Gibraltar

In today’s world finding wide spread consensus is rare. One notable exception, however, appears to be the rise and use of artificial intelligence (“AI”). Since the widespread adoption of LLM based AI (such as Chat GPT, Claude or Gemini), and their steady adoption into everyday tools and services, one conclusion is difficult to escape. AI is no longer a future concept, but an established and seemingly permanent feature of modern life. Against that backdrop, regulatory intervention was inevitable. As AI capabilities have expanded, so too has the need for oversight. Legislators and regulators are now grappling with how best to manage both the risks and opportunities presented by these technologies. Within the European Union, this has culminated in the introduction of the Artificial Intelligence Act, which came into force on 1 August 2024 (the “AI Act”) with most obligations for High Risk AI coming into force on 2 August 2026. The legislation represents the EU’s attempt to create a harmonised framework governing the development, deployment and use of AI systems, with a particular focus on ensuring safety, accountability and transparency. For businesses operating in Gibraltar, a key area of concern is the extent to which this EU regime may apply beyond its borders. The starting point lies in Article 2 of the AI Act, which adopts a deliberately broad approach. In particular, it captures entities placing AI systems or general-purpose AI models on or to the EU market (what could be termed “Market Jurisdiction”), entities which deploy AI systems within their EU operations (what could be termed “Use Jurisdiction”)  but also those operating from outside the EU where the output of those systems are used within it (what could be termed “Output Jurisdiction”). In other words, the Act is designed to have extraterritorial reach and effect. This raises the obvious question: what does that mean in practice, and where does it leave Gibraltar-based businesses? In our view, the position is neither novel nor especially complex. The approach mirrors, in many respects, the familiar territorial scope of the General Data Protection Regulation (GDPR). As such, the analysis turns on whether there is a sufficient connection to the EU market to establish any of Market, Use or Output Jurisdiction. The key questions to be asked are therefore likely to be: (i) does your AI product or service have customers in the EU; (ii) are the outputs of your AI used to influence decisions in the EU; (iii) do you market  your AI product or service into the EU; (iv) is your AI embedded or incorporated into another product or sold into the EU; or (v) do you deploy AI system within your EU based operations.  If yes then there is a likelihood that the AI Act may apply to you. In those circumstances, Gibraltar entities may find themselves subject to compliance obligations similar to those imposed under GDPR, including, where required, the appointment of an authorised representative within the EU. At present, Gibraltar has not introduced a standalone legislative regime specifically regulating AI. Instead, the use of AI technologies is assessed through the lens of existing legal frameworks, most notably data protection. The Gibraltar General Data Protection Regulation, together with the Data Protection Act 2004, already impose a number of obligations which are directly relevant to AI deployment. These include requirements for fair and transparent processing, clear communication with data subjects regarding how their data is used (including where AI may be involved in a decision making process), and the undertaking of data protection impact assessments in cases involving high-risk processing (something which many large-scale AI applications will trigger). Additionally, issues of data sovereignty will also likely fall to be considered such as sharing or transferring data outside Gibraltar, UK or EU (by using AI tools whose servers  are based in the US for example) would bring in wider data sharing requirements. In practice, the lawfulness of AI-driven data processing will often depend on the availability of a valid legal basis, an area which remains particularly challenging in contexts such as data scraping, repurposing of datasets and large-scale profiling. Accordingly, for Gibraltar businesses seeking to navigate the evolving AI landscape, the logical starting point is not necessarily new regulation, but existing compliance. Ensuring that data protection policies and practices are robust, up to date, and properly implemented is a critical first step, often requiring a thorough internal data audit. Once that foundation is in place, organisations can begin to refine their governance frameworks to address AI-specific risks, including through the adoption of tailored internal policies governing the use of AI tools within the workplace. Internal policies alone however will not be sufficient to safeguard businesses against the unintended consequences of AI, we consider that businesses should go further and train employees as to the consequences of using open-source AI models, such as Chat GPT and the risks in waiving confidentiality (which could be in itself a data breach). Breaching such confidentiality can have catastrophic consequences, including waiving legal privilege as recently confirmed in UK v Secretary of State for the Home Department [2026] UKUT 00081, where the Court expressly confirmed legal representatives had waived privilege after having uploaded confidential documentation on Chat GPT! The use and risks of AI within the workplace are not abstract; they have already materialised  and can have serious and  often  immediate consequences.

