Insurance & Insurtech Compliance in Georgia
How State Insurance Supervision Service licensing, AML duties for all insurers, beneficiary checks at payout and supervisor-agreed remote onboarding shape KYC in Georgia.
Key takeaways
- To write insurance in Georgia you need a licence from the State Insurance Supervision Service, held by a Georgian joint-stock company (or a branch of an insurer from a member country of the Organisation for Economic Co-operation and Development); Georgian citizens may buy cover in Georgia only from a licensed insurer.
- Every licensed insurer and registered insurance broker is a reporting entity under the anti-money laundering (AML) law, not only life insurers, so customer identification, sanctions screening and suspicious transaction reporting apply to the whole book.
- Life and investment-type policies carry extra duties: identify the named beneficiary at the start, verify that person before any payout, and check whether the beneficiary is a politically exposed person.
- Selling online is allowed, but remote (non-face-to-face) customer checks must follow procedures set by and agreed with the insurance supervisor, product disclosures must reach the customer on a durable electronic medium, and customers can cancel distance contracts within 14 days.
- Selfie and liveness checks process biometric data, which Georgian data protection law treats as a special category: document the purpose, scope and retention in writing before you start.
The Georgian insurance market is open to online distribution, but it is closed to unlicensed cross-border writers: direct insurance requires a local licence or an eligible branch, and insurers may not sell foreign insurers' policies on their behalf except for motor liability cover valid only outside Georgia.
Two bodies set the rules a digital insurer meets first: the State Insurance Supervision Service of Georgia, which licenses insurers, registers brokers and supervises AML compliance in the sector, and the Financial Monitoring Service of Georgia, the financial intelligence unit that receives reports and writes the identification rule. The State Audit Office of Georgia now supervises personal data protection.
The biggest practical obstacle for a new entrant is remote onboarding: the AML law permits it, but only through operational and technical procedures that the supervisor sets and agrees, so the onboarding design must be settled with the State Insurance Supervision Service before launch.
1. Who regulates this sector
| Authority | Remit for insurers | Level | Official site |
|---|---|---|---|
| State Insurance Supervision Service of Georgia | Licensing, broker registration, prudential and conduct rules, AML supervision of insurers, brokers and pension companies, sanctions | National | insurance.gov.ge |
| Financial Monitoring Service of Georgia | Financial intelligence unit: suspicious transaction reports, identification and reporting rules, transaction suspension orders | National | fms.gov.ge |
| State Audit Office of Georgia | Personal data protection supervision, including biometric processing and breach notification | National | pdp.sao.ge |
| National Bank of Georgia | Approves the list of high-risk jurisdictions used for enhanced due diligence | National | nbg.gov.ge |
UN targeted financial sanctions are implemented by a government commission on UN Security Council resolutions, whose listings and freezing decisions insurers must apply (AML law Articles 40-41).
2. Licensing and authorisation
The Law of Georgia on Insurance (No. 690, 1997, consolidated to 28 May 2026) [In force] reserves insurance activity to legal persons licensed by the State Insurance Supervision Service or to an eligible branch (Article 22(13)). Licences are issued in three classes, life, non-life and reinsurance, only to joint-stock companies, for an indefinite term and without transfer (Article 22(2)-(3), (10)-(11)). Only a life licence holder may issue a life annuity.
A foreign insurer may act as a direct insurer in Georgia only through a branch, and only if it is registered and licensed in a member state of the Organisation for Economic Co-operation and Development; such a branch operates on its parent's licence (Articles 2(c.b), 7(4), 22(8)-(9)). Georgian legal persons insuring activity or property in Georgia, and Georgian citizens buying cover in Georgia, may contract only with an insurer licensed by the Service (Article 8(3)).
Applicants must identify direct and beneficial holders of a significant share (10 percent or more) and all administrators, explain the source of capital, file a three-year business plan and prove the minimum capital set by the Service is paid up in a Georgian bank (Article 22(5)). Owners and administrators face fit-and-proper tests that exclude persons convicted of money laundering or economic crime (Article 22¹). Insurers pay a supervisory fee of 1 percent of annual gross premium (Article 19¹).
Insurance agents need no licence, but insurance brokers must be registered by the Service before they start, hold minimum capital or a guarantee fund and professional liability cover, and keep client money in a segregated Georgian bank account (Articles 12, 16¹, 22(12)).
3. AML, KYC and customer due diligence
The Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism (No. 5226-Iს, 2019, consolidated to 1 April 2026) [In force] lists insurance organisations, insurance brokers and pension companies as reporting entities (Article 3(1)(a.b), (a.g), (a.i)) and names the State Insurance Supervision Service as their supervisor (Article 4(f)). The list is not limited to life business, so non-life insurers carry the core duties too.
