iGaming & Gambling Compliance in Georgia

Georgia is an open but tightly controlled market. Online casino, slots and sports betting (totalisator) are lawful under permit, and the 2026 reform added an export model for operators serving only non-Georgian players. The country does not admit offshore operators: the permit holder must be a Georgian entrepreneur with management and servers in Georgia.

The Revenue Service of the Ministry of Finance licenses and inspects operators and runs the self-exclusion and prohibited-persons lists. The Ministry of Finance supervises gambling operators for AML purposes and sets technical and onboarding rules, and the Financial Monitoring Service of Georgia receives suspicious activity and threshold reports.

The biggest obstacle for a new entrant is the onboarding standard: Georgia combines a minimum age of 25 for its own citizens with list checks, state database checks, annual re-verification and a ban on accepting any money before verification is complete.

1. Who regulates this sector

Gambling permits are national; municipalities may only restrict where venues are located (gambling law Article 35).

2. Licensing and authorisation

The Law of Georgia on Organising Lotteries, Games of Chance and Other Prize Games (No. 1180, 25 March 2005) requires a permit under the Law on Licences and Permits for every game of chance or prize game held in Georgia, for organising them by "system-electronic" (online) means, and for supplying games to operators (Article 5(1)). Operating without a permit, or breaching permit conditions, is a violation of law. The lottery is run by a single tender-appointed operator (Article 6).

Permit types

Article 11(1) lists separate permits for land-based casinos, slot machine halls, totalisators (betting shops), gambling clubs, lotto and bingo, and for the online equivalents: online casino games, online slot games and online totalisator games, each with an "international" variant, plus a permit to supply games or essential products and services. Key conditions:

• Permits go only to entrepreneurs registered in Georgia (Article 11(2)) and may not be transferred (Article 11(24)).
• An online casino or slots permit can be issued with or without a land-based permit; an online totalisator permit is issued only to a land-based totalisator permit holder (Article 11(4) to (6)).
• Each online permit allows one website under one internet domain name; changing the domain or the place of management requires an amendment to the permit registry (Article 11(4) to (6) and (22)).
• Online permits linked to a land-based permit lapse with it, and if the land-based venue closes the online business may continue only for the current quarter, up to 60 days (Article 11(10) to (15)).
• Permits run for five years; derivative online permits run for the remaining term of the base permit (Article 11(18)).
• No permit is issued to an applicant with recognised tax debt, or whose managers, founders or beneficial owners have an unspent conviction for intentional economic or serious crimes (Article 11(23), (25) and (26)).

Online application file

An online applicant must give the Revenue Service the physical address in Georgia from which the games are managed and the location of the server infrastructure in Georgia, its player registration, identification and verification procedure, its personal data storage and security arrangements, transaction record-keeping, an authorisation certificate showing that essential products meet Ministry of Finance standards, and criminal record certificates for managers, founders and beneficial owners (Article 19(1³) for casino games, Article 20(1¹) for slots, Article 12(1²) for totalisator, which also requires prize fund security of at least GEL 10,000). Only games supplied by a permitted supplier may be used (Article 29(4)).

3. AML, KYC and customer due diligence

Lottery organisers and organisers of games of chance and prize games are obliged ("accountable") persons under Article 3(1)(b.b) of the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism (No. 5226-Iს, 30 October 2019), and the Ministry of Finance is their supervisory body (Article 4(e)). The gambling law repeats the duty to comply with the AML law and report to the Financial Monitoring Service (Article 29(1)).

When CDD applies

Gambling operators apply CDD when receiving funds or paying out winnings or funds above GEL 5,000, including linked transactions, and for online gambling when the business relationship is established, which the law defines as registering the customer as a player (Article 11(3)). Any suspicion triggers CDD regardless of amount (Article 11(4)).

What CDD covers

Identify and verify the customer from a reliable, independent source; identify the beneficial owner (25% ownership or control, Article 13); establish the purpose of the relationship; monitor it (Article 10). Operators must link CDD data to each player's transactions (Article 12(7)).

Enhanced measures

Enhanced due diligence, including source of funds and senior management approval, applies to high-risk customers (Article 18), customers linked to high-risk jurisdictions (Article 19) and politically exposed persons and their family and close associates (Article 21).

Reporting and records

Suspicious activity reports go to the Financial Monitoring Service on the day suspicion arises (Article 26(2)). Records are kept for five years from the end of the relationship or the transaction (Article 27).

