Travel & Hospitality Compliance in Georgia
How the Law on Tourism, new operator registration, mandatory tourist insurance, UN sanctions duties and e-visas shape identity checks for travel businesses in Georgia.
Key takeaways
- Travel agencies, tour operators and hotels in Georgia are not covered by the anti-money laundering (AML) law, so they have no formal know-your-customer rule. Currency exchange is the exception: it needs registration with the National Bank of Georgia and full customer checks.
- Every business, including a booking site or hotel, must not make money or other assets available to people on United Nations (UN) sanctions lists, and must tell the Financial Monitoring Service when it applies that freeze.
- Since 1 January 2026, foreign tourists must hold health and accident insurance worth at least GEL 30,000 for their whole stay. Border police may check the policy, which can be paper or electronic, in Georgian or English.
- Since 1 June 2026, tour operators, travel agencies and tour guides must register in the Georgian National Tourism Administration database; fines for trading unregistered apply from 1 January 2027.
- Online sellers face specific rules: from 1 June 2027 a website counts as a point of sale, and linked click-through bookings can turn separate purchases into a regulated travel package. Visas for many visitors are issued entirely online through the e-Visa portal.
Georgia is open to online travel and hospitality businesses without a sector licence. Most identity duties sit with the state and with carriers: the Ministry of Foreign Affairs issues visas, the Ministry of Internal Affairs controls the border, and airlines transmit passenger data to a state agency.
The principal regulator of travel sellers is the Georgian National Tourism Administration, which supervises the Law on Tourism. The single biggest change for new entrants is the 2023 Law on Tourism, which phases in registration, consumer contract rules and insolvency protection between 2026 and 2030.
1. Who regulates this sector
Georgia is a unitary state, so licensing and supervision are national.
| Authority | Remit in travel | Level | Official site |
|---|---|---|---|
| Georgian National Tourism Administration (GNTA) | Supervises the Law on Tourism; registers tour operators, agencies and guides | National | gnta.ge |
| Ministry of Foreign Affairs of Georgia | Visas, including e-visas and the Geoconsul portal | National | mfa.gov.ge |
| Ministry of Internal Affairs of Georgia | Border inspection; Patrol Police check tourist insurance; certificate of lawful stay | National | police.ge |
| Operational-Technical Agency of the State Security Service | Receives airline passenger data (API and PNR) | National | ota.gov.ge |
| National Bank of Georgia (NBG) | Registers and supervises currency exchange offices | National | nbg.gov.ge |
| Financial Monitoring Service of Georgia (FMS) | Receives notifications on UN sanctions freezes | National | fms.gov.ge |
| Revenue Service | Customs; identifies travellers moving more than GEL 30,000 in cash | National | rs.ge |
| State Audit Office of Georgia | Personal data protection supervisor since 2 March 2026 | National | pdp.sao.ge |
2. Licensing and authorisation
No licence is needed to sell travel or run accommodation in Georgia. The Law of Georgia on Tourism (No. 3969-XIIIმს-Xმპ, 15 December 2023) instead uses registration and, later, financial security:
GNTA database registration
Under Article 11¹, added by Law No. 1630 of 28 May 2026, tour guides, tour operators and travel agencies must register in the GNTA database of tourism businesses and report any start, end or change of activity in writing. In force since 1 June 2026. The National Agency of Public Registry also passes registry data on tourism businesses to GNTA electronically (Article 11(4)).
Risk-bearing activities
Adventure and other risk-bearing tourist services may be provided only by authorised persons, with certified staff and mandatory liability insurance where the Government so requires (Articles 33 and 34, in force since 1 June 2026). The Government sets the list of activities and the technical regulation.
Insolvency protection
Tour operators and providers of linked travel arrangements must hold insurance or a bank guarantee covering prepayments and repatriation, and lodge the certificate with GNTA (Articles 27 to 32). [Adopted, effective 1 Jun 2030]
A hotel or travel business that exchanges currency for guests becomes a currency exchange office, which must be registered with the NBG before it trades.
