Fintech 2021 - Fin Tech

1. What are the sources of payments law in your jurisdiction?

Payment services in Gibraltar are primarily regulated under the Financial Services (Payment Services) Regulations 2020 ("PSR"). The PSR transpose the Payment Services Directive EU 2015/2366 ("PSD 2") into Gibraltar law. See Question 14 for further information on the applicability of EU law insofar as Gibraltar law in concerned.

The PSD 2 makes provisions for the transparency of payment services and requirements for both users and providers in the provision of payment services. It replaced the first Payment Services Directive (2007/64/EC) and increased the scope and application capturing transactions in any currency and "one leg out" transactions. PSD 2 is able to capture new services and providers, these include the newly defined "payment initiation services providers" and "account information services providers".

Payment services under the PSR may consist of: enabling cash withdrawals; enabling cash to be placed in a payment account; credit transfers, including standing order; issuing payment instruments or acquiring payment transactions; or money remittance. Any firm wishing to provide these type of services must be authorised by the Gibraltar Financial Services Commission ("GFSC") as a Payment Services Provider and is required to comply with all legislative and regulatory requirements.

The other main source of payments law in Gibraltar is the Financial Services (Electronic Money) Regulations 2020 ("E-Money Regulations"), which governs the issue and distribution of electronic money. Types of electronic money include pre-paid cards and electronic pre-paid accounts for use online. Depending on the construct of a virtual currency, in certain circumstances, cryptocurrencies may also qualify as electronic money under Gibraltar law. For further detail on the E-Money Regulations see question 14 below.

2. Can payment services be provided by non-banks, and if so on what conditions?

Payment services can be provided by banks as well as non-banks. Authorised Credit Institutions or Electronic Money Issuers are not required to apply for a separate payment service permission. These institutions will however need to ensure that their Credit Institution or Electronic Money regulatory permission is extended to cover payment services and they will need to comply with the relevant payment services requirements.

In order for a non-bank or non-electronic money issuer to become authorised to provide payment services they must apply to the GFSC for a regulatory permission. In order to do so, they must submit an application pack consisting of: 3 year financial projections, GFSC regulated individual forms for each individual that will performing a regulated function, GFSC non-executive director forms for each non-executive director, GFSC controller forms for each controller, business plan, risk methodology and framework, supporting policies and procedures, details of source of wealth/source of funds business continuity plan and any other document the applicant considers the GFSC should take into consideration as part of the application as well as the application fee.

An applicant may apply for one of the following three classes of payment services permissions, depending on the services they will provide:

Class A – for providing the service of money remittance.
Class B – for payment initiation services and/or account information services.
Class C – for services enabling cash to be placed on a payment account as well as all the operations required for operating a payment account, services enabling cash withdrawals from a payment account as well as all the operations required for operating a payment account, execution of payment transactions including transfers of funds on a payment account with the user's payment services provider or with another payment service provider, execution of payment transactions where the funds are covered by a credit line for a payment service user and/or issuing and/or acquiring payment services.

If an applicant requests an authorisation for a range of services that falls within two different classes of permissions, the applicant should select the class of permissions with the highest capital requirement. This means that a firm is only able to hold one class of permissions.

Applicants will have an initial ongoing capital requirement depending on their Class. Class A is €20,000, Class B is €50,000 EUR and Class C is €125,000. Regulated firms may hold multiple permissions and may therefore be required to hold the aggregate of capital for each licence. These cases are dealt with by the GFSC by a case-by-case basis.

3. What are the most popular payment methods and payment instruments in your jurisdiction?

The most popular payment methods in Gibraltar are debit card payments, credit card payments and cash.

4. What is the status of open banking in your jurisdiction (i.e. access to banks' transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?

In Gibraltar, the PSR provides for the authorisation of Account Information Service Providers ("AISPs") and Payment Initiation Service Providers ("PISPs"). AISPs are authorised to provide consolidated information on one or more payment accounts held by a payment service user with either another payment service provider or with more than one payment service provider. PISPs are authorised to initiate instructions by a payer or payee to its payment service provider requesting the execution of a payment transaction at the request of the payment service user with respect to a payment account held at another payment service provider.

5. How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?

In Gibraltar, the overarching national law on data protection is the Data Protection Act 2004 ("DPA 2004"). The DPA 2004 was amended on 25 May 2018 to:

implement the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR");
transpose the Law Enforcement Directive (Directive (EU) 2016/680);
implement a data protection framework under the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data of 1981 ("Convention 108"); and
implement Articles 126–130 of the Convention of 19 June 1990 applying the Schengen Agreement of 14 June 1985.

The changes made to the DPA 2004 took Brexit into account, as well as the Data Protection Act 2018 of England and Wales ("DPA 2018"). Both statutes share a similar structure, but with notable differences, such as the repeal of Part IV of the DPA 2004, which related to intelligence service processing and was similar in structure and content to Part 4 of the DPA 2018.

Following the end of the Brexit transition period, the DPA 2004 was further amended, and the EU GDPR now forms part of Gibraltar law by virtue of Section 6 of the European Union (Withdrawal) Act 2019, as read with (i) Section 2(1B)(a) of DPA 2004, and (ii) the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. This is now referred to as the "Gibraltar GDPR", which is essentially the EU GDPR read with certain modifications. It is, therefore, important to read the Gibraltar GDPR and the DPA 2004 side-by-side.