Order No. 1 of the Head of the Financial Monitoring Service (5 June 2020, in force 20 October 2020) adds a threshold report: gambling and lottery organisers report receipts of funds and payouts of winnings or funds above GEL 50,000 within five working days (Articles 7(2) and 9(2)). Payment service providers separately report cash placed on an online player's account above GEL 10,000 (Article 6(2)(c)). Operators must screen customers against United Nations Security Council sanctions lists before the relationship begins and as soon as the lists change (Article 4).

4. Identity verification and onboarding

The Minister of Finance's Order No. 43 of 26 February 2021, the rule on registration, identification and verification of players by online permit holders, governs remote onboarding. Face-to-face identification follows the Financial Monitoring Service rule on customer identification (Order No. 2 of 2020).

Registration data

At registration the player must give at least name, date of birth, personal number (if any), identity or citizenship document number, issue date, issuing country and authority and expiry, an active phone number, username, email and password, and confirm that they are an adult and will not let others use the account. The operator completes registration only after the player enters a one-time code sent by SMS to that phone number (Order No. 43, Article 4).

Verification methods

For Georgian citizens the operator must check identity data in the electronic database of the Public Service Development Agency, from which it may receive name, date of birth, personal number, document details, photograph and registered address (Article 5(2)). The player must present a valid photo identity document, and the operator verifies by one of these methods (Article 5(4)):

• a photograph of the player holding the document, with document data and face clearly visible;
• a video call that allows the person to be identified;
• in-person contact;
• a technological solution using biometric data to match the selfie against the document photo or the Agency database photo;
• an SMS one-time code, which is not permitted for verification at registration.

The operator must confirm that the person matches the registration data and is not on a sanctions list, open only one account per person, and accept no stakes or money until identification and verification are complete (Articles 5(5) and 6). Operators may rely on a regulated third party under Article 16 of the AML law, but keep final responsibility (Order No. 43, Article 3). The AML law also lets obliged entities use the Agency's databases without the data subject's consent for identification and verification (Article 16(7)).

Age and exclusion checks

Georgian citizens under 25 and foreign nationals or stateless persons under 18 may not play, in venues or online, and operators must check age from an identity document (gambling law Articles 29(1) and 32(1)). Persons on the dependent-persons list or the prohibited-persons list must also be refused (Article 32(1¹)).

5. Digital channels: what's different

Bottom line: online play requires its own permit and full identity verification before any money moves, while a land-based venue checks an identity document at the door and applies AML due diligence only above GEL 5,000.

Verification before money moves

The Minister of Finance's Order No. 41 of 26 February 2021 on deposits to and withdrawals from online gaming accounts allows deposits and withdrawals only for players verified under Order No. 43, forbids taking or paying out money before verification ends, and bans transfers between players' gaming accounts that bypass a licensed financial institution (Article 4). Deposits and withdrawals may go only through licensed financial institutions and their products, permitted cash desks, payment terminals and electronic wallets (Article 3).

Annual re-verification

Order No. 52 of 22 February 2022 (in force 1 March 2022) requires each player to be re-verified within five working days after every continuous 12 months, by SMS one-time code, a check of the Public Service Development Agency database for Georgian citizens and residence permit holders, and a sanctions list check. A player who misses re-verification may not play or deposit (Order No. 43, Articles 3(6), 5(8) and 6(a) as amended).

International online gambling

Law No. 1822-Vმს-XIმპ of 25 June 2026 [In force], published on 3 July 2026, defines "international organisation" of online casino, slot and totalisator games as online gambling in which Georgian citizens may not take part. International permits are issued without any land-based permit, run for five years, cover one domain each, and require the website to display operator and permit details in Georgian and English together with the ban on Georgian citizens and on foreigners under 18 (gambling law Articles 3, 11 and 19(1⁴)). The law contains transitional provisions.

6. Data protection and biometrics

The Law of Georgia on Personal Data Protection (No. 3144-XIმს-Xმპ, 14 June 2023) applies to onboarding data. Biometric data processed to identify a person uniquely, including facial images, is a special category (Article 3(b) and (d)), which may be processed only on a ground in Article 6, such as processing expressly regulated by law. Order No. 43 expressly provides for biometric face matching against the document or state database photograph, and the AML law provides for state database checks. Before processing biometric data the controller must set out in writing the purpose, the data, the retention period, storage and destruction rules and safeguards for data subjects (Article 9(2)). Large-scale processing of special category data requires a data protection impact assessment (Article 31). Law No. 1289-IVმს-XIმპ of 17 December 2025 moved data protection supervision to the State Audit Office of Georgia.

