Ask a question!
In August 2026, the National Bank of Georgia adopted several regulatory acts at once that significantly alter the rules governing the Georgian crypto market.
When viewed individually, the changes in each document may seem like a set of new requirements: capital, reporting, cybersecurity, customer complaints, and fines. But when taken together, a much more significant trend becomes apparent.
Georgia is effectively completing the transition from a relatively lenient VASP registration model to full-fledged prudential supervision—a form of oversight that, by its very nature, increasingly resembles the regulation of other financial institutions.
For existing VASPs, this means they must restructure their internal processes and invest in compliance and IT. For new companies, it means a significantly higher barrier to entry.
At the same time, however, this does not appear to be an attempt by the government to drive the crypto business out of the country. Quite the opposite: the government is trying to transform it from a relatively free and nascent market into an institutional financial industry.
Let’s take a closer look at exactly what has changed and what market participants should prepare for.
How we got here
Mandatory registration of VASPs with the National Bank was introduced in Georgia as early as 2023. NBG Order No. 94/04 established requirements for registration, administrators, office space, software, and AML/CFT procedures.
Therefore, it would be incorrect to say that previously it was enough to simply register a company and start operating without any restrictions.
However, the initial Georgian regulatory model was largely built around AML/CFT, ownership transparency, and market access for companies.
Now, the very philosophy of supervision is changing.
Amendments to the Organic Law on the National Bank of Georgia have significantly expanded the NBG’s powers. Article 52⁵ explicitly authorizes the National Bank not only to register and inspect VASPs, but also to set requirements for capital, owners, and administrators; regulate specific categories of services; introduce risk-management standards; restrict activities; and impose sanctions.
The National Bank itself explicitly refers to the new model as “prudential supervision” and specifically mentions consumer protection, cybersecurity, and operational risk management. In developing the regulations, the NBG studied the European MiCA, the VARA regime in Dubai, approaches taken by the U.S., the U.K., and Singapore, as well as recommendations from the IMF and IOSCO.
It is precisely in this context that the August package of regulatory acts should be viewed.
Supervisory capital: The main new barrier to entry
One of the most significant changes was introduced by National Bank Order No. 207/04 to the main procedure for the registration and regulation of VASPs, Order No. 94/04.
A minimum supervisory capital requirement is established:
- 150,000 GEL—if the VASP engages in the exchange of virtual assets, including via crypto-ATMs/kiosks, and/or the transfer of virtual assets;
- 350,000 GEL—if the company operates a trading platform;
- 250,000 GEL — for other VASP services, with the exception of the initial offering of stablecoins, for which a special regime applies.
If a VASP provides several types of services simultaneously, the highest of the applicable minimums applies.
But there is an important caveat here. 150,000 or 350,000 lari—this is not simply an amount that can be shown once in a bank account at the time of registration. The law specifically refers to regulatory capital, which a VASP is required to maintain at all times.
At least 75 % of this capital must consist of primary capital. Secondary capital is limited to one-third of the primary capital. The rules also specify which financial instruments may be included in the capital and provide for deductions, such as the residual value of intangible assets.
If capital falls below the established level, the VASP must notify the NBG and submit a plan to restore it. Until the violation is remedied, capital distributions, payments on relevant instruments, bonuses, and other transactions leading to an outflow of funds may be restricted.
In other words, this reflects the classic logic of prudential regulation: the regulator is concerned not only with who owns the company and whether it complies with AML requirements, but also with whether it is financially capable of sustaining its own operations and managing the associated risks.
The rules have already changed for new VASPs
This is where it is particularly important to distinguish between existing and new market participants.
For VASPs registered before Order No. 207/04 took effect, a transition period is provided: they must bring their risk-management framework into compliance by July 1, 2027, and meet the supervisory capital requirements by September 1, 2027.
However, there is no such grace period for new applications.
A bank statement confirming the deposit of the minimum supervisory capital has been explicitly added to the list of documents required for VASP registration.
Therefore, a company that has just registered a Georgian LLC but has not yet filed an application with the NBG does not become an “existing VASP” solely based on the date of the legal entity’s registration.
It is the VASP status itself that is of key importance.
There is a narrow transitional exception: Order No. 207/04 explicitly states that it does not apply to relevant administrative proceedings initiated before the amendments took effect. Therefore, pending applications submitted earlier must be considered separately.
For all other new projects, the economics of entering the market now look completely different.
Whereas previously a significant portion of a VASP project’s budget went toward legal support, AML compliance, office space, staff, and technical infrastructure, this is now supplemented by at least 150,000–350,000 lari in regulatory capital.
This immediately changes the profile of potential market participants.
A VASP is no longer just a registration but a continuously operating compliance system
The second fundamental change is the requirements for risk management.
