Revolut Receives Regulatory Permission in Gibraltar
On October 19, 2026, the Government of Gibraltar announced that Revolut Global Digital Assets Limited, a Revolut subsidiary, had received permission under Part 7 of Gibraltar's Financial Services Act from the Gibraltar Financial Services Commission (GFSC) to conduct regulated distributed ledger technology (DLT) activities.
According to the government announcement, the authorised activities include the transmission and execution of virtual asset orders, virtual asset custody, and virtual asset staking services. Revolut said the entity would support its international digital asset operations, although the specific regions and services it will cover have yet to be announced.
The development reflects the continued expansion of digital asset services by major financial technology companies through local regulatory authorisations. For cross-border platforms, obtaining permission is only one part of market entry. Businesses must also understand local regulatory requirements and establish risk management and customer protection controls appropriate to their authorised activities.
Importantly, a Gibraltar licence does not automatically permit Revolut to offer every crypto service in every jurisdiction. Whether a service can be offered in a particular market depends on local law, licensing requirements, and applicable cross-border service rules.
Why Cross-Border Crypto Businesses Need Layered Compliance
Digital asset platforms may provide trading execution, custody, staking, fiat payments, and account management. These activities can be subject to different licensing conditions, customer asset safeguards, and risk-control obligations. A global compliance policy based solely on one jurisdiction's licence may overlook significant differences between markets.
Cross-border operations also require firms to consider where customers are located, which legal entity provides a service, how funds move, and what role third-party providers play. A crypto service covered by a particular authorisation in one market may require additional permission elsewhere or face different restrictions on marketing and customer onboarding.
Businesses should therefore maintain a compliance matrix organised by jurisdiction and service type. It should identify the activities each entity is authorised to conduct, the customers it may serve, and any applicable limitations. Before launching a product, firms should verify licensing status, disclosure obligations, customer agreements, and internal controls, while continuing to monitor regulatory developments.
How KYT and AML Support International Digital Asset Services
For platforms involved in transaction execution and custody, anti-money laundering (AML) controls and Know Your Transaction (KYT) monitoring can help identify potential risks in fund movements. Firms can combine customer due diligence, wallet risk assessments, transaction behaviour analysis, and ongoing monitoring to detect links to high-risk addresses, unusual fund flows, or activity that deviates from a customer's established pattern.
However, blockchain monitoring cannot replace legal licensing reviews, and an address risk label alone does not prove that a customer has committed an offence. Transaction analysis should be assessed alongside customer identity, the purpose of activity, and the relevant business context. Appropriate human review and escalation procedures are also important.
Custody services require attention to asset security, access permissions, segregation of duties, and incident response. Staking may involve additional considerations, including asset lock-up, protocol risks, and disclosure of service terms. The specific controls required depend on the applicable rules, product design, and services actually provided.
Revolut's Gibraltar authorisation illustrates that international digital asset expansion is not simply a product-growth strategy; it is an ongoing compliance responsibility. Platforms entering multiple markets can reduce regulatory and financial crime risks by clearly defining licensing boundaries, applying risk-based controls, and integrating KYT, AML, and customer protection into daily operations.