Crypto & Virtual Assets Compliance in Georgia

Georgia is open to virtual asset businesses, but only through a single national registration with the National Bank of Georgia, which also supervises anti-money laundering (AML) compliance. Suspicious transaction reports go to the Financial Monitoring Service of Georgia, the country's financial intelligence unit.

The regime is local by design. A provider must be a Georgian company with a head office in Georgia, and a representative must be in the country for at least 14 days a month. Foreign exchanges cannot passport in or serve Georgian customers on the strength of a licence elsewhere.

The biggest practical hurdle for a new entrant is the remote onboarding approval. Before going live, a firm must submit its electronic identification process to the NBG with an independent audit report, and the rules on liveness, document checks and vendor data storage are prescriptive.

1. Who regulates this sector

Georgia is a unitary state, so there is no regional licensing layer. Commercial banks and other financial institutions whose own sector law authorises them to provide virtual asset services are exempt from most of the VASP registration rule but remain subject to its AML provisions.

2. Licensing and authorisation

The Rule on Registration, Cancellation of Registration and Regulation of VASPs, approved by NBG Order No. 94/04 of 13 June 2023, prohibits anyone other than a registered VASP or an authorised financial institution from providing virtual asset services. As restated by Order No. 207/04 of 26 August 2026, the regulated services are exchange of convertible virtual assets (for fiat, other virtual assets or financial instruments, including through kiosks), transfer, safekeeping or administration, portfolio management, operating a trading platform, lending, initial offerings and services related to initial offerings.

Who can register

Only a limited liability company or joint stock company incorporated in Georgia can be a VASP. It needs a head office in Georgia from which its administrators actually manage the business, and one authorised representative must be present in Georgia for at least 14 days in each calendar month. Administrators and holders of significant shareholdings (10% or more since August 2026) face fit-and-proper tests covering criminal records, financial soundness and, for administrators, relevant higher education or at least two years of management experience in finance or virtual assets.

Application and timeline

The application includes the service list, a schematic of every asset and fund flow, details of websites and apps used, a three-year business plan, AML policies with an organisational risk assessment, and a bank statement showing the minimum capital is paid in. The NBG may require a live demonstration of the platform. It decides within 60 calendar days of a complete file and may extend twice by 60 days each. The registration act now names the specific services authorised, and the public register shows them.

Capital and risk management [Partly in force]

A firm offering several services must hold the highest applicable amount. New registrants must have a risk management framework, covering operational, cyber, fraud and continuity risk, with an independent audit opinion within 12 months of registration; it must include annual penetration tests of critical systems and vulnerability scans at least twice a year. Firms registered before 27 August 2026 have until 1 July 2027 for the risk framework and 1 September 2027 for capital.

Losing registration for false information, AML breaches or other serious grounds bars the firm and its owners from reapplying for three years.

3. AML, KYC and customer due diligence

VASPs are obliged entities under Article 3(1)(a.o) of the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism (No. 5226-Iს, 2019), and the NBG is their supervisor (Article 4(c)).

When due diligence applies

On establishing any business relationship; on a one-off virtual asset transaction, or linked transactions, above USD 1,000, EUR 1,000 or GEL 3,000; on any suspicion, regardless of amount; and when earlier identification data is in doubt (Article 11).

Core measures

Identify and verify the customer from reliable independent sources, identify the beneficial owner (25% ownership or other ultimate control), establish purpose and nature, and monitor the relationship, including the origin of funds and convertible virtual assets where needed (Articles 10 and 13).

Enhanced due diligence

For high-risk customers, politically exposed persons and links to NBG-listed high-risk jurisdictions: senior management approval, source of funds and virtual assets, and enhanced monitoring (Articles 18, 19 and 21).

Reporting and records

Report a suspicious transaction to the Financial Monitoring Service on the day suspicion arises (Article 26). The Service can suspend a transaction for up to 72 hours. Records are kept five years, extendable by up to five more on request (Article 27).

Order No. 94/04 adds crypto-specific controls. Before starting operations a VASP must run software that automatically detects suspicious or linked transactions by analysing blockchain data. It may not deal with VASPs or financial institutions that are unlicensed, unsupervised for AML, or based in countries without rules equivalent to Georgia's. Reliance on a third party's due diligence is permitted only where the third party is regulated to FATF standards and is not in a high-risk jurisdiction; the VASP keeps ultimate responsibility (AML Law, Article 16).