Family Office Structures: Built Years Ago, Still Right Today? For Summary Q&A click here. Most family offices don’t start with a blank page. They inherit something: a trust settled years ago, a holding company that has quietly sat at the centre of things, together with a set of arrangements that made perfect sense at the time they were put in place. They continue, adapt slightly and expand around the edges. And slowly, almost without noticing, the structure stops being a decision and becomes part of the background. It works. It is familiar. No one is entirely sure when it was last reviewed, but it is not causing any obvious problems – so it remains as is. This is how many family office structures evolve, not through deliberate design, but through continuity, and continuity is powerful. It carries institutional memory, preserves stability and avoids unnecessary disruption. But it also carries assumptions. The context in which many of these structures were originally created has shifted, often significantly. Families are more international, assets are more complex, and the expectations of the next generation are different from those of the previous. Transparency, governance and control are no longer side considerations, they are central issues. Yet the structures themselves often remain anchored in an earlier version of the same family. The uncomfortable question, rarely asked directly is simple: if we were setting up this structure today, would we do it this way? That question tends to open the door to jurisdictions that are not always part of the immediate conversation. Gibraltar is one of them. Not because it presents itself as a default or an obvious first choice, but because it invites a more deliberate assessment of what the structure is actually trying to achieve.   When families explain why their arrangements sit where they do, the reasoning is usually framed in terms of certainty, established jurisdictions, recognised legal systems and deep pools of advisers. All of these are important. But beneath that is something more human, a preference for what is known. Structures that are easy to explain, easy to replicate, and unlikely to raise questions at the wrong moment. That instinct is entirely rational, but is not always aligned with what works best over time. Family office structuring today is less about preserving assets in a static environment and more about managing change across generations. Governance matters more. Flexibility matters more. The ability to adapt without rebuilding from scratch is often the difference between a structure that lasts and one that slowly becomes constraining. This is where Gibraltar’s profile becomes interesting. It combines a legal system that is immediately recognisable, common law, English derived, predictable in its reasoning, with a scale that changes how advice and regulation actually feel in practice. Decisions are not abstract. The people advising on a structure are often directly involved throughout its life. Engagement with regulators is not filtered through layers of process. There is a directness with how things operate that is difficult to replicate in larger centres. More than that, in a smaller jurisdiction the key participants tend to be visible and accessible. Regulators, banks, advisers and, where needed, even policymakers are not distant institutions but reachable individuals. Conversations happen earlier, issues are addressed more directly, and structures can be shaped with a clearer understanding of how they will be treated in practice. For a family office, that has real value. It changes the experience from navigating a system to engaging with it. A structure is not just defined by how it is set up, but by how it behaves over time. How quickly can it respond to change? How straightforward is it to refine governance as the family evolves? How accessible are the individuals who help navigate those decisions? These questions rarely feature in initial jurisdiction comparisons, but they tend to surface later, when the structure is under pressure. In a smaller jurisdiction, continuity is not just a characteristic of the structures, but of the advisers behind them. ISOLAS, having been established in Gibraltar since 1892 maintains relationships with families, which often extend across generations. Advisers are not introduced at the point of a transaction, but much earlier, with successive generations becoming familiar with the structure and the decision-making process over time. That continuity has practical value. When moments of transition arise, succession, governance changes, or the need to revisit long-standing arrangements, those advising are not approaching matters in isolation. They understand the history, the context and the family dynamics, allowing the conversation to move more quickly from explanation to solution. And when you look more closely at how modern family office structures are actually used, certain features start to matter more than headlines. The ability to use private trust companies to retain a degree of family