Blockchain 2020 – Gibraltar – Technology

Introduction

Gibraltar’s regulatory standards and framework for the
regulation of virtual asset service providers (VASPs) in the
fast-paced and dynamic world of distributed ledger technology (DLT)
has been central to the success of Gibraltar’s developed DLT
industry.

While DLT is still a relatively nascent technology, Gibraltar
understood the need for proactive and purpose-built regulation for
operators in the space, with the government of Gibraltar
approaching this emerging industry with a receptive and innovative
attitude as far back as 2014. It is this progressive approach that
has allowed Gibraltar to position itself as a global
standard-setting jurisdiction for reputable DLT firms that want to
take advantage of the numerous benefits this technology offers, but
that want to do so in a safe and (appropriately) regulated
environment.

The jurisdiction has taken, and continues to take, the steps
required to maintain its position. Its regulatory approach allows
DLT firms to grow whilst ensuring that they are regulated to a
higher standard than is currently required by EU standards and also
keeping up-to-date with Financial Action Task Force (FATF)
recommendations.

Gibraltar’s DLT Regime

Gibraltar’s DLT regime was fully enacted in January 2018
through the Financial Services (Distributed Ledger Technology
Providers) Regulations 2017, now the Financial Services
(Distributed Ledger Technology Providers) Regulations 2020 (the
“DLT Regulations”). The introduction of the DLT
Regulations meant that any firm using DLT for storing or
transmitting value belonging to others, in or from Gibraltar, needs
to be authorised by the Gibraltar Financial Services Commission
(GFSC) as a DLT provider.

Gibraltar’s DLT framework was the world’s first
purpose-built regulatory framework for businesses using DLT. By
operating through a risk-based nine-principle approach, rather than
rigid rules, the framework is able to evolve with the fast-moving
industry. It further enables firms to use innovative solutions,
provided that they are able to satisfy the GFSC that they meet the
regulatory obligations. The effect of such an innovative approach
has meant that, whilst other jurisdictions are lagging behind, and
struggling to legislate at the rate that technology is developing,
Gibraltar remains ahead of the pack and for the most part is
anticipating and legislating far in advance of FATF recommendations
and worldwide threshold requirements.

Gibraltar’s risk-based principled approach has enabled the
GFSC to maintain an added layer of supervisory oversight that
permits it to take a view on the adequacy of new technologies used
to support its customer due diligence (CDD) and/or know your
customer (KYC) requirements as well as building in requirements
around the traceability of transactions relating to any customer.
This includes records and identifiers of devices and network
connections, transaction monitoring processes and transaction
history analysis.

All of this was facilitated through the requirements imposed on
DLT firms in Gibraltar to have specific systems designed to detect
and disclose financial crime risks. The effect was that
Gibraltar’s DLT firms and DLT Regulations remained largely
unaffected by the enactment of the Fifth Anti-Money Laundering
Directive (5AMLD) earlier in 2020.

5AMLD

Upon releasing 5AMLD, the European Commission issued the
following statement: “we are today marking an important step
in fighting against financial crime.” Upon first reading this
quote, one may think that 5AMLD had dramatically moved the
goalposts. Indeed, in relation to the DLT sphere, 5AMLD has
introduced requirements for digital wallet providers and
crypto-asset/cryptocurrency exchanges to be subject to registration
and supervision for AML compliance.

Many authorities will dramatically increase the regulatory
control and supervision of DLT firms operating from their
jurisdictions. In fact, most authorities that regulate DLT do so
specifically and solely in relation to AML/CFT, so falling in line
with 5AMLD. This includes financial services hubs such as the
United Kingdom, which is often regarded as operating one of the
most tightly regulated financial services markets in the world.

Many jurisdictions may have been forced to react and introduce
legislation or regulations that encompass the requirements of 5AMLD
in respect of virtual assets only this year. In contrast,
Gibraltar’s regulatory approach has meant that, in this
context, Gibraltar has been 5AMLD compliant since 2017 – two
years before the 5AMLD was transposed and given effect. Similarly,
the activity captured within the DLT framework is wider and
captured certain activity in the space that is carved out of 5AMLD.
The reason these businesses have been required to operate within
these compliance standards for so long is because under the DLT
Regulations, DLT firms became “Relevant Financial
Businesses” within the context of Gibraltar’s Proceeds
of Crime Act 2015 (POCA), and accompanying Anti Money Laundering
Guidance notes. In essence, DLT firms were subject to exactly the
same standard as all existing financial services businesses, with
additional requirements within the guidelines specific to DLT
businesses.

Thus, the registration and supervision that is now faced by DLT
firms in jurisdictions such as the United Kingdom has been in place
in Gibraltar since 2017. This affirms that Gibraltar’s stance
strikes the right balance between enabling DLT firms in Gibraltar
to grow in a far more secure and more regulated environment.

Indeed, this is also the case with the 2019 Financial Action
Task Force recommendations, which has caused the legislation of
many jurisdictions (only recently enacted) to arguably become
outdated or inconsistent with the Financial Action Task
Force’s recommendations.

Financial Action Task Force

In October 2018 the Financial Action Task Force adopted changes
to its recommendations to explicitly clarify that they apply to
Financial Activities involving “virtual assets” and added
two new definitions relating to “Virtual Assets” and
“Virtual Asset Service Providers”. The FATF adopted its
interpretative note at its June Plenary last year to clarify how
the FATF requirements should apply, in particular in respect of the
application of a risk-based approach to virtual asset activities
and VASP operations, with supervision or monitoring for AML/CFT
purposes, licensing or registration, preventative measures such as
CDD, record-keeping, suspicious transaction reporting and other
sanctions and enforcement measures. Gibraltar has had the
regulation and licensing of VASPs in place for a few years and
continues to work on the adoption and interpretation of
Recommendation 16, better known as the Travel Rule, upon which
Gibraltar’s Minister for Digital and Financial Services,
Albert Isola, has already announced Gibraltar is intending on
acting.

