Fintech & Digital Payments Compliance in Georgia

Georgia is open to digital payment and e-money businesses, including app-only models, but through a single national route: registration with the National Bank of Georgia as a payment service provider. There is no regional licensing and no passporting from foreign licences; the applicant must be a Georgian legal entity with a head office and data backups in the country.

The NBG is both the licensing authority and the AML supervisor for payment providers, while the Financial Monitoring Service of Georgia receives suspicious transaction reports. Personal data protection, including biometric data, is supervised by the State Audit Office from 2 March 2026.

The biggest obstacle for a new entrant is usually the remote onboarding approval: the NBG must consent in writing to the electronic customer due diligence process before it goes live, and the rules on liveness, document checks, data location and outsourcing are prescriptive.

1. Who regulates this sector

Licensing and supervision are national. EU law does not apply directly in Georgia, even where Georgian rules follow EU models.

2. Licensing and authorisation

Registration as a payment service provider

Under NBG Order No. 77/04 of 1 May 2023, no one may provide payment services, including money remittance, unless registered by the NBG, and only a legal entity founded and registered under Georgian law may apply. Commercial banks, microbanks and NBG-registered microfinance organisations are outside this registration requirement. The same rule covers e-money issuers, which are payment service providers that issue electronic money. [In force]

The application includes a schematic of each payment service showing every flow of information and money, a demonstrable electronic system, a three-year business plan for activity in Georgia, ownership and beneficial owner documents, ten-year criminal record certificates and, where relevant, compliance plans for the NBG's strong customer authentication and wire transfer rules. The NBG decides within 60 calendar days of a complete file.

Substance requirements

Head office in Georgia

Administrators must manage the business from a physically separate head office in Georgia, and one authorised representative must be in Georgia at least 14 days a month.

Data in Georgia

Backups of each customer's balance records must be made at least daily and stored in a data centre in Georgia, retrievable from the head office.

Fit and proper

Administrators need relevant higher education or two years' managerial experience in finance; convictions for serious or economic crimes disqualify administrators and significant shareholders. A sole shareholder who is also director must appoint a second director.

Safeguarding

Customer funds must sit in nominee accounts at a Georgian commercial bank or microbank: 100% of e-money issued and of non-cash funds at the end of each banking day, or an NBG-approved bank guarantee.

A provider becomes a "significant" provider if its average monthly payment volume over 12 months exceeds GEL 9,000,000, or if an e-money provider's average daily outstanding e-money over six months exceeds GEL 1,500,000; significant providers must meet the NBG's capital adequacy rule and additional governance and outsourcing requirements. Payment initiation providers must also show minimum supervisory capital at registration.

Agents, outsourcing and the sandbox

A provider must notify the NBG 30 days before using agents and is fully liable for them, including for AML compliance. Outsourcing is barred to jurisdictions where the NBG could lose access to information. The NBG's regulatory sandbox (Order No. 125/04 of 23 May 2025) allows controlled live testing of new products.

The NBG may cancel a registration for, among other grounds, AML breaches, misleading documents or not starting services within three months; most cancellations bar the owners from reapplying for three years. Microfinance organisations, loan-issuing entities and currency exchange offices follow separate NBG registration regimes and are obliged entities in their own right; under an amendment adopted on 1 April 2026, factoring companies and factoring platforms join the list of AML obliged entities from 1 January 2027. [Adopted, effective 1 Jan 2027]

3. AML, KYC and customer due diligence

Payment service providers, microfinance organisations, currency exchange offices, loan-issuing entities, microbanks and banks are all "obliged entities" (financial institutions) under Article 3 of the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism (No. 5226-Iს, 2019), and the NBG is their supervisor under Article 4. For open banking, the law does not apply to account information services, and payment initiation requires only customer identification and verification.

When due diligence is required

Under Article 11, preventive measures (identification and verification of the customer and beneficial owner, the purpose of the relationship, and ongoing monitoring) apply when a business relationship is established; for an occasional transaction above GEL 15,000 (or linked transactions); for an occasional wire transfer above GEL 3,000; whenever there is doubt about identification data; and at any amount where money laundering or terrorist financing is suspected. Verification must be completed before the relationship starts, although for lower-risk customers it may finish afterwards if needed to avoid interrupting service, as soon as reasonably possible. Anonymous accounts and accounts in fictitious names are prohibited.