A VASP must have a comprehensive system for identifying, assessing, monitoring, and managing risks. This covers operational risks, cybersecurity, the resilience of the technological infrastructure, fraud risk, outsourcing, business continuity, data quality, and other risks associated with the company’s specific services.
The regulator specifically requires the ability to obtain consolidated data, maintain event and incident logs, and generate the information necessary for the NBG.
Cybersecurity regulations are particularly noteworthy.
For critical systems, penetration testing must be conducted annually. For other systems, testing is conducted based on risk, but at least once every three years. Additional testing is required following significant changes to critical infrastructure.
Vulnerability scanning must be conducted at least twice a year.
Moreover, for a new VASP, the process does not end with drafting internal policies.
No later than 12 months after registration, the company must have an appropriate risk-management framework and a current report from a qualified independent auditor confirming compliance with a number of established requirements.
If critical or high-risk vulnerabilities are identified in the documentation or penetration test report, the NBG has the right to revoke the VASP’s registration or its authorization to provide the relevant type of service.
This is a very significant shift.
Previously, for a small crypto project, cybersecurity might have been viewed primarily as a technical issue: how well the server was protected and how competent the developer was.
Now it is a regulatory issue.
The existence of procedures, logs, tests, independent audits, and a documented incident response becomes part of a company’s right to remain in the market.
“We’ve written a policy” is no longer enough
Perhaps one of the most challenging aspects for some already-registered VASPs will not even be capital.
Raising money is relatively straightforward.
It is much more difficult to build an organization that can prove to the regulator that its internal documents truly reflect actual processes.
If the policy states that incident management is conducted, there must be an incident log.
If a business continuity procedure is specified, there must be an infrastructure in place that allows it to be carried out.
If a company manages outsourcing, there must be contracts, risk assessments, and monitoring of contractors.
If regular vulnerability scanning is specified, there must be scan results and confirmation of remediation.
This is precisely where the line will be drawn between a “paper VASP” and a truly functioning, regulated organization.
A special note: Consumer protection
Order No. 202/04 extends certain elements of the consumer protection regime currently in place in the financial sector to VASPs.
Starting January 1, 2027, VASPs will be required to receive and review user complaints.
Complaints may be filed verbally, in writing, or electronically. For written and electronic complaints, VASPs must acknowledge receipt, maintain appropriate records, and provide the outcome of the review no later than one month after receipt.
In addition, VASPs must submit statistics on received complaints to the National Bank by the 10th of each month.
At first glance, this appears to be a minor administrative change.
In reality, it is quite significant.
The regulator is beginning to view VASP customers not merely as participants in private crypto transactions, but as consumers of a regulated financial service.
For the companies themselves, this means they must establish a full-fledged complaints management process: a channel for submitting complaints, registration of requests, response times, designated staff members, and the maintenance of complaint histories and statistics.
In practice, for an actively operating VASP, this already implies, at a minimum, a CRM or ticketing system and a formalized workflow.
Stablecoins are becoming a separate regulated financial activity
A separate aspect of the reform concerns stablecoins.
Order No. 201/04 of August 21 introduces monthly reporting requirements for VASPs issuing stable virtual assets.
The first report must be submitted no later than October 15, 2026, and thereafter, reports must be filed monthly by the 10th of each month for the preceding calendar month.
The regulator receives information on the number of stablecoins issued and redeemed, the composition and location of reserves, the pegged currency, and the degree of coverage of liabilities.
Moreover, Order No. 201/04 is merely the reporting component of a much broader framework.
Back in March 2026, by Order No. 52/04, the NBG introduced a special regime for the initial offering of stable virtual assets. Stablecoins in circulation must be 100 % backed by reserve assets; requirements have been established regarding the composition of reserves, their segregation from the issuer’s capital, redemption, and the management of technological and operational risks.
In other words, Georgia’s stablecoin regime is gradually becoming much closer in its economic essence to the regulation of issuers of monetary or payment instruments than to the standard issuance of crypto-tokens.
Fines are only one part of enforcement
Order No. 204/04 expands the existing procedure for imposing sanctions on VASPs.
Depending on the violation, fines can reach up to 50,000 GEL.
For example, providing a service in violation of the service scheme agreed upon with the NBG may result in a fine of 20,000 GEL. Obstructing an inspection is punishable by a fine of 10,000 GEL, and failure to comply with a written request from the National Bank is punishable by a fine of 5,000 GEL for each instance. Liability also applies for failure to provide information or for providing it late.
Separate liability is imposed on VASP administrators: a fine of 5,000 GEL is imposed for improper performance of duties resulting in a violation of the law by the company. In the event of a repeat failure to comply with a requirement, the fine may be doubled.
It is particularly important to note that a financial fine is by no means the most severe possible measure.
The NBG may restrict operations, require the rectification of violations, take action against administrators, limit the distribution of profits, and ultimately revoke a VASP’s registration.
