Gibraltar Enables Itself to Comply with FATF guidelines

[TravelMug]

I'm sure we pretty much heard about this tiny nation Gibraltar, which similar to Malta has been a save haven for crypto projects and even crypto relating gambling sites. And now it seems that they have 'succumb' to the pressure of FATF and they get themselves to comply with the rules.

The Regulatory Principles

The nine principles set out below applied to DLT Providers will ensure that the GFSC’s regulatory outcomes are achieved.

1. A DLT Provider must conduct its business with honesty and integrity.

The GFSC must be satisfied that the applicant, including the persons associated with it, are fit and proper to undertake the DLT activity. The basic elements which are relevant to such an assessment include:

    honesty, integrity and reputation;
    skill, competence, care and experience; and
    financial position.

2. A DLT Provider must pay due regard to the interests and needs of each and all its customers and must communicate with its customers in a way which is fair, clear and not misleading. 

DLT Providers are expected to devote as much time and consideration to protecting consumers' interests as to their own, and dedicate sufficient resources necessary to protect consumers. 

There is a need to use best endeavours to mitigate the risks associated with use of DLT and employ best practice in the operation of their business. 

DLT Providers must make appropriate disclosures regarding: 

    the use of DLT in the business;
    the risks associated with the technology and its use by firm; and 
    the products and services supplied and associated risks.

DLT Providers need to make initial and per-transaction disclosure of risks, terms and conditions, as well as employing ethical advertising and marketing standards.

They must have adequate complaint policies and disclosures and be able to manage and disclose any conflicts of interest.

DLT Providers need to ensure that the information is presented in a way that is likely to be understood by the target customer and does not disguise, diminish or obscure important items, statements or warnings.

3. A DLT Provider must maintain adequate financial and non-financial resources.

DLT Providers are expected to maintain sufficient financial resources to ensure that it can be run in a sound and safe manner. Capital levels must be monitored to ensure that sufficient capital is held to support business objectives. Capital level must be commensurate with the prudential risks. As a minimum, DLT Providers are expected to hold sufficient capital to ensure an orderly, solvent wind-down of its business. Where appropriate, DLT Providers are required to hold professional indemnity insurance cover. 

Consideration will therefore be given to the following:

    adequacy of financial resources;
    sustainability of business model;
    maintenance and retention of books and records; and
    audit and reporting standards.

In terms of non-financial resources, DLT Providers must ensure that it will be able to comply with the requirements imposed by the GFSC in the exercise of its functions.

4. A DLT Provider must manage and control its business effectively, and conduct its business with due skill, care and diligence; including having proper regard to risks to its business and customers.

DLT Providers are expected to apply good, forward-looking risk management practices. This will help provide assurance to all stakeholders that the core processes and systems are effectively controlled, are fit for purpose and that risk is being managed in the right way. 

Strong risk management practices will make DLT Providers better equipped to act on risks and control in a timely manner, therefore reducing the likelihood of significant risks emerging that have not already been identified and managed effectively.

5. A DLT Provider must have effective arrangements in place for the protection of client assets and money when it is responsible for them.

DLT Providers are expected to take all reasonable precautions to protect customer assets in their custody or control against unexpected eventualities and threats. Custodial assets will need to be segregated from the DLT Provider’s own assets. 

DLT firms need to ensure that they maintain robust and accurate records of transactions. 

6. A DLT Provider must have effective corporate governance arrangements. 

DLT Providers need to implement good corporate governance. This is crucial as it will establish the system by which firms will be run and business overseen, including its structure, processes, culture and strategies. It will establish the rules by which authority is exercised and decisions taken and implemented to manage all risk types and exposures. 

DLT Providers need to deliver and maintain a corporate culture consistent with the secure and confident delivery of these principles. They need to have an open, cooperative and transparent relationship with the GFSC and other regulators and must disclose to them any matter of which the regulator would reasonably expect notice. 

Areas of focus will include: 

    board structure, including composition to ensure that there is a good balance and mix of skills and experience to complement the business; 
    adequate application of the four eyes principle; and
    application of mind and management from Gibraltar.

7. A DLT Provider must ensure that all systems and security access protocols are maintained to appropriate high standards.