Since 1 March 2026, Law No. 1119-IVმს-XIმპ requires every person to make funds unavailable to UN-designated persons immediately and without prior notice, and obliged entities must list any assets they have restricted in their suspicious transaction report.

4. Identity verification and onboarding

NBG Order No. 104/04 of 29 April 2025, the Rule on carrying out preventive measures electronically, governs every remote onboarding by an NBG-supervised entity. A customer onboarded in breach of it is treated as unverified. The process must include consent to data processing, a liveness check, and either a real-time document check with face comparison or a comparison of the liveness photo with the photo held by the Public Service Development Agency.

• Documents: the customer must hold the physical document during the session; images taken earlier are not accepted. Data must be read automatically by optical character recognition or NFC.
• Georgian citizens and residents: document security features must be checked and all data compared with the Public Service Development Agency record, which may be queried without the customer's consent.
• Non-residents: only a biometric passport or identity document valid for crossing the Georgian border is accepted, verified by document-validation software, a transfer of at least 1 tetri from another account in the customer's name, or another reliable method.
• Automated matching: face-to-document software must meet a minimum accuracy of 1/10,000, with sampled human review of passed and failed sessions. Three-dimensional face scanning is recommended where no person is involved.
• Video identification: HD, end-to-end encrypted, at least three randomly chosen tasks, no pre-recorded video, the four-eyes principle, and retention of the full recording.
• Attempts: no more than three failed attempts per customer in 24 hours; failed sessions are classified and kept for at least one year.

Remote onboarding of a legal entity is allowed only if it, every company in its ownership chain and every beneficial owner are from Georgia or a country listed in Annex 1 to the rule (including the EU, Schengen states, the United Kingdom, the United States, Canada, Japan, Singapore and the United Arab Emirates). Other NBG-supervised entities may start a corporate relationship before original documents arrive, within a 60-day grace period; that exception does not apply to virtual asset services.

5. Digital channels: what's different

Bottom line: due diligence obligations are the same in every channel, but remote onboarding needs prior written NBG approval of a prescribed liveness and document-check process, plus geolocation and anonymiser detection that apply only to crypto firms.

Geolocation and anonymisers

Before remote onboarding, a VASP must establish the customer's location, at least the country, from the IP address using an automated tool or another geolocation method, and must detect VPN, TOR or proxy use and apply the measures set out in its own procedures (Order No. 104/04, Article 2(3) and (4)).

Cross-border flows after onboarding

For remotely onboarded customers, a VASP must identify international transfers linked to high-risk or offshore jurisdictions and reassess the relationship, and must block card payments linked to those jurisdictions. Offshore jurisdictions that are also Annex 1 countries are exempt (amended by Order No. 288/04, December 2025).

Vendors and data location

All data from the remote process, including logs and back-ups, must be stored only on the obliged entity's side; an identity verification vendor may keep only a technical audit log. Firms had until 1 February 2026 to file the independent audit confirming this (Order No. 142/04). Every year the firm must also commission an independent information security audit and penetration test.

6. Data protection and biometrics

The Law of Georgia on Personal Data Protection governs identity data. For crypto onboarding, Order No. 104/04 makes consent to data processing the first step of every remote session. It allows personal data to be sent to an outsourced verification provider in a country without adequate protection only if security is maintained during and after transfer, the firm monitors the processing, confidentiality is regulated by contract, and the customer is fully informed of the processing and their rights. Travel Rule data must be exchanged securely and in line with the same law (Order No. 253/04, Article 9(4)).

7. Sector-specific obligations

Travel Rule [Adopted, compliance by 31 Dec 2027]

Article 17¹ of the AML Law and Articles 9 to 15 of the NBG Regulation on information accompanying fund transfers and virtual asset transfers (Order No. 253/04, as amended by Order No. 386/04 of 27 December 2023) require the originator's VASP to send the originator's name, blockchain address or account, and address, identity document number or date and place of birth, plus the beneficiary's name and address or account. Data may travel separately from the on-chain transaction. For transfers to or from a self-hosted wallet the VASP must collect and store the same data, and above EUR 1,000, USD 1,000 or GEL 3,000 it must assess whether the customer owns or controls the wallet. Receiving VASPs must reject, return or request missing data, and report repeatedly non-compliant counterparties to the NBG.