The DPA 2004 and the Gibraltar GDPR are supplemented by the following:

the Communications (Personal Data and Privacy) Regulations 2006 ("CPDP Regs"); made under the Communications Act 2006; and
the Data Protection (Search and Seizure) Regulations 2006 ("DPSS Regs").

The Communications Act 2006, together with the CPDP Regulations, transpose the E-Privacy Directive (Directive 2002/58/EC), imposing obligations on publicly available electronic communications services providers and users when they process personal data.

The DPSS Regulations, among other things, authorise justices of the peace to issue warrants to the supervisory authority in certain circumstances, allowing them to enter premises, inspect and seize as required.

Both the EU GDPR and Gibraltar GDPR have what is referred to as "extra-territorial effect", in that, respectively, the EU GDPR can apply outside of the EU, and the Gibraltar GDPR can apply outside of Gibraltar. This is achieved in a similar manner in both pieces of legislation. Focusing on Gibraltar, the territorial scope of the Gibraltar GDPR can extend to any of the following situations:

Where a controller/processor has an "establishment" in Gibraltar and processing occurs "in the context of the activities" of that establishment. This applies regardless of whether the processing occurs in Gibraltar or not.
Where goods or services are offered to data subjects in Gibraltar, irrespective of whether payment is required by a non-Gibraltar controller/processor. There should be an element of targeting and other evidence will be considered, such as whether consumers are able to pay in their local currency, or whether a marketing campaign has taken place. This test is also not limited by citizenship or residency of the data subjects.
Where the monitoring of behaviour of data subjects in Gibraltar is carried out by a non-Gibraltar controller/processor. Examples of monitoring would be predicting trends, or use of geo-location.
Where a controller is not established in Gibraltar, but in a place where domestic law applies by virtue of public international law.

Under Article 27 of the Gibraltar GDPR, controllers and processors established outside of Gibraltar would need to consider the appointment of a local representative in Gibraltar, if they are offering goods or services or monitoring the behaviour of data subjects in Gibraltar.

Controllers and processors based in Gibraltar offering goods or services or monitoring the behaviour of data subjects in the EU are subject to the EU GDPR, and will need to consider their obligations in that context. In particular, until the issue of adequacy is decided by the European Commission in respect of Gibraltar, appropriate safeguards (e.g., such as standard contractual clauses) would need to be considered prior to a data transfer from Gibraltar to the EU or vice versa, given that, at the time of writing, Gibraltar is considered as a "third country" for the purposes of Chapter V of the EU GDPR.

The DPA 2004 designates the Gibraltar Regulatory Authority ("GRA") as the Information Commissioner.

The GRA is an independent statutory body responsible for the enforcement of the DPA 2004, as read with the Gibraltar GDPR, and its primary role as Information Commissioner is to uphold the privacy rights of individuals.

Under changes made to the DPA 2004, the GRA now has increased regulatory powers under that Act, as well as those granted under Article 58 of the Gibraltar GDPR. These powers are classed as "investigative", "corrective" and "authorisation and advisory", allowing the Information Commissioner to, among other things:

bring or defend legal actions in Gibraltar or other courts;
co-operate with and render assistance to supervisory authorities in other states of territories;
conduct data protection compliance audits;
issue information notices, requiring others to provide it with information to investigate compliance;
issue assessment notices to allow it to enter premises, obtain documents and equipment, and interview persons;
issue enforcement notices, including warnings and reprimands, which may impose temporary or definitive bans on processing, or order a controller/processor to take corrective action; and/or
issue monetary penalty notices.

Article 57 of the Gibraltar GDPR also prescribes the tasks and functions of the Information Commissioner. These include, but are not limited to, promoting of awareness of rights and obligations, handling of complaints, conducting of investigations and taking enforcement action against those controllers or processors failing to comply, and certifying and approving certain mechanisms and schemes such as contractual clauses or binding corporate rules.

6. What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?

Gibraltar has always maintained itself at the forefront of novel technological developments. In fact, for most blue-chip online gambling businesses around the world, it is found that most are based in Gibraltar, which was also the fastest mover in developing regulation around that space.

Gibraltar is replicating that philosophy in the blockchain space and follow the success of online gaming, and is doing so by stepping out of the regulatory "sandbox", in the same way as it did back in the gaming days. Rather than creating a "safe space" for businesses to test innovative financial products, services, business models and delivery mechanisms in a live environment without immediately incurring all the normal regulatory consequences of engaging in the activity in question, Gibraltar has instead chosen to provide legal certainty and allow businesses to operate within a purpose-built legislative framework. In doing so, it considers that a flexible, adaptive approach is required in the case of novel business activities, products and business models and that whilst regulatory outcomes remain central, these are better achieved through the application of principles rather than rigid rules. This is because, for businesses based on rapidly evolving technology, such hard and fast rules can quickly become outdated and unfit for purpose. Accordingly, Gibraltar's principles-based framework is based on risk and proportionality, and is outcome-focused yet robust. This framework applies to firms carrying out by way of business, in or from Gibraltar, the use of distributed ledger technology (DLT) for storing or transmitting value belonging to others.

The Government of Gibraltar recognises that this is a nascent industry and whilst Gibraltar has shown leadership in this space, development is clearly an ongoing process and Gibraltar is aware of the importance, as a jurisdiction, for it to invest in supporting the development of knowledge and skills, in tandem with generating economic results as Gibraltar continues to strive for excellence.

7. Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?