Simplified and enhanced measures

Article 9 allows the Financial Monitoring Service, by its own normative act, to exempt low-value e-money instruments that can only pay for goods and services, cannot hold more than GEL 500 (up to GEL 1,500 if usable only in Georgia), cannot be loaded anonymously, and allow no more than GEL 150 in cash withdrawals. Enhanced measures apply to higher-risk customers (Article 18), politically exposed persons and their family and close associates (Article 21) and customers linked to high-risk jurisdictions on the NBG's list (Article 19); they include source of funds and wealth checks and management approval.

Beneficial ownership, reporting and records

• Beneficial owner: a natural person owning or controlling 25% or more of a legal entity, directly or indirectly, or otherwise exercising ultimate control (Article 13).
• Suspicious transactions: reported to the Financial Monitoring Service on the day reasonable suspicion arises (Article 26), including attempted transactions; tipping off is prohibited.
• Information requests: answered within two working days (Article 26).
• Threshold reports: further transaction types reportable to the Service are set by Financial Monitoring Service Order No. 1 of 5 June 2020, last amended on 17 November 2025.
• Records: kept for five years after the relationship ends or the occasional transaction, extendable by up to five years on request (Article 27).

Every obliged entity needs a compliance control system with a senior compliance officer, training and independent audit (Article 29), and must assess the risk of any new technology or channel before launch (Article 8).

4. Identity verification and onboarding

Financial Monitoring Service Order No. 2 of 5 June 2020 sets the identification data. For individuals this covers name, date and place of birth, personal number, document number, sex, citizenship and address. Accepted documents for Georgian citizens are a passport, identity card or driving licence; for foreign nationals a residence card, passport or another document accepted for crossing the Georgian border. The document must bear a photograph and be valid. For legal entities, a Georgian public registry extract or a foreign registry extract dated within six months is required. Remote identification and beneficial owner verification follow the supervisor's own rules rather than this order.

Article 16(7) of the AML law lets obliged entities and their outsourcers query the Public Service Development Agency's databases without the customer's consent. Reliance on a regulated third party is allowed, except one in a high-risk jurisdiction, and the obliged entity keeps ultimate responsibility.

NBG Order No. 104/04 of 29 April 2025 on carrying out preventive measures electronically governs how the steps in Figure 1 are performed for every NBG-supervised obliged entity. A customer onboarded in compliance with it counts as identified and verified; a customer onboarded in breach of it counts as unidentified. [In force]

5. Digital channels: what's different

Bottom line: Remote onboarding is permitted, but only through an NBG-approved process with mandatory liveness and live document checks, and it is closed to nationals of high-risk jurisdictions and to some foreign corporate customers who could be onboarded in person.

Approval, data location and outsourcing

Before introducing or changing a remote process, the provider must apply to the NBG with the Annex 2 form and an independent auditor's report; the NBG decides within 30 calendar days, extendable by 30. The full information asset, including backups, must be kept only on the provider's side: an outsourced verification vendor may keep only a technical audit log, and the provider must have high assurance that the vendor deletes everything else. The provider must commission an annual independent information security audit and penetration test.

Technical standards for liveness and matching

The process must collect consent, run a liveness check and verify the document in real time. Liveness technology must be checked by a qualified third party; a 3D face scan is recommended where no human is involved. Automated face matching must achieve a minimum accuracy of 1 in 10,000, staff must sample automated decisions, and failed attempts are capped at three per customer in 24 hours. Agent-led video identification needs encrypted HD video, at least three randomly chosen tasks, the four-eyes principle and random allocation of staff; pre-recorded video is not allowed.

Foreign customers and high-risk jurisdictions

Under Order No. 288/04 of 16 December 2025, citizens or residents of a high-risk jurisdiction or offshore zone cannot be onboarded remotely unless they hold Georgian citizenship or residence. For remotely onboarded customers, international transfers linked to high-risk jurisdictions are prohibited, and the provider must detect card payments linked to them. For non-residents, the provider must document why the customer banks in Georgia and whether the account may serve for transit. [In force]

6. Data protection and biometrics

The Law of Georgia on Personal Data Protection (No. 3144, 2023) applies to all identity capture. From 1 May 2026, its rewritten Article 9(1) allows biometric data to be processed only where necessary for carrying out an activity, security, property protection or preventing disclosure of secret information, where these aims cannot be achieved otherwise without disproportionate effort, or in other cases expressly provided by law. For payment providers, the mandatory liveness and face-matching steps in NBG Order No. 104/04 are the clearest legal anchor, and that order requires consent to data processing as the first step of the remote process. [In force from 1 May 2026]

Since 2 March 2026 the State Audit Office supervises data protection: data breaches must be notified to it within 72 hours unless significant harm is unlikely, and a controller registered abroad that processes data using technical means in Georgia must appoint a special representative there. Under Order No. 104/04, transfers to a vendor in a country without adequate protection need security safeguards, contractual confidentiality and full information to the customer.

