Operating a digital-asset business in Georgia without a clear regulatory position is a calculated risk few operators can afford to carry. Banks review VASP status before opening accounts. Correspondent partners ask for it. And an enforcement action in a growth market can freeze operations before a licence application is even filed. Georgia has emerged as a notable entry point for crypto businesses targeting the CIS region and beyond – its low-cost operating environment, territorial tax treatment and a relatively accessible regulatory authorisation path draw founders who want a working base outside the EU while their MiCA structure matures.
This page sets out what Georgia's digital-asset regime currently requires, who needs to be licensed, how the process works in practice, and how Georgia fits into a cross-border licensing stack.
Georgia's Regulatory Environment for Digital Assets
Georgia regulates virtual-asset service providers primarily through the National Bank of Georgia (NBG), which has expanded its supervisory mandate to cover VASP registration (the obligation for businesses offering defined crypto services to register and comply with applicable anti-money-laundering and counter-financing-of-terrorism requirements). The regime draws on FATF Recommendation 15, which requires member jurisdictions to regulate VASPs and apply risk-based AML/CFT controls. Georgia, as a FATF-engaged jurisdiction, has aligned its VASP supervision with that standard.
The NBG is the primary point of engagement for any business considering a Georgia base. Its supervisory perimeter covers entities that exchange, transfer or provide custody services for virtual assets, as well as those that facilitate participation in token offerings. The regime is not yet a full equivalence match for MiCA (the EU's Markets in Crypto-Assets Regulation), but it is more structured than many neighbouring markets, and regulators have shown a willingness to engage with well-prepared applicants.
In our practice, we see Georgia most commonly used as a first-registration jurisdiction for businesses that are scaling into the CIS corridor, that need a tax-efficient base while an EU authorisation is pending, or that serve a client base where a Georgia registration satisfies local counterparty requirements. The cross-border reality, however, is that Georgia registration alone does not authorise activity directed at EU, UK or US persons – those markets require their own regulatory footprint.
Who Needs a Licence in Georgia?
The NBG's supervisory scope reaches any entity that, as a business activity, exchanges virtual assets for fiat or other virtual assets, transfers virtual assets on behalf of customers, provides custody or wallet services, or facilitates participation in token sales. If your business performs any of those functions for users located in Georgia – or is incorporated in Georgia and performs them internationally – the registration requirement is engaged.
The key analytical question is whether the activity is conducted as a business and whether it falls within the defined VASP perimeter. Peer-to-peer platforms, DeFi protocols with no identifiable operator, and pure software publishers have historically argued they fall outside the perimeter, but regulators globally are narrowing those positions. We regularly advise operators to conduct a formal activity analysis before assuming they are out of scope.
A common structural error is incorporating a Georgian entity for operational or tax reasons while assuming the VASP registration requirement does not apply because customers are offshore. The NBG's position – consistent with FATF guidance – is that the location of incorporation matters, not just the location of customers. An entity incorporated in Georgia and conducting VASP activities, even exclusively for foreign users, is generally expected to satisfy local registration requirements.
For a scoped assessment of your Georgia exposure and whether the registration obligation is engaged for your structure, contact OBOLUS at info@oboluslaw.com. The analysis above describes the standard position. Your entity structure, the user base you serve, and where your banking sits can each change the conclusion materially.
How Does the Georgia VASP Registration Process Work?
Registration with the NBG requires an applicant to demonstrate that the business has adequate AML/CFT policies, a capable compliance officer, documented risk management procedures, and governance structures that meet the regulator's expectations for a supervised entity. The application is documentary in the first instance – the NBG reviews submitted materials and may request supplementary information or a meeting with management.
The preparation phase is where most applications either build credibility or create problems. A well-structured application package typically includes corporate documentation, beneficial ownership disclosure, an AML/CFT policy suite, a business model description with projected activity volumes, and evidence of the compliance function. Applications that arrive without a coherent AML policy or with gaps in UBO disclosure are routinely returned for completion, adding weeks or months to the timeline.
Timeline for a well-prepared application is typically a matter of weeks to a few months, depending on the complexity of the business model and the regulator's current caseload. We have seen straightforward exchange registrations processed more quickly than custody or lending models, which typically attract more detailed scrutiny of the safeguarding and insolvency-remoteness arrangements.
There is a practical cross-border dimension to the application itself. Many Georgian VASP applicants have ultimate beneficial owners in third countries, hold bank accounts outside Georgia, or have servers in a different jurisdiction. The NBG will ask about each of those connections. Preparing coherent answers in advance – rather than responding reactively – is a significant efficiency gain.
