The Gibraltar Gambling Act 2025 and Corporate Implications

Background: Replacing the 2005 Act

Gibraltar's gambling industry has been regulated under the Gambling Act 2005 for over two decades. In that time, the online gambling market has undergone fundamental transformation — the emergence of mobile gaming, live dealer products, in-play sports betting, and, more recently, cryptocurrency gambling has exposed the limitations of a legislative framework designed for the early days of internet wagering. The Gambling Act 2025, passed by the Gibraltar Parliament in March 2026, comprehensively replaces the 2005 Act and establishes a modern regulatory architecture suited to the current and foreseeable gambling landscape.

Gibraltar has approximately thirty licensed gambling operators, many of which are among the world's largest online gambling businesses. The territory's gambling sector contributes a material share of GDP and employs a significant proportion of the local workforce. The legislature and the Gibraltar Gambling Commissioner have engaged extensively with the industry over a multi-year consultation process that preceded the Act, meaning the principal provisions are not a surprise to most existing licence holders. Nevertheless, the compliance and governance implications for licensed operators are substantial and require prompt attention.

This regulatory update examines the key changes introduced by the Gambling Act 2025, the corporate implications for existing and prospective licence holders, and the practical steps operators should take during the transitional period.

Key Changes Under the New Act

The Gambling Act 2025 introduces changes across three principal dimensions: the powers and functions of the Gibraltar Gambling Commissioner; the structure of gambling licences; and the regulatory framework for player protection and responsible gambling. The most significant provisions are summarised below.

Expanded Gambling Commissioner Powers

The Act substantially expands the Gibraltar Gambling Commissioner's investigative and enforcement powers. Key new powers include:

• Enhanced information-gathering powers: The Commissioner may now issue information notices requiring licence holders to provide specified information or documents within prescribed timeframes. Failure to comply is a criminal offence and a ground for licence suspension or revocation.
• Expanded inspection rights: The Commissioner's inspection powers are extended to cover all premises, systems, and records connected to a licensed operator's Gibraltar operations, including IT systems and data repositories held by third parties on behalf of the operator.
• Civil financial penalties: The 2025 Act introduces a civil penalty regime enabling the Commissioner to impose financial sanctions on licence holders for regulatory breaches without requiring prosecution. Maximum penalties are calculated by reference to a percentage of the operator's annual Gibraltar-source gross gambling yield.
• Expedited suspension powers: The Commissioner may now suspend a licence on an expedited basis (without the full hearing process otherwise required) where there is an immediate and serious risk to players or the integrity of gambling activities.

Updated Licence Categories

The 2005 Act's licence categories — broadly divided into gaming and fixed odds betting — have been rationalised and expanded. The Gambling Act 2025 introduces the following principal licence categories:

• Category A — Online Casino and Games: Covers remote casino games, slots, virtual games, and peer-to-peer products. Replaces the former gaming licence with enhanced technical and RNG audit requirements.
• Category B — Sports Betting: Covers fixed odds and spread betting on sporting events, including in-play and exchange products. Introduces specific requirements for event integrity monitoring and reporting.
• Category C — Lottery and Prize Competitions: A new category covering online lottery products, prize competitions, and free-to-play mechanic products with prize elements previously regulated inconsistently.
• Category D — Cryptocurrency and Digital Asset Gambling: A new, standalone category specifically addressing gambling activities denominated in or settled using cryptocurrencies or digital assets. Requires applicants to hold or partner with a Gibraltar DLT Provider Licence and imposes specific AML and customer due diligence standards for digital asset transactions.

Existing licence holders will be migrated to the appropriate new category during the transitional period. The Commissioner has indicated that migration notifications will be issued to all current licence holders by June 2026.

