Compliance is at the core of any successful Virtual Asset Service Provider (VASP) operation, regardless of jurisdiction. Georgia, while offering a lighter regulatory framework compared to the EU, has nonetheless adopted core international standards in Anti-Money Laundering (AML), Know Your Customer (KYC), and data sharing obligations similar to the Financial Action Task Force (FATF)’s Travel Rule.

This article provides an overview of the key compliance requirements for VASPs operating in Georgia as of 2025.

1. AML Obligations in Georgia

Although Georgia is not part of the European Union, it aligns its anti-money laundering policies with FATF recommendations. All licensed VASPs must implement an internal AML framework that includes:

• A written AML policy
• Identification and verification of clients (KYC)
• Ongoing monitoring of client activity
• Risk-based client categorization
• Reporting of suspicious transactions to local authorities (e.g., the Financial Monitoring Service)
  
  

VASPs must ensure their compliance team is trained and that internal procedures are updated to reflect the most recent threats and typologies related to virtual assets.

2. Know Your Customer (KYC)

KYC is a foundational requirement of Georgia’s compliance environment. VASPs are expected to perform due diligence on all clients, particularly those engaging in high-volume or high-risk transactions.

Key KYC elements include:

• Identity verification (passport, ID, proof of address)
• Beneficial ownership disclosure for corporate clients
• Source of funds checks where appropriate
• Periodic re-verification for existing clients
  
  

KYC must be performed before establishing any customer relationship and must be appropriately documented and retained.

3. The Travel Rule in Georgia
   
   

While Georgia is not bound by the EU’s Transfer of Funds Regulation (TFR), which enforces the Travel Rule across crypto transfers, the country applies similar standards in practice.

Under FATF Recommendation 16, which Georgia follows:

• VASPs must collect and retain identifying information about both the sender and recipient of a transaction.
• This includes full name, account number or wallet address, and in some cases the physical address or national ID number.
• The rule generally applies to transactions exceeding a threshold (commonly USD/EUR 1,000).
  
  

VASPs must be capable of sharing this information with counterparties or authorities upon request and must maintain adequate technical infrastructure to support this obligation.

4. Internal Compliance Structure
   
   

To meet compliance standards, every VASP in Georgia must appoint a qualified Compliance Officer. Their responsibilities include:

• Drafting and implementing AML/KYC policies
• Conducting internal audits and compliance reviews
• Liaising with the National Bank of Georgia (NBG) and other regulators
• Ensuring all staff are trained in relevant compliance procedures
  
  

Companies must also establish recordkeeping systems to securely retain transaction and customer data for at least five years.

5. Penalties for Non-Compliance
   
   

Failure to comply with AML/CFT rules can result in:

• Fines and administrative penalties
• Suspension or revocation of the VASP license
• Criminal liability in cases of gross negligence or willful misconduct
  
  

The National Bank of Georgia has the authority to impose enforcement actions and monitor ongoing compliance.

Conclusion

Although Georgia offers a simplified path to licensing, it does not compromise on international compliance obligations. VASPs must take AML, KYC, and Travel Rule-equivalent requirements seriously and build appropriate internal structures to meet regulatory expectations.

For companies seeking a balance between operational freedom and global compliance standards, Georgia provides a viable and attractive jurisdiction.