Gibraltar: Conduct, Safeguarding & Promotions

Conduct, Safeguarding & Financial Promotions

Gibraltars safeguarding conduct regime for payment institutions and electronic money institutions was substantially overhauled with the commencement, on 16 July 2026, of new Schedules 4 and 5 to the Financial Services (Payment Services) Regulations 2020 and the Financial Services (Electronic Money) Regulations 2020, introduced by Legal Notices 2026/224 and 2026/225 respectively and published in the Gibraltar Gazette, No. 5328, of that date. The changes move Gibraltars safeguarding regime from a comparatively general set of obligations toward a detailed, operationally specific framework covering diversification of safeguarding arrangements, reconciliation methodology, resolution-pack content, and periodic audit.

Under the amended Electronic Money Regulations, an institution must periodically review whether it is appropriate to diversify, or further diversify, the third parties with which it deposits, holds, invests, insures or guarantees relevant funds, and must adjust the third parties used and the amounts deposited where it concludes diversification is appropriate, placing an active, recurring diversification-assessment duty on institutions rather than a one-off structuring decision. Institutions using insurance or a guarantee, alone or combined with segregation, that provides unlimited cover are relieved of the internal safeguarding reconciliation requirement but must instead perform a daily calculation of their safeguarding requirement, a substitution of one control (daily calculation) for another (reconciliation) rather than a net reduction in obligation. A new statutory no-recourse, no-combination, no-set-off protection applies to the safeguarding account itself: the account provider has no interest in, recourse or right against money or assets in the safeguarding account for sums owed to it or a third party on another account, and no right to combine the safeguarding account with another account or exercise set-off or counterclaim against the safeguarded money or assets, reinforcing the ring-fenced character of safeguarded funds at the custodial level.

A new annual audit obligation, set out in Schedule 5, applies to institutions that have been required to safeguard more than GBP 100,000 of relevant funds at any time for a period of at least 53 weeks; the auditors report must be delivered to the GFSC within four months of the end of the period covered, with a copy provided to the institution at the same time. Where an institution relies on unlimited insurance or guarantee cover and so performs the daily calculation in lieu of reconciliation, paragraph 11(2) specifies that this daily calculation substitutes for the internal reconciliation obligation rather than operating alongside it. A defined resolution-pack obligation requires that certain documents and records, including those identifying funds and assets institutions and insurance or guarantee providers, acknowledgement letters, policies or guarantees, documents identifying relevant individuals, and the most recent internal and external audit reports, be retrievable immediately under paragraph 23(2); separately, an administrator, receiver, trustee, liquidator or analogous officer appointed over the institution must be able to retrieve each required document within 48 hours of appointment, giving the resolution pack direct operational relevance in an insolvency scenario rather than leaving it a purely documentary exercise. On insolvency itself, regulation 34(1)(a) gives electronic money holders claims priority over all other creditors from the asset pool, and regulation 34(1)(b) bars set-off or security rights over the asset pool until those claims are paid in full, save for set-off relating to fees and expenses of operating an account.

The GFSC supported these statutory changes with a new Guidance Note on Safeguarding for payment institutions and electronic money institutions, announced 20 July 2026, setting out its expectations on safeguarding of customer funds, safeguarding resolution packs, and safeguarding audit requirements, issued in close proximity to the Schedule 4/5 commencement date. Monthly regulatory reporting timelines for electronic money institutions were also tightened, with institutions now required to submit required returns within 15 business days after the end of each calendar month under new regulation 32A(1), excluding the month in which the institution first became an electronic money institution.

Outlook

With the Schedule 4/5 changes now in force, the near-term focus shifts to how institutions operationalise the new diversification-review, reconciliation-or-daily-calculation, and resolution-pack requirements, and whether the GFSCs supporting Guidance Note, once its full content is available, surfaces supervisory expectations beyond the bare statutory text. The GBP 100,000/53-week audit threshold is likely to be the first point at which a visible population of institutions newly falls within scope of the annual audit obligation, making it a natural marker for assessing how broadly the new Schedule 5 regime bites in practice.

Conduct, Safeguarding & Financial Promotions

Gibraltar's safeguarding and governance requirements for payment and e-money firms were tightened by LN 2026/225, which amended the 2020 E-Money Regulations' safeguarding and governance provisions. This amendment has been in force since 16 July 2026. The amendment sits within the existing E-Money Regulations framework rather than introducing a wholly new regime, strengthening the governance and asset-safeguarding obligations applicable to licensed e-money issuers and payment institutions operating from Gibraltar.

Separately, the FCA's CASS 15 Supplementary Safeguarding Regime took effect in the UK from 7 May 2026 for UK-regulated payment and e-money institutions, including a Gibraltar firm that operates via a UK branch. A Gibraltar-licensed firm accessing the UK market solely through the temporary passporting bridge, rather than through a UK branch, is not itself brought into scope of CASS 15 by that access route alone; the distinction between branch-based and passporting-based UK presence is material to which safeguarding regime applies.

Outlook

Firms should monitor whether further safeguarding amendments follow the July 2026 tightening, and should track their own UK presence structure (branch versus passporting bridge) against the CASS 15 scope boundary as the 31 December 2026 bridge expiry approaches.

Conduct, Safeguarding & Financial Promotions

A significant UK conduct-side change with direct relevance to Gibraltar market access is set to take effect this cycle. The FCA's Supplementary Safeguarding Regime under CASS 15 takes effect 7 May 2026 for UK-regulated payment institutions and e-money institutions, and specialist commentary describes it as the most significant PI/EMI safeguarding overhaul in a decade. This is assessed Probable, sourced via specialist secondary commentary.

The safeguarding mechanism itself operates through segregation requirements for customer funds held by PIs and EMIs. Because continued Gibraltar market access is understood to be conditioned on maintaining equivalent standards to the UK regime, this UK-domestic conduct change carries a direct, if indirect, compliance implication for Gibraltar-domiciled PI/EMI firms: they are expected to meet an equivalent safeguarding bar even though CASS 15 is not itself a Gibraltar instrument.

Outlook

The key point to watch is how the equivalent-standards expectation is formally operationalised for Gibraltar firms — whether through the current transitional passporting arrangement's own conditions, through future GAR conditions once that regime becomes operational, or through some other mechanism. No Gibraltar-specific instrument implementing an equivalent safeguarding standard was located this cycle.