Stablecoins

The Rule for the Initial Coin Offering of a Stablecoin (Order No. 52/04, 6 March 2026) requires prior written NBG consent for any stablecoin offering in Georgia, 100% reserve backing in the pegged currency held with a licensed custodian, quarterly external reserve verification, a Georgian-language whitepaper, and redemption at nominal value within three business days, or five above GEL 300,000. Issuers must apply enhanced due diligence before redeeming for holders who are not their clients.

Product restrictions

A virtual asset is a fungible, non-unique digital representation of value; digital representations of money, securities and other financial instruments are excluded. VASPs may not offer privacy coins or obfuscation methods that defeat traceability, lend virtual assets to individuals, act through agents, or carry on business other than virtual asset services and ancillary activities.

8. Risk indicators and red flags

Typologies flagged in NBG rules and statements

• Location masking: VPN, TOR or proxy use during onboarding or login.
• Transit accounts: non-resident customers using the account to pass funds through Georgia.
• High-risk corridors: transfers or card payments linked to high-risk or offshore jurisdictions.
• Anonymity-enhancing assets: deposits from mixers or privacy coins.
• Missing originator data: incoming transfers repeatedly lacking Travel Rule information.
• Unregistered counterparties: Georgian-incorporated firms named in foreign sanctions that are not on the NBG register.
• Self-hosted wallets: large transfers to wallets the customer cannot show they control.

9. Enforcement and penalties

NBG Order No. 133/04 (29 May 2024), restructured by Order No. 204/04 of 24 August 2026, sets fixed fines per breach, mostly charged per violation, per customer or per transaction. AML breaches fall into three tiers. Examples in the especially serious tier include missing or defective blockchain monitoring software (GEL 20,000), sanctions-screening software that is missing or seriously defective (GEL 15,000), late suspicious transaction reports (GEL 5,000 each) and dealing in privacy coins (GEL 10,000 each). In the serious tier, serving a customer without identification costs GEL 1,000 per case and politically exposed person failures GEL 5,000 per person. Systemic repeat breaches can attract up to GEL 100,000. Under the August 2026 changes, offering a stablecoin without NBG consent costs GEL 50,000 per breach, administrators can be fined GEL 5,000, and a repeated breach doubles the fine. The NBG may instead suspend administrators, restrict operations or cancel registration.

Published decisions show the regime in use: the NBG fined SHER888 LLC GEL 465,000 for breaches including onboarding without identification, failing to monitor the source of funds and virtual assets, and obstructing an inspection. In 2026 it also stated publicly that Georgian-incorporated firms named in EU, UK and US sanctions actions were unregistered and outside its supervision.

10. Recent changes and what to watch

• 31 December 2027 [Adopted, compliance by 31 Dec 2027]: Travel Rule compliance deadline for VASPs; fines for Travel Rule breaches apply from the same date.
• 1 July and 1 September 2027 [Partly in force]: existing VASPs must meet the new risk-management framework and then the minimum capital requirements.
• 27 August 2026 [In force]: Order No. 207/04 adds service-based capital, risk management, stablecoin registration requirements and service-specific registration acts.
• 25 August 2026 [In force]: Order No. 204/04 adds fines for regulatory, stablecoin and reporting breaches and doubles fines for repeats.
• 6 March 2026 [In force]: stablecoin offering rule, Order No. 52/04.
• 1 March 2026 [In force]: immediate asset-freeze obligation for UN-designated persons applies to everyone.
• 1 January 2026 [In force]: VASPs must display their NBG registration act on all channels, including websites and apps.

11. What this means for identity verification

A Georgian crypto onboarding flow must be built around Order No. 104/04: real-time liveness, a live document read by OCR or NFC with security-feature checks, and, for Georgian documents, a match against the Public Service Development Agency record. Geolocation and anonymiser detection must run before identity capture, with eligibility rules that exclude high-risk and offshore nationals. Non-residents need biometric travel documents and a second verification signal. Any vendor must be configured so that images, video and data sit only with the VASP, and the whole process needs NBG approval and an annual security audit. Re-verification is required when identity documents are renewed, and blockchain-level monitoring and Travel Rule data capture, including ownership proof for self-hosted wallets, should be designed in now for the 2027 deadline.