VASP Registration in Georgia NBG Registration & Step-by-step Roadmap

Georgia has emerged as one of the most compelling jurisdictions for virtual asset businesses seeking a clear, cost-effective regulatory home. VASP registration in Georgia is administered by the National Bank of Georgia (NBG), which consolidated oversight of virtual asset service providers under its supervisory framework through rules published in mid-2023. Backed by the Organic Law on the National Bank of Georgia, the regime offers international founders a transparent pathway: moderate formation costs, an improving banking environment, favourable tax treatment, and proximity to both the EU and CIS markets. With ongoing NBG rulemaking including a stablecoin and ICO regulation announced in March 2026 applicants face growing urgency to register and build compliant operations now.

Do You Need a VASP Licence? Definitions and Decision Checklist

What Activities Trigger the Registration Requirement?

Under the NBG’s registration framework, any entity that provides one or more of the following services to third parties in or from Georgia must hold a valid VASP registration. The regulated activities include:

• Exchange services: converting virtual assets to fiat currency (and vice versa), or exchanging one virtual asset for another.
• Transfer services: conducting transactions that move virtual assets from one address or account to another on behalf of clients.
• Custody and administration: safekeeping or managing virtual assets, private keys, or instruments enabling control over virtual assets.
• Portfolio management: managing portfolios of virtual assets on a discretionary or advisory basis.
• Trading platform administration: operating a platform that enables the buying, selling, or matching of virtual-asset orders.
• Lending and borrowing: providing or facilitating virtual-asset-based lending arrangements.
• ICO services: offering, distributing, or marketing initial coin offerings or token sales on behalf of issuers.

Quick Decision Flow

Use the following rules to determine whether your business requires NBG VASP registration:

• You operate a fiat-to-crypto on-ramp or off-ramp: Registration is mandatory regardless of transaction volume.
• You provide custodial wallet services: Holding private keys on behalf of users is a registrable activity.
• You run a non-custodial protocol with no hosted wallets: You may fall outside the registration perimeter, but should obtain a formal legal opinion before proceeding.
• You are a regulated financial institution already supervised by the NBG: Separate VASP registration may still be required confirm with the regulator.
• You act solely as a technology vendor or infrastructure provider: If you do not control client funds or execute transactions, you are unlikely to need registration.
• You market or distribute tokens through an ICO: The new stablecoin and ICO rule will impose additional requirements early registration is advisable.

NBG Requirements and Checklist for VASP Registration in Georgia

The NBG’s registration framework rests on two primary instruments: Order No. 94/04 (approved 13 June 2023), which sets out the substantive requirements for VASP registration, and the Internal Control Compliance Questionnaire (published August 2023), which the regulator uses to assess the adequacy of an applicant’s AML/CFT framework. Together, these instruments define what the NBG examines: fit-and-proper status of administrators and ultimate beneficial owners, minimum capital adequacy, AML/CFT safeguards, IT and cybersecurity measures, and consumer disclosure practices.

Required Documents at a Glance

• Corporate formation documents: Certificate of registration, charter/articles of association, extract from the Public Registry.
• Ownership and control chart: Full beneficial-ownership structure down to natural persons, including shareholding percentages.
• Criminal record certificates: For all ultimate beneficial owners, directors, and key administrators apostilled where issued abroad.
• Proof of minimum capital: Bank statement or auditor confirmation demonstrating the required capital level as specified by the NBG.
• Internal AML/KYC policy: Comprehensive manual covering customer due diligence, enhanced due diligence, ongoing monitoring, and suspicious-transaction reporting.
• Risk assessment: A documented ML/TF risk assessment specific to the applicant’s products, client segments, and geographies.
• IT and security overview: System architecture diagram, cold-wallet and hot-wallet controls, data-protection measures, incident-response plan, and business-continuity documentation.
• Business plan: Financial projections, staffing plan, description of services, target markets, and marketing strategy.
• Proof of local presence: Lease agreement or registered-office confirmation in Georgia.
• Sample client terms and disclosure statement: Draft terms of service with risk disclosures required by the NBG.

Downloadable Checklist

To simplify preparation, we recommend using a structured checklist that mirrors the NBG’s expectations document by document. The NBG-VASP-Registration-Checklist-Georgia.pdf consolidates every required item, cross-referenced to the relevant NBG Order provisions and the Internal Control Compliance Questionnaire fields. Applicants can use it to track document-gathering progress, assign responsibilities across their legal and compliance teams, and perform a final completeness review before submission.