3. Identity framework (AML rules do not apply)
Article 3(1) of the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism (No. 5226-Iს, 30 October 2019) lists the obliged entities. Hotels, travel agencies, tour operators and booking platforms are not on the list, so customer due diligence, suspicious transaction reporting and the five-year record rules of that law do not apply to them.
Currency exchange is in scope
Currency exchange offices are financial institutions under Article 3(1)(a.d), supervised by the NBG (Article 4(c)). They must identify and verify customers for occasional transactions above GEL 15,000, or linked transactions above that amount, and whenever money laundering is suspected (Article 11(1) and (4)), report suspicious transactions to the FMS and keep records for five years (Articles 25 and 27).
Sanctions duties apply to everyone
Article 1(3) and Article 41(7) require every natural and legal person, not only obliged entities, to avoid making funds, other assets or economic resources available to persons on UN Security Council sanctions lists, and Article 41(8) requires them to notify the FMS when they apply the restriction. A first breach draws a warning and a repeat a GEL 1,000 fine (Article 43¹, added by Law No. 1119 of 26 November 2025).
What governs identity instead
Traveller identity is anchored in the Law of Georgia on the Legal Status of Aliens and Stateless Persons (No. 2045-IIს, 5 March 2014): entry requires a valid travel document, which includes a passport or an ID card recognised for travel (Articles 2(f) and 4), and a visa, residence permit or visa-free right (Articles 5 and 10). The Revenue Service identifies travellers carrying more than GEL 30,000 in cash across the border and reports them to the FMS (AML Law Articles 11(7) and 25(5)).
4. Identity verification and onboarding
Travel sellers have no prescribed verification method, but the documents they handle are fixed by law. Visitors exempt from visas may stay 90 days in any 180-day period (Aliens Law Article 10(2)); others need a visa, and short-term e-visas are applied for on the Ministry of Foreign Affairs webpage (Article 6(1²)). Refusal of entry can follow false identity or purpose data, or missing insurance or funds (Article 11(1)(d) and (h)).
Carriers carry the heaviest identity duties. Under Article 13 of the Aliens Law they must check that foreign passengers hold a valid visa and travel document, and they bear return costs when a passenger is refused for lacking them. Government Ordinance No. 384 of 27 July 2021 requires airlines to send advance passenger information (document number, issuing state, type, expiry, name, nationality, date of birth and sex) to the Operational-Technical Agency within 15 minutes of take-off, and passenger name records 24 hours before departure and again after take-off. The PNR includes payer details and the travel agency that sold the ticket.
Since 1 September 2026, Article 21³ of the Aliens Law allows a foreigner to be required to show a certificate of lawful stay, issued by the Ministry of Internal Affairs Service Agency, to receive public or private services other than medical care. Where the Government lists a service, the provider must refuse it without the certificate.
5. Digital channels: what's different
Bottom line: identity rules for travellers are channel-neutral, but online sellers face extra contract rules from June 2027 and visitors can obtain a visa without visiting a consulate.
| Requirement | In person / land-based | Online / remote | Difference |
|---|---|---|---|
| Short-term visa | Consular application, documents handed in | e-Visa, decision within 5 working days | Differs |
| Point of sale | Shop or office | Website or online platform counts as one point of sale | Same |
| Package formation | Combined by one trader | Also by linked bookings sharing name, payment and e-mail within 24 hours | Differs |
| Contract copy | Paper copy on request | Copy or confirmation on a durable medium | Differs |
| Proof of tourist insurance | Paper policy | Electronic policy accepted | Same |
| UN sanctions freeze | Applies | Applies | Same |
| Biometric processing | Necessity test | Necessity test | Same |
e-Visa replaces the consulate visit
The Ministry of Foreign Affairs issues electronic visas to foreigners abroad who apply through its webpage, with a decision no later than five working days after the application (Aliens Law Articles 6(1²) and 8(7)). A booking flow can therefore send the traveller to the e-Visa portal rather than a consulate.
