Staged Application for Authorisation Process

Please note that the Staged Application for Authorisation Process will come into effect at the beginning of 2024.

The New Staged Application for Authorisation Approach

The purpose of the Staged Application for Authorisation Approach (“Staged Approach") is to provide a more structured process (“the Staged Application Process”) for the submission of Initial applications for permission to carry on one or more regulated activities under part 7 of the Financial Services Act 2019 (“the Act”).

The Staged Application Process is designed to establish a streamlined framework for authorisation of firms, which is sector-specific, consistent, proportionate, efficient and of the highest regulatory standards that will also enhance speed to market.

The development of the Staged Application Process has involved a comprehensive review of how we process and consider applications for authorisation, including a period of external consultation – the GFSC’s response to which can be found here.

The Staged Approach will allow the GFSC to apply a risk-based approach, focusing on the collation of critical core information submitted at an early stage.  In taking a risk-based approach, the GFSC, whilst meeting its regulatory objectives, will ensure that speed to market underpins the whole process.  

As such, the threshold conditions in the Act and any sector-specific threshold conditions, core business model, capital, key individuals, and key elements of the proposed operations of an application will be assessed first.

Once the GFSC is satisfied with the information received at each stage, it will then seek further information through the subsequent stages of the application process. This information will build on the core information already provided, progressing towards submission of all relevant application documents.

How do I initiate the process?

The Staged Application Process is designed to follow directly on from our pre-application process.

The GFSC strongly recommends applicants use the pre-application process as we have seen the benefits it provides to our applicants - allowing us to identify any concerns early on and avoids applicants submitting a full application (with the corresponding application fee) that is unlikely to be successful.

Process Overview

The application for authorisation process has been divided into three stages, with the addition of a fourth “mobilisation” stage for applications from the Banking, E-Money, Investments (Non-S-NIIs.  Non-small and non-interconnected investment firms or Class 2 firms - “Investments Class 2”) and Distributed Ledger Technology (“DLT”) sectors.

An applicant will move through the stages sequentially, successfully completing one stage before the GFSC moves the application to the next stage.

The Staged Application Process will implement three main stages, with the addition of a fourth “mobilisation” stage, each with specific documentation and information to be provided:

Stage 1Business Model, Capital, Key Individuals
Stage 2Risks framework, Financial crime, Business Continuity, Corporate Governance, IT systems
Stage 3Non-Financial Resources, Compliance Structure, Conduct of Business, KPI's, Consumer Duty, Operational Resilience
Stage 4Mobilisation - Systems Testing

We want to work with applicants to move them through the first three stages of the proposed approach within a maximum period of 9 months for the Insurance, Banking, Investments Class 2, E-Money and DLT sectors.  For all other sectors a maximum 6-month period.

The time taken to process an application will continue to be dependent on the quality and extent of information provided by the applicant, as well as the timeliness of its submission.  

A key principle of the Staged Approach - 

The GFSC will communicate to the applicant that the applicant can move forward to the next stage only once the GFSC is satisfied with the content provided at the current stage. The applicant will then be invited to submit the further information required at the next stage of the application process.

Stage 1 -Business Model, Capital & Key Individuals

Following the pre-application stage, an applicant will enter Stage 1 of the authorisation process by being invited to submit the following:

  • Application fee – please note that the application fee structure has not been amended. The full application fee. 
  • Stage 1 documents – a non-exhaustive list of the information/documentation that will be required has been set out in Annex 1.  
  • Any additional firm-specific documents and/or information required by the GFSC to complete Stage 1 (communicated to the applicant during Stage 1).

On receipt of the fee and Stage 1 documents, the GFSC will confirm the GFSC Supervisor who has been assigned to assess the application for authorisation.

The GFSC will consider the documentation and information submitted and assess the viability of the proposed business.  In doing so, the GFSC will also consider whether the applicant meets the Threshold Conditions, as well as any other requirements under the Financial Services Act 2019 and sector-specific regulations.

Stage 1 is expected to last the following maximum periods for each sector, subject to the quality of Stage 1 information submitted and timely responses from the applicant: 

  • Banking, Insurance, E-Money, Investments Class 2 and DLT sectors – 5 months; and
  • All other sectors – 3 months.

When the GFSC is satisfied with all the responses and information/documentation received from an applicant, the GFSC will inform the applicant that its application can progress to Stage 2.

Stage 2 - Risk Management, IT Systems, Corportate Governance & Financial Crime

Stage 2 of the authorisation process for all sectors (including Banking, Insurance, E-Money, Investments Class 2 and DLT) is expected to last a maximum period of 2 months, subject to the quality of the Stage 2 information/documentation submitted and timeliness of responses from the applicant.

A non-exhaustive list of the information/documentation that will be required in Stage 2 has been set out in Appendix A.

When satisfied with all the further Stage 2 responses and information, the GFSC will inform the applicant that its application can progress to Stage 3.

At this point, the GFSC will then be willing to consider issuing a ‘Minded to Authorise’ letter to the applicant, where required. This is designed to aid applicants with the raising of capital and recruitment discussions with individual candidates and outsourcing providers.

Stage 3 - Conduct of Buisness, Non-Financial Resources, Policies & Procedures

Stage 3 of the authorisation process is expected to last the following maximum periods for each sector, subject to the quality of the Stage 3 information/documentation submitted and timeliness of responses from the applicant:

  • Banking, Insurance, E-Money, Investments Class 2 and DLT sectors – 2 months; and
  • All other sectors – 1 month.

A non-exhaustive list of the information/documentation that will be required in Stage 3 has been set out in Appendix A.

When the GFSC is satisfied with the Stage 3 responses and information, the application will move to a GFSC decision for authorisation. For those sectors where a mobilisation stage is required, authorisation will be subject to the requirement to complete the mobilisation stage to the satisfaction of the GFSC. 

