Georgia VASP Registration FAQ

‘Crypto licence’ is common search and market language. The formal Georgian process is registration as a Virtual Asset Service Provider with the National Bank of Georgia, followed by ongoing supervision.

Covered activities can include exchange, transfer, safekeeping or administration, individual portfolio management, trading-platform administration, permitted lending, and initial offerings or related services. Classification follows the real customer, instruction, control and asset flows—not the marketing label.

Not merely for buying, holding or disposing of assets for your own account. Registration turns on providing a covered service for another person. Third-party instructions, fees, custody, execution, arrangements or pooled assets can change the conclusion.

No. Free Industrial Zone status, a company registration or a local commercial authorisation does not replace NBG registration when the Georgian business provides a covered virtual-asset service.

Virtual-asset lending to natural persons is prohibited. A business lending or yield model still requires specific analysis of borrower status, funding, custody, collateral, liquidation, contracts and other possible regulatory overlaps.

Possibly, but the conclusion is functional. The review examines customer contracting, key generation, signing, recovery, upgrade powers, smart-contract administration, order or transfer decisions and any other ability to control assets or provide the service.

The live register verifies the legal entity and its registration status at a point in time. Product, custody, contractual, operational and financial diligence remains relevant for customers and counterparties considering a relationship with that provider.

The applicant should be a Georgian limited liability company or joint-stock company. A foreign group may establish a Georgian subsidiary, but the complete ownership and UBO chain, funding and group relationships must be evidenced.

The head office is an operating and supervisory access point where responsible people, required records and the functioning electronic system must be available. A mailing address alone does not demonstrate substance or operating readiness.

The prescribed dossier must satisfy Georgian-language requirements. Foreign public and corporate records may also need recent issuance, apostille or legalisation and certified Georgian translation, depending on the document and issuing country.

At least one person authorised to represent the VASP must be present in Georgia for at least 14 calendar days in each month. The wider office, management, staffing, system-access and absence-cover arrangements must also fit the actual model.

Where the sole shareholder is also a director, the registration rule requires at least two directors. Each appointment should have real competence, authority, time, access and a defined operating role—not be a name-only solution.

Often, depending on the record and issuing country. Ownership, company, criminal-record, education and other evidence also have content and recency requirements. We build a jurisdiction-specific document matrix before ordering documents.

The applicant should be able to trace onboarding, screening, wallet or order activity, monitoring, alerts, decisions, reporting, reconciliation and record retrieval through a functioning system. Staff explanations, policy statements and configured behaviour should agree.

Critical and connected systems require annual penetration testing. Other systems require risk-based testing at least every three years, with additional testing after material changes to critical infrastructure. Vulnerability scanning is required at least twice annually, alongside BCP/DRP, incident records and independent assurance.

The legal NBG decision period is 60 calendar days after a complete required filing. Assessment, ownership evidence, translations, staffing, contracting, system configuration, testing and responses make the total project longer and model-specific.

The official VASP registration fee is GEL 5,000. It does not include professional work, translations, personnel, office, technology, providers, security testing, assurance, accounting, tax or continuing operating costs.

The minimum is GEL 150,000 for exchange and/or transfer services, GEL 350,000 for a trading platform and GEL 250,000 for other ordinary VASP services. The highest applicable threshold governs a multi-service model, and at least 75% of the minimum must consist of primary capital. Stablecoin initial offerings follow a separate regime.

The National Bank of Georgia reviews and decides the VASP application. Banks, payment providers, custodians and liquidity venues conduct their own diligence and commercial review; we prepare and coordinate the relevant evidence and responses under the agreed scope.

No. The regulatory sandbox is a controlled innovation-testing route, not a temporary VASP licence or permission for unrestricted commercial operation. The NBG decides eligibility and conditions, and a formal registration path may still be required.

After a preliminary model review, we issue a written scope and capped-fee quotation for the agreed professional services, assumptions and deliverables. The GEL 5,000 official fee, applicable supervisory capital and third-party implementation costs are shown separately.

We normally need the intended services, customer and owner countries, ownership structure, asset and fiat flows, custody or control model, target launch, existing company, people, providers and system status. Sensitive source documents follow only after preliminary checks and an agreed channel.

Registration begins continuing supervision. The VASP must maintain its capital, people, head office, systems, operational-risk and cybersecurity framework, records, AML controls, reporting, provider oversight and change process, with evidence that management can review and the NBG can inspect.

Under Georgia's 2026 framework, a registered VASP requires prior written NBG consent and must address 100% reserve backing, segregation, redemption, holder information, capital, resilience and monthly NBG reporting. The first monthly return is due by 15 October 2026; subsequent returns are due by the 10th day of each month.

Georgia has adopted a Travel Rule framework with a VASP implementation deadline of 31 December 2027. New transfer products should design originator and beneficiary data, counterparty, self-hosted-wallet, missing-data, security and privacy controls now.

No universal tax-free claim is responsible. Guidance on an individual's crypto disposal and VAT does not determine a VASP company's service income, distributed profits, payroll, source, transfer pricing, mining or cross-border tax treatment.

Yes. Cash-facing branches and kiosks change customer identification, linked-transaction detection, cash security, surveillance and retention, staffing, reconciliation, records and system-availability controls. The required electronic system must support the service whenever it operates.

Before implementation. Changes to owners, administrators, services, countries, customer types, branches, websites or applications, custody, providers, systems or material AML risk should enter a controlled approval, notification, testing and evidence process.