Linked click-through bookings become packages
Under Article 2(h³.b.e) of the Law on Tourism, services bought from different traders through linked online booking processes form a package if the first trader passes the traveller's name, payment details and e-mail address to another trader and that contract is concluded within 24 hours. The selling trader must tell the traveller so (Article 14(4)). [Adopted, effective 1 Jun 2027]
Durable medium
On concluding a package contract the operator must provide a copy or confirmation on a durable medium; a paper copy can be demanded only where the parties met in person (Article 16(1)). The contract must be in Georgian and may also be in a language the traveller speaks (Article 16(7)).
6. Data protection and biometrics
Passport scans and booking data fall under the Law of Georgia on Personal Data Protection (No. 3144-XIმს-Xმპ, 14 June 2023). Since 2 March 2026 the State Audit Office is the supervisory authority, after Law No. 1289 of 17 December 2025 dissolved the Personal Data Protection Service.
Article 9(1), rewritten by Law No. 1259 with effect from 1 May 2026, allows private businesses to process biometric data only where necessary for their activity, security, property protection or preventing disclosure of secret information, and only if those aims cannot be achieved otherwise without disproportionate effort. Face-matching at check-in or in an app must meet that test; identifying border crossers is reserved to the authorities. Controllers must notify the State Audit Office of a data breach within 72 hours unless it is unlikely to cause significant harm (Article 29).
7. Sector-specific obligations
Mandatory tourist insurance
Article 12 of the Law on Tourism requires every tourist entering Georgia to hold health and accident insurance. Government Ordinance No. 602 of 26 December 2025, in force since 1 January 2026, sets the minimum sum insured at GEL 30,000 for the whole stay, accepts policies from Georgian or foreign insurers, and lets the Patrol Police check the policy at the border. The policy must state the parties, territory, insured period, risks and sum insured. Diplomatic and official passport holders, accredited mission staff, persons entering under international agreements and international road haulage drivers are exempt. A tourist is a visitor staying at least one night and under a year, not for employment.
Package travel contracts
From 1 June 2027, Articles 13 to 26 require pre-contract information on passport and visa requirements and the insurance rules, written contracts naming a local contact, and contact details for an unaccompanied minor whose package includes accommodation (Article 16(2)(f)). Travellers may withdraw from an off-premises package contract within 14 working days (Article 21(5)).
Guest registration
The Law on Tourism and the Aliens Law do not impose a guest-registration duty on accommodation providers. The relevant identity point for a hotel is the certificate of lawful stay, if the Government lists accommodation among the services that require it.
8. Risk indicators and red flags
Identity and compliance red flags in travel bookings
- Sanctions match: a guest, payer or beneficiary appears on a UN sanctions list.
- Insurance gaps: a policy below GEL 30,000, covering only part of the stay, or missing required fields.
- Document mismatch: booking name, passport data and payer details do not match.
- False purpose: inconsistent travel purpose or identity data, a ground for refusing entry.
- Overstay history: unpaid fines for unlawful stay, which bar new visas and entry.
- Large cash: payments in cash above GEL 30,000 brought across the border undeclared.
- Unregistered partners: tour operators or guides absent from the GNTA database.
9. Enforcement and penalties
| Breach | Penalty (repeat) | Basis and timing |
|---|---|---|
| Trading without GNTA registration | GEL 500 (GEL 1,000) | Law on Tourism Art. 49(4), from 1 Jan 2027 |
| Risk-bearing service without certificate | GEL 3,000 (GEL 6,000) | Art. 49(2), from 1 Jun 2027 |
| Breach of the technical regulation | Warning or GEL 1,500 (GEL 3,000) | Art. 49(3), from 1 Jun 2027 |
| No insolvency protection | GEL 1,500 (GEL 3,000) | Art. 49(6), from 1 Jun 2030 |
| Obstructing GNTA supervision | Warning or GEL 500 (GEL 1,000) | Art. 49(8) |
| UN sanctions freeze duty | Warning (GEL 1,000) | AML Law Art. 43¹ |
| Failure to notify a data breach | Warning or GEL 2,000; GEL 3,000 above GEL 500,000 turnover | Data Protection Law Art. 78 |
| Currency exchange rule breach | GEL 2,000 per office; GEL 3,000 for an administrator failing AML duties | NBG Order No. 17/04 as amended by No. 168/04 |
Fines under the Law on Tourism are fixed amounts per breach and are paid to the state budget; GNTA officials draw up the offence reports, a power suspended until 1 January 2027 (Article 51(11)). In a recent currency exchange case, the NBG wrote to a Tbilisi exchange office on 19 May 2026 for failing to file monthly reports and cancelled its registration on 7 July 2026.
