Crypto in Georgia: VASP Registration, What the National Bank Requires, and What It Costs You in Practice

For several years Georgia was known in crypto circles as a jurisdiction where a company could operate with very little regulatory friction. That period is over. Georgia introduced a Virtual Asset Service Provider regime, supervised by the National Bank of Georgia, and the practical position now is that a business providing virtual asset services must be registered before it operates.

Which activities are caught

The regime follows the international definition of a virtual asset service provider closely. In outline it captures a person who, as a business, provides:

• Exchange between virtual assets and fiat currency.
• Exchange between one virtual asset and another.
• Transfer of virtual assets.
• Custody or administration of virtual assets, or of the instruments that control them.
• Participation in and provision of financial services related to the offer or sale of a virtual asset.
• Lending, borrowing and comparable services in virtual assets, where offered as a business.

Mining for one's own account and holding one's own assets are treated differently from providing a service to others. The perimeter question is always the same: are you doing this for other people, as a business?

What the National Bank looks at

• A Georgian legal entity with transparent ownership up to identifiable beneficial owners.
• Fit and proper assessment of owners, directors and key function holders.
• Capital and financial standing appropriate to the activity, maintained continuously.
• Governance: internal controls, risk management, business continuity, and outsourcing arrangements described rather than asserted.
• Information security and custody arrangements - key management, cold and hot wallet policy, incident response.
• A full AML/CFT programme, including the travel rule for virtual asset transfers, blockchain analytics, sanctions screening, and reporting to the Financial Monitoring Service of Georgia.
• Segregation of client assets from the provider's own assets, with the mechanism evidenced.

Custody and key management, examined closely

For any model that holds customer assets, the National Bank pays particular attention to how private keys are controlled, because that is where customer losses actually happen. Expect to describe, and evidence, a concrete key-management policy: the split between cold and hot storage, who can authorise a movement of assets, whether multi-signature or equivalent controls apply, how keys are backed up and recovered, and how a security incident is detected and responded to. Client assets should be segregated from the provider's own, so that customer holdings are identifiable and returnable and do not form part of the provider's estate if it fails. A custody model that cannot be explained in operational detail is not ready to file.

The AML programme, specifically

For a VASP the anti-money-laundering file is the application. It has to work on the day it is inspected.

1. Business risk assessment covering customers, products, geographies, channels and asset types.
2. Customer due diligence, with enhanced measures for higher-risk relationships and politically exposed persons.
3. Wallet screening and transaction monitoring, with the analytics provider named and the escalation path defined.
4. Travel rule compliance for transfers between providers, including how you handle counterparties that cannot receive the data.
5. Sanctions screening at onboarding and continuously, with a documented false-positive procedure.
6. Suspicious transaction reporting, record retention, training and independent testing.

The travel rule, in practice

The travel rule is the part of a VASP AML programme that catches applicants off guard, because it depends on parties you do not control. When virtual assets move between providers, originator and beneficiary information has to travel with the transfer. Your programme has to specify how you collect and transmit that data, how you receive and check it on inbound transfers, and - the hard case - what you do when a counterparty cannot receive or return the required information. The National Bank wants to see a defined, documented policy for that gap, not an aspiration that every counterparty will be compliant.

Banking, which is the real constraint

Registration does not entitle a business to a bank account. Georgian banks apply their own risk appetite to crypto, and it is narrow. Expect a bank to ask for the registration, the AML programme, the analytics arrangements, the source of the company's funds, the flow of funds through the product, and named officers. Budget more time for banking than for the registration itself, and do not sign customer commitments before the account exists.

Tax

• Corporate income tax follows the general Estonian-model rules: 15% on distributed profit, with reinvested profit generally untaxed until it leaves the company.
• VAT treatment depends on the service and the customer, and must be assessed for each revenue stream rather than assumed.
• Personal taxation of crypto gains for individuals has its own treatment and has been the subject of specific guidance; it should be confirmed case by case rather than taken from a forum post.

Timeline, honestly

A VASP registration is a project measured in months, not weeks, and the banking relationship often takes longer than the registration itself. The pace is set by how quickly the applicant can produce evidence rather than intentions: a real AML programme, a described and tested custody model, named and vetted officers, and answers to the National Bank's follow-up questions. The sequencing matters too - registration first, then banking - and neither should be assumed to complete on a fixed date. Do not make customer or investor commitments that depend on a registration or an account that does not yet exist.

How Trustlex approaches crypto files

We begin with a perimeter analysis - what the product does, for whom, with whose assets - and give a written answer on whether registration is required. If it is, we scope the governance, AML and technology work, and we say honestly what the banking prospects look like for that specific model before the engagement starts.