Georgia VASP registration: NBG technical requirements and how to document your systems

Georgia does not issue a crypto licence. It runs a registration regime: a company that provides virtual asset services to other people must be registered with the National Bank of Georgia (NBG) before it operates. The obligation is in Article 52⁵ of the Organic Law on the National Bank of Georgia, and the NBG registration rule (Order No. 94/04) has applied since 1 July 2023. The NBG register dated 23 October 2026 lists 43 providers.

Registration now asks for much more than it did in 2023. NBG Order No. 207/04 came into force on 27 August 2026. It added minimum supervisory capital, a risk management framework, yearly penetration tests and an independent audit. Providers registered before that date have until 1 July 2027 for the risk rules and 1 September 2027 for capital. The engineering work is to describe the system exactly as it runs and to prove each control with evidence.

This article maps each verified obligation to a platform control, the evidence the NBG can ask for and an owner. It is a technical reading, not legal advice. We rebuilt the current rule from its original Georgian text and the five amending orders on Matsne, the official legal database; we did not have the paid consolidated version. Article numbers refer to the registration rule unless we say otherwise.

What are the key dates?

Date	What happened
9 September 2022	Parliament adds VASP supervision to the Organic Law and sets a GEL 5,000 registration fee; both apply from 1 January 2023
1 July 2023	The NBG registration rule (Order 94/04 of 13 June 2023) comes into force
90 days from 1 July 2023	According to the NBG, firms active before 1 January 2023 had to apply in this period and could operate until it decided
December 2025	Organic Law amended: the NBG may set capital, safekeeping, risk management and consumer protection rules for VASPs
1 January 2026	Providers must show their NBG registration act in every channel, including websites and apps (Article 7(15))
27 August 2026	Order 207/04 in force: capital, risk management, penetration tests, audit
1 July 2027	Providers registered before 27 August 2026 meet the risk management rules (Article 7¹)
1 September 2027	The same providers meet the capital rules (Article 7²)
31 December 2027	Providers comply fully with the Travel Rule regulation (Order 253/04, Article 17(2))

Which activities need NBG registration?

Article 3(11¹) lists the services: exchange of convertible virtual assets for money, other virtual assets or financial instruments, including through kiosks; transfer; safekeeping or administration, including of the means that control the assets; portfolio management; trading platform administration; lending; and initial offerings and related services.

The rule also bars virtual asset lending to natural persons and the use of agents (Article 1(6) and (9)). Other limits:

• The provider must be a Georgian limited liability company or joint stock company (Article 1(5)).
• It may not carry out other business, apart from auxiliary activities and exchanging its own virtual assets (Organic Law, Article 52⁵(4)).
• The NBG says registration also applies inside Free Industrial Zones.
• Payments in virtual assets are prohibited except where the NBG allows them (Organic Law, Article 39¹). The NBG FAQ says Georgian businesses may not accept virtual assets as payment for goods or services, so a crypto payment gateway for Georgian merchants needs a legal review before any technical work.

Is it still registration, or a licence now?

It is still called registration, but since August 2026 it authorises named services and carries prudential rules. Since Order 207/04, the registration act names each service the provider may offer (Article 3(12)). The NBG may cancel a registration, or its consent for one service, if an audit or a penetration test finds critical or high-risk vulnerabilities (Article 7¹(14)). There is also a minimum capital requirement:

Service (Article 7²(1))	Minimum supervisory capital	About EUR, NBG rate of 30 Oct 2026
Exchange (including kiosks) and/or transfer	GEL 150,000	€51,800
Trading platform administration	GEL 350,000	€121,000
Other services, except stablecoin offerings	GEL 250,000	€86,400
Stablecoin initial offering (separate stablecoin offering rule)	GEL 500,000, rising with reserve assets	€172,800 and up

A provider with several services holds the highest amount (7²(2)). At least 75% must be primary capital (7²(3)). An applicant files a bank statement that shows the capital (Article 3(1)(e¹)). If capital falls short, the provider tells the NBG immediately and sends a restoration plan within five working days (7²(16)).