Enhanced Player Protection Framework

The responsible gambling provisions of the 2025 Act are the most prescriptive in Gibraltar's regulatory history. The Act creates a statutory framework for player protection that goes significantly beyond the voluntary commitments that characterised the previous regime:

• Mandatory affordability checks: Operators are required to conduct affordability assessments for players who meet defined loss or deposit thresholds. The thresholds and methodology will be set out in subordinate regulations, with the Commissioner empowered to update them periodically.
• National self-exclusion register integration: Gibraltar operators must integrate with a national self-exclusion register. Players who self-exclude through the register cannot participate in gambling with any licensed Gibraltar operator.
• Compulsory responsible gambling messaging: Operators must display prescribed responsible gambling messages at defined intervals during gaming sessions, in addition to existing requirements on sign-up and deposit flows.
• Enhanced duty of care obligations: The Act introduces an express statutory duty of care to customers, codifying the obligation to take reasonable steps to identify customers showing signs of problem gambling and to intervene in specified ways. This duty can be enforced by the Commissioner and may, in certain circumstances, give rise to private civil liability.

Corporate Governance Requirements

The Gambling Act 2025 introduces the most significant expansion of corporate governance requirements in Gibraltar gambling regulation to date. Key governance provisions include:

• Fit and proper requirements extended to senior managers: The 2005 Act's fit and proper assessment was focused on directors and key personnel at the time of licence application. The 2025 Act extends ongoing fit and proper obligations to all senior managers within the licensed entity, with operators required to maintain and update a senior manager register and notify the Commissioner of any material change.
• Compliance function requirements: Licensed operators must maintain a dedicated compliance function with a qualified compliance officer. The compliance officer must have direct access to the board and the Commissioner, and cannot be subject to commercial pressure that compromises their independence.
• Board-level accountability: The Act introduces explicit board-level accountability for regulatory compliance. A nominated director must be designated as responsible for gambling regulation compliance. This individual will be the primary point of contact for the Commissioner and will bear personal accountability for material compliance failures.
• Annual compliance attestation: Operators must submit an annual compliance attestation to the Commissioner, signed by the designated director, confirming ongoing compliance with the Act and associated regulations.

Compliance and Reporting Obligations

In addition to governance requirements, the Act expands operators' ongoing compliance and reporting obligations:

• Quarterly regulatory reports: Operators are required to file quarterly reports with the Commissioner covering gross gambling yield, player accounts, self-exclusion data, and compliance incidents. This replaces the previous annual reporting requirement.
• Incident reporting: Any significant compliance incident — including data breaches, system failures affecting player funds, or identified breaches of the player protection framework — must be notified to the Commissioner within 24 hours of identification.
• AML reporting alignment: The Act harmonises the gambling-specific AML reporting obligations with Gibraltar's broader AML framework under the Proceeds of Crime Act, reducing duplication but increasing the granularity of required transaction monitoring and suspicious activity reporting.

Transitional Period: April 2026 Onwards

The Gibraltar Gambling Commissioner has announced a transitional period running from the Act's commencement on 1 April 2026. During this period:

• Existing licence holders continue to operate under their current licences, which are deemed to be issued under the equivalent new Act category.
• Operators have until 30 September 2026 to bring their governance, compliance, and reporting arrangements into full conformity with the Act's requirements.
• The Commissioner will issue formal migration notifications to all current licence holders by 30 June 2026, confirming the new category to which each licence is mapped and any specific conditions attached.
• The civil penalty regime applies from 1 October 2026. Before that date, enforcement action for transitional period non-compliance will be taken under the Commissioner's existing powers.

What Operators Need to Do Now

Licensed Gibraltar gambling operators should treat the transitional period as an immediate compliance priority. The key actions for the remainder of 2026 are:

1. Map current structure to new licence categories: Identify which new category your current licence maps to, and assess any conditions or requirements specific to that category that may represent a change from your current obligations.
2. Appoint a designated director: Designate a board-level director as the responsible individual for gambling regulation compliance and notify the Commissioner. Ensure this individual understands the personal accountability provisions of the Act.
3. Review and strengthen the compliance function: Assess whether your current compliance officer and team meet the Act's requirements for independence and qualifications. Address any gaps before 30 September 2026.
4. Implement responsible gambling enhancements: Review your player protection framework against the Act's requirements and the forthcoming subordinate regulations on affordability thresholds. Begin system development for mandatory affordability checks and national self-exclusion integration.
5. Prepare quarterly reporting infrastructure: Ensure your data systems and reporting processes can produce the quarterly reports required by the Act from the transitional period end date.
6. Review senior manager register: Map all individuals who fall within the extended fit and proper regime as senior managers, complete internal assessments, and establish the notification protocol for future changes.