Gibraltar introduces tiered B2B licensing under its new Gaming Act

Gibraltar’s new Gaming Act replaces the old one-size-fits-all B2B licensing model with a tiered structure. For PSPs, payment processors, and other high-risk suppliers, the practical point is simple: smaller businesses should face lower entry costs, while the regulator keeps a formal licensing grip on who is operating in the market.

1. The new legislation creates different licence categories, so providers can apply for authorisation that matches the size of their business. Under the previous regime, suppliers effectively had to obtain a full B2B licence regardless of scale, which meant higher costs and more regulatory friction for smaller firms.
2. The reform also ends Gibraltar’s historic “sheltering” system, where providers operated under the infrastructure of licensed B2C operators before securing their own authorisation. That setup is now being replaced by a formal licensing process, even though sheltering had allowed the regulator to supervise new providers before they received an independent licence.
3. Steven Caetano, senior partner at Gibraltar law firm ISOLAS, said on the Connected by Pragmatic Solutions podcast that the new framework is more proportionate. He pointed to a level three licence for existing providers that are still relatively small, with a lower licence fee and a smaller cap on the number of clients they can serve.
4. Caetano also said the model should help both companies already operating in Gibraltar and firms looking to enter the jurisdiction, because they will be able to expand the scope of their licence as the business grows. In his words, the old system required a level one B2B licence no matter how small the operation was.
5. Beyond licensing, the Gaming Act updates Gibraltar’s regulatory framework to reflect how online gaming has changed since the original legislation came into force in 2005. Caetano said the earlier regime was heavily focused on technology infrastructure and server location, which is harder to justify in an industry that now relies heavily on cloud services.

The regulatory direction here matters for high-risk payment providers because it signals a move away from fixed infrastructure checks and toward operational substance. In practice, that usually means fewer legacy requirements tied to where servers sit and more attention to how the business is actually run.