What does the NBG check about people and premises?

• Administrators must meet the suitability criteria of Article 3(3), including higher education in a relevant field (economics, finance, law, IT and others) and/or at least two years of managerial experience in the financial or virtual asset sector (3(3)(f)).
• A company whose only owner is also its director needs at least two directors (3(5)).
• The head office must be in Georgia, the administrators must manage the business from it, and it must be physically separate from other businesses (7(1)–(2)).
• One person authorised to represent the company must be in Georgia for at least 14 days in each calendar month (7(12)).
• Foreign documents need an apostille or legalisation and a certified Georgian translation (3(2)).
• The NBG decides within 60 calendar days of a complete file. The clock stops while the NBG waits for answers, and it may be extended by 60 days (3(10)).

What does the application ask about your systems?

Annex 5 of the rule, as replaced in August 2026, is the checklist. The technical items are:

1. A flow diagram for each service. It shows how information, virtual assets and money move from start to finish, with every participant, including intermediaries, and a separate diagram for an asset group whose flow differs. Foreign VASPs and payment providers in the flow are listed with their supervisors.
2. The electronic system. You give its name, a register extract for the system’s manufacturer, the manufacturer’s website, and the place where the system and the records of customer obligations and transactions are hosted. You demonstrate the system to the NBG before registration is completed.
3. Websites and apps. Proof of the right to use each domain, and each app’s name, store and developer.
4. AML documents. The internal AML instruction, the organisational money laundering risk assessment or the NBG questionnaire, and a signed statement on the compliance control system.
5. A business plan with a three-year budget that shows you will operate in Georgia.

The NBG may refuse registration if the system does not match the flow diagram (Article 3(9)(e)). After registration, the diagram is a controlled document: you must notify the NBG at least 30 calendar days before you change the electronic system, a website address, an app or the service flow (Article 5).

Article 7 adds ongoing duties. Every operation is recorded with a log of each action on that data and can be retrieved quickly from the head office (7(5)). NBG staff get access to the internal system at the head office (7(11)). Remote customer identification follows a process agreed with the NBG (7(4)).

What did the August 2026 amendment add?

Article 7¹ requires a risk management framework for operational risk, cyber security, infrastructure resilience and fraud. It must include business impact analysis, critical functions, critical third parties and disruption tolerances (7¹(6)). The business continuity plan must include an IT disaster recovery plan, and the rule calls yearly testing “advisable” (7¹(9)). The provider runs penetration tests every year on all critical systems and the systems connected to them, on other systems on a risk basis at least every three years, and after any significant change to critical infrastructure (7¹(10)–(11)). It runs vulnerability scans at least twice a year, covering the systems outside that year’s penetration test (7¹(12)). It obtains an independent, qualified audit report within 12 months of registration (7¹(13)), and keeps every version of the framework for eight years after the service ends (7¹(4)).

What are the AML and Travel Rule obligations?

A VASP is an obliged person under the Law on Facilitating the Prevention of Money Laundering and Terrorism Financing. Andersen in Georgia reads the law as requiring due diligence on one-off transactions above USD 1,000, EUR 1,000 or GEL 3,000, and five-year record retention; confirm both with counsel before you set onboarding and deletion rules. The NBG has fined VASPs for breaching the Financial Monitoring Service rule on recording and submitting transaction information.

The registration rule adds three controls. A provider may not deal with VASPs or financial institutions that are not licensed or registered, not supervised for AML, or based in countries without FATF-equivalent rules (8(1)). It may not offer privacy coins or use techniques that block tracing on distributed ledgers (8(2)). Before it starts operating, it must have software that automatically detects suspicious or linked transactions from blockchain data (8(3)); without it, the NBG may cancel the registration (Article 6(1)(g)).