Step-by-Step Application Process for VASP Registration in Georgia

Before submitting an application to the NBG, applicants must establish a Georgian legal entity and assemble all required documentation. The following seven-step roadmap outlines the practical sequence most applicants follow, from initial entity setup through to post-submission inspection readiness.

Step 1: Entity Formation and Local Setup

The recommended vehicle for most applicants is a Georgian Limited Liability Company (LLC, known locally as shezghuduli pasukhmgeblobis sazoghadoeba). LLCs can be formed at the Public Service Hall in as little as one business day for an expedited fee, although most founders should allow five to seven working days for standard processing. You will need a registered office address in Georgia, a local bank account, and tax registration. Some applicants explore the Tbilisi Free Industrial Zone for potential incentives, though VASP-specific regulatory implications must be carefully assessed before choosing this route.

Step 2: Minimum Capital and Bank Requirements

The NBG sets minimum capital expectations that vary depending on the scope of VASP activities undertaken. Applicants should consult the current NBG fintech guidance for specific figures and confirm the applicable threshold during a pre-application inquiry. Capital must typically be demonstrated through a confirmed bank balance or an independent auditor’s certificate. Opening a corporate bank account in Georgia requires thorough KYC documentation banks will scrutinise the source of funds and the business model, so prepare a detailed explanation of your virtual-asset operations alongside standard corporate identification documents.

Step 3: Appoint Administrators and Key Personnel

Under the Organic Law on the National Bank of Georgia, the NBG conducts fit-and-proper assessments on directors, administrators, and persons holding qualifying ownership stakes. Each candidate must submit a detailed CV, an apostilled criminal-record certificate, and declarations of any regulatory sanctions, insolvency proceedings, or disqualification orders. Georgia-based VASPs must also designate a local compliance officer responsible for AML/CFT matters this individual will serve as the primary point of contact with both the NBG and the Financial Monitoring Service.

Step 4: Draft AML/CFT Policies and KYC Procedures

AML/CFT policy preparation is the most resource-intensive part of the application. The NBG’s Internal Control Compliance Questionnaire probes applicants on their customer onboarding workflows, source-of-funds verification processes, ongoing transaction-monitoring systems, sanctions-screening tools, and suspicious-activity reporting procedures. Policies must be aligned with the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism. Applicants are strongly advised to test automated screening and monitoring tools in a sandbox environment before submission, as the NBG may request live demonstrations or sample outputs during review.

Step 5: Prepare IT and Security Documentation

The NBG expects a comprehensive IT and cybersecurity package. This should include a system-architecture diagram showing how client virtual assets are stored (distinguishing cold-wallet from hot-wallet infrastructure), backup and disaster-recovery plans, access-control protocols, data-encryption standards, and log-retention policies. Evidence of regular penetration testing and vulnerability assessments strengthens the application. Where the applicant uses third-party custody or infrastructure providers, contracts and SLAs must be disclosed.

Step 6: Complete and Submit the NBG Application Package

Applicants submit the full dossier to the NBG together with completed Internal Control Compliance Questionnaire responses. Submission can be made electronically or by post, in accordance with the NBG’s guidance. The package should include a cover letter summarising the application, a document index cross-referencing each requirement, and any supplementary materials (e.g., organisational charts, flow diagrams for transaction monitoring). Expect the NBG to issue clarification requests preparing a comprehensive dossier on the first attempt significantly reduces processing time.

Step 7: Post-Submission Process and Inspection Readiness

After submission, the NBG performs a completeness check and may issue one or more rounds of follow-up questions. Industry observers note that applicants with weak AML systems or incomplete IT documentation face the longest delays. The regulator may also conduct an on-site or remote inspection before finalising registration. Applicants should maintain a compliance room a physical or virtual repository of all policies, procedures, training records, and audit trails ready for review at short notice. The NBG has demonstrated its willingness to impose monetary fines on registered VASPs that fail supervisory expectations, underscoring the importance of entering the registration process with robust systems already in place.

Common application pitfalls to avoid:

• Incomplete KYC on beneficial owners: Missing or un-apostilled criminal-record certificates are a frequent cause of delay.
• Weak transaction-monitoring framework: Generic policies without evidence of system implementation trigger additional scrutiny.
• Insufficient IT evidence: Architecture diagrams that omit key security controls (cold-wallet separation, access logging) raise red flags.
• Unclear ownership structure: Complex multi-layered structures without transparent beneficial-ownership disclosure slow the fit-and-proper assessment.