control without undermining governance. The flexibility of trust law that accommodates multi-generational planning without constant restructuring. The availability of foundations as an alternative for families less comfortable with traditional trust concepts, while still seeking permanence and clarity of purpose. Alongside this sits the corporate layer, often overlooked but critical. A system where companies are taxed on a largely territorial basis creates a different dynamic for globally held assets, particularly where underlying income is not sourced locally. For principals and senior executives within the family office, personal structuring also becomes part of the equation. Specialist tax regimes, such as Category 2 Status and High Executive Possessing Specialist Skills (HEPSS) are not, in themselves, the reason to choose a jurisdiction, but they reflect a broader philosophy with an ecosystem designed around mobile families and key decision-makers. In practical terms, Category 2 Status provides a capped tax exposure, with tax payable on a maximum assessable income of £118,000, resulting in a maximum annual liability of approximately £42,380, regardless of actual worldwide income. HEPSS, by contrast, is focused on senior executives, capping taxable earned income at £160,000 per annum. These are not headline features in isolation. They illustrate a consistent theme, namely that the jurisdiction is structured with an understanding that capital, control and individuals do not move independently of one another. Set against that is lifestyle, which is often treated as peripheral, but rarely is in practice. The anticipated UK–EU treaty arrangements, including the proposed removal of the land border between Spain and Gibraltar and the potential for Gibraltar to participate in a Schengen-style framework, would further reinforce what is already a distinctive proposition, a stable legal base combined with seamless access to a broader Mediterranean environment.   There is also a broader dynamic at play. Larger, more established jurisdictions excel at standardisation. They offer depth, consistency and a degree of institutional familiarity that is hard to match. That is why they dominate. But scale brings inertia. Change is slower, innovation is more considered, and structures tend to follow well-trodden paths. That works well when the objective is predictability. It is less effective when the objective is adaptability. Smaller jurisdictions operate differently. They are closer to the clients they serve, quicker to engage with new ideas, and more willing to shape solutions around specific circumstances rather than fit circumstances into existing templates. Gibraltar sits firmly in that category. Its approach to areas such as digital assets has demonstrated how that responsiveness can be translated into practical frameworks; however, for family offices, the more relevant consideration is cultural rather than technical. There is an embedded willingness to engage with complexity, rather than defer it. That matters when dealing with multi-generational wealth, where the questions are rarely standard and the answers rarely sit neatly within pre-existing structures. What makes this slightly counterintuitive is how much effort families typically invest elsewhere. Investment strategies are scrutinised in detail. Managers are selected carefully. Asset allocations are debated at length. The structure that holds all of it together, often the single longest-lived element of the entire ecosystem, is given comparatively little attention once it is in place. It becomes part of the scenery. Revisiting it feels unnecessary, until it becomes necessary. Gibraltar is not the answer in every case. Sometimes the existing arrangements remain entirely appropriate. Sometimes the benefits of familiarity outweigh the advantages of change. But what Gibraltar does, quietly, is prompt a reassessment.   It is sufficiently different to make the decision an active one again. It requires the family and its advisers to revisit the fundamentals, what the structure is for, how it is meant to operate, and whether it still reflects the reality of the family it serves. That exercise, in itself, is where most of the value sits. Because in family office structuring, the risk is rarely that nothing exists. It is that what exists is no longer aligned with what is needed, and no one has paused to notice. And that is not a question of jurisdiction. It is a question of whether the structure is still doing its job. For those establishing family office structures today, the question is slightly different, but no less important. It is not about revisiting what exists, but about getting it right from the outset. Jurisdiction, governance and flexibility are not decisions that sit at the margins, they shape how a structure will operate across generations. In that context, this may be the moment to consider alternatives more deliberately. Gibraltar, for the reasons outlined above, is not always the default answer. But it is increasingly a considered one.