7. Sector-specific obligations

Self-exclusion and prohibited persons

The Revenue Service keeps two lists, which may contain only Georgian citizens (gambling law Article 7¹). A person enters the dependent-persons list on their own application or by judicial order for five years; removal before then requires a court order and is possible only after three years. The prohibited-persons list covers employees of budget organisations (including civil servants and political officials), employees of national regulatory bodies and of the National Bank of Georgia, and members of families registered in the database of socially vulnerable families (Article 3(b³)).

Electronic control system and standards

The Revenue Service may oversee permit holders in real time through an electronic control system run by a selected operator (Article 7(3¹)), and operators must connect their equipment and give access to it (Article 29(1)). Games and essential products, including random number generators, jackpot platforms, player and financial databases, need authorisation certificates against Ministry of Finance standards (Article 3).

Conduct rules

Operators may not lend to players for betting (Article 29(2)), must block player-to-player transfers (Article 29(1)), and may not offer prizes in kind in games of chance (Article 11(27)). Online gambling may not be organised or played in internet cafés (Article 11(8)).

8. Risk indicators and red flags

Online gambling indicators drawn from Georgian rules

• Account sharing: one account used by several people, or one person seeking a second account.
• Structured payouts: deposits or withdrawals split to stay under the GEL 5,000 or GEL 50,000 thresholds.
• Minimal-play cash-out: funds deposited and withdrawn with little wagering.
• Peer transfers: attempts to move funds between players' gaming accounts.
• Cash deposits: large cash placements through desks or terminals onto online accounts.
• Identity changes: repeated changes of phone number or document data after verification.
• Excluded players: Georgian citizens attempting to use international (foreign-only) sites.
• High-risk links: players resident in, or paying through, high-risk jurisdictions.

9. Enforcement and penalties

Any breach of the gambling law or of rules issued under it counts as a breach of permit conditions (Article 29(5)), fined by the Revenue Service or the Ministry of Internal Affairs and payable within 30 days (Article 7(4) and (5)); liability also arises under Article 34 of the Law on Licences and Permits (Article 37(2)). Article 37¹ sets fixed fines per permit type. Law No. 1578-Vმს-XIმპ of 27 May 2026 [In force] raised them: as presented to Parliament, fines for casino permit holders and for online casino, slot and totalisator permit holders rise from GEL 7,000 to GEL 20,000, and for slot halls, gambling clubs and game suppliers to GEL 10,000.

Separate administrative fines apply under the Code of Administrative Offences as amended by Law No. 2592-XIმს-Xმპ of 9 February 2023, in force from 1 June 2024:

Permits can also be revoked by the Revenue Service (Article 7(1)). Under the AML law the Financial Monitoring Service may order a transaction suspended for up to 72 hours (Article 36).

10. Recent changes and what to watch

• 3 July 2026: Law No. 1822 on international online gambling published [In force]. Foreign-only online casino, slots and betting can be licensed in Georgia; watch for Revenue Service implementing rules and fee changes.
• June 2026: Law No. 1578 raising fines for permit breaches [In force]. Higher exposure per breach for online operators.
• November 2025: AML law amended (Law No. 1119) to strengthen UN sanctions freezing and add administrative liability [In force]. Sanctions screening controls should be reviewed.
• 1 June 2024: administrative fines for admitting under-age or listed players, including online [In force].

11. What this means for identity verification

Onboarding must finish before the first deposit, so verification speed matters commercially. Flows need to capture a photo identity document and the citizenship field, run an SMS one-time code, and use one of the permitted methods: selfie with document, video call or biometric face match. For Georgian citizens, a lookup against the Public Service Development Agency database is mandatory and supplies the reference photograph for face matching.

Eligibility depends on citizenship as well as age: 25 for Georgian citizens and 18 for foreigners on domestic sites, and a full block on Georgian citizens on international sites. List checks against the Revenue Service registers and United Nations sanctions lists run at registration and at each annual re-verification, which needs automated scheduling. Detect duplicate accounts, keep identity evidence and transaction links for five years, and document biometric processing safeguards in advance.