Align the application, AML framework and system behaviour so the company can demonstrate controls and keep evidence.
Review build-versus-buy, providers, identity and business verification, sanctions/PEP/adverse-media, blockchain analytics, wallet/custody, exchange, ledger, reconciliation, cases, reporting, logs, data retention, access control, incidents and continuity.
Service overview
The technology stack has to turn legal requirements into enforceable journeys, permissions, screening, monitoring, records and exception handling.
- Solution and data architecture
- Vendor and dependency matrix
- KYC/KYB, sanctions and KYT workflows
- Wallet, ledger and reconciliation controls
Design the evidence trail before integration
Architecture must connect identity, wallet and transaction data, rules, alerts, cases, approvals, reports and immutable logs. Vendor brochures do not prove that the applicant can operate the control.
The demonstration standard
The team can reproduce a customer journey, explain every decision and retrieve the underlying evidence without relying on a vendor sales representative.
Mandatory resilience and testing cycle
The VASP risk framework must cover operational and cyber risk, fraud, outsourcing, business continuity, IT disaster recovery, incident management and supervisory reporting. Critical and connected systems require annual penetration testing; other systems require risk-based testing at least every three years. Material changes to critical infrastructure trigger additional testing, and vulnerability scanning is required at least twice each year.
Operational records, incident registers and consolidated data must be available in real time. A newly registered VASP must obtain a qualified, independent and current audit opinion on the framework within 12 months after registration.
Design the evidence trail
Architecture workshops follow a customer from onboarding to transaction, monitoring, case, decision, reporting and reconciliation. Each provider is assigned data, control, incident and evidence responsibilities.
A common failure
The applicant relies on provider brochures and screenshots but lacks configured rules, audit logs, access rights and a reproducible end-to-end demonstration.
What you can expect from us
We begin with the live model and current evidence, agree the decisions and dependencies, then issue a written scope. You may engage us for advice and review only, for a defined implementation module, or for the complete build and regulatory coordination. The quotation caps our professional fee for the agreed assumptions and separates the GEL 5,000 official registration fee, translations, personnel, office, software, assurance and other third-party costs.
Founder decision
Agree the product perimeter, markets, counterparties and risk appetite before costly build work.
Operating evidence
Connect each claim to an accountable person, configured control, record and test result.
Launch consequence
Carry approved assumptions into filing, banking, provider onboarding and supervised operations.
Questions we address in this workstream
The application must describe an operationally credible system, and the NBG can require access and a functioning demonstration. Vendor selection alone is not readiness: integrations, rules, records, permissions, cases, reporting, reconciliation and audit trails should be configured and testable.
A useful demonstration follows onboarding, identity and sanctions checks, wallet or order activity, transaction monitoring, alerts, investigation, approval or rejection, reporting, reconciliation and record retrieval. Staff should explain their decisions without relying on a vendor salesperson.
Vendors may process and store evidence under controlled arrangements, but the VASP needs contractual rights, timely access, retention, export, audit, incident notice and continuity. Management must be able to retrieve and understand the records during supervision or a provider outage.
Design originator and beneficiary data, counterparty identification, self-hosted-wallet handling, missing-data decisions, secure exchange, audit logs and privacy controls now. Georgia's implementation deadline is 31 December 2027, but late retrofit can be costly.
Security and continuity determine whether customer assets, data and records remain controlled during key compromise, system failure or provider outage. The regulatory cycle includes an embedded IT disaster-recovery plan, annual penetration testing of critical and connected systems, twice-yearly vulnerability scanning, incident records and independent assurance. Testing and recovery evidence should match the architecture actually used.