HM Government of Gibraltar has today published confirmation that Spain’s Ministry of Finance has issued a draft Ministerial Order to remove Gibraltar from its list of non-cooperative jurisdictions, marking a significant and long-awaited milestone. If implemented following the short 7 day public consultation period, this will bring to an end a designation that has remained in place since 1991, despite Gibraltar’s long established record as a transparent and internationally cooperative Jurisdiction. The proposal recognises that Gibraltar now satisfies Spain’s domestic criteria for fiscal transparency and tax fairness, aligning Spain’s position with Gibraltar’s standing internationally, including its OECD “white list” status for many years. Beyond the symbolism, the practical implications are important. Gibraltar’s inclusion on the Spanish blacklist has historically triggered a range of adverse domestic tax consequences, particularly affecting individuals and businesses with cross-border connections. Its removal should therefore reduce friction, provide greater certainty in residency and structuring considerations, and remove a number of technical barriers that have persisted notwithstanding the Gibraltar-Spain Tax Agreement. It is also noteworthy that this step fulfils a commitment given by Spain when the Gibraltar-Spain Tax Agreement entered into force in March 2021, albeit later than originally envisaged. The publication of the draft Order suggests that Spain is now moving to honour that undertaking. From a broader perspective, this development reflects Gibraltar’s continued alignment with evolving international tax standards and its positioning as a credible, well-regulated financial services jurisdiction. Importantly, this announcement comes at a time when agreement has been reached on the future UK–EU treaty in respect of Gibraltar, with implementation expected shortly. That treaty is expected to remove the physical border between Gibraltar and Spain, fundamentally reshaping the movement of people, goods and services across the frontier. Taken together, these developments point to a clear and very positive shift in the cross-border dynamic, moving away from historic friction and toward greater cooperation, legal certainty and economic alignment. Overall, this represents a genuinely significant moment for Gibraltar, with meaningful implications for its international positioning and for businesses and individuals operating across the region, aligning itself to the stated ambition of the European Union, Spain, the United Kingdom and Gibraltar of a shared prosperity for the region.

Change of Control Notifications via GFSC Portal As of the 1st June 2026, Change of Control notifications pursuant to the Financial Services Act 2019 (“FSA”) may be submitted to the GFSC via the GFSC’s online portal (“GFSC Portal”). Accordingly, notifications relating to acquisitions, increases, reductions or cessations of control in respect of Gibraltar Regulated Firms may now be submitted via the GFSC Portal. Key features introduced by the GFSC Portal include logic-driven forms, automated information requests, the development of structure charts, as well as live status tracking. This will enable for an overall streamlining of such notifications with added efficiencies and benefits for firms, proposed acquirors and advisors, as well as for the GFSC itself. In order to assist with these changes, the GFSC has made comprehensive guidance available on its website outlining the functionality of the GFSC Portal, including video tutorials and FAQs. Change of Control – GFSC Guidance Notes The GFSC has also published, on 1st June 2026, a new set of Guidance Notes on Change of Control: Assessment of Acquisitions and Increases in Control (“COC Guidance Notes”). The COC Guidance Notes are relevant to all Gibraltar regulated firms and replace previously applicable EU Guidelines with a set of Gibraltar specific guidelines. As those familiar with the Gibraltar Authorisation Regime (“GAR”) regulatory alignment process will note from the publication of recent GFSC guidance notes, these COC Guidance Notes are largely consistent with UK FCA/PRA equivalent guidance. This includes on matters such as conditional approvals, aggregation of holdings, practical guidance on submitting notifications and approach to financial crime assessments. By way of summary, the COC Guidance Notes set out the GFSC’s expectations on the following issues: identifying controllers, including the concepts of significant influence, aggregated holdings and indirect controllers; the submission of a section 111 notice and the approach to completeness; the notification obligations of Gibraltar-regulated firms; the assessment criteria; and the GFSC’s use of its statutory power to attach conditions to an approval where doing so advances any of its regulatory objectives.