The most prevalent concern for Gibraltar's financial services industry as a whole is Brexit, and the loss of passporting rights for financial services institutions that operated under traditional EU frameworks that enabled them to carry out regulated activities in other European Union Member States on the basis of a registration rather than having to go though a full authorisation process, and without having to have an establishment in those judications.

While the loss of passporting rights is a primary concern for traditional financial services institutions, it should be noted that with respect to distributed ledger technology providers ("DLT Providers") specifically, Gibraltar's distributed ledger technology framework does not derive from European law. There is presently no harmonised EU regime for passporting in this sector and therefore the loss of passporting rights is not as prevalent a concern for Gibraltar DLT providers as no passporting rights existed in this sector, even before Brexit.

For EU law purposes, Gibraltar was treated as part of the UK and, as a result, the EU passporting rights that existed between Gibraltar and EU member states never applied between Gibraltar and the UK. Instead, the rights of Gibraltar and UK financial services firms to access each other's respective markets was provided for separately, through deemed passporting rights set out in domestic legislation. While transitional arrangements had been put in place to ensure continued reciprocal passporting arrangements for financial services firms in Gibraltar and the United Kingdom following the end of the transition period, the Gibraltar Authorisation Regime ("GAR") which will be set out in the UK Financial Services Act 2021, will recognise the unique arrangements and special historic relationship between the UK and Gibraltar, allowing Gibraltar-based financial services firms continued market access to the UK, and continuing the align standards and supervisory practices with those of the UK.

Therefore not only will these passporting arrangement preserve the status-quo of the already established industries, it also presents opportunities and important areas for growth. Since the UK's departure from the EU, Gibraltar is currently the only jurisdiction in the world where authorised financial institutions not currently operating under the UK's Temporary Permission Regime can continue to access the UK market in the same manner as if they were in the UK.

While Gibraltar was not included in the Trade and Cooperation Agreement that was entered into between the EU and the UK on 24 December 2020, a separate agreement was reached in principle on 31 December 2021 paving the way for a treaty on Gibraltar's relationship with the EU to be established. The EU Council have recently approved the European Commission's mandate, and formal negotiations between the EU and the UK for a treaty on Gibraltar's future relationship with the EU have commenced. Although the negotiations that will determine the precise details of the expected treaty have commenced only recently, it is envisaged that Gibraltar's future relationship with the EU will be in the form of a bespoke Schengen-style arrangement which would allow for passport-free travel within the Schengen Area.

Therefore, while Brexit has certainly created risks in this sector, it has also created a number of opportunities for growth which will no doubt enable Gibraltar's robust financial services industry to continue growing.

8. What tax incentives exist in your jurisdiction to encourage fintech investment?

Gibraltar has no tax incentives that are specific to fintech investment. However, Gibraltar offers an extremely competitive overall tax package for companies and individuals wishing to conduct business from Gibraltar.

There are no capital gains tax, value-added tax, death duties, inheritance, wealth, capital transfer, gifts or withholding tax levied in Gibraltar at present. For companies, corporation tax is generally 12.5%, payable on profits that derive from income accrued in or derived from Gibraltar; that is to say, by reference to the location of the activities that give rise to the profits. Under tax legislation, the location of the activities that give rise to the profits of a business whose underlying activity results in income, and requires a licence and regulation under any law of Gibraltar, shall automatically be considered to derive from Gibraltar.

Favourable tax packages are also available for High-Net-Worth Individuals and High Executives Possessing Specialist Skills ("HEPSS") who want to establish residence in Gibraltar and can benefit from tax payable on income being resected to a capped amount, which encourages talent towards Gibraltar. See further details in the answer to question 11.

9. Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?

Gibraltar's fintech sector has experienced all levels of investments from Series A to Series C due to the success of Gibraltar DLT Framework.

Most recently, ISOLAS LLP's client Bitso, a leading Gibraltar authorised DLT Provider and the largest cryptocurrency platform in Latin America raised $250 million in a Series C round of funding that values the company at a $2.2 billion valuation. Tiger Global and Coatue co-led the round, which also included participation from Paradigm, BOND & Valor Capital Group and existing backers QED, Pantera Capital Kaszek. The Series C investment round follows its Series B in December 2020 where Bitso raised $62 million at an undisclosed valuation.

Furthermore, client of ISOLAS LLP and Gibraltar authorised DLT Provider LMAX Group, an institutional FX and crypto execution venue has also announced that it has signed a definitive agreement to sell a 30% stake in the company to J.C. Flowers & Co LLC, a leading private investment firm dedicated to investing globally in the financial services industry, for cash consideration of $300 million valuing LMAX Group at $1 billion.

Decentralized derivatives trading protocol and ISOLAS LLP client Vega has also announced that it has closed a $5 million funding round with contributions from a number of venture capital and trading firms such as Arrington capital and Coinbase Ventures.

Bullish Global has also been capitalized with over US$10 billion in cash and digital assets following an initial injection by Block.one of US$100 million, 164,000 BTC, and 20 million EOS, and through the completion of an additional US$300 million strategic investment round. Among the renowned investors leading the capital raise were Peter Thiel's Thiel Capital and Founders Fund, Alan Howard, Louis Bacon, Richard Li, Christian Angermayer, Galaxy Digital, and global investment bank Nomura.

10. If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?

Gibraltar has already proven itself to be a leading jurisdiction in the fintech space. This can be seen from the calibre of the DLT Providers that have already become authorised as DLT Providers in Gibraltar – including XAPO, Bitso, Huobi and LMAX to name a few.

