Registration places the Georgian VASP inside a continuing supervisory relationship. The National Bank can test whether the people, premises, systems, customer files, transactions, reports and management decisions still match the registered operating model, and it can require correction or apply measures when they do not.
What continuing supervision is designed to establish
The NBG’s task is not limited to confirming that policies remain on file. Supervision can examine whether owners and administrators remain suitable, whether the real products and countries match the registered model, whether the head office and responsible people remain available, and whether AML/CFT controls identify and manage risk in live activity.
For management, the practical standard is reproducibility. A responsible person should be able to retrieve a customer file, reconstruct a transaction, explain a wallet-risk decision, show the alert and investigation history, evidence any report, produce management information and demonstrate how a weakness was corrected.
Information requests, access and inspection
The supervisory framework permits the NBG to request information and records, inspect and access the relevant electronic system, and issue written instructions or additional requirements. An efficient response starts with a current evidence index, named owners and controlled facts. Last-minute document creation increases the risk of contradictions or incomplete records.
AML/CFT supervision follows the risk
The NBG’s 2024 VASP risk update describes a risk-based focus on organisational risk assessments, AML/CFT procedures, transaction-monitoring technology, customer-risk assignment and reassessment, unusual-transaction detection and management of virtual-asset typologies. Cash and kiosk activity, anonymity-enhancing tools, mixers, high-risk wallets and cross-chain movement should be addressed where relevant to the model.
The sanctions framework has evolved
NBG Governor Order No. 133/04 establishes the rules for determining, imposing and enforcing monetary fines on VASPs and administrators. Order No. 204/04 of 24 August 2026 introduced more granular penalties for departures from the agreed service scheme, inspection failures, unfulfilled written instructions, stablecoin reporting and other supervisory breaches.
The framework also permits non-monetary measures. Depending on seriousness, repetition and risk, the NBG may restrict operations, suspend or remove administrators, prohibit distributions or bonuses, require a controlling shareholder to relinquish control, or cancel registration. Repeated breaches may double the applicable monetary fine.
When a Georgian VASP can face a GEL 20,000 fine
Order No. 133/04 classifies several failures as especially serious. A GEL 20,000 penalty can apply to a single specified control failure; it should not be read as the maximum exposure of an inspection.
Other penalties can apply per client, per transaction, per report, per requested document or per separate breach. The May 2025 amendment also allows the NBG, depending on the seriousness of AML/CFT breaches, to use supervisory sanctions such as restrictions on operations, administrator measures or deregistration instead of or after monetary fines.
| 2026 enforcement example | Fine |
|---|---|
| Operating contrary to the service scheme agreed with the NBG | GEL 20,000 |
| Each inspection document or item not supplied by the deadline | GEL 7,000 |
| Obstructing an inspection | GEL 10,000 |
| Each unfulfilled NBG written instruction | GEL 5,000 |
| Each missing, late, inaccurate or incomplete stablecoin monthly report | GEL 1,000 |
Stablecoin-specific violations can reach GEL 50,000 per occurrence. The applicable provision, facts and repetition history should be confirmed before quantifying exposure.
The NBG published an enforcement case in which SHER888 LLC was fined GEL 465,000 across multiple findings. One component alone was GEL 264,000 for 528 record-retention violations at GEL 500 each. View the NBG enforcement notice.
Registration cancellation is an operating risk
False or misleading information, obstruction, serious or repeated breaches, failure to maintain operating conditions, inability to demonstrate the system, prolonged inactivity or failure to remediate can undermine registration. The board should therefore treat regulatory status as an asset supported by controls, people, financial resources and timely decisions.
Material change must be assessed before release
Ownership, administrators, branches, kiosks, websites, applications, providers, custody, countries, products, systems and significant AML risks can alter the registered model. A change record should identify the legal requirement, risk impact, NBG approval or notification position, documents and configurations affected, testing and launch conditions.
The registration act must be visible through service channels
From 1 January 2026, registered VASPs must display or make the individual NBG registration act easily available through the spaces and channels where services are provided, including the head office, branches, self-service kiosks, website and application as applicable. This helps users distinguish a registered legal entity from an unregistered brand or lookalike service.
What useful board reporting looks like
- High-risk customers and changes in customer-risk distribution.
- Sanctions, PEP and wallet-risk decisions, including overrides.
- Alert volumes, ageing, investigations and suspicious-activity decisions.
- Cash, kiosk, self-hosted-wallet and high-risk counterparty exposure.
- Reconciliation breaks, operational incidents and provider failures.
- Capital adequacy, penetration-testing results, vulnerability scans and independent-assurance findings.
- Staffing, competence, access and workload capacity.
- Regulatory requests, material changes and overdue corrective actions.
- Quality-assurance results, root causes, retesting and closure evidence.
Inspection-readiness programme
- Maintain the obligations, change and NBG-correspondence registers.
- Keep an indexed evidence room with current Georgian versions.
- Sample customer files, transactions, alerts and reports by risk.
- Test retrieval from the live system and critical providers.
- Rehearse interviews with administrators and control owners.
- Run a complete customer-to-report system demonstration.
- Track findings to evidence-based closure and board approval.
CryptoLicense.ge can coordinate inspection readiness, regulatory responses and remediation as a defined engagement or managed workstream. The operating company and its administrators remain the decision-makers and control owners.
Legislation and regulatory materials
Our regulatory assessments and implementation work are based on the Georgian legislation and National Bank of Georgia materials below. Legal texts available in our legislation library open on CryptoLicense.ge; the official Matsne source is linked at the bottom of each legal-text page.
- Organic Law of Georgia on the National Bank of Georgia
- NBG Governor Order No. 94/04 — VASP registration, cancellation and regulation
- NBG Governor Order No. 207/04 — supervisory capital, operational risk and cybersecurity
- National Bank of Georgia — Update of the ML/TF Risk Assessment of the VASP Sector (2024)
- NBG Governor Order No. 133/04 — VASP fines, imposition and enforcement rule
- NBG Governor Order No. 204/04 — 2026 fines and enforcement amendments
- NBG Governor Order No. 113/04 of 1 May 2025 — amendment to the VASP sanctions rule
- NBG Governor Order No. 308/04 of 29 December 2025 — amendment to the VASP fines rule
- NBG — registration-act display requirement effective 1 January 2026
- NBG — notice on dealing with unregistered virtual-asset service providers
- NBG — 9 August 2026 statement on mandatory VASP registration, strict regulation and FATF-aligned framework
- NBG — published GEL 465,000 VASP enforcement case