The Travel Rule is in NBG Order 253/04, Articles 9 to 12:

• The sender’s provider sends both parties’ names and their blockchain addresses or account numbers, plus the sender’s address, an identification number, or date and place of birth (9(1)–(2)).
• The data travels securely before or with the transfer, not necessarily on the blockchain (9(4)).
• For a self-hosted wallet, the provider collects and keeps the same data. Above EUR 1,000, USD 1,000 or GEL 3,000, it assesses whether the customer owns or controls the address, for outgoing transfers to an address the customer calls their own and for incoming transfers from a self-hosted address (9(5)–(6), 11(3)).
• No transfer goes out until these rules are met (9(8)). A receiving provider rejects, returns or asks for missing data, and reports counterparties that fail repeatedly to the NBG (12).

Which controls and evidence will the NBG look for?

The first column is the legal requirement, paraphrased, with its citation. The other columns are our implementation recommendation, drawn from building and running exchange, wallet and custody software at the reference exchange since 2024 and from preparing technical files for licence applications. The rule does not name these roles.

Requirement (citation)	Control in the platform	Evidence	Owner
Operations recorded, each action logged, quick retrieval (7(5)); real-time records (7¹(8)(a))	Double-entry ledger; append-only log of every operator action	Log export; retrieval test timed from the head office	CTO
NBG access at the head office (7(11))	Read-only supervisor role over a logged connection	Role definition; access log	CTO, compliance
NBG reports produced quickly, by any parameter (7¹(8)(d)–(e))	Reports generated from the ledger, not by hand	Report samples	Compliance
Incidents logged; procedure to report large operational risk events (7¹(8)(b), 7¹(6)(i))	Incident register, severity classes, notification template	Register; drill record	CISO
Unique, protected credentials; data and software protected (7¹(7)(c), (h), (i))	Staff 2FA; secrets in a vault; role-based access; reviewed releases	Access review; change log	CISO
Systematic backups with integrity and authenticity protected (7¹(7)(g), (j))	Encrypted, immutable or offline backups at a second site; tested restores	Backup schedule; checksum report	CTO
Continuity plan with disaster recovery (7¹(6)(f), 7¹(9))	Standby environment; restore drills on clean hardware	Plan; timed drill report	CEO, CTO
Penetration tests and scans (7¹(10)–(12))	Test calendar linked to releases; remediation tracker	Reports; remediation status	CISO
Outsourcing managed; supplier contract (7¹(6)(j), 7¹(7)(d))	Third-party register: hosting, KYC, analytics, software vendor	Register; contracts	CEO
Automated detection of suspicious transactions (8(3))	Automated blockchain monitoring on deposits and withdrawals; risk-based holds; alert review	Alert and case logs	MLRO
Travel Rule data and self-hosted wallet checks (253/04, Art. 9–12)	Travel Rule provider; withdrawal form fields; ownership proof flow	Message logs; samples	MLRO

What does Georgian law not spell out yet?

We did not find these in the registration rule and its amendments. Check other NBG acts, AML and data-protection law with counsel; until then, treat them as good practice:

• Client asset segregation. We found no rule in the registration rule or its amendments on how a provider separates or reconciles client assets. Article 52⁵(1)(k) of the Organic Law lets the NBG set safekeeping standards; we found none published by 31 October 2026. Keep client and company wallets apart and reconcile the ledger with the blockchain every day.
• Server location. We found no text that requires servers in Georgia. You must declare where the system and data are hosted, and NBG staff must reach the system from the head office. Confirm the hosting plan with counsel.
• Incident timing. Article 7¹ requires a procedure for notifying the NBG of major operational risks, but the texts we read set no hour limit. Confirm deadlines with counsel, then set an internal clock and test it.

What should a provider do now?

If you are already registered:

1. Run a gap assessment against Article 7¹ now. An auditor needs a framework that already works, and 1 July 2027 is eight months away.
2. Book the first penetration test and both 2027 vulnerability scans.
3. Plan the capital for 1 September 2027.
4. Build the Travel Rule data flow and test it with real counterparties before 31 December 2027.

If you are applying: file the capital bank statement, a diagram for each service and the system manufacturer’s register extract, and plan the NBG demonstration. Automated blockchain monitoring must run before you start operating; the risk framework and the independent audit report are due within 12 months of registration.