AML/CFT Obligations and the Travel Rule in Georgia
Registration under the Georgian VASP regime does not end the compliance obligation – it begins it. Registered VASPs are expected to operate a functioning AML/CFT programme that includes customer due diligence, transaction monitoring, suspicious transaction reporting, and record-keeping. The NBG conducts supervisory reviews, and deficiencies identified post-registration can result in corrective orders or, in serious cases, suspension of the registration.
The Travel Rule (the obligation, drawn from FATF Recommendation 16, to pass originator and beneficiary information alongside virtual-asset transfers above a defined threshold) applies within the Georgian framework. The specific threshold at which the Travel Rule is triggered is subject to the applicable provisions of current NBG regulation – operators should consult current legislation rather than relying on any stated figure here. In practice, Travel Rule compliance requires a technical integration with a Travel Rule solution provider and a set of correspondent VASP policies that govern how the business handles transfers to and from entities in jurisdictions without equivalent requirements.
In our cross-border practice, Travel Rule compliance is frequently the item that delays banking approvals more than the licence itself. Correspondent banks and payment processors ask for evidence of a functioning Travel Rule process before they open rails for a new VASP. Registering in Georgia without addressing Travel Rule readiness in parallel means the business will likely be ready to operate on paper before it is ready to operate in practice.
Tax and Banking Considerations for Georgia-Licensed Operators
Georgia's tax environment is a significant part of the jurisdiction's appeal. The territorial tax system means that a Georgian entity generally pays corporate income tax only on Georgia-sourced income, with profits generated from activity outside Georgia not subject to Georgian corporate tax at the entity level. Virtual-asset businesses that structure international revenues carefully can achieve a materially lower effective rate than they would in most EU or UK jurisdictions.
The tax treatment of specific activities – staking rewards, DeFi protocol fees, OTC desk margins – is not uniformly settled in Georgian tax law. Operators we advise routinely seek a tax position paper before committing to a Georgian structure, because the difference between income and capital treatment, or between Georgian-sourced and foreign-sourced characterisation, can be significant at scale.
Banking for Georgian VASPs is the area where operators most frequently encounter friction. Georgian domestic banks apply risk-based AML screening to VASP customers, and not all banks actively want VASP business. Account opening requires the same level of documentation the NBG registration process requires – and often more, because the bank's own compliance team makes an independent assessment. We have seen well-registered businesses wait considerably longer for banking than for the underlying VASP registration. Planning the banking track in parallel with the licensing track, rather than sequentially, is a consistent recommendation from our side.
Cross-border banking – using EMI accounts in Lithuania, Malta or another EU jurisdiction alongside a Georgian operating account – is a common solution. It requires its own analysis of whether the EMI licence covers VASP customer types in the relevant categories, and whether the EMI's own bank has restrictions on serving crypto businesses.
If your Georgian structure's banking track has stalled or your EMI relationship has been restricted, write to OBOLUS at info@oboluslaw.com for a structured second review. A prior application that stalled often contains a structural issue that can be addressed before a new approach is made.
How Does Georgia Compare to Other Licensing Destinations?
For an inbound operator choosing between Georgia and a competing jurisdiction, the decision turns on four axes: regulatory credibility, operating cost, tax efficiency, and the banking environment each jurisdiction enables.
Against EU-passportable regimes – principally the MiCA CASP authorisation available through ESMA and national competent authorities in Lithuania or Malta – Georgia does not passport into the EU. A Georgian VASP registration does not permit the business to serve EU residents without a separate EU authorisation. For businesses whose primary growth market is the EU, Georgia is a parallel base rather than a primary licence.
Against offshore jurisdictions such as the BVI (under the VASP Act 2022 and BVI FSC supervision) or the Cayman Islands (under the CIMA VASP framework), Georgia offers a more tangible operational presence – a real office, real employees, a real bank – which increasingly matters to institutional counterparties who conduct VASP due diligence. The "shelf registration" model that characterised earlier crypto licensing rounds is under pressure from banks, exchanges and payment processors who want to see genuine substance.
Against Gulf-region regimes such as VARA (Virtual Assets Regulatory Authority in Dubai) or the ADGM/FSRA framework in Abu Dhabi, Georgia is lower cost and faster, but provides less regulatory prestige for businesses targeting institutional or high-net-worth client segments who expect a premium-jurisdiction brand.
The practical decision matrix for an inbound operator typically resolves as follows. A business primarily serving the CIS/MENA corridor on a cost-sensitive model will often find Georgia's operating cost and tax efficiency compelling, provided it builds genuine substance and accepts that EU activity will require a second licence. A business with EU growth as the primary objective will typically treat a MiCA-authorised jurisdiction as the anchor and use Georgia as a secondary operating base. A business targeting institutional capital or premium-market branding will typically look to VARA, ADGM/FSRA or Singapore's MAS Payment Services Act framework as the primary vehicle.
