Georgia VASP Regulatory Updates

27 August 2026 — supervisory capital and operational resilience

Order No. 207/04 introduced service-based minimum supervisory capital and a detailed operational-risk and cybersecurity framework. A VASP must maintain GEL 150,000 for exchange and/or transfer services, GEL 350,000 for a trading platform, or GEL 250,000 for other ordinary VASP services. The highest applicable amount governs a multi-service model, and at least 75% of the minimum must consist of primary capital.

The same amendment requires documented operational-risk, outsourcing, incident, business-continuity and IT disaster-recovery controls; annual penetration testing of critical and connected systems; risk-based testing of other systems at least every three years; vulnerability scanning at least twice each year; and a qualified independent audit opinion. New VASPs have 12 months after registration to obtain the framework and audit opinion. Existing VASPs must implement the risk framework by 1 July 2027 and the capital requirement by 1 September 2027.

The amendment’s transitional provision excludes administrative proceedings commenced before it entered into force. An applicant already in process should confirm its procedural position against the filing date, NBG correspondence and the applicable consolidated text rather than assume that the exclusion settles its post-registration operating obligations.

24 August 2026 — expanded fines and enforcement measures

Order No. 204/04 added more granular penalties, including GEL 20,000 for operating outside the service scheme agreed with the NBG, GEL 10,000 for obstructing an inspection, GEL 7,000 for each requested inspection item not supplied by the deadline, GEL 5,000 for each unfulfilled written instruction and GEL 1,000 for specified late, inaccurate or incomplete records and stablecoin returns. Stablecoin-specific breaches can attract penalties of up to GEL 50,000 per occurrence. Repeated breaches may double the monetary fine, while non-monetary measures may restrict operations, administrators, distributions or control and may culminate in cancellation of registration.

21 August 2026 — stablecoin monthly reporting

Order No. 201/04 requires stablecoin issuers to file an electronically signed monthly return covering issuance, circulation, redemption and reserve information. The first report is due by 15 October 2026; subsequent returns are due by the 10th day of each month for the preceding month. Reserve coverage must remain at least 100%.

September 2026 — current regulatory baseline

This update log was checked against current NBG and Matsne sources on 1 September 2026. The GEL 5,000 registration fee, 60-calendar-day statutory decision period, Travel Rule implementation date and published tax treatment remain unchanged.

March–April 2026 — stablecoin and AML framework developments

Order No. 52/04 introduced the dedicated stablecoin initial-offering and servicing framework. Relevant issuers need prior written consent, 100% reserve backing, segregation, redemption, disclosure, reporting, capital and operational and cyber controls. Separately, the AML/CFT law shows a further amendment published on 6 April 2026; compliance teams should work from the current consolidated text.

29 December 2025 — later VASP fines amendment

Order No. 308/04 amended the monetary-fines rule concerning failure to update information or obtain management permission in specified risk-based AML/CFT circumstances. Operators should review the current consolidated rule when assessing an incident or control defect.

1 January 2026 — registration-act display

The individual NBG act confirming VASP registration must be displayed or made easily available through relevant service spaces and channels, including the head office, branch, self-service kiosk, website and application. Legal, product and operations owners should test the live journey.

1 May 2025 — broader non-monetary AML/CFT measures

Order No. 113/04 added non-monetary measures to the VASP sanctions framework, including warning, directed remediation and restrictions affecting administrators, operations or registration depending on seriousness and risk. Boards should ensure deficiencies produce root-cause correction and retesting, not only a policy edit.

2024 VASP sector risk update

The NBG’s update highlighted weaknesses in AML internal instructions, customer-risk assignment and reassessment, preventive measures and suspicious or unusual transaction detection. It also described risks involving cash and kiosks, privacy-enhancing technology, mixers, high-risk wallets, self-hosted addresses, DeFi and cross-chain movement. Historic application or transaction statistics in the report remain snapshots of their stated dates and are not reproduced here as current market totals.

Travel Rule planning to 31 December 2027

The current NBG page states 31 December 2027 as the VASP implementation date. New transfer products should nevertheless build the originator/beneficiary data model, counterparty process, self-hosted-wallet controls, missing-data decisions, secure exchange and audit trail now.

How this log becomes action

• Record the official instrument, publication and effective date.
• Identify affected legal entities, products, customers and channels.
• Map changes to contracts, risk assessment, policy, systems, training and disclosure.
• Decide any NBG approval, notification or response requirement.
• Test implementation and retain closure evidence.
• Report residual risk and overdue action to management.