This means that compliance risk directly becomes a business continuity risk.
For a VASP owner, the issue is no longer simply whether potential fines can be factored into operating expenses. Systematic non-compliance can result in the loss of the very ability to operate.
A special liquidation procedure for vasps is even being introduced
At the end of August, another important document was adopted—one that’s easy to overlook amid the new capital requirements.
NBG Order No. 209/04 of August 27, 2026, establishes a special procedure for the liquidation of VASPs. It will take effect on September 1, 2028.
After deregistration, the liquidation process will be supervised by the NBG, and the liquidator will assume the powers of the VASP’s governing bodies.
The fate of client assets is of particular interest.
Clients’ fiat funds, clients’ virtual assets, property, and means of access to them transferred to the VASP as part of the provision of services, as well as the reserve assets of the stablecoin issuer, are explicitly not included in the VASP’s liquidation estate.
This is yet another element of a completely new regulatory framework.
The regulator is already thinking not only about how to register a company and oversee its operations, but also about how a VASP should safely exit the market and what will happen to its clients’ assets in the event of bankruptcy or deregistration.
This is what regulation of a mature financial sector typically looks like.
What does all this mean for existing vasps
For existing companies, the transition period may create a false impression that nothing needs to be done until mid-2027.
In practice, however, now is the time to start preparing.
It is relatively easy to bring capital up to the regulatory level before the deadline. Risk management is more complex: it will require an analysis of the current architecture, changes to internal procedures, penetration testing, vulnerability management, incident management, outsourcing controls, business continuity planning, preparation of supporting documentation, and, ultimately, an independent audit.
If this work begins in the spring of 2027, there may not be enough time to correct serious deficiencies.
In addition, the complaints regime will take effect on January 1.
Therefore, for many Georgian VASPs, 2026–2027 will effectively be a period of regulatory transformation.
The key dates are currently as follows:
- October 15, 2026—the first reporting deadline for eligible stablecoin issuers; followed by monthly reporting.
- January 1, 2027 — Rules for reviewing and handling VASP customer complaints take effect.
- July 1, 2027 — Previously registered VASPs must bring their risk-management frameworks into compliance with the new requirements.
- September 1, 2027 — previously registered VASPs must meet the supervisory capital requirements.
- January 1, 2028 — the NBG must bring old registration certificates and the registry into compliance with the new classification of services.
- September 1, 2028 — a special procedure for the liquidation of VASPs takes effect.
What does this mean for new players?
For a new VASP, the first change is obvious: the market has become more expensive.
The general idea of “let’s set up a Georgian LLC, prepare the documents, register the VASP, and then see if the business takes off” is now much less viable.
The project will require capital ranging from 150,000 to 350,000 GEL already at the registration stage, and this capital must then be maintained.
But that’s just the beginning of the expenses.
You’ll need to budget for compliance, AML, technical infrastructure, cybersecurity, penetration testing, vulnerability scanning, independent audits, risk management, and handling customer inquiries.
Therefore, before registration, it becomes particularly important to correctly define the scope of services.
Previously, an applicant might have been interested in describing its activities as broadly as possible “for the future.”
Now, each additional service can mean new regulatory obligations, additional risks, and, in some cases, a higher minimum capital requirement.
Moreover, activities must comply with the service scheme approved by the NBG: operating outside its scope is in itself grounds for sanctions.
This means that VASP design is gradually shifting from a legal task of “how to obtain registration” to a full-fledged task of regulatory architecture: what exactly the company will do, with which clients, through which systems, where custody will be held, who the counterparties will be, what data is stored, how assets are moved, and where the key risks lie.
The market will likely begin to consolidate
This is no longer a legal norm, but rather an economic conclusion drawn from current developments.
The introduction of fixed capital and significant fixed compliance costs almost inevitably increases the minimum economically viable scale for a VASP.
For a company that conducts only a few small transactions per month, maintaining all the necessary infrastructure may simply no longer make sense.
Therefore, over the next few years, we can expect a reduction in the number of passive, “standby,” and essentially paper VASPs.
Some owners may choose to deregister. Others may sell their companies. Some may consolidate their operations or switch to a model in which the regulated portion of the business is conducted through a larger partner.
Conversely, for large, actively operating VASPs, stricter regulation may even prove beneficial.
The higher the barriers to entry and compliance costs, the more difficult it is for new competitors to quickly enter the market.
Georgian VASPs are becoming more valuable, but for an entirely different reason
A few years ago, the appeal of Georgian VASPs was largely based on a relatively simple registration process and relatively low startup costs.
This advantage is gradually disappearing.
But another one is potentially emerging in its place.
If the NBG succeeds in establishing a functioning system of prudential supervision, Georgian registration could be viewed by counterparties not merely as a company’s entry in the registry, but as evidence that the organization maintains adequate capital, undergoes IT audits, has a risk-management system in place, and is subject to genuine oversight by the central bank.