In a recent matter, a payments operator incorporating in Georgia for regional remittance activity found that its primary institutional partner required a MiCA-passportable authorisation for the EU leg of the transfer corridor. The Georgia registration covered the origination side; we worked with allied counsel in an EU member state to structure a complementary CASP authorisation that covered the EU-destination leg. Both tracks ran in parallel, and the combined structure was operational within a single calendar quarter.
What Are the Most Common Licensing Mistakes in Georgia?
The most frequent error is treating the VASP registration as a compliance endpoint rather than a starting point. Registration grants permission to operate; it does not guarantee that banks will open accounts, that payment processors will integrate, or that institutional counterparties will pass their own VASP due diligence. Operators who treat the registration as the finish line often find themselves registered but unable to function commercially.
A close second is inadequate AML/CFT documentation. The NBG expects a policy suite that is specific to the business model – not a generic template downloaded from the internet. A bespoke AML policy for an OTC desk looks different from one for a retail exchange. Submitting an obviously generic policy signals to the regulator that the compliance function is not yet mature, which invites additional scrutiny.
Third is the assumption addressed elsewhere on this page: that a Georgian registration covers global activity. It does not. Directing services at EU, UK or US persons requires engaging those jurisdictions' own regimes, regardless of where the entity is incorporated.
Finally, beneficial ownership disclosure is frequently under-prepared. The NBG requires disclosure of the full UBO chain, including intermediate holding companies in third countries. Incomplete UBO disclosure is the single most common reason for a registration to stall mid-process. Preparing a complete corporate structure chart and UBO declaration before filing saves significant time.
Georgia Licensing: A Self-Assessment for Operators
Before engaging with the NBG process, operators benefit from a structured self-assessment across five questions.
First: does your business activity fall within the NBG's VASP perimeter? Exchange, transfer, custody and token-sale facilitation are the core triggers. If you are unsure, a formal activity analysis is the first step.
Second: is your corporate structure NBG-ready? That means a Georgian legal entity in good standing, a documented UBO chain, and a registered address that reflects genuine operations rather than a mail-forwarding service.
Third: is your compliance function built? A compliance officer with relevant experience, an AML/CFT policy suite tailored to your business model, and a transaction monitoring solution are the minimum viable compliance stack.
Fourth: is your banking strategy mapped? Identify the Georgia-based and cross-border banking relationships you will need before registration, and begin those conversations in parallel.
Fifth: have you mapped the cross-border regulatory position? If you serve, or intend to serve, users in the EU, UK, US or other regulated markets, identify what additional licences those markets require and build a sequenced roadmap.
Operators who can answer all five questions affirmatively before filing are in a materially stronger position than those who file first and discover the gaps under regulatory scrutiny.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – our full-service approach to VASP authorisation across 70+ jurisdictions
- UAE (VARA/Dubai) vs. BVI: Where to License – a structured comparison of two major offshore and Gulf licensing destinations
- Corporate Bank Account Opening for Digital-Asset Firms – legal counsel for VASP banking across EMI and traditional bank channels
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and by the complexity of the business model. In Georgia, a well-prepared VASP registration application is typically processed within a matter of weeks to a few months. Gaps in AML documentation or UBO disclosure are the most common causes of delay. Across other jurisdictions, timelines range from several weeks for straightforward registrations to six months or more for full authorisations under MiCA or the MAS Payment Services Act regime.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on your target market, your business model, your institutional counterparty requirements and your cost base. Georgia suits operators targeting the CIS corridor who need a tax-efficient base with genuine substance. EU-facing businesses typically require a MiCA-passportable authorisation. Gulf-market operators often look to VARA or ADGM/FSRA. We map the full licensing stack – operating, custody and payment layers – before recommending a jurisdiction sequence.
Do I need a separate custody licence?
In most leading jurisdictions, custody of virtual assets for third parties is a separately regulated activity. Under MiCA, custody and administration of crypto-assets on behalf of clients is a distinct CASP service. Under VARA and the ADGM/FSRA framework, custody is a separately licensed activity. In Georgia, the NBG's VASP perimeter covers custodial wallet services, so businesses providing custody should confirm whether their registration covers that activity specifically. We regularly advise operators on the custody layer as part of the broader licensing stack.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around each mandate. We map the licence stack across operating, custody and payment layers before you commit – structuring licensing, banking and tax as one mandate rather than three disconnected workstreams. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy and cross-border licensing structures for digital-asset operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.