When due diligence applies
On starting a business relationship, on occasional transactions above GEL 15,000 (linked transactions combined) or transfers above GEL 3,000, and on any doubt or suspicion regardless of amount (Article 11).
What it covers
Verify the customer from a reliable, independent source, identify and verify the beneficial owner, establish purpose and monitor (Article 10(1)). If this fails, the relationship is prohibited (Article 10(6)).
Beneficial ownership
A natural person holding 25 percent or more of shares or votes, or otherwise exercising ultimate control (Article 13).
Enhanced measures
Higher-risk customers, politically exposed persons and links to high-risk jurisdictions require management approval, source of funds checks and enhanced monitoring (Articles 18, 19, 21).
Life and investment-type policies
For investment-type life cover, including accumulating and refundable products (Article 2(1)(ჩ)), the insurer or broker must identify a named beneficiary, or gather enough information on an undetermined class of beneficiaries to identify them at payout; verify the beneficiary before paying; identify any third party to whom policy rights are assigned; and apply enhanced measures before payout, including identifying the beneficiary's beneficial owner, when risk is higher (Article 14). Insurers must also take reasonable steps to establish whether the beneficiary or its beneficial owner is a politically exposed person, informing management before payout where risk is higher (Article 21(6)).
Reporting and records
Suspicious transactions, including attempted ones, must be reported to the Financial Monitoring Service on the day suspicion arises, and information requested by the Service is due within two working days (Articles 25, 26). The Financial Monitoring Service Order No. 1 of 5 June 2020 [In force] sets threshold reports for banks and payment providers but none for insurers, whose core duty is the suspicious transaction report. Records must be kept for five years after the relationship ends, extendable by up to five years on request (Article 27).
4. Identity verification and onboarding
The Financial Monitoring Service Order No. 2 of 5 June 2020 (identification and verification rule, amended 29 October 2025) [In force] sets the data to collect for a natural person: full name, date of birth, personal number, identity document number with issue date, issuing country and authority and expiry, sex, citizenship, place of birth, registered address and actual residence (Article 4(1), as amended in 2021).
Non-life business has insurance-specific relief, added by FMS Order No. 5 of 16 October 2020. Where a customer's total premiums in a calendar year do not exceed GEL 1,000, name plus date of birth or personal number is enough (Article 4(3)(c)); up to GEL 3,000 for an individual, or GEL 5,000 for a legal person, verification is optional (Articles 5(3¹)(c), 7(6¹)(b)). None of this applies to life insurance.
Accepted documents must carry a photograph and be valid: for Georgian citizens a passport, identity card or driving licence; for foreign nationals a residence card, passport or another document accepted for crossing the Georgian border (Article 5). Copies must be certified by a notary or an authorised employee, which may be done electronically; data received from the Public Service Development Agency through the state data exchange need no certification (Article 17). Verification may finish up to 30 calendar days after onboarding for low-risk customers if needed to avoid interrupting service (Article 11(2)).
Insurers may query Public Service Development Agency databases without consent (AML law Article 16(7)) and may rely on a regulated third party or an agent under contract while keeping ultimate responsibility (Article 16).
The supervisor's Order No. 55 of 30 May 2022 [In force] requires UN list screening of beneficial owners before onboarding and mirrors the GEL 3,000 and 5,000 thresholds for beneficial owner verification (Articles 1(5), 9(2)).
5. Digital channels: what's different
Bottom line: the identification duties are the same online and in person, but remote customer due diligence is lawful only through procedures that the State Insurance Supervision Service sets and agrees, and online sales carry their own disclosure and evidence rules.
| Requirement | In person / agent-led | Online / remote | Difference |
|---|---|---|---|
| Customer due diligence duties | Article 10 measures | Same Article 10 measures | Same |
| Permission to verify without meeting | Not applicable | Only under supervisor-set, agreed procedures | Differs |
| Rule governing the method | FMS Order No. 2 | Supervisor's electronic identification rule | Differs |
| State database check (PSDA) | Permitted without consent | Permitted without consent | Same |
| Pre-sale information sheet | On paper | On a durable medium; chatbots may convey content without the sheet | Differs |
| Contract documents | Handed over at signing | Durable medium; if the channel cannot carry them, immediately after conclusion | Differs |
| Right to cancel without reason | 30 days for life; none for other non-distance contracts | 14 days for distance contracts (30 for life) | Differs |
| Burden of proof of informed consent | Insurer | Insurer | Same |
| Beneficiary verification (life) | Before payout | Before payout | Same |
Remote due diligence needs the supervisor's procedure
The AML law allows a reporting entity to carry out identification, beneficial ownership and purpose checks electronically without direct contact, but only in the manner established by the supervisor and through operational and technical procedures agreed with it that manage money laundering risk (Article 12(4)); the supervisor's legal act defines electronic identification and verification (Article 12(6)). FMS Order No. 2 expressly excludes electronic identification from its scope and leaves it to the supervisor (Article 1(4)-(5)). The National Bank's rule (Order No. 104/04) does not cover insurers.
