Skip to main content
Didit Raises $2M and Joins Y Combinator (W26)
Didit
Europe

Identity verification
built for Gibraltar Flag of Gibraltar

Gibraltar ID Card, British passport (Gibraltar endorsement), driving licence on one session — GFSC + GRA iGaming + UK FCA-mirror + UK GDPR aligned. $0.33 full KYC, 500 free every month.

Backed by
Y Combinator
GBTC Finance
Bondex
Crnogorski Telekom
UCSF Neuroscape
Shiply
Adelantos

Trusted by 2,000+ organizations worldwide.

Country brief

How identity verification works in Gibraltar.

The fraud surface and the frameworks an engineering or compliance lead needs before scoping an integration.
Fraud landscape
Two pressures shape Gibraltar identity fraud: deepfake and synthetic-ID attacks on the world's longest-standing online-gambling hub (Gibraltar Regulatory Authority — GRA), and elevated forgery pressure as Gibraltar Distributed Ledger Technology (DLT) firms onboard high-net-worth crypto customers worldwide. Didit scores 200+ real-time fraud signals on every session — face morph, replay, injection, document tampering, device intelligence, IP geolocation.
Compliance frameworks
  • Proceeds of Crime Act 2015 (POCA)
  • GFSC AML/CFT Code of Practice
  • GRA Gambling Act 2005
  • Gibraltar DLT Framework
  • UK GDPR / Data Protection Act 2004
  • MoneyVal recommendations
  • FATF 40 recommendations
Regulators

Who supervises identity verification in Gibraltar.

These are the supervisors a Gibraltar verification flow has to answer to. One Didit hosted flow + one audit log covers every one of them — no separate integration per agency.
  • GFSC

    Gibraltar Financial Services Commission — unified prudential supervisor for banks, e-money institutions, payment service providers, insurers, securities firms, and Distributed Ledger Technology (DLT) providers. Mirrors UK FCA standards post-Brexit.

  • GRA

    Gibraltar Regulatory Authority — supervises remote-gambling operators under the Gambling Act 2005 and runs the UK GDPR data-protection mandate as the Gibraltar Information Commissioner.

  • GFIU

    Gibraltar Financial Intelligence Unit — Gibraltar's Financial Intelligence Unit. Receives Suspicious Activity Reports under the Proceeds of Crime Act 2015 (POCA).

  • HM Government of Gibraltar

    Issues the Gibraltar Stock Exchange warnings register referenced in AML screening, plus the Companies House Gibraltar registry referenced by KYB onboarding.

  • Royal Gibraltar Police

    Law-enforcement authority. Maintains Wanted Persons notices and law-enforcement signals relevant to AML/CFT screening obligations under the Proceeds of Crime Act 2015.

Verification flow · One API

Four modules. One verification.

ID, biometric, AML, and a Gibraltar database cross-check — composed on one workflow, billed per success, returned in one report.
01 · ID

Capture and read the ID.

Captured on any phone — auto-classified, OCR-parsed, and template-verified.

  • Gibraltar Identity Card, British passport with Gibraltar endorsement (with the chip read on e-Passports), Gibraltar driving licence, and Gibraltar residence permit for non-British and non-EU residents.
  • Returns the name, ID number, date of birth, place of issue, and expiry. Same flow handles every EU/EEA national identity card for cross-border players and Spain-adjacent customers.
Read the docs
Stage 01Capture and read the ID
  • Gibraltar Identity Card · Residence permit
  • Gibraltar driving licence
  • British passport (Gibraltar endorsement) — chip read on e-Passport
02 · Biometric

Match the face. Prove it's a real person..

Selfie confirmed live and matched against the ID portrait.

  • Same selfie is searched against the customer's prior users — catches anyone trying to onboard twice or under a different name. Critical for GRA-licensed operators chasing self-excluded players or multi-account fraud rings. Free.
  • Active liveness ($0.15) for elevated-risk flows — user turns or blinks.
Read the docs
Stage 02Match the face. Prove it's a real person.
  • Selfie on any phone or laptop camera
  • Mobile-handoff QR when the user starts on desktop
03 · AML

Screen for sanctions, PEPs, and adverse media.

1,300+ global sanctions, PEP, and adverse-media lists — plus Gibraltar watchlists:

  • Gibraltar Stock Exchange — Warnings — Gibraltar-specific regulatory warnings register.
  • GFSC — regulatory enforcement and market warnings — Gibraltar Financial Services Commission enforcement actions and prohibited-person notices.
  • HM Government of Gibraltar — Crown Court enforcement and debarment register — court-level enforcement and debarment notices.
  • Royal Gibraltar Police — Wanted Persons notices — active domestic criminal and fugitive notices.
  • UK OFSI — Consolidated List — UK HM Treasury Office of Financial Sanctions Implementation, applies via UK-mirror perimeter.
  • OFAC — Specially Designated Nationals (SDN) — US Treasury sanctions.
  • UN Security Council Consolidated Sanctions — global multilateral sanctions.
  • EU Consolidated Financial Sanctions — EU-level sanctions applicable via GFIU monitoring obligations.

Severity-scored. Ongoing monitoring ($0.07/user/yr) re-checks daily and fires a webhook on new hits.

Read the docs
Stage 03Screen for sanctions, PEPs, and adverse media

Screen for sanctions, PEPs, and adverse media — see the docs for the full module surface.

04 · Registry

Add country-specific data sources as Gibraltar partners onboard.

Gibraltar does not currently expose a public government consumer API for civil-registry lookups — no database validation service exists for the Civil Status and Registration Office register.

  • The Gibraltar ID Card and British passport with Gibraltar endorsement are captured + OCR-parsed (and chip-read on e-Passports) via the Identity Document Verification module — the authoritative document-side assurance the GFSC and GFIU expect.
  • The full AML Screening surface ($0.20 per check) is live today — global sanctions, PEPs, adverse media, UK OFSI Consolidated List, OFAC SDN, UN sanctions, GFSC enforcement, plus the Gibraltar Stock Exchange Warnings register.
  • A Gibraltar-specific authoritative-source lookup ships as data partners onboard — no integration change needed when the service goes live.
Read the docs
Stage 04Add country-specific data sources as Gibraltar partners onboard

Add country-specific data sources as Gibraltar partners onboard — see the docs for the full module surface.

Documents covered

Every Gibraltar document Didit accepts.

One row per accepted credential — flag, document name, document type. Live from the Didit Business Console.
Authoritative datasets

Civil-registry and AML coverage for Gibraltar.

One card per dataset Didit cross-checks against — civil registries on the Database Validation API plus the global AML watchlist pool. Each card links to the technical docs.
Compliant by design

Open a new country in one click. We do the hard work.

We open the local subsidiaries, secure the licenses, run the penetration tests, earn the certifications, and align with every new regulation. To ship verifications in a new country, flip a toggle. 220+ countries live, audited and pen-tested every quarter — the only identity provider an EU member-state government has formally called safer than in-person verification.
Read the security & compliance dossier
EU financial sandbox
Tesoro · SEPBLAC · BdE
ISO/IEC 27001
Information security · 2026
SOC 2 · Type I
AICPA · 2026
iBeta Level 1 PAD
NIST / NIAP · 2026
GDPR
EU 2016/679
DORA
EU 2022/2554
MiCA
EU 2023/1114
AMLD6 · eIDAS 2.0
EU-aligned by design
FAQ

Common questions about Gibraltar.

Infrastructure for identity and fraud.

One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes.

Ask an AI to summarise this page