Regulatory & Compliance

Xapo operates under a dual regulatory framework, fully overseen by the Gibraltar Financial Services Commission (GFSC), which clearly separates our fiat and digital asset operations. Our traditional banking entity (Xapo Bank) acts as a fully licensed credit institution to handle your fiat operations. Under this entity, eligible fiat deposits are protected up to £120,000 by the Gibraltar Deposit Guarantee Scheme (GDGS).

In parallel, your digital wealth is managed by our distinct Virtual Asset Service Provider (VASP) entity, which holds permissions as a regulated Distributed Ledger Technology (DLT) Provider. This clear distinction between the Bank and the VASP ensures that your crypto assets are legally ring-fenced and subject to specialised oversight, offering you the robust consumer protection expected of a tier-1 financial institution.

Yes. At Xapo Bank, we believe in transparency and institutional-grade accountability. We partner with a Big 4 accounting firm to conduct comprehensive, independent annual audits of our financial statements. This provides verified proof that our balance sheet is secure, our capital and liquidity ratios far exceed standard requirements, and all member assets are accounted for to the highest international standards.

On an operational level, we enforce strict Anti-Money Laundering (AML) and Know Your Customer (KYC) protocols, paired with an internal Zero Trust framework to ensure your personal data remains strictly confidential and secure.

Our Virtual Asset Service Provider (VASP) licence legally mandates the strict segregation of our members' Bitcoin from our own corporate funds. Because your Bitcoin is held in a 1:1 reserve and legally ring-fenced, we never rehypothecate or use your assets for our own trading or working capital. This model ensures your wealth is protected under a clear legal framework and remains exclusively yours, completely insulated from any institutional liabilities.

Gibraltar is a globally respected, tier-1 financial jurisdiction and a pioneer in establishing a clear, purpose-built regulatory framework for Distributed Ledger Technology (DLT). Operating from Gibraltar allows us to offer the rigorous consumer protections of traditional banking while leveraging legal certainty for digital assets. It is the ideal jurisdiction for secure, transparent, and compliant digital banking.

Xapo Bank is headquartered and fully regulated in Gibraltar. Our flagship headquarters operates out of a beautifully restored, historic former military barracks right in the heart of Gibraltar's city centre. It is unique globally for creating a single, cohesive legal framework that regulates both traditional retail banking licenses and advanced crypto custody under strict statutory laws. Your fiat deposits are held by Xapo Bank Limited, a regulated credit institution. Your Bitcoin is held by Xapo VASP Limited, a regulated DLT provider. Both entities operate under separate GFSC permissions under the Financial Services Act 2019.

As a fully licensed credit institution, our banking compliance framework requires us to back all member fiat deposits 100% with highly liquid, low-risk cash equivalents (like short-term US Treasuries). We do not engage in commercial lending, yield-chasing, or speculative investments with your money. Compliance here means your cash is physically present, fully liquid, and always available for withdrawal.

(Please note that this statement refers to your fiat deposits. Other products, including the BTC Credit Fund, operate under different structures.)

To prevent financial crime and maintain institutional safety, Xapo Bank satisfies a comprehensive regulatory compliance checklist for every new account opening. This includes rigorous Know Your Customer (KYC) identity checks, global anti-money laundering (AML) screening, and secure verification of source of wealth. By conducting these checks remotely, we protect our banking ecosystem from bad actors while keeping your account fully compliant with global financial regulations.

No. Under European and Gibraltar financial regulations, national deposit insurance schemes apply strictly to traditional fiat currencies, not digital assets. Therefore, while your US Dollar balances (including USD Savings) are legally protected by the Gibraltar Deposit Guarantee Scheme (GDGS) up to the currency equivalent of £120,000, your Bitcoin holdings are not.

Instead, your Bitcoin is held by a separate, legally separated entity: Xapo VASP Limited. This entity operates under Gibraltar's statutory Distributed Ledger Technology (DLT) Provider framework, which replaces government deposit insurance with strict asset segregation laws.

By regulatory mandate, your Bitcoin is legally ring-fenced from our corporate balance sheet and held in a 1:1 reserve. This dual-entity structure ensures that if the bank ever faced corporate financial distress, your digital wealth remains recognised by law as your private, untouchable property—legally ring-fenced from traditional banking liabilities and creditors.

Yes, Xapo Bank is fully compliant with the Financial Action Task Force (FATF) "Travel Rule" guidelines for digital assets. When you deposit or withdraw Bitcoin to or from an external wallet, our compliance systems are legally required to securely communicate transaction data – including the originator and beneficiary identities – with other regulated financial entities. This ensures that your global crypto transactions align perfectly with international anti-money laundering (AML) banking standards, helping ensure your transactions with Xapo align with international AML standards.

No. While the Travel Rule mandates the collection and transmission of identity information, it does not expose your data to the public blockchain ledger or third-party advertisers. All personal information exchanged between Xapo Bank and other regulated financial institutions is transmitted through dedicated, heavily encrypted compliance rails. Our data governance architecture strictly adheres to high-standard data protection acts and GDPR principles. Your confidential financial details are exclusively accessible to authorised compliance personnel and legitimate regulatory authorities during official investigations, preserving your core privacy while maintaining compliance with applicable data protection laws.