Distance selling disclosures
The supervisor's consumer protection instruction for insurers (Order No. 18 of 2017, restated by Order No. 37 of 25 September 2019) [In force] applies to every channel, including distance communication. Online, the pre-sale information sheet must be sent on a durable medium; where an offer is made by artificial intelligence such as a chatbot, the insurer must still give all the required information, though not in sheet form; telephone sellers must identify the insurer and the purpose of the call first (Article 3). Travel insurance is exempt from these disclosure articles (Article 1(10)). Contract documents go to the customer in tangible form or on a durable medium, and the insurer bears the burden of proving that the customer was fully informed and consented (Article 4).
Cancellation right and servicing notices
Since Order No. 56 of 21 October 2022 [In force], a customer may cancel a contract concluded at a distance within 14 days, or a life contract within 30 days, without reason or penalty; exceptions cover premiums up to GEL 30, cover shorter than the cancellation period, ancillary cover and market-linked pricing (Article 4¹). Since 1 February 2025 (Order No. 72), insurers must send premium reminders 1 to 5 days before each due date and debt notices within 3 working days, by an agreed durable channel (Article 5(7)-(12)).
6. Data protection and biometrics
The Law of Georgia on Personal Data Protection (No. 3144-XIმს-Xმპ, 2023, consolidated to 10 June 2026) [In force] is the general regime. For insurers it bites in four places. Biometric data, defined to include facial images used to identify or confirm identity, is a special category when processed for unique identification (Article 3(b), (d)); its processing needs a ground in Article 6, such as written consent or a specific legal basis.
Article 9(1), rewritten by Law No. 1259 of 17 December 2025 with effect from 1 May 2026, permits biometric processing only where necessary for carrying out activities, security, protection of property or of secret information and those purposes cannot be met by other means without disproportionate effort, or where a law provides for it. Before processing, the controller must set out in writing the purpose and scope of the biometric data, the retention period, storage and destruction rules and the safeguards for data subjects (Article 9(2)).
Insurance organisations must appoint a personal data protection officer (Article 33). Fully automated decisions with significant effects, such as an automated onboarding refusal, require a data protection impact assessment and human involvement on request (Articles 19, 31). Incidents go to the State Audit Office within 72 hours (Article 29).
7. Sector-specific obligations
Agents and brokers
An insurer may distribute directly or through agents and brokers, but only through brokers registered with the Service (Insurance Law Article 12(2)). Brokers are reporting entities in their own right. Agents acting for the insurer are not treated as third parties for reliance: the insurer remains ultimately responsible for their customer due diligence under the written agency contract (AML law Article 16(5)), and must assess the agent's reputation and controls and monitor its work (FMS Order No. 2, Article 13). Insurers may not conclude contracts on behalf of a foreign insurer, except motor liability cover that applies only outside Georgia (Insurance Law Article 12(11)).
Reinsurance due diligence
Before accepting risk from a foreign insurer, a reinsurer or broker must assess its reputation, supervision and AML controls, obtain management approval and define each party's obligations (AML law Article 23).
Sanctions screening at issuance and payout
Customers, representatives, beneficial owners and administrators must be screened against the UN Security Council list before onboarding and promptly after each list change; counterparties and life insurance beneficiaries must be screened before the transaction or payment (FMS Order No. 1, Article 4). Dealing with a listed person is prohibited and must be reported (AML law Article 10(7)).
8. Risk indicators and red flags
Indicators the Georgian rules single out for insurers
- Assignment of a life policy: rights transferred in whole or part to a third party, who must be identified promptly (AML law Article 14(2)).
- Unidentified or unusual beneficiary: a beneficiary class that cannot be resolved before payout, or a beneficiary who is a politically exposed person (Articles 14, 21(6)).
- Unusual transactions: complex or unusually large transactions, or unusual patterns, with no apparent economic or lawful purpose (Article 20).
- Structuring: split premiums or policies that keep a customer under the GEL 1,000 and 3,000 identification thresholds (Article 2(1)(თ)).
- High-risk jurisdictions: customers resident in, or paying through institutions located in, jurisdictions on the National Bank list (Article 19).
- Opaque ownership: multi-layered structures without reasonable rationale, nominee shareholders or nominee directors (Order No. 55, Article 3(4), (6)).
9. Enforcement and penalties
Under Article 21¹ of the Insurance Law, the Service may sanction an insurer or its administrators for breaching the Insurance Law, its own instructions, the AML law and its implementing acts, or consumer protection law. Sanctions escalate from a written warning to fines, suspension of administrators, restrictions on dividends and new business, compulsory administration and licence cancellation; serious breaches can skip steps. Brokers face a parallel ladder ending in deregistration.