The Government of Gibraltar has approached the growing cryptocurrency and wider blockchain and distributed ledger technology related sector with a uniquely receptive and progressive attitude. Financial regulators and policy makers in Gibraltar have understood the need for regulation in this sector, responding rapidly to such demand as far back as 2014, with the creation of the Cryptocurrency Working Group. This private sector initiative led to the development of the Distributed Ledger Technology Framework ("DLT Framework"), which became effective on 1^st January 2018, making Gibraltar the first jurisdiction in the world to deliver a framework of its kind that regulates businesses that use DLT for the defined purposes relating to a "storage" or "transfer" of "value", which is a wider concept that pure virtual assets. The DLT Framework currently includes nine principles that apply to DLT businesses operating in Gibraltar and these principles are substantiated by detailed guidelines constructed in a way that allows them to evolve at the same pace as the technology and its application, while always maintaining the core regulatory and legislative principles. The response to this approach has been global and truly significant. Those who know nothing about Gibraltar may be surprise, but those who know the history of the small jurisdiction, with a joined-up partnership between lawmakers, regulators and industry that is able to adapt and evolve to attract the right opportunities at the right level with the speed and flexibility needed to accomplish such goals, will not be surprised at all.

This success has also been seen in the crypto funds space: pursuant to a 2020 research report into the global crypto hedge fund landscape, commissioned by PwC and Elwood Asset Management, Gibraltar was shown to be the third-highest jurisdiction of choice for crypto hedge fund managers (with 10% of crypto hedge fund managers based in Gibraltar), only behind the UK (15%) and the US (52%). Gibraltar was also listed as having the fourth-highest number of domiciled crypto hedge funds (6%).

More recently, the third annual edition of the report, published in 2021, shows Gibraltar as having strengthened its position as a preferred domicile for crypto hedge funds, with the third-highest number of domiciled crypto hedge funds (9%), overtaking the BVI (8%) and Luxembourg (3%), and pushing down Lichtenstein to less than 5%. Furthermore, the two leading jurisdictions for crypto hedge funds have experienced an overall decline in their market share compared to the 2020 report (the US from 38% to 33% and the Cayman Islands from 42% to 34%), whereas Gibraltar has maintained steady growth (from 6% to 9%).

Since the coming into force of the DLT Framework, the Government of Gibraltar has been delivering on a detailed and strategically formulated activity schedule, created to proactively drive home Gibraltar's very strong DLT message, by researching and identifying key markets and audiences and focusing its marketing in these areas. The Government of Gibraltar also launched an advisory group that focuses on the creation of new technology-related educational courses, such as blockchain. The New Technologies in Education ("NTiE") group, which is a well-established initiative since its inauguration in 2018, is a joint initiative between the Government and the University of Gibraltar in collaboration with some of the leading new technology companies based in Gibraltar. The advisory group's aim is to address the growing demand for related skills as the sector continues to expand in Gibraltar. The University of Gibraltar has also successfully been delivering a professional course in this space titled "Professional Certificate of Competence in Blockchain and Smart Contracts".

Whilst Gibraltar has shown leadership in this space, development is clearly an ongoing process and Gibraltar is aware of the importance as a jurisdiction, for it to invest in supporting the development of knowledge and skills in tandem with generating economic results as it continues to strive for excellence. The Government of Gibraltar created the Gibraltar Association for New Technologies ("GANT") in 2018, an association formed together with the private sector, including Gibraltar's leading law firms, accounting firms and technology companies all forming part of its membership. GANT serves several purposes, primarily enhancing the development in Gibraltar of the use of blockchain and DLT and other future developments (collectively referred to as "New Technology"), with a view to enhancing the reputation, integrity and public trust in this sector.

GANT has also been tasked to raise the profile of "New Technology" in Gibraltar across a spectrum not necessarily limited to financial services. This includes encouraging respective organisations to emphasise the high value of their reputation and interest in contributing to enhanced client and investor protection and remaining committed to safeguarding customer and jurisdictional interests. GANT also provides a forum for discussion on "New Technology" issues within the membership and to assist other sectors of the wider Gibraltar Finance Centre, whilst also assisting and advising the Government of Gibraltar on all aspects of this sector.

October 2021 saw the launch of the Digital Skills Academy in Gibraltar. The academy aims to close the digital skills gap and provide opportunities to people in all sectors of society and will provide a platform for Gibraltar to have its own place for the training in digital skills of students and members of the private and public sectors. The Academy works closely with local companies. Currently, there are not sufficient amounts of skilled workers in order to keep up with the influx of technology companies all over the globe, therefore, these courses are structured to combat the skilled employee shortage in the technology industry. By Gibraltar addressing this problem locally at its core, it will allow Gibraltar to continue striving as a leading jurisdiction in the fintech space.

11. Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?

There are no fintech specific immigration schemes in Gibraltar. Gibraltar, as well established fintech hub, already has access to a large talent pool within its fintech sector as it has always been a leading jurisdiction in this field for a number of years. Furthermore, through the NTiE and GANT (see further details in the answer to question 10), the Government of Gibraltar has been equipping the local workforce with the necessary technical knowledge and skills for the fintech sector.