All systems used should ensure the right level of access to authorised personnel with up to date monitoring systems. On-going and proactive security assessments should be conducted on DLT technologies to keep up to date with any new threats and potential vulnerabilities. 

These include:

    risk assessment of applications, underlying technology, and cybersecurity;
    policies, procedures and controls to ensure the delivery of this principle;
    skilled and experienced staffing;
    continuous vulnerability and threat analysis and assessment;
    continuous monitoring and response provisions; and 
    independent compliance audit and reporting.

8. A DLT Provider must have systems in place to prevent, detect and disclose financial crime risks such as money laundering and terrorist financing.

DLT Providers must adequately apply anti-money laundering and counter terrorist financing preventive measures which are commensurate with their risks, and report suspicious transactions. DLT Providers need to be aware of the vulnerabilities of its products and services to financial crime risks and ensure that they implement measures to mitigate the risks. 

DLT Providers need to comply with the Proceeds of Crime Act and any guidance issued by the GFSC.   

9. A DLT Provider must be resilient and must develop contingency plans for the orderly and solvent wind down of its business.

DLT Providers need to develop, test and maintain adequate business continuity, disaster recovery and crisis management plans.

Preparedness for any potential threats or loss should form part of the disaster recovery plans as well as a well-managed and structured business continuity management process. Testing of the plans and its embedded processes should form part of the business model.

https://www.fsc.gi/dlt

So it's pretty much being transparent I would say, they term them "DLT" (Distributed Ledger Technology) or simply put Blockchain Technology. And projects or providers now need to comply with this new regulatory framework based on FATF.

[1714624892]

1714624892

[1714624892]

1714624892

[1714624892]

1714624892

[Yaunfitda]

I think it's the right move for them, I mean, they've been in the picture already and you don't want to be on the opposite side and go against the FATF at this point. Well there could be pressure, but I guess it's better this way as you can't fight this global regulation that's been sweeping, from exchanges, to traders to a pro-crypto friendly countries like Gibraltar.

[sheenshane]

I still remember the glorious days where people can enjoy cryptocurrency in any part of the world. But yes, it really has to be regulated.
I feel bad since another country is about to put a fence against the cryptocurrency. The FATF isn't that strict anyway. Cryptocurrency companies only had to comply with the regulations and they will be fine.

Just like FATF AML Regulation. This could be the fact that from time to time, there are too many changes by different tied up.

[btc_angela]

I still remember the glorious days where people can enjoy cryptocurrency in any part of the world. But yes, it really has to be regulated.
I feel bad since another country is about to put a fence against the cryptocurrency. The FATF isn't that strict anyway. Cryptocurrency companies only had to comply with the regulations and they will be fine.

Just like FATF AML Regulation. This could be the fact that from time to time, there are too many changes by different tied up.

Yeah, those where the days wherein we really enjoy our crypto and could earn right away specially arbitrage through different countries without having to go with this strict regulations. But it's bound to happen, but I would say that it is strict by any measures, we are no longer (pseudo) anonymous as they require everyone to have a very unyielding regulations specially about KYC's which we crypto enthusiast hates, or at least majority of us doesn't want our identification revealed to this third party services.

[Darker45]

I find nothing particularly wrong with the principles of this regulation. The stipulations are apparently for the protection and smooth business experience of every DLT provider's customers and even the DLT providers themselves.

The terms are general, though. So we still do not know the specific steps and policies that would be implemented by each DLT provider in line with them. For example, under this:

8. A DLT Provider must have systems in place to prevent, detect and disclose financial crime risks such as money laundering and terrorist financing.

DLT Providers must adequately apply anti-money laundering and counter terrorist financing preventive measures which are commensurate with their risks, and report suspicious transactions. DLT Providers need to be aware of the vulnerabilities of its products and services to financial crime risks and ensure that they implement measures to mitigate the risks.  

DLT Providers need to comply with the Proceeds of Crime Act and any guidance issued by the GFSC.  

I have these particular probing questions, among others:

• What specific "systems" are they talking about?
• What are these "preventive measures" that would be implemented under this specific principle?
• Are they going to be requiring KYC to each and every customer?
• What are covered under "suspicious transactions"?
• What steps are DLT Providers going to take upon the discovery of these "suspicious transactions"?
• Will there be immediate blocking of accounts and the like?

