For a tiny jurisdiction perched at the mouth of the Mediterranean, Gibraltar has spent the past few years at the centre of a storm. What began as a police investigation into alleged sabotage of a national security system has spiralled into one of the most consequential governance reckonings the territory has ever faced. Two major public inquiries, the McGrail Inquiry and the Inquiry into the Retirement of the Former Commissioner of Police, now hold up a mirror to Gibraltar’s institutions, revealing uncomfortable truths about political power, policing, transparency and the rule of law.

And while Gibraltar was recently removed from the FATF grey list, a milestone the government hailed as proof of the jurisdiction’s improved financial governance, these inquiries paint a more complicated picture. Taken together, their findings may well shed new light on the ongoing risks facing organisations and investors operating in Gibraltar.

This is a moment of both accountability and instability. And the world is watching.

The inquiry that changed Gibraltar: The McGrail saga

What started in 2020 as an investigation into the alleged hacking of Gibraltar’s National Security Centralised Intelligence System soon mutated into something far more seismic. By the summer of that year, Ian McGrail, Commissioner of the Royal Gibraltar Police with an unblemished 36-year career, had lost his job under circumstances increasingly viewed as opaque, politicised and deeply troubling.

Represented by legal teams who described the events that followed as “Kafkaesque,” McGrail challenged the Gibraltar government, forcing the establishment of a public inquiry. The resulting Inquiry, broadcast live for the first time in Gibraltar’s history, became a national spectacle. As one observer put it, “what was heard cannot be unheard, and what was seen cannot be unseen.”

The evidence exposed a cascade of allegations: inducements to coax witnesses to dig up dirt, arrests for making false statements, reports of depleted police ranks, and even an Osman warning issued to McGrail amid concerns for his safety. For four years, McGrail and his legal team navigated a relentless onslaught, with one barrister likening it to a Bruce Lee film: fast-paced, unforgiving, and exhausting.

The Inquiry concluded oral hearings in May 2024, and after final submissions that summer, the Chairman’s report is now poised for publication. The Chief Minister confirmed it will be tabled in Parliament “in the coming weeks.” This is no longer just a police dispute. It is a constitutional moment.

A second inquiry, a wider lens

Running alongside the McGrail Inquiry, a separate Inquiry into the retirement of the Former Commissioner of Police reached its own conclusion this year. The inquiry was equally extensive: 114 affidavits, 73 witnesses, live hearings involving Gibraltar’s most senior officials, and a special recall session in April 2025 to examine newly disclosed WhatsApp evidence.

Its scope ranged from the alleged hacking investigation to the fatal collision at sea involving a police vessel, to the highly controversial incident where officers obstructed an aircraft attempting to remove a UK Ministry of Defence employee.

The Chairman has now formally delivered the final report to the Government. The Chief Minister has again promised publication shortly, subject to redactions. Once released, this report may open yet another chapter in Gibraltar’s evolving governance narrative.

A jurisdiction under scrutiny, despite leaving the grey list

Against this backdrop, Gibraltar’s removal from the FATF grey list in 2023 was widely presented as a turning point: a validation of improved anti-money laundering (AML) controls, a boost for its financial services sector, and a sign that the territory was on a more stable regulatory footing.

But inquiries of this scale, examining the inner workings of policing, government interaction, transparency, and national security, do cast shadows.They prompt a deeper question for businesses and international partners: Is Gibraltar truly a stable, low-risk jurisdiction or does the turmoil exposed through these inquiries indicate vulnerabilities beneath the surface?

For banks, gaming companies, insurers, crypto platforms, and multinational groups that rely on Gibraltar’s regulatory infrastructure, governance risk is compliance risk.

The inquiries highlight:

• internal tensions within law enforcement

• politicised decision-making

• rapid legislative changes limiting disclosure

• allegations of interference

• institutional fragilities that could affect due process and independent oversight

Even with FATF’s stamp of approval, these issues remain highly relevant for risk assessments, onboarding decisions, and ongoing monitoring.

What this means for businesses and investors

For organisations with exposure to Gibraltar, or considering it, these developments matter. They signal an environment in which reputational, legal and regulatory risks may be heightened, particularly where political pressure intersects with operational decision-making.

Three practical implications stand out:

Governance volatility requires recalibrated risk assessments

Public inquiries revealing systemic concerns can influence internal controls, law enforcement responsiveness, and the predictability of official decisions. Firms should assess whether their Gibraltar operations or partnerships could be impacted by shifts in policing, public confidence, or political relationships.

Conduct and transparency concerns raise due diligence expectations

Stakeholders such as banks, regulators and insurers, may expect enhanced due diligence in sectors relying on Gibraltar’s legal system or enforcement agencies. Organisations may need to demonstrate more robust oversight, documentation, and risk mitigation.

Future regulatory tightening or loosening is unpredictable

While leaving the FATF grey list suggests compliance improvement, inquiries of this magnitude often trigger reform. Legislative amendments, governance restructuring, and new oversight mechanisms could change operational requirements, create new reporting duties, or shift enforcement priorities.

A moment that will define Gibraltar’s future?

Both inquiries have now delivered their reports. Once made public, they may confirm what many inside Gibraltar already believe, that the territory is facing a watershed moment in its democratic and institutional development.

Whether Gibraltar emerges stronger, more transparent, and more stable or whether the turmoil exposes deeper fractures, will depend heavily on how the Government responds in the coming months.

What is clear is that these inquiries have already altered Gibraltar’s reputation. Even with its removal from the FATF grey list, the revelations shine a bright light on the complexities of governance in the jurisdiction. For businesses, investors, and compliance professionals, Gibraltar is no longer a “quiet” or predictable offshore outpost. It is a jurisdiction in transition, one whose risks and opportunities must be understood with eyes wide open.

The Bribery and Corruption Risk Assessment Refresh Checklist helps businesses keep their anti-bribery efforts up to date. It focuses on spotting new risks, checking third-party relationships, and making sure policies and training still match current needs. Try it here.