This could potentially improve the attitude of banks, institutional counterparties, and large corporate clients toward Georgian VASPs.
Of course, Georgian VASP registration does not automatically guarantee a bank account or recognition abroad. Banks and foreign counterparties conduct their own risk assessments.
However, the quality of the jurisdiction itself as a crypto hub is determined not only by how easy it is to obtain registration there. For serious businesses, it is often more important how much trust other participants in the financial system place in that registration.
Does this mean that Georgia is becoming the “new MiCA”?
No.
Georgia is not copying the European MiCA, and Georgian VASP registration does not equate to a European crypto license.
But the direction it’s taking does align with the global trend.
The NBG itself confirms that, when developing the new framework, it analyzed MiCA, VARA, legislative initiatives in the U.S. and the U.K., Singapore’s regulatory framework, as well as materials from the IMF and IOSCO.
Therefore, it’s probably not worth expecting a return to the ultra-light VASP model.
On the contrary, it is logical to expect that regulation will continue to evolve: requirements regarding governance, safeguarding of client assets, reporting, outsourcing, owners, operational resilience, and specific types of crypto services may become more detailed over time.
At the same time, however, the government is betting on fintech
Against this backdrop, Georgian Government Resolution No. 409 on the establishment of the Interagency Council for the Development of Financial Technologies is particularly noteworthy.
The council includes representatives from the Ministry of Economy, the Ministry of Justice, the Ministry of Finance, the National Bank of Georgia (NBG), the Insurance Supervisory Authority, and the Communications Commission.
It has been tasked with preparing a national Fintech Development Strategy and a corresponding action plan. The council may engage market participants, international organizations, and experts, as well as establish specialized working groups.
This is an important political signal.
If the government’s goal were simply to restrict crypto activity as much as possible, a separate interagency body dedicated to fintech development would seem rather odd.
What is happening can be better described by the following formula: not less fintech—but more fintech, within a much stricter institutional framework.
What’s next
The main mistake right now is to view the August changes as a one-time set of requirements that only need to be met once.
Most likely, we are witnessing only the beginning of the second phase of regulation in Georgia’s crypto sector.
The first phase, from 2023 to 2025, involved bringing VASPs out of a virtually unregulated environment: registration, AML/CFT, and requirements for owners, administrators, and infrastructure.
The second phase—2026–2028—focuses on capital, risk management, cybersecurity, consumer protection, regulatory reporting, supervision, and orderly liquidation.
The next logical step could be further refinement of requirements regarding governance, client assets, outsourcing, reporting, and specific products.
Therefore, the strategy of “getting VASP authorization first and building compliance later” is gradually becoming ineffective.
A different approach is coming to the fore: first, a regulated financial business is designed—and VASP authorization is obtained specifically for that business.
Conclusion
Georgia is not shutting down the crypto market. It is doing something more important: raising the barrier to entry.
For small and minor projects, this is bad news. Operating as a VASP is becoming more expensive, the requirements are more complex, and the liability is greater.
For large, well-capitalized, and technologically mature companies, the situation may be the opposite. The exit of weaker players reduces competition, while increased oversight potentially enhances the international reputation of Georgia’s VASP sector.
Therefore, what is happening can be described as a transition from the era of “obtaining VASP registration” to the era of “building a VASP business”.
And this is, perhaps, the most significant change in the Georgian crypto market in 2026.
This article was prepared as of September 5, 2026.
Regulatory framework
The regulatory framework remains the Organic Law of Georgia on the National Bank of Georgia, specifically Article 52⁵ on the supervision of VASPs. The basic registration rules are established by NBG Order No. 94/04 dated June 13, 2023; Order No. 207/04 dated August 2026 added requirements regarding supervisory capital, risk management, and cybersecurity.
The sanctions procedure is governed by Order No. 133/04, as amended by Order No. 204/04. Consumer complaints are governed by the General Rules on Consumer Protection No. 32/04, as amended by Order No. 202/04. The stablecoin regime is based, in particular, on Orders No. 52/04 and No. 201/04. Government Resolution No. 409 established the Fintech Development Council, and NBG Order No. 209/04 approved the future special liquidation procedure for VASPs.
Frequently asked questions about the new requirements for VASPs in Georgia
What has changed for VASPs in Georgia in 2026?
The National Bank of Georgia has significantly tightened regulation of virtual asset service providers. New requirements have been introduced regarding supervisory capital, risk management systems, cybersecurity, the handling of customer complaints, reporting, IT audits, and regular testing of information systems. The NBG has also expanded its system of fines and supervisory measures.
What is the minimum capital requirement for VASPs in Georgia now?
The minimum supervisory capital depends on the services provided:
- 150,000 