[dothebeats]

At some point, regulations would have to be followed for the betterment of the scene, else it will still prove to be a feeding ground for low-life people using cryptocurrencies as a medium to perpetrate their illegal activities. Gibraltar and Malta are favorites for crypto startups due to its inviting nature towards such companies, though it is also slowly attracting a lot of scammers and fraudulent personalities given its leniency towards regulations. Gibraltar was the first to 'give in' or rather comply with the FATF guidelines, and it shouldn't be frowned upon given that this only opens a lot more opportunity for the space to grow into something healthy with less of the illegalities.

[Kemarit]

At some point, regulations would have to be followed for the betterment of the scene, else it will still prove to be a feeding ground for low-life people using cryptocurrencies as a medium to perpetrate their illegal activities. Gibraltar and Malta are favorites for crypto startups due to its inviting nature towards such companies, though it is also slowly attracting a lot of scammers and fraudulent personalities given its leniency towards regulations. Gibraltar was the first to 'give in' or rather comply with the FATF guidelines, and it shouldn't be frowned upon given that this only opens a lot more opportunity for the space to grow into something healthy with less of the illegalities.

Yeah, but it took them time to comply with FATF rule, but still I think their government weight everything first and most probably think that complying is the best and only way to continue to be a safe-haven for crypto projects. And if they didn't then there could be someone who are going to take advantage of their lax law and probably run scam projects in their country. So it will be a black eye for them as they might be blacklisted. I'm sure Malta will follow (if they haven't done so). As for us, we should accept the fact the regulation is indeed in the crypto space and will be the common theme for years to come.

[mohamadali]

I find nothing particularly wrong with the principles of this regulation. The stipulations are apparently for the protection and smooth business experience of every DLT provider's customers and even the DLT providers themselves.

The terms are general, though. So we still do not know the specific steps and policies that would be implemented by each DLT provider in line with them. For example, under this:

8. A DLT Provider must have systems in place to prevent, detect and disclose financial crime risks such as money laundering and terrorist financing.

DLT Providers must adequately apply anti-money laundering and counter terrorist financing preventive measures which are commensurate with their risks, and report suspicious transactions. DLT Providers need to be aware of the vulnerabilities of its products and services to financial crime risks and ensure that they implement measures to mitigate the risks.  

DLT Providers need to comply with the Proceeds of Crime Act and any guidance issued by the GFSC.  

I have these particular probing questions, among others:

• What specific "systems" are they talking about?
• What are these "preventive measures" that would be implemented under this specific principle?
• Are they going to be requiring KYC to each and every customer?
• What are covered under "suspicious transactions"?
• What steps are DLT Providers going to take upon the discovery of these "suspicious transactions"?
• Will there be immediate blocking of accounts and the like?

[stompix]

I'm sure we pretty much heard about this tiny nation Gibraltar, which similar to Malta has been a save haven for crypto projects and even crypto relating gambling sites. And now it seems that they have 'succumb' to the pressure of FATF and they get themselves to comply with the rules.

Now?
That's an extract from the 2017 version of the amendment , it was repealed the same year.

The new regulations were also adopted long ago, in January, Gibraltar was under pressure for a long time to choose where it stands, as it found itself in the middle of the Brexit debate.

Yeah, but it took them time to comply with FATF rule, but still I think their government weight everything first and most probably think that complying is the best and only way to continue to be a safe-haven for crypto projects. And if they didn't then there could be someone who are going to take advantage of their lax law and probably run scam projects in their country.

I never understood why crypto projects like to blame everything on regulation when it comes to light they are hiding behind a shell company based in some shady location with a virtual office and no real company. How is Barry Silbert and many others being able to run tons of projects in the US with all that regulations and others can't....pretty obvious why.

[gentlemand]

When people on here venerate 'crypto hubs' like Gibraltar and Malta I seem to be completely unable to find anything of any note that's actually operating in unfettered paradise there.

I think they seize on one vague noise the piddly government makes and then decide armies of grandmas there are running thousands of crypto street stalls while their crypto grandchildren code 'blockchain' on the beach.

