A Georgian VASP registration is an operating status under continuing National Bank supervision. The company should be able to reproduce the customer, transaction and management evidence behind its controls on an ordinary day—not assemble it only after an information request or inspection begins.
The supervisor’s toolkit
The framework allows the NBG to register and cancel registration, assess administrators, regulate and inspect AML/CFT compliance, require information, issue written instructions, impose additional requirements or restrictions and apply sanctions within its legal powers. The practical consequence is that every material statement in the application should have an owner, operating control and retrievable record.
What continuing supervision can test
- Whether owners, UBOs and administrators remain transparent and suitable.
- Whether the actual products, channels and countries match the approved or notified model.
- Whether the head office, management presence, staffing and system access are maintained.
- Whether customer due diligence, sanctions and KYT controls operate as described.
- Whether unusual activity is identified, investigated, escalated and reported.
- Whether records, reporting, incidents, training, audit and remediation are controlled.
Material change is a governance process
A new owner, administrator, branch, website, app, provider, custody arrangement, corridor, product or system can change the risk and regulatory position. Product governance should therefore include legal, AML, technology, finance and operations before implementation. The output should record whether NBG approval, notification, updated documents or testing is required.
Enforcement lessons should change the control environment
Public sanctions and supervisory communications are useful because they show the cost of controls that exist on paper but fail in operation. A board should translate a relevant case into a short impact assessment: what happened, whether the same weakness exists, who owns remediation, how it will be tested and what evidence closes the issue. CryptoLicense.ge uses only attributable official cases and never presents unrelated sanctioned firms as clients.
Cancellation risk is not managed by a compliance calendar alone
False or misleading filing information, obstruction of supervision, serious or repeated breaches, failure to maintain the required operating conditions, prolonged inactivity or failure to correct weaknesses can threaten the value of registration. Management information should therefore show both deadlines and control effectiveness: high-risk customers, monitoring backlog, overrides, incidents, reconciliations, staffing gaps, provider failures and open remediation.
Build inspection readiness into ordinary work
- Maintain a current obligations and regulatory-change register.
- Run file and alert quality assurance using risk-based samples.
- Test system access, record retrieval and end-to-end demonstrations.
- Rehearse interviews with the responsible administrators and control owners.
- Track findings to evidence-based closure and board sign-off.
- Keep a controlled record of material-change decisions and NBG communications.
Managed support can coordinate these disciplines, but the registered VASP and its administrators remain accountable for the business.
Official materials used for this guide
These links support the editorial baseline; the explanation above is written for founders and operators. Current consolidated legislation and later official instruments take priority.