AML fines for insurers are set per breach by the supervisor's fine rule (Order No. 63 of 31 January 2024, amending Order No. 02 of 2015) [In force]. Selected amounts:
| Breach | Fine (GEL) | Basis |
|---|---|---|
| Onboarding without beneficial owner checks or the required identification procedure | 1,000 | Per customer |
| Inadequate measures on a life (investment-type) beneficiary | 2,000 | Per person |
| Politically exposed person obligations breached | 2,000 | Per person |
| Inadequate enhanced due diligence on a higher-risk customer | 5,000 | Per customer |
| Suspicious or unusual transaction measures not applied | 3,000 | Per breach |
| Ignoring a Financial Monitoring Service suspension order | 5,000 | Per breach |
| Transaction with a UN-sanctioned person | 7,000 | Per breach |
| Failure to execute a Government Commission freezing decision | 10,000 | Per breach |
| No customer risk level assigned at the start of an on-site inspection | 1,000 | Per customer |
| No compliance control system or required electronic record system | 5,000 | Per finding |
Per-customer amounts multiply quickly when a digital onboarding flow is defective.
10. Recent changes and what to watch
- 28 May 2026, Insurance Law Article 5(4) [In force]: Law No. 1631 provides that the object, types and procedure of compulsory insurance are defined by the relevant legislation rather than only by a law; watch for new mandatory lines and their distribution rules.
- 1 May 2026, biometric data rule [In force]: rewritten Article 9(1) of the data protection law governs selfie, liveness and face-match processing.
- 1 April 2026, AML law amendment [In force]: latest consolidation of the AML law; it adds factoring firms to the reporting-entity list from 1 January 2027 and leaves insurers' obligations unchanged.
- Law No. 1289 of 17 December 2025, data protection supervisor [In force]: supervision of personal data protection moved to the State Audit Office; breach notifications and consultations now go there.
- 28 November 2025, UN sanctions chapter [In force]: freezing obligations for all persons and administrative liability for non-compliance added to the AML law.
- 29 October and 17 November 2025, Financial Monitoring Service rules [In force]: identification and reporting rules updated; records must now be producible immediately.
11. What this means for identity verification
Capture the full Georgian data set and verify it from a valid photo document or Public Service Development Agency data, which returns a photograph for face comparison; non-residents need a document valid for crossing the Georgian border. Agree the remote procedure with the State Insurance Supervision Service before launch. The National Bank's electronic onboarding rule does not bind insurers, but its elements (liveness, real-time document capture, attempt limits) indicate what a Georgian financial supervisor expects.
Treat face images and liveness results as special-category data with a written purpose, scope and retention record, offer human review of automated refusals, and keep onboarding evidence for five years after the relationship ends. For life products, add a second verification event at payout covering the beneficiary, any assignee, politically exposed person status and UN list screening.
How Identomat helps
Identomat runs identity verification, screening and monitoring for regulated businesses on one platform, with workflows you configure for each market. For the requirements in this guide, that means:
- Remote KYC onboarding with ID document capture and verification, face match and biometric liveness, configurable to the procedure agreed with the insurance supervisor.
- Screening of customers, beneficial owners and life insurance beneficiaries against sanctions and PEP lists at onboarding and before payout.
- KYB and beneficial owner verification for corporate policyholders, with KYC questionnaires for source of funds in enhanced due diligence.
- No-code workflow builder with an audit trail of every check, and cloud, on-premises or hybrid deployment to fit outsourcing and data protection rules.
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
Yes. Georgia's AML law lists insurance organisations and insurance brokers as reporting entities without limiting the list to life business, and the State Insurance Supervision Service supervises them. Non-life insurers must identify customers, screen against UN sanctions and report suspicious transactions. Some duties are lighter: beneficial owner verification may be skipped where annual non-life premiums stay within GEL 3,000 for individuals or GEL 5,000 for companies.
Yes, but remote customer due diligence is lawful only through procedures that the State Insurance Supervision Service establishes and agrees with the insurer, under Article 12(4) of the AML law. The identification data and verification standard are the same as in person. Insurers may verify against Public Service Development Agency databases without consent, must deliver disclosures on a durable medium, and must offer a 14-day cancellation right on distance contracts.
Before paying out. For investment-type life policies the insurer identifies a named beneficiary when the policy is written, or gathers enough information on a class of beneficiaries, then verifies the beneficiary before payment. It must also check whether the beneficiary or its beneficial owner is a politically exposed person and apply enhanced measures, including management notification, where the risk is higher.
Get the PDF guide
Enter your details and the download button will switch on.