[squatter]

When people on here venerate 'crypto hubs' like Gibraltar and Malta I seem to be completely unable to find anything of any note that's actually operating in unfettered paradise there.

Malta doesn't make it easy to research licensed entities. Supposedly as of May this year, 340 firms applied for licenses in 2019 and 26 are now actively registered, but the register on the MFSA's site is broken so I can't see which companies those are.

They did recently publish a list of companies operating without a license, but I don't recognize most of the names since they didn't publish DBAs.

I think a lot of companies temporarily registered there because they had a transitional phase where you could operate outside of compliance or with a rubber stamp temporary license. OkCoin did that, if memory serves correctly. That transitional period is long over now though, so I assume most of those companies moved their registrations elsewhere.

[DaveF]

When people on here venerate 'crypto hubs' like Gibraltar and Malta I seem to be completely unable to find anything of any note that's actually operating in unfettered paradise there.

I think they seize on one vague noise the piddly government makes and then decide armies of grandmas there are running thousands of crypto street stalls while their crypto grandchildren code 'blockchain' on the beach.

It's been going on for years in crypto and every other financial market. One small country or one that for them moment has lax or no regulation to the next.
As soon as other countries take note and start to point out the error of their ways they start to implement some regulations and the crypto businesses move to the next location.

It's just way it is.

-Dave

[malevolent]

I never understood why crypto projects like to blame everything on regulation when it comes to light they are hiding behind a shell company based in some shady location with a virtual office and no real company. How is Barry Silbert and many others being able to run tons of projects in the US with all that regulations and others can't....pretty obvious why.

Does he run any B2C companies focused on Joe Average, or is it all B2B? They complain about regulations because they increase costs of doing business, raise the barriers of entry, and keep scaring away customers (not everyone feels like supplying selfies and stool samples just to use some service). Allegedly shady locations are chosen because often they're the only sensible option.

[Harlot]

Similar to what happened to Malta several months back

Malta doing all it can to avoid FATF grey-listing, Edward Scicluna says

I see a pattern now where crypto-friendly countries where crypto companies reside the most are being pressured by the FATF to do some additional legislation to avoid illicit activities from happening in their country which is really questionable to begin with as they should not target countries where there is no history of helping do illicit activities but instead focus on where the money is flowing. The pattern is pretty obvious by targeting these 2 small nations that are known to accept the crypto industry and is now in strict surveillance of the FATF.

[malevolent]

Malta doing all it can to avoid FATF grey-listing, Edward Scicluna says

Actually makes sense given how they're often accused of being complicit in laundering Italian mafia's money, and how much finance/gambling contributes to their economy. If they have to choose between cryptocurrencies and gambling they'll go with gambling, a more mature industry that already brings them a lot of money (given the size of their economy).

[Mbitr]

Their old guidelines were rather non specific, they are at least trying to make clear and compliant rules .
Let’s see what happens.
This is taken from the section -
DLT Provider Guidance Notes
Protection of Clients Assets and Money

https://www.fsc.gi/uploads/Guidance%20Note%205%20-%20Protection%20of%20Client%20Assets%20GFSC%202020.pdf

[Harlot]

Malta doing all it can to avoid FATF grey-listing, Edward Scicluna says

Actually makes sense given how they're often accused of being complicit in laundering Italian mafia's money, and how much finance/gambling contributes to their economy. If they have to choose between cryptocurrencies and gambling they'll go with gambling, a more mature industry that already brings them a lot of money (given the size of their economy).

Even if there are links against Italian mafia activities happening in Malta the question is why would they focus on these small country rather than focusing on applying the regulations by the FATF itself on Italy? Are they just picking of smaller countries just because they think they have a chance to be out of compliance with the rules and regulation? That bigger countries like Italy don't need to have some kind of stricter regulation and enforcement because they are a bigger country? If the FATF wants to improve their enforcement they should apply it to all countries not just the small ones.

[gentlemand]

If the FATF wants to improve their enforcement they should apply it to all countries not just the small ones.

Everyone goes for the path of least resistance. And it could be said that a tiny jurisdiction is much more prone to being hijacked or undermined by one element. The big black holes will always be so.