Gibraltar AML for Accountants: GFSC Registration and Review

Accountants, tax advisers, auditors and insolvency practitioners in Gibraltar are supervised for anti-money laundering by the Gibraltar Financial Services Commission (GFSC). This guide summarises two GFSC publications: its guidance note on which accountancy and tax advisory activities need registration (dated March 2025), and its thematic review of audit and insolvency firms (published December 2025). It is general information, not legal advice, so check the GFSC's current guidance notes and the Proceeds of Crime Act 2015 before you rely on it.

If you work across several jurisdictions, our guides to Jersey AML for accountants and Malta AML for accountants show how other regulators approach the same questions.

Why registration exists

The GFSC's scope note explains that registration of accountants and tax advisers comes under the Proceeds of Crime Act 2015 (Relevant Financial Business) (Registration) Regulations 2021. It says the regime followed a 2019 MONEYVAL recommendation that all relevant financial businesses be supervised for AML, counter-terrorist financing and counter-proliferation financing purposes. Accountants and tax advisers have been required to register since 2021.

What triggers registration

According to the scope note, a firm must register if it carries out an in-scope activity by way of business, which means providing services for remuneration. The note sets out conditions that go with registration:

• a registered office in Gibraltar
• a locally based money laundering reporting officer (MLRO) appointed under section 28 of the Proceeds of Crime Act, who is a permanent, full-time employee
• an AML/CFT/CPF Responsible Person appointed under section 9B of the Act

The GFSC must refuse registration if the MLRO, a director, an officer or a beneficial owner is not fit and proper (Regulation 7). Our guide to the MLRO role in an accountancy firm sets out what an MLRO does in general terms.

Activities in scope

For external accountants, the note lists audit and assurance (including reporting accountant work for IPOs), preparing and signing off accounts, bookkeeping and preparing annual and periodic accounts, succession advice, advice on investments and custody of client money, payroll agents providing accountancy services, and forensic accounting. For tax advisers, it lists tax compliance work, tax advice, succession advice, and advice on investments and custody of client money. The note defines bookkeeping as recording and data entry of transactions, and accountancy services as interpreting, analysing, classifying, reporting and filing financial information.

What is out of scope

The note lists several exclusions: firms already authorised by the GFSC, or an equivalent local supervisor, for AML purposes; individuals not acting for remuneration; in-house accountants serving their own employer or an entity where they are a director or officer; and certain payroll-only services, such as software support that does not involve analysing or preparing financial information, paying self-employed people or umbrella companies, payroll for end-user assignments, and human resources or recruitment services where payroll is a minor part of the business.

Red flags the GFSC highlights

The scope note also flags higher-risk indicators for the sector. They include cash-intensive businesses where invoices may be falsified (a trade-based money laundering risk), opaque or complex structures including entities invoicing each other under common beneficial ownership, unexplained complex transactions across layers, intermediaries or jurisdictions, non-transparent transactions with related parties, and aggressive tax practices such as Gibraltar companies with no chargeable income or companies dependent on shareholder support. The note describes transaction monitoring as imperative.

The December 2025 thematic review of audit and insolvency firms

The GFSC's thematic review covered audit firms, statutory auditors and insolvency practitioners. Firms were notified in July 2024, and on-site and desk-based reviews began in the fourth quarter of 2024. The report says both sectors are rated lower risk in Gibraltar's 2025 National Risk Assessment, and that the review completed the GFSC's sector-specific thematic review programme. It does not state how many firms were reviewed.

What the GFSC found

In the audit sector, firms often used group-wide methodologies that did not fully reflect Gibraltar's legislation, some did not properly apply the four core risk factors (customer, country, product and interface), and source of funds and source of wealth checks were often limited to the corporate customer rather than extending to its beneficial owners. Customer due diligence was generally met overall.

In the insolvency sector, practitioners are authorised individually and personally hold the MLRO and Responsible Person roles, but many relied on their employers for policies and compliance support without adequate oversight, and on generic group-level business risk assessments that did not capture insolvency-specific risks. The report stresses that individual practitioners remain accountable.

Good and poor practice

Good practice, according to the report, included documented risk-based source of wealth and funds checks extending to beneficial owners, risk-based periodic reviews, transaction monitoring before funds are released, business risk assessments covering products, clients, jurisdictions and delivery channels and discussed at board level, regularly updated risk methodologies, and Gibraltar-specific policies that cover proliferation financing. Poor practice included no documented ongoing sanctions screening, simplified due diligence applied to high-risk jurisdictions, reviews not carried out within policy timescales, staff unaware of red flags, risk assessments covering only money laundering and terrorist financing and not proliferation financing, undocumented risk scoring rationale, and group policies that do not refer to local law.

Follow-up

Every entity received individual feedback and was placed on a supervisory plan. Where significant deficiencies were found, the GFSC took enhanced supervisory action and, where necessary, referred cases to its Enforcement and Perimeter Surveillance team. The report names no enforcement outcomes, and says each firm's feedback letter set out remedial actions with deadlines.

Practical points (our suggestions)

These points are our own reading of the GFSC material, not GFSC requirements:

• Check that group policies actually cite Gibraltar law and are tested against it, rather than adopted wholesale.
• Extend source of funds and source of wealth work from the corporate client to its beneficial owners where risk calls for it, as discussed in our firm-wide AML risk assessment guide.
• Keep a dated record of sanctions screening against the lists the GFSC names (UN, EU, UK and Gibraltar), and see our guide to sanctions screening for accountants.
• Make sure the risk assessment covers proliferation financing and is specific to each service line.

Frequently asked questions

Who supervises accountants in Gibraltar for AML?

The GFSC's registration regime covers accountants and tax advisers under the 2021 registration regulations, and its thematic review covered audit and insolvency firms.

Does a Gibraltar accountancy firm need a local MLRO?

According to the scope note, registration requires a locally based MLRO appointed under section 28 of the Proceeds of Crime Act who is a permanent, full-time employee, as well as a separate AML/CFT/CPF Responsible Person.

Are in-house accountants covered?

The scope note excludes in-house accountants serving their own employer, or an entity where they are a director or officer.