage-of-yield formula absent confirmation.

Appeals

Specified decisions are appealable to the Gambling Appeals Tribunal under section 141. Building the Tribunal route into internal escalation and regulatory-response procedures is worthwhile before it is needed.

Regulated individuals: enacted, not yet live

Part 5 creates a personal approval regime. A regulated function is, under section 57, a function within a licence holder listed in Schedule 3 to the Act, together with the function of exercising significant influence over a licence holder (section 60). Section 58 obliges a licence holder to ensure regulated functions are performed by approved regulated individuals.

Two points must be read together:

1. Part 5 is not in force. Sections 55–77 were expressly excluded from LN.2026/064 and await a separate commencement notice. As at the date of this update no such notice has been published. The regime is the one that is coming, not the one currently in force.
2. There is a grace period when it does commence. Schedule 8 provides that where a licence holder is obliged to but does not satisfy section 58 at the date Part 5 comes into operation, section 58 does not apply in respect of that regulated function until the earlier of 12 months from commencement, or the function being performed by an approved regulated individual.

The practical sequence is therefore: not yet started, then approximately a year of runway. Operators should map their Schedule 3 functions and significant-influence holders now as a planning exercise and watch the Gazette for the commencement order — but should not treat personal approval as a present legal obligation.

The cost, when it arrives, is modest: £500 per individual for a first approval lasting five years, and £200 for a material change to an existing approval. The burden is the assessment and evidence process, not the fee.

Player protection and codes of practice

The Act provides the framework for player protection; the operative detail sits substantially in codes of practice issued by the Commissioner, including the Generic Code, which functions as interpretive guidance to the industry.

Operators should expect the codes and subordinate regulations to address customer interaction and problem-gambling identification, self-exclusion arrangements, responsible gambling messaging, and the form and frequency of regulatory returns and incident notification. Where a specific threshold, register, or reporting cadence is not stated in the Act, treat it as a matter for the codes and confirm it against the published text rather than assuming it by analogy to another jurisdiction.

That caution matters particularly in relation to the United Kingdom. Gibraltar's regime is closely aligned with the UK's in supervisory culture and regulator-to-regulator cooperation, but it is not a copy of it. Requirements such as prescribed affordability thresholds or a national self-exclusion scheme should not be assumed to apply in Gibraltar in the same form, or at all, without reference to the Gibraltar codes.

Digital assets and cryptocurrency

There is no standalone cryptocurrency or digital-asset gambling licence under the Gambling Act 2025. Gambling denominated or settled in digital assets is regulated through the ordinary licence categories and the applicable AML and customer due diligence framework, not through a separate gambling category.

Two adjacent regimes are frequently — and incorrectly — merged into the gambling analysis:

• The DLT Provider Licence is a separate regime supervised by the Gibraltar Financial Services Commission under the Financial Services (Distributed Ledger Technology) Regulations, directed at firms that store or transmit value belonging to others. It is not a sub-category of the Gambling Act, and the Gambling Act does not impose it as a general precondition for accepting digital-asset wagers.
• The Property (Digital Assets) Bill 2026 is separate legislation addressing the proprietary status of crypto-tokens under Gibraltar law.

Where a gambling business does hold or transmit customer digital assets, the analysis is genuine — but it is a cross-regime question about the perimeter of the DLT regulations and the GOSS customer-funds limb, not a question of selecting a crypto gambling licence category.

Action points

The order matters. Perimeter triage comes first, because it is the only item with a deadline measured in weeks.

1. Triage the perimeter — immediately. Determine whether any group entity is newly caught: as an aggregator, platform supplier, or direct integrator; as a contracted-out provider of fraud prevention, CDD, compliance, ID verification, or CRM services; as a marketing or affiliate business; as a holder of more than 25% of a Relevant Company; or as a non-bank holder of customer funds. Test both limbs of section 30.
2. Pay the application fee in full when filing. Under regulation 6(2) an unpaid application is not an application. For newly in-scope businesses this is the difference between preserving and losing transitional cover before 1 October 2026.
3. Check whether a content-provider approval is the right route. A studio distributing solely through an aggregation platform and not supplying licence holders directly may need a £1,000 approval rather than a B2B licence.
4. Rebuild fee and duty modelling against LN.2026/065. Model annual fees per licence and per vertical; confirm the applicable B2C gross-yield band and B2B direct-integration tier; apply 0.15% duty with the £100,000 exemption to betting and gaming but not to intermediary commission; and remember that free bets, free spins, and bonuses are not deductible. Discard any model built on the revoked 2018 Regulations.
5. Engage the Authority on multi-activity fee treatment. Regulation 6(6) gives it discretion over how annual fees apply to a holder conducting multiple regulated activities.
6. Diarise the payment calendar. Annual fees due 1 April, payable by 30 April. Duty instalments due 1 April, 1 July, 1 October, and 1 January, each payable by the last day of that month.
7. Review the ownership and fiduciary chain. Identify holdings above 25% in any Relevant Company and assess whether the holder — including trustee, foundation, or corporate service arrangements — requires a GOSS licence in its own right.
8. Build change-of-control fees into transaction planning. A £3,000 base fee rising to £30,000, with the notice incomplete until any assessed balance is paid.
9. Test any fee-driven structuring against regulation 11. Artificial or fictitious arrangements reducing duty or fees may be disregarded.
10. Prepare for supervision under Parts 7 and 8, and build the section 141 Tribunal route into escalation procedures.
11. Plan, but do not prematurely implement, Part 5. Map Schedule 3 functions and significant-influence holders and monitor the Gazette; sequence spend against commencement plus the 12-month grace period.
12. Track the codes of practice and revisit player protection, reporting, and incident-notification arrangements as each is issued.
13. Confirm substance arrangements — management and control, decision-making records, and local presence — against the Act's expectations rather than infrastructure location.