GI v13.3.0 Sign in

Gibraltar (GI) · Module Detail

Gibraltar: Consumer Protection & APP Fraud

← Full Gibraltar overview Build report with Gibraltar Request deeper dive

#

Consumer protection rests on the GFSC Consumer Duty (Core Principles and Consumer Duty Regulations 2024, in force 9 May 2024, UK-aligned, outcomes-based). Crucially, on APP fraud Gibraltar has NO equivalent of the UK's mandatory reimbursement regime: under the Financial Services (Payment Services) Regulations 2020, PSPs must only reimburse 'unauthorised' payments, so APP-fraud victims (who authorise the payment) are not guaranteed reimbursement — a material divergence from the UK PSR mandatory reimbursement regime introduced October 2024. The GFSC issues consumer fraud-awareness alerts.

Standing sub-brief · written on or before 4 July 2026174 words · last cycle 2026-10-06

Consumer Protection & APP Fraud

Gibraltar's consumer-protection position carries a material divergence from the UK. Under the Financial Services (Payment Services) Regulations 2020, Gibraltar PSPs are only required to reimburse consumers for 'unauthorised' payments. Because authorised push payment (APP) fraud involves the victim authorising the payment, such transactions fall outside the regulations and victims are not guaranteed reimbursement — a material divergence from the UK PSR mandatory reimbursement regime introduced in October 2024. No equivalent mandatory reimbursement regime presently exists in Gibraltar, and the GFSC issues consumer APP-fraud awareness alerts. This divergence materially lowers PSP fraud-liability exposure in Gibraltar relative to the UK, applying to both bank and non-bank firms, and represents a competitive and consumer-protection differential operators should weigh.

Periodic update · new data 2026-10-06

Consumer Protection & APP Fraud

Gibraltars consumer-protection framework for payments complaints operates on statutory timelines distinct from, but connected to, the UK regime. Under the Gibraltar Payment Services Regulations, regulation 75(3) to (5), and the equivalent Electronic Money Regulations provision at regulation 26(2), complaint-handling timelines of 15 and 35 business days apply, giving firms a defined acknowledgement-and-resolution structure for payment-service and e-money complaints respectively. These Gibraltar-specific timelines sit alongside a UK regulatory extension: the FCA Handbook provision DISP 1.1.3R(5) extends the FCAs amended DISP 1.6.1R acknowledgement rule to Gibraltar-based firms that are subject to DISP 1 under GEN 2.3, with that extension taking effect from 1 June 2026. The practical effect is that a Gibraltar-based firm within the relevant scope must now meet an FCA-originated acknowledgement timeline requirement in addition to its own domestic Gibraltar complaint-handling timelines under the Payment Services and Electronic Money Regulations, rather than operating under a single unified standard.

A structural gap remains visible in Gibraltars dispute-resolution infrastructure: whether Gibraltar operates a functioning out-of-court dispute-resolution or ombudsman scheme under Part 14 of the Financial Services Act 2019, which commenced on 25 March 2021, is not confirmed by any appointed-ombudsman record or published contact details in the Act as consolidated to 13 August 2026. The FCA, for its part, states that Gibraltar currently has no such scheme. This is a notable absence given the parallel tightening of complaint-handling timelines under the Payment Services and Electronic Money Regulations and the extended FCA acknowledgement rule: a consumer with an unresolved Gibraltar payments complaint may have defined timelines for acknowledgement and initial handling but an unclear path to independent out-of-court resolution if those internal processes do not resolve the matter. This is worth surfacing explicitly as an enablement-relevant absence rather than passing over it: the lack of enforcement or infrastructure in this specific area is itself analytically significant for consumer-protection purposes, independent of whether any complaint volume has actually tested the gap.

Outlook

The open question for this module is whether Gibraltar moves to establish or formally confirm an operating ombudsman or dispute-resolution scheme under Financial Services Act 2019 Part 14, given that the statutory power has existed since March 2021 without apparent operational implementation as far as current records show. Separately, firms subject to both the Gibraltar-specific complaint-handling timelines and the FCAs extended DISP 1.6.1R acknowledgement rule from 1 June 2026 should expect continued attention to how the two timeline regimes interact in practice, particularly where a complaint touches both Gibraltar-domestic and UK-facing elements of a firms business.

Sources and findings (4)
  1. T3Isolas (gibraltarlawyers.com) — APP Fraud — Under the Financial Services (Payment Services) Regulations 2020, Gibraltar PSPs are only required to reimburse consumers for 'unauthorised' payments; because APP fraud involves the victim voluntarily making the payment, such transactions fall outside the PSR Regulations and victims are not guaranteed reimbursement.
  2. T3Isolas (gibraltarlawyers.com) — APP Fraud — Gibraltar's position contrasts with the UK Mandatory Reimbursement Regime introduced October 2024; no equivalent regime presently exists in Gibraltar, so PSPs are not legally obligated to reimburse APP-fraud victims.
  3. T1GFSC (fsc.gi) Consumer Duty / Triay Lawyers — The Consumer Duty is an outcomes-focused standard of care (Four Outcomes + Cross-Cutting Rules) under the Financial Services (Core Principles and Consumer Duty) Regulations 2024; the GFSC commenced thematic reviews of firms' compliance from Q3 2024.
  4. T1GFSC (fsc.gi) Consumer Alert — The GFSC issues consumer fraud-awareness alerts, including on rising APP fraud where fraudsters impersonate banks or the Royal Gibraltar Police to induce victims to make payments.