GI v13.3.0 Sign in

Gibraltar (GI) · Module Detail

Gibraltar: Operational Resilience & Critical Infra

← Full Gibraltar overview Build report with Gibraltar Request deeper dive

#

Gibraltar has implemented a UK-equivalent Operational Resilience regime: the GFSC published Operational Resilience, Outsourcing/Third-Party Risk Management and Liquidity Risk Management Guidance Notes in 2024 following industry consultation. Firms identify important business services and set impact tolerances (deadline 13 July 2024), with full compliance expected after 13 July 2026. DORA applies indirectly to firms that are part of EU groups. Gibraltar may set requirements differing from both FCA and PRA given its smaller market.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Horizon · 2026-07 (± a quarter)GFSC Operational Resilience full-compliance milestoneAdopted, not yet in force · Tier 1 source
Standing sub-brief · written on or before 4 July 2026193 words · last cycle 2026-06-23

Operational Resilience & Critical Infrastructure

Gibraltar's operational-resilience regime is closely aligned with UK approaches and carries the most imminent compliance deadline in the current spine. The GFSC published Guidance Notes on Operational Resilience, Outsourcing/Third-Party Risk Management and Liquidity Risk Management, with consultation concluding 12 January 2024. The implementation pathway required firms to set impact tolerances by 13 July 2024 and to hold a prioritised plan by 13 July 2026; after 13 July 2026, firms must remain within impact tolerances in severe-but-plausible disruption. This applies to both bank and non-bank GFSC-regulated payments firms. DORA applies indirectly to EU-group firms, layering an additional resilience expectation onto Gibraltar entities within EU groups.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T1GFSC (fsc.gi) news — Guidance Notes publication — The GFSC published Guidance Notes on Operational Resilience, Outsourcing/Third-Party Risk Management and Liquidity Risk Management following an industry consultation that concluded 12 January 2024; the outsourcing note complements the Operational Resilience Regulations and Guidance Note, aligned with UK approaches.
  2. T3PwC Gibraltar — Operational Resilience — Firms must have identified important business services and set impact tolerances by 13 July 2024, hold a prioritised plan by 13 July 2026, and after 13 July 2026 have comprehensive strategies to remain within impact tolerances in severe-but-plausible disruption.
  3. T3Isolas (gibraltarlawyers.com) — GFSC Annual Report 2023/24 — The GFSC implemented a UK-equivalent Operational Resilience regime and UK-equivalent Consumer Duty regime as part of legislative amendments enhancing regulatory alignment with the UK (GFSC Annual Report 2023/24).
  4. T3Sicsic Advisory / Grant Thornton Gibraltar — The EU's DORA applies indirectly to Gibraltar-presence firms that are part of EU groups or operate a Brexit solution via an EU subsidiary; the GFSC is likely to have different operational-resilience requirements to both the FCA and PRA given the smaller market.