In addition, Gibraltar offers a special employment tax status (HEPSS status) for employees that meet certain criteria as a cost saving incentive for companies recruiting senior executives which has proven to be extremely successful in attracting highly skilled and talented individuals to Gibraltar. The HEPSS status is available to individuals who possess skills not available in Gibraltar and, in the Government's opinion, necessary to promote and sustain economic activity of particular economic value to Gibraltar, who will occupy a high executive or senior management position, and who will earn more than £160,000 per annum of income. Income tax liability is capped at the first £160,000 of taxable earnings. The cap primarily applies to income from the designated employment, but can extend to certain dividends, interest, pensions income and foreign income.

The Government has in place a Liaison Department which provides firms with an improved service in all their dealings with Government. The prime objective of this department is to assist and support the Financial Services and Gaming Sectors in their interaction with Government across the entire spectrum of the Public Service. The industries are offered a fast track process in relation to all matters touching the public service. The Liaison department is the problem-solving hub which boasts sound and effective results within a 24-hour turnaround period.

12. If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?

See answers to questions 11 and 12. Gibraltar, as well established fintech hub, already has access to a large talent pool within its fintech sector as it has always been a leading jurisdiction in this field for a number of years. Furthermore, through the NTiE and GANT (see further details in the answer to question 10), the Government of Gibraltar has been equipping the local workforce with the necessary technical knowledge and skills for the fintech sector.

13. What protections can a fintech use in your jurisdiction to protect its intellectual property?

Gibraltar primarily follows UK law in relation to the registration of intellectual property rights and the protection of registered and unregistered intellectual property.

Patents

A patent is a form of intellectual property which grants the inventor the right to exclude others from making or selling his or her invention for a period of time, thus being able to take legal action against anyone who makes, uses, sells or imports the invention without his or her permission. The invention must not be specifically excluded from protection.

Original applications to register a trade mark or patent in Gibraltar cannot be made, the Gibraltar Registry will only replicate successful registrations made in the Intellectual Property UK Patent Office.

The grantee of a UK patent may apply within three years from the date of issue of the patent, to have such patent registered in Gibraltar in accordance with Section 2 of the Patents Act 1924.

As part of the registration process the following documents must be submitted to the Gibraltar Registry in accordance with Section 3 of the Patents Act 1924:

application for registration of a patent (Form 1);
certified copies of the specification(s) (including drawings if any) of the UK patent;
certificate of the comptroller-general of the UK Patent Office giving full particulars of the issue of the specification/s and, in the case of a patent treated as being granted in the UK by virtue of the provisions of Section 2 of the Patents Act 1924, a certificate by an officer duly authorised under the Patents Act designating the UK has accepted the European Patent (UK) designating the UK as being effective in the UK and that the particulars of the application are true; and
a filing fee of GBP30.

Upon such application being received, together with the documents mentioned in Section 3, the Registrar of Patents shall issue a certificate of registration in accordance with Section 4 of the Patents Act 1924. The protection of a patent will remain valid for as long as the UK patent is valid; the time period is 20 years from the date of issue of the UK patent, provided that the applicable renewal fees have been paid accordingly.

Patent rights are able to be enforced against a party through the UK or Gibraltar courts. The remedies for patent infringement include the seizure/destruction of the infringing goods, monetary damages and injunctive relief. Section 7 of the Patents Act 1924 outlines the powers of the Gibraltar Supreme Court and states that:

"The Supreme Court shall have power upon the application of any person who alleges that his interests have been prejudicially affected by the issue of a certificate of registration, to declare that the exclusive privileges and rights conferred by such certificate of registration have not been acquired on any of the grounds upon which the United Kingdom patent might be revoked under the law for the time being in force in the United Kingdom: Provided that such grounds shall be deemed to include the manufacture, use or sale of the invention in Gibraltar before the priority date applicable to the patent in the United Kingdom, but not to include the manufacture, use or sale of the invention in Gibraltar by some person or persons after the priority date applicable to the patent in the United Kingdom and before the date of the issue of the certificate of registration under section 4. For the purposes of this proviso the expression "priority date" in its application to a patent in the United Kingdom has the meaning assigned to it in section 5 of the Patents Act, 1949, or any other Patents Act for the time being in force."

Trade Marks

A trade mark is a sign which can distinguish the trade origin of goods and/or services from those of competitors. A trade mark must be considered to be distinctive, which means if it can be recognised as a sign that differentiates the origin of goods and/or services from those of other sources. A trade mark may include words, sounds, logos, colours, shape or any combination thereof.

The Registrar of Trade Marks deals with the registration of trade marks under the Trade Marks Act 1948 and the Trade Marks Rules 1948. It is not possible for originating applications to be made in Gibraltar. Therefore, a trade mark must first be registered in either the UK Intellectual Property Office, the European Union Intellectual Property Office, or the World Intellectual Property Office under the Madrid Protocol (with an EU or UK Designation).

The European Union Intellectual Property website confirms that a European Union Trade Mark extends to all member states inclusive of the UK and therefore Gibraltar. However, the position following Brexit remains unclear and it is advisable that those who wish to ensure protection both in the UK and Gibraltar post-Brexit should seek to register trade marks in both the EU and the UK separately – in other words, to err on the side of caution.

Trade marks registered in other EU national trade mark registries may not be registered in Gibraltar, unless it is an EU-registered trade mark or is registered under the Madrid Protocol at the World Intellectual Property Office with an EU or UK designation.

Under Council Regulation (EU) No 40/94 European Union Trade Marks, it is possible to obtain a single trade mark registration which is effective throughout the EU and such protection can be extended to Gibraltar.