Gibraltar continues to position itself ahead of the curve and
whilst many jurisdictions are now commencing steps to tackle their
lack of regulations, and introduce simple-level VASP regulation
that relates mostly to compliance, Gibraltar has had a far more
detailed licensing regime in place since 2018.

One example of this is the suggestion from FATF that VASPs
should be required to meet “registration criteria set by
relevant authorities.” The wording in the recommendations
cites the fact that authorities should “impose such conditions
on licensed or registered VASPs to be able to effectively supervise
the VASPs. Such conditions should allow for sufficient supervisory
hold and could potentially include, depending on the size, nature
of the VASP activities, requiring a resident executive director,
substantive management presence or specific financial
requirements.” Gibraltar-authorised VASPs are required to
comply with principles relating to customer care and communication,
adequate risk disclosure, specific suitability analysis in certain
cases, regulatory capital adequacy requirements and financial and
non-financial resources, business continuity, contingency and
insurance requirements, specific governance arrangements,
requirements around systems and security access protocols,
including cybersecurity and IT vulnerability penetration testing,
risk management, client asset protection and segregation, and, as
mentioned previously, specific financial crime provisions.

Market Integrity

One of the commonly referred-to risks within DLT and virtual
assets revolves around the integrity of those markets. The
International Organization of Securities Commissions (IOSCO) has
identified several issues that merit consideration and that relate
to transparency, custody, clearing and settlement, trading,
security and systems integrity. It is also recognised that the
fostering of innovation needs to be balanced with the appropriate
level of regulatory oversight, especially in the context of a
market that ultimately requires consumer confidence in this
emerging market.

Of course, principles relating to all regulated secondary and
other markets are well defined and relate in part to the integrity
of trading through fair and equitable rules, regulation that
promotes transparency of trading, which is designed to detect and
deter manipulation and unfair trading and the management of large
exposures, default risk and market disruption. Foreign exchange
markets, stock markets and commodity brokers face or have faced
market risks in the past but fall squarely within these rules and
frameworks now. Whilst still possible on these traditional markets,
such activity is certainly less prevalent than in the crypto
markets, which by and large remain unregulated.

Market manipulation exists in the crypto sphere for a variety of
reasons. Primarily, an exchange may wish to manipulate its trading
volume in order to receive referrals from popular crypto websites,
thus ensuring that more users who are new or entering into the
crypto space decide to do business with themselves. The result is
that these exchanges may increase their listing fees for users to
list their tokens on an exchange. The effect of which is less
liquidity on these exchanges, making the prices more volatile,
which facilitates whaling, in which those traders with large
capital or those holding a large amount of a specific coin are able
to push the market in their favoured direction. This will
ordinarily entail raising the coin’s price and then selling off
all of their coins once the price reaches its peak, causing a
drastic fall in the value of the currency.

Other key ways that exchanges may manipulate the markets include
freezing assets on their platform, staging system breakdowns that
prevent investors from withdrawing their assets, and wash trading,
which involves traders buying and selling the same security to
mislead other traders. Whilst all these tactics may well have been
utilised in the past in forex, commodity exchanges or the stock
market in general, the fact is that they are now prevented from
doing so under regulation.

Therefore, it is vital that DLT exchanges are adequately
regulated in order to bring the DLT sphere into the mainstream and
increase consumer confidence that their money is being traded
fairly and not subject to any form of manipulation. As it stands,
no jurisdiction in the world has properly defined market rules and
frameworks for virtual asset exchanges.

However, as is becoming common practice in the market, Gibraltar
is once again leading the way in this sector, with Minister Isola
confirming in an interview with financial news outlet “The
Banker” that, within the coming months Gibraltar is planning
to introduce a tenth core principle to its DLT Regulations to
develop market integrity standards for exchanges in this space. In
so doing, Gibraltar will once again be leading the way in the
crypto market and undoubtedly be setting an example for other
jurisdictions to follow in its footsteps, as was the case in 2017
when Gibraltar’s DLT Regulations were first introduced.

Additionally, Minister Isola’s announcement shows that
Gibraltar’s pioneering approach to regulate this sector by
setting principles emphasises how modern problems require modern
solutions. It should further instil confidence in the market, not
only crypto but all emerging technologies, that Gibraltar is a good
home, combining regulation with flexibility to innovate.

Conclusion

Gibraltar’s innovative approach to its DLT Regulations has
most certainly enabled Gibraltar’s DLT industry to flourish
whilst maintaining regulatory oversight and ensuring consumer
protection. This has been facilitated through a novel approach of
adopting principles in its regulation as opposed to a set of fixed
rules that the DLT firms need to abide by.

The effect is that Gibraltar is two years ahead of international
regulatory requirements and indeed regulates far beyond what the
international community requires, as seen from Minister
Isola’s statement on market integrity. The success Gibraltar
has been able to achieve in its developed DLT industry serves as an
example of how new markets require a novel approach to regulation,
as opposed to “packaging” modern and innovative business
activities within traditional frameworks that were not designed
with these types of businesses in mind, and further demonstrates
how Gibraltar is not only a pioneer in this space, but a leader in
respect of DLT regulation and international standards.

Originally published by Isolas, July 2020

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.