Prior to entering the mobilisation stage below, an applicant would submit (during Stage 3) a “Mobilisation Plan” setting out the actions and timeframes the applicant is working towards to become fully operational. 

The Mobilisation Plan will detail what will be implemented or developed and how this will be achieved. It should also clearly define the timeframes in which elements of the plan will be completed – these can be communicated in the way the applicant deems most appropriate. The GFSC will assess the suitability and content of the Mobilisation Plan in Stage 3, working with the applicant to ensure all the relevant information is included and expectations for the mobilisation stage are clearly communicated.

Stage 4 - Mobilisation (Systems Testing)

Mobilisation is a stage entered into by applicants in E-Money, Banking, Investments Class 2 and DLT sectors for the purposes of enabling the GFSC to ‘test’ the firm’s systems and controls. This route allows an applicant to obtain a permission and operate within a controlled environment, allowing it time to develop its operational capability.

An applicant entering the mobilisation stage will generally not have fully developed operational capabilities but will have met the other Threshold Conditions. Therefore, a requirement will be placed on its activities due to the remaining required compliance in other areas. The level at which any restrictions are placed on the amount of business that can be carried out by the firm will be agreed between the GFSC and the applicant.

The timeframe for the mobilisation stage will vary on a case-by-case basis, however it is expected that this will normally range from 3 – 6 months. 

The following are examples of areas that firms will usually be focused on actioning during mobilisation:

  • building and testing products, services and IT systems;
  • building out their infrastructure – building-out, testing and implementing systems and IT infrastructure; and finalise material outsourcing arrangements (as indicated during the application process);
  • recruitment – finalising senior management appointments and other staff recruitment and training;
  • risk and controls – completing the build-out of control functions such as Risk, Internal Audit and Compliance;
  • operationalise their policies and procedures – finalising their customer journey, including details of products, pricing, and on-boarding arrangements; and completing policies and procedures;
  • business continuity – finalising its Recovery Plan, Continuity Plan and Solvent Wind-down Plan; and
  • funding – fully capitalising the firm for when they exit mobilisation.

Reporting on completion of action points and milestones will be in line with those put forward in the Mobilisation Plan in Stage 3 and a risk-based and proportionate approach will be applied to the reporting of progress through the mobilisation stage. This will therefore depend on the complexity and nature of not only the firm but also the elements being developed and tested by the applicant in question.

The GFSC will subsequently carry out an onsite visit to determine whether the firm has completed the action points (identified in the Mobilisation Plan) and on successful completion (of the action points), the mobilisation stage would come to an end. At this stage, the GFSC will require a confirmation from the firm’s board on the ability of the firm to assume full scale authorisation and trading without restrictions. Firms will then be provided with a Variation of Permission to remove the restriction requirements.

Being authorised during the mobilisation stage places a firm in a strong position to build its operations with confidence and raise capital by practically demonstrating a successful business model. A firm in mobilisation is conditionally authorised, allowing it the opportunity to gain access to payment systems and other providers with the ability to test them out before fully launching its products. It also provides firms with the additional time to build out its board, risk management framework and products.

Overview of Documentation Required

Comprehensive Buisness Plan Checklists

Mind and Management

The GFSC has established criteria for mind and management that applicants must satisfy to be successful in securing and retaining a regulated activity permission. We will not approve a permission unless we are satisfied that the applicant meets the criteria set out below.

Regulated Firms must ensure that the mind and management of the business is conducted from its office in Gibraltar, and the firm should be able to evidence this. Where firms provide services to customers in jurisdictions outside Gibraltar, the firm should be able to continue to demonstrate that its Gibraltar office complies with our mind and management requirements. This is an ongoing requirement that will be continually assessed by the relevant supervisory team.

To ensure that the mind and management principle is being complied with, the firm must evidence that the following are being conducted from its Gibraltar office on an ongoing basis:

  • Decision making pertaining to the running of business on a day to day basis.
  • Approval of operational policy and guidelines.
  • Approval of key deviations from standard company policy and guidelines.
  • Approval of significant expenditure items.
  • Approval and sign off of key contracts, including outsourcing arrangements.
  • Approval of all major expenditure incurred by the company.

In addition, they must:

  • have access to all accounting records of the firm at all times and oversee the production of management accounts and statutory returns; and
  • be able to furnish the GFSC with information that it requires regarding the day-to-day running of the company in a timely manner, including information processed by other parties under any outsourcing agreement.

Four Eyes

The overriding requirement is that the four-eyes (two individuals) criterion is to be met on a continual basis and that individuals assigned to fulfil these roles do so over the entire operations of the firm.  It is not therefore possible to satisfy this criterion when a number of different individuals look over other parts of a firm’s operations. 

These provisions are designed to ensure that at least two minds are applied to both or errors leading to difficulties for the business as a whole are less likely to occur.  They must also have sufficient experience and knowledge of the business and the necessary authority to detect and deal with any imprudence, dishonesty or other irregularities in the firm.

In determining whether a firm meets the four-eyes criterion, we will consider:

  • The seniority and authority of the person. 
  • Whether the individuals are conducting their roles on a day-to-day basis within Gibraltar. 
  • Experience and knowledge of the individuals. 

A non-executive director, for example, would automatically be excluded from performing this role. Similarly, non-resident executive directors or non-resident executive managers would normally fail to meet this requirement. A person who is permanently employed in Gibraltar and discharges that employment in Gibraltar but resides in close proximity in Spain, will, for the purposes of this criterion, be considered “resident”.

Fit and Proper

We will not approve a permission unless we are satisfied that the applicant, and the Regulated Individuals associated with it, are fit and proper to undertake the regulated activity.