Georgia VASP registration FAQ

Does Georgia issue a crypto licence?

No. The NBG registers virtual asset service providers. Since 27 August 2026 registration also brings capital, risk management and audit rules.

How much capital does a crypto exchange need in Georgia?

A trading platform needs GEL 350,000 of minimum supervisory capital. Exchange and transfer services need GEL 150,000. A provider with several services holds the highest amount.

How long does NBG registration take?

The NBG decides within 60 calendar days of a complete application. The period stops while the NBG waits for answers and can be extended by 60 days.

Can a foreign company register as a VASP in Georgia?

Only through a Georgian limited liability company or joint stock company. It needs a head office in Georgia, and one authorised representative must be in Georgia at least 14 days a month.

Does Georgia apply the Travel Rule to crypto transfers?

Yes. NBG Order 253/04 sets the sender and recipient data for virtual asset transfers and the checks for self-hosted wallets. Providers must comply fully by 31 December 2027.

Does licence-ready software make a VASP compliant?

No. Software gives you controls and evidence. Compliance depends on the company, its people and how it operates, and the NBG decides.

How BitPolaris helps

BitPolaris builds the exchange, wallet and custody software that has run in production at the reference exchange since 2024. The exchange has an operations console with roles, an audit log and reports, KYC tiers with Sumsub or Didit, and travel-rule data capture with an export for your travel-rule provider. Custody adds hot, warm and cold tiers, M-of-N approvals, address whitelists with delays, a reserve monitor that compares the ledger with the blockchain around the clock and an exportable operator log. Custody is self-hosted only, so key generation, storage and recovery stay in your hands. Our cloud option for the exchange runs on dedicated EU servers: declare that location in the application, sign a supplier contract under Article 7¹(7)(d) and check it against outsourcing and data-protection rules. Article 8(3) requires automated blockchain monitoring, which you arrange separately.

The Licence Technical Pack covers the documents: Lite at €1,250 one-time, Pro at €6,300 one-time and Regulator Q&A at €1,450 a month (excluding VAT, 31 October 2026). Georgia is offered on request, so agree the scope with us before you buy. Background: what regulators ask for and Armenia’s 2027 licence deadline.

We are not a law firm and do not file applications; you and your counsel do. The pack is not an audit, so it cannot replace the independent audit in Article 7¹(13) or the penetration tests. Installing our software does not make anyone compliant or registered.

Sources

1. Organic Law of Georgia on the National Bank of Georgia, consolidated English text (Articles 39¹, 52⁵), Matsne
2. NBG Order No. 94/04 of 13 June 2023, registration rule, original text and amendment list, Matsne
3. NBG Order No. 207/04 of 26 August 2026 (capital, risk management, Annex 5), Matsne
4. NBG Orders No. 376/04 of 25 December 2023 (Matsne), No. 266/04 of 25 November 2025 (Matsne) and No. 5/04 of 15 January 2026 (Matsne)
5. NBG Order No. 253/04, regulation on information accompanying transfers of funds and virtual assets, consolidated to December 2023, NBG PDF and amending Order No. 386/04, Matsne
6. Law amending the Law on Registration Fees, No. 1795-IXმს-Xმპ of 9 September 2022, Matsne
7. NBG, Virtual asset service providers page and register (register file dated 23 October 2026)
8. NBG, Frequently asked questions on virtual assets
9. NBG, Rule of VASP registration approved, 20 June 2023
10. NBG, NBG expands the supervisory framework for VASPs, 8 September 2026
11. NBG, NBG develops regulation on virtual asset services, 10 March 2026
12. NBG, Amendment on displaying the registration act, 27 November 2025
13. NBG, Warning on unregistered providers, including Free Industrial Zones, 7 October 2025
14. NBG, Fine imposed on VASP “Matio” LLC
15. Andersen in Georgia, Georgia’s legal framework for virtual asset services
16. Andersen in Georgia, New stage in virtual asset market regulation in Georgia, 2 October 2026
17. NBG, official exchange rates, 30 October 2026