New VASP licensing rules affecting recovery in Gibraltar

Gibraltar's virtual-asset service providers operate under one of the world's oldest dedicated crypto-licensing regimes. As of early 2026, that regime is tightening – and the changes carry direct consequences for anyone trying to trace and freeze stolen digital assets through a Gibraltar-registered VASP.

Updated licensing rules mean that VASPs in Gibraltar now face stricter compliance and cooperation obligations. For recovery practitioners, this is a double-edged shift: enhanced record-keeping requirements strengthen the evidentiary base for a disclosure order, while new procedural layers can slow the response when hours already matter.

Below we set out what changed, who is affected, and what to do now.

What Has Changed in Gibraltar's VASP Licensing Rules?

Gibraltar's distributed-ledger technology regime has been progressively updated to align with evolving international standards on anti-money-laundering, counter-terrorist financing, and consumer protection. The most recent round of revisions tightens the conditions under which a licensed VASP must retain transactional records, respond to formal legal process, and cooperate with court-ordered disclosure.

Licensed VASPs must now maintain more granular records of wallet-level transaction data – and must be in a position to produce those records quickly on receipt of valid legal process. That is a meaningful change for recovery. On-chain tracing can identify the path a stolen asset took; a disclosure order served on a Gibraltar VASP can now unlock the identity data sitting behind a wallet address with greater precision than before.

At the same time, new licensing conditions require VASPs to verify that any freeze or hold on client assets is supported by appropriate legal authority. That means a freezing order over digital assets must be properly framed and served. Informal requests – even from law enforcement – carry less weight than before.

Who Is Affected by the New Rules?

The changes matter most to three groups.

• Victims of crypto fraud whose stolen assets passed through, or currently sit at, a Gibraltar-licensed VASP. The stronger record-keeping obligation works in your favour – but only if legal process is initiated promptly.
• Insolvency practitioners pursuing digital assets stripped from an estate. Gibraltar's licensing rules now create a clearer audit trail through the exchange layer, which supports both on-chain tracing and a formal Bankers Trust-style disclosure order compelling the VASP to identify account holders.
• Referring lawyers and litigation funders assessing the viability of a claim where the target holds or has recently moved assets through a Gibraltar VASP. The updated regime makes Gibraltar a more predictable forum for interim relief – though the procedural requirements are more exacting.

One group that is not helped by the new rules: those who wait. Dissipation can occur within hours of a theft. A VASP's enhanced record-keeping is only useful if the asset is still traceable to an account the VASP can identify and freeze.

What Should You Do Now?

Speed is the single most important variable. On-chain tracing begins the moment a matter is opened. Public blockchains are transparent; movement leaves a trail we can follow to a cash-out point, even when identities are obscured. The question is whether that trail leads to a live account before it goes cold.

If stolen or misappropriated funds have passed through a Gibraltar-based VASP, the practical steps are as follows.

• Preserve every piece of evidence: transaction IDs, wallet addresses, screenshots, communications, and any account documentation held by the victim.
• Engage a specialist to begin on-chain tracing immediately. Blockchain-analytics tools can map the movement of funds from the originating wallet to any identifiable choke point, including a Gibraltar VASP's deposit address.
• Consider whether a disclosure order against the VASP – compelling it to identify the account holder behind the receiving wallet – is available on the current facts. Gibraltar's updated rules give that application stronger procedural footing than before.
• Assess whether a freezing order over digital assets held at the VASP is warranted and whether the assets are still present. A freezing application is typically made without notice, to avoid alerting the target.

We regularly advise on matters where funds have moved across multiple chains and through one or more licensed VASPs before reaching a cash-out point. In our experience, the window between theft and irreversible dissipation is short – often days, sometimes hours. Gibraltar's tightened rules improve the toolkit. They do not extend the window.

To assess whether a Gibraltar VASP disclosure or freezing application is viable on your facts, contact us at info@axiomtracel.com or request a confidential case review.

For a broader view of crypto asset recovery strategy, visit our Crypto Asset Recovery insight hub. For jurisdiction-specific guidance on Gibraltar proceedings, see our Gibraltar recovery overview. If the fraud involves a pooled investment scheme, our analysis of recovering crypto lost to a Ponzi-style fund covers the additional layers that apply.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel in Gibraltar and other relevant jurisdictions where proceedings must be filed. Our team has traced stolen digital assets through exchange choke points and supported successful freezing applications in multiple forums. We do not promise outcomes; we give an honest read on what the facts support. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace routinely coordinates proceedings with local counsel in Gibraltar; local procedure governs the filing. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.