10. Recent changes and what to watch
- 1 June 2030 [Adopted, effective 1 Jun 2030] Insolvency protection and its fines apply to tour operators and linked-arrangement providers.
- 1 June 2027 [Adopted, effective 1 Jun 2027] Package travel and timeshare contract rules start, including the linked online booking test.
- 1 January 2027 [Adopted, effective 1 Jan 2027] Fines for trading without GNTA registration apply; the Government must also submit a draft law on resort activities by this date.
- 8 September 2026 [In force] Government Ordinance No. 443 amended the visa procedures, with transitional provisions; check visa categories when advising travellers.
- 1 September 2026 [In force] Certificate of lawful stay for foreigners introduced; the Government lists the services for which it is mandatory.
- 1 June 2026 [In force] GNTA database registration for tour operators, agencies and guides; risk-bearing activity rules.
- 1 May 2026 [In force] Narrower legal basis for biometric processing.
- 1 January 2026 [In force] Mandatory GEL 30,000 tourist health and accident insurance.
11. What this means for identity verification
Booking flows should capture passport or travel ID data in the format airlines already send to the state: document number, issuing state, type, expiry, name, nationality, date of birth and sex. They should check the insurance policy for the GEL 30,000 minimum and full-stay dates, and screen guests and payers against UN sanctions lists before accepting payment. Currency exchange desks need full customer due diligence above GEL 15,000. Facial biometrics are optional for most travel businesses and must pass the Article 9 necessity test, so document capture with database or chip reading is the lower-risk default. From June 2027, booking engines that pass customer data to partner sites must track the 24-hour linked-booking window. Because the certificate of lawful stay may become a precondition for some services, onboarding should allow a certificate check to be added without redesign.
How Identomat helps
Identomat runs identity verification, screening and monitoring for regulated businesses on one platform, with workflows you configure for each market. For the requirements in this guide, that means:
- ID document capture and verification, including NFC chip reading of e-passports, to collect traveller data accurately at booking.
- AML screening of guests and payers against sanctions lists, including UN lists, before payment is accepted.
- Face match and biometric liveness as configurable steps, so they can be enabled only where the necessity test is met.
- KYC onboarding with full customer checks for currency exchange desks operating in hotels or travel outlets.
- No-code workflow builder to add new checks, such as a certificate of lawful stay, without redesigning the flow.
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
No formal KYC rule applies. Georgia's AML law does not list travel agencies, tour operators or hotels as obliged entities, so they have no customer due diligence or suspicious transaction reporting duties. They must still avoid providing funds or assets to UN-listed persons and notify the Financial Monitoring Service when they apply that freeze. A hotel that exchanges currency must register with the National Bank and follow AML rules for that activity.
Yes. Since 1 January 2026, every tourist entering Georgia must hold health and accident insurance with a sum insured of at least GEL 30,000 covering the whole stay. The policy can be issued by a Georgian or foreign insurer, presented on paper or electronically, in Georgian or English. Patrol Police may check it at the border. Diplomats and some other groups are exempt.
No licence is required, but since 1 June 2026 tour operators, travel agencies and tour guides must register in the Georgian National Tourism Administration database and report changes. Trading without registration is fined GEL 500, and GEL 1,000 for a repeat, from 1 January 2027. Insolvency protection becomes mandatory from 1 June 2030.
Get the PDF guide
Enter your details and the download button will switch on.