The following documents are required in order to register a UK trade mark, a Madrid Protocol trade mark or a European Union trade mark:

application for registration of a trade mark (Form 1);
certified representation of the trade mark – certificate of the Comptroller of the UK Patent Office (under their title of Registrar of Trade Marks) giving full particulars of the registration of the trade mark in the UK and such other documents as may from time to time be prescribed (Section 4, Trade Marks Act 1948);
two prints of the trade mark; and
the applicable filing fee of GBP30.

Once all the relevant documents have been submitted to the Gibraltar Registry, the Registrar will then enter the prescribed particulars in the register and shall issue a certificate of registration to the applicant who shall then be the registered proprietor in Gibraltar of the trade mark in respect of the goods entered in the register.

The registration of UK and EU trade marks are renewable every ten years and valid in Gibraltar while they are valid in the UK or the EU.

Industrial Designs

Industrial design is an intellectual property right that legally protects the visual design of objects or part of an object in the territories that it is registered in and it constitutes the ornamental aspect of an object. In Gibraltar, there are two forms of industrial design, these being registered and unregistered designs.

Designs registered in the UK are automatically protected in Gibraltar by virtue of Section 2 of the Gibraltar Designs Act 1928. Registered Community Designs are also automatically protected in Gibraltar by virtue of the Treaty on the Functioning of the European Union. UK-registered design right applications are made and obtained through the UK Intellectual Property Office.

A design is legally defined as being the appearance of the whole or part of an object resulting from the features of, shape, colours or materials of the object or ornamentation. Both 3D and 2D designs are protected by registered designs. The design must not have been publicly disclosed or published within the EEA prior to being registered. There is, however, a 12-month grace period following the disclosure which allows the designer to make its application.

An unregistered design right in the UK arises automatically on the creation of an original object and it has been recorded in an article or design document, subject to the provisions of Part 3 of the UK Copyright, Designs and Patents Act 1988.

Designs registered in the UK have their rights are extended and protected in Gibraltar and there is no need for any applications to be made in Gibraltar. Designs produced in Gibraltar enjoy reciprocal protection in the UK under Part 3 of the UK Copyright, Designs and Patents Act 1988.

A registered design can be renewed every five years up to 25 years, subject to the payment of fees. The length of protection afforded to an unregistered design according to Section 216 of the UK Copyright, Designs and Patents Act 1988 will be 15 years from the earlier of the end of the calendar year in which the design was first recorded in a design document or an article was first made to the design or if articles made to the design are made available for sale or hire within five years from the end of that calendar year, ten years from the end of the calendar year in which that first occurred.

Owners of both registered and unregistered designs are able to enforce action through the UK or Gibraltar courts. For unregistered designs, remedies can include injunctive relief, damages or accounting for profit made. For registered designs, remedies can include injunctive relief, damages, accounting for profit made, delivery or destruction of the infringed product.

Copyright

Copyright is a property right which subsists in sound recordings, films or broadcasts, original literary works – which includes databases, computer programs and preparatory design – dramatic, musical or artistic works and in the typographical arrangement of published editions. Copyright protects the author's work in several ways and prevents others from replicating this work, making an adaptation of this work, putting it on the internet and performing or playing this work in public.

Copyright protection is automatic upon the creation of the said qualifying work, and so no registration process is required. The length of the copyright is dependent on the type of work – for example, works such as written, sound, films and artistic work will last for 70 years after the author's death.

A copyright holder is able to enforce court proceedings where he or she believes that there has been an infringement on the copyright and remedies include damages, injunctions and accounts. It is a criminal offence to infringe copyright.

Others

Other intellectual property rights in Gibraltar also extend to trade secrets. This is a common law right in which the information contained within has commercial value because it is secret and the use or disclosure is likely to harm the interests of the trade secret holder in several ways – for example, scientific and technical potential, business or financial interests, strategic positions or the ability to compete.

In accordance with Section 4 of the Protection of Trade Secrets Regulations 2018 it is possible the acquisition of trade secrets in Gibraltar shall be considered lawful if obtained by any of the following means:

independent discovery or creation;
observation, study, disassembly or testing of a product or object that has been made available to the public or that is lawfully in the possession of the acquirer of the information who is free from any legally valid duty to limit the acquisition of the trade secret;
exercise of the right of workers or workers' representatives to information and consultation in accordance with any rules of law applicable in Gibraltar; or
any other practice which, under the circumstances, is in conformity with honest commercial practices.

In accordance with Section 8 of the Protection of Trade Secrets Regulations 2018, the limitation period for bringing a claim for the unlawful acquisition, use or disclosure of a trade secret is six years. The start date for reckoning the limitation period for a claim for the unlawful acquisition, use or disclosure of a trade secret against an infringer begins with whichever is the later of:

the day on which the unlawful acquisition, use or disclosure that is the subject of the claim ceases; or
the day of knowledge of the trade secret holder.

Where damages are awarded in relation to unlawful acquisition, Section 16 of the Protection of Trade Secrets Regulations 2018 states that all appropriate aspects shall be considered, including:

any negative economic consequences, including any lost profits, which the trade secret holder has suffered, and any unfair profits made by the infringer;
elements other than economic factors, including the moral prejudice caused to the trade secret holder by the unlawful acquisition, use or disclosure of the trade secret; and
where appropriate, damages may be awarded on the basis of the royalties or fees which would have been due had the infringer obtained a licence to use the trade secret in question.