Costs and Timelines for VASP Registration in Georgia

Typical Fees and Cost Components

There is no single “licence fee” for Georgia VASP registration. Total costs depend on the scope of services, company structure, and compliance-infrastructure choices. The principal cost components are:

• Company formation: Legal fees plus Public Registry charges typically in the range of USD 500–2,000 depending on complexity and speed of incorporation.
• NBG administrative costs: While the NBG does not charge a traditional application fee in the manner of some EU regulators, applicants should budget for regulatory correspondence, notarisations, and potential translation costs.
• Compliance build: AML/KYC policy drafting, transaction-monitoring systems, screening-tool licences, and legal review represent the largest variable cost commonly USD 5,000–20,000 depending on whether templates or bespoke solutions are used.
• Banking and correspondent arrangements: Advisory costs for securing a corporate bank account and, where applicable, payment-service-provider integrations.
• Contingency: Budget for independent audits, third-party legal opinions, translation and apostille services, and any remediation the NBG may require during review.

Timeline Table

These estimates are informed by practical experience and the NBG’s fintech overview. Applicants should treat 90 days as the baseline planning assumption and invest in pre-application readiness to minimise delays.

Ongoing Compliance and AML/CFT Risk After VASP Registration

Key Ongoing Obligations

Registration is the beginning, not the end, of a VASP’s regulatory relationship with the NBG. Post-registration obligations include:

• Transaction reporting: VASPs must report suspicious transactions to the Financial Monitoring Service (FMS) in accordance with the AML/CFT law. Records of all transactions must be retained for the statutory period.
• Periodic supervisory reporting: The NBG may require VASPs to submit regular compliance reports and updated Internal Control Compliance Questionnaire responses. On-site and remote inspections are conducted to verify ongoing adherence.
• Sanctions and screening: VASPs must maintain up-to-date sanctions-screening systems aligned with national and international sanctions lists, as referenced in the NBG’s supervisory framework.

Enforcement Examples and Penalties

The NBG has demonstrated active enforcement of VASP compliance standards. Publicly available enforcement actions show the regulator imposing monetary fines on VASPs for AML/CFT deficiencies. These cases serve as a clear signal: the NBG treats VASP supervision seriously and will penalise non-compliance, including inadequate transaction monitoring, incomplete record-keeping, and failure to maintain fit-and-proper personnel. The likely practical effect of these early enforcement actions is to raise the compliance bar for all new applicants.

Practical Compliance Checklist for the First 12 Months

• Staff training: Deliver AML/CFT and sanctions-awareness training within 30 days of registration; schedule refresher sessions quarterly.
• Independent audit: Commission an independent review of AML/KYC controls within the first six months to identify gaps before the NBG’s first inspection cycle.
• Transaction-monitoring tuning: Review alert thresholds and rule calibration after the first 90 days of live operations; document all tuning decisions.
• Incident-reporting plan: Establish and test an incident-response procedure, including data-breach notification protocols and escalation to the FMS.
• Policy updates: Incorporate any new NBG rules or orders (such as the stablecoin regulation) into internal policies promptly upon publication.

Georgia vs Alternatives Crypto Licence Comparison

Georgia’s NBG-supervised VASP registration offers a distinctive combination of regulatory clarity, speed, and cost-effectiveness. The following comparison table positions Georgia alongside commonly considered alternatives for crypto licensing:

Georgia stands out for its relatively fast processing timelines, lower operational costs, and the NBG’s increasingly sophisticated but pragmatic supervisory approach. Industry observers expect Georgia’s attractiveness to grow further as the NBG continues its rulemaking programme and the country’s alignment with EU regulatory standards deepens. For businesses prioritising speed to market and cost efficiency without sacrificing regulatory credibility, VASP registration in Georgia warrants serious consideration.

Next Steps Your VASP Registration Compliance Consultation

Navigating NBG requirements for VASP registration in Georgia demands precision from entity structuring and capital verification through to AML/CFT policy development and IT documentation. A 30-minute compliance intake call is the recommended starting point: it enables a preliminary assessment of your business model against the NBG’s registration criteria, identifies document gaps, and establishes a realistic timeline and budget. From there, a tailored registration package can be scoped covering company formation, full dossier preparation, compliance-system implementation, and ongoing regulatory support through the first 12 months of supervised operations.

Sources

• National Bank of Georgia Virtual Asset Service Providers (VASPs)
• National Bank of Georgia Internal Control Compliance Questionnaire (August 2023)
• National Bank of Georgia Monetary Fine Imposed on VASP (Enforcement Example)
• Organic Law of Georgia on the National Bank of Georgia (matsne.gov.ge)
• Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism (matsne.gov.ge)
• Financial Monitoring Service of Georgia
• NBG Development of Regulation on Virtual Asset Services (March 2026)