7. Sector-specific obligations

Wire transfer information

The payer's provider must ensure transfers carry the payer and payee information the NBG specifies (Article 17 of the AML law); a recipient or intermediary provider must assess whether missing information calls for a suspicious transaction report. Registration requires a compliance plan for the NBG's wire transfer information regulation (Order No. 253/04 of 30 November 2018).

Sanctions

Any person must freeze, without notice, funds of persons designated under UN Security Council resolutions and inform the Financial Monitoring Service; since an amendment of 26 November 2025, failure by persons outside the obliged-entity list is an administrative offence. NBG-supervised entities must also screen against the lists set by NBG Order No. 208/04 of 4 August 2023 on sanctions regimes, and Order No. 104/04 requires them to assess the risk of sanctions evasion in remote onboarding.

Complaints and data disclosure

Complaint records must be kept for at least six years. From 2 March 2026, the payment law lists who may receive a customer's payment data, including the Financial Monitoring Service and the State Audit Office; anyone else needs a court decision.

8. Risk indicators and red flags

Payment and e-money red flags drawn from NBG and AML rules

• Transit use by non-residents: a foreign customer with no clear reason to bank in Georgia or signs of pass-through flows.
• Structuring: linked occasional transactions or transfers kept just under GEL 15,000 or GEL 3,000.
• High-risk corridors: card payments or transfers involving high-risk jurisdictions or offshore zones by remotely onboarded customers.
• Repeated failed e-ID attempts: several failed sessions linked by personal number or IP address.
• Coached or coerced applicants: behaviour in video identification suggesting phishing or another person's influence.
• Proxy onboarding: attempts to open an account remotely on someone else's behalf.
• Unlicensed counterparties: corporate customers that are foreign online casinos, unregulated financial or virtual asset businesses.
• Unexplained wealth: activity inconsistent with the customer's stated source of funds or business.

9. Enforcement and penalties

The NBG fines payment service providers under Order No. 87/04 of 13 June 2017 (amended most recently on 1 May 2025). AML breaches are tiered and fined per violation, per customer or per day:

Payment-law breaches carry separate fines, such as 1% per day of any safeguarding shortfall (at least GEL 300). In a published decision, the NBG fined e-money provider eMoney Georgia JSC GEL 93,000, mainly for failing to establish the source of wealth and funds of 19 customers, ignoring risk factors in customer risk ratings and not filing suspicious transaction reports.

10. Recent changes and what to watch

• 1 January 2027: [Adopted, effective 1 Jan 2027] Factoring companies and factoring platforms become AML obliged entities under the NBG, adding a new class of lenders and platforms to the regime.
• 1 May 2026: [In force] New Article 9(1) of the data protection law narrows when biometric data may be processed; firms should document the legal basis for selfie and liveness checks.
• 2 March 2026: [In force] The State Audit Office replaced the Personal Data Protection Service as supervisor; breach notifications and special representative registrations go to it.
• 2 March 2026: [In force] Amended Article 43(2) of the payment law lists who may receive customer payment data without a court decision.
• 1 February 2026: [Deadline passed] Providers using outsourced remote verification had to evidence vendor-side storage and deletion controls with an independent audit report.
• 16 December 2025: [In force] NBG Order No. 288/04 tightened remote onboarding of non-residents and transfers linked to high-risk jurisdictions.
• 26 November 2025: [In force] AML law amendment strengthened UN sanctions freezing and created administrative liability for non-compliance by any person.

11. What this means for identity verification

For a Georgian payment or e-money app, the remote flow is effectively specified by regulation: recorded consent, a real-time liveness check with a fresh photo, a live document capture read by OCR or NFC with security feature checks, and comparison with the Public Service Development Agency database for Georgian documents. Face matching must meet the 1 in 10,000 accuracy floor and be sampled by staff. Build attempt counters, suspicious-attempt logging by personal number and IP address, and one-year retention of failed sessions into the product.

Non-resident journeys need a separate branch: document validity software or a 1 tetri reference transfer, nationality and residence screening against high-risk and offshore lists, and a written rationale. Online corporate onboarding is limited to Georgian or listed-country structures, with paper documents within 60 days. Verification data and backups must sit with the provider, not the vendor, and a change of software supplier needs renewed NBG agreement.