14. How are cryptocurrencies treated under the regulatory framework in your jurisdiction?

In terms of the activity of the business in the DLT space, Gibraltar has developed the first DLT-specific regulatory and principles-based legislative framework for these operators. This detailed framework goes well beyond the basic compliance requirements or registration processes that exist in many jurisdictions. Cryptocurrencies are not considered legal tender in Gibraltar and, accordingly, are not issued or guaranteed by the Gibraltar Government.

While the United Kingdom and Gibraltar are no longer members of the European Union, subject to certain exceptions, all direct EU legislation and all EU-derived domestic legislation so far as operative immediately before midnight on 31 December 2020, continue to form part of Gibraltar's domestic legislation pursuant to sections 5(1) and 6(1) of the European Union (Withdrawal) Act 2019. Accordingly, the provisions of all EU-derived financial services frameworks, as they stood at midnight on 31 December 2020, continue in force and effect in Gibraltar.

As in most jurisdictions that operate under European law principles, depending on the construct of the virtual currency, cryptocurrencies may still qualify as electronic money ("E-Money"), as a form of asset-backed security, financial instrument or even unit of a collective investment scheme ("CIS") arrangement. Without being able to go into each of these for the purposes of this chapter, in the context of the recent focus on stablecoins and central bank-issued digital currencies, on a European level, the regulation of E-Money is based on the E-Money Directive, which defines E-Money as an electronically, including magnetically, stored monetary value as represented by a claim on the issuer, which is issued on receipt of funds for the purpose of making payment transactions, and accepted by a natural or legal person other than the E-Money-issuer. This definition is in line with the definition contained in the Financial Services (Electronic Money) Regulations 2020. E-Money requires an issuer. Therefore, a cryptocurrency that comes into existence by way of mining (e.g. Bitcoin) without an issuer, or representing any form of claim on any issuer, should not qualify as E-Money. Conversely, a cryptocurrency that is issued by an issuer at par value against fiat and furnished with the promise of the issuer to be redeemed in exchange for fiat against the issuer of that currency, and therefore being accepted as means of payment by third parties, would qualify as E-Money and trigger a number of considerations around this from a payments services perspective also.

Owing largely to the difficulty of regulating cryptocurrencies themselves, the DLT Framework has attempted not to enforce the regulation of cryptocurrencies, but instead to impose a regulatory regime for firms that carry on by way of business, in or from Gibraltar, the use of DLT for storing or transmitting value belonging to others. Accordingly, regulation will depend on what services a firm is providing customers in respect to their cryptocurrencies and whether this falls under the scope of regulation.

Because cryptocurrencies vary widely in design and purpose, it should be kept in mind that these may represent transferable securities or financial instruments, and their promotion and sale would already be covered by existing securities legislation in Gibraltar such as the FSA. Its classification as a security triggers various consequences; in particular, regulatory consequences. The requirement to issue a prospectus when offering securities publicly is only one example of such a requirement. A distinction must be drawn between the concept of a security on the one hand and a financial instrument on the other, with the latter being the broader term.

"Securities" are one of several sub-categories of financial instruments. Regulatory requirements may therefore also arise for non-securities that are classified as financial instruments. This includes the requirements arising under MiFID II, which, in addition to applying to businesses providing certain investment services or engagement in certain activities with clients in relation to financial instruments, also defines "financial instruments" in a wide form, including forms of commodity derivative contracts and arrangements that may apply to any asset or right of a fungible nature (under certain conditions).

If a cryptocurrency meets the MiFID II definition of a financial instrument, then a number of crypto-asset-related activities carried out by an exchange are likely to qualify as investment services/activities for which a licence is required outside of the DLT Framework. This includes multilateral trading facilities ("MTF"), organised trading facilities ("OTF") and other exchange-related activities.

Gibraltar is further looking to expand and extend the obligations to which DLT firms must adhere and is subsequently looking towards adding a 10^th principle to the DLT Regulations with an aim to regulate and develop market integrity standards for crypto exchanges. The International Organization of Securities Commissions ("IOSCO") has identified several issues that merit consideration relating to transparency, custody, clearing and settlement trading, security and systems integrity. Implementing market integrity standards for these exchanges is one of the most pressing issues in the market, with organisations such as Bitwise and BTI estimating that 70–95% of all trading volume on exchanges is potentially manipulative. The effect of which is a reduction in market confidence in this sphere.

It should of course be borne in mind that foreign exchange markets, stock markets and commodity brokers face or have faced market risks in the past, but now fall squarely within developed rules and frameworks that prevent or restrict such manipulation taking place. This is not to say that there is no manipulation taking place in the more mainstream markets, but rather that it is less prevalent due to such regulation. Thus, the introduction of these standards in the regulatory sphere in Gibraltar would serve to restrict manipulation in the same way that this is restricted in traditional markets.

15. How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?

Other than in respect of AML/CFT (see below), there is no specific legal or regulatory framework which governs the sale, promotion or distribution of tokens. However, there may be instances where, depending on what the token will be used for and how the token issue is structured, the token may fall within existing financial services legislation. Accordingly, securities law or the EU Prospectus Regulation requirements are not altered in any way as a result. That is to say, the public offering of tokens that constitute securities continue to fall under current frameworks governing the issuance of securities.

The operation of the actual business relating to such a token could also be captured within the DLT Framework, despite the issuance potentially not being captured, if for example, the firm will also be operating a secondary market relating to those tokens.

However, from a compliance and risk perspective, any creation and issuance of tokens will generally always be caught by the Proceeds of Crime Act ("POCA") in Gibraltar, which was specifically amended to capture this activity.

More recently, Gibraltar has o introduced the Proceeds of Crime Act 2015 (Relevant Financial Business) (Registration) Regulations 2021 ("RFBR Regs"), which impose an obligation on four classes of relevant financial businesses to register with the GFSC for the purpose of AML/CFT and counter proliferation financing supervision, to the extent they are not already supervised. In particular, these requirements apply to: (a) undertakings that receive, whether on their own account or on behalf of another person, proceeds in any form from the sale of tokenised digital assets involving the use of DLT or a similar means of recording a digital representation of an asset; and (b) money for virtual business, exchange or arrange to make arrangements with a view to the exchange of (i) virtual assets for money, (ii) money for virtual assets, or (ii) one virtual asset for another. Failure to register is a criminal offence punishable with up to two years' imprisonment and/or a fine. The registration regime should not be confused with any application for regulatory permissions required under the FSA, in respect of regulated activity defined under that Act. Such permissions would need to be sought if the relevant financial business intends to carry out a regulated activity. Additionally, the registration requirements are not applicable where a person is already subject to supervision by a supervisory authority. The RFBR Regs provide fitness and proprietary criteria that the GFSC will need to consider when accepting or refusing registration (including the withdrawal of registration after it is granted).

It should also be noted that entities issuing tokens may separately have to comply with classic consumer protection law, depending on the design of the digital token.

16. Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?

Given the advantages that Gibraltar offers as a proof-of-concept jurisdiction in financial services, it will come as no surprise that a number of blockchain projects have moved beyond the proof-of-concept, by formalising actual use cases for distributed ledger technology. Some of these resulted from using tokens as a means of raising finance and developing innovative business models. Areas vary from decentralised platforms using fully automated processes for creating markets on and trading margined derivatives, to smart contract platforms secured by the Bitcoin network, to automated trading of crypto tokens and derivative products.

17. To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?

Artificial Intelligence is already used in the financial sector. The GFSC has a neutral approach regarding technology in the financial sector so that regulation should not impede its use but rather encourage it.

18. Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?

There are a number of Insurtech firms established in Gibraltar as part of Gibraltar's evolving fintech community. Two of the most successful Insurtech start-ups in the UK, Zego and Marshmallow have established their own insurance companies in Gibraltar – Zego in 2019 and Marshmallow in 2020.

19. Are there any areas of fintech that are particularly strong in your jurisdiction?

Gibraltar's DLT Framework is the world's first purpose built regulatory framework for businesses using blockchain or DLT and is based on the application of principles rather than rigid rules. This is because, for businesses based on rapidly evolving technology, such hard and fast rules quickly become outdated and unfit for purpose. Accordingly, Gibraltar's principles-based framework is based on risks and proportionality, and is outcome-focused yet robust. This approach has enabled Gibraltar to position itself as a leading jurisdiction for fintech businesses to set up in. Consequently, Gibraltar maintains a strong presence in all areas of fintech business with no area specifically outperforming others. Gibraltar's DLT Framework has been particularly successful in attracting some of the largest global crypto-trading platforms exchange platforms.

20. What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?

Financial institutions were initially rather reluctant and reserved towards fintechs, which came to disrupt this specific sector and position themselves as direct competitors of incumbent financial institutions with their individual and corporate customers, whom they seek to capture by offering them new types of relationships based on a renewed customer experience.

Over the past years, however, fintech has become more mainstream and this reluctance has given way to a relationship of increased cooperation, incrementally blurring the boundaries between incumbents financial institutions and fintechs. Various trends are noticeable:

Fintechs are taking something that incumbent financial institutions already do, and do it faster, cheaper or in some way better – and steal market share by doing so e.g. challenger banks.
Fintechs are acquired by incumbent financial institutions through M&A, which allows to benefit from the widest possible opportunities, as well as internal incubators and innovation labs by many prominent incumbent financial institutions.
Fintech companies supply services to incumbent financial institutions order to help those institutions do something that they do already. Many examples exist but this could include blockchain analytics and onboarding / ID verification technology.

In relation to the first category, collaboration is naturally less likely. However, the second and to a large extent the third categories lend themselves to collaboration.

21. To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?

Generally, large financial institutions have their own fintech development / innovation teams and aim at developing fintech innovation in view of their own vision and needs. However, their strategy regarding fintech innovations can vary considerably. Incumbent financial institutions in Gibraltar are progressively moving away from in-person transactions and toward digital transactions and the use of fintech to service the needs of clients. The global pandemic has expedited the need for such fintech services. Banks in Gibraltar have been quick to support the industry and developed the relevant skillset to ensure they can provide banking services to crypto businesses.

22. Are there any strong examples of disruption through fintech in your jurisdiction?

There are many examples of disruptive fintech innovators in Gibraltar. Most notably, however, is Xapo – the digital wallet and crypto custodian which has recently become authorised as a credit institution in Gibraltar. This is the first bank of its type in Europe combing banking services and bitcoin custodian services allowing Gibraltar to be at the forefront of an upcoming industry once again.

Originally published by Legal 500 Fintech Country Comparative Guide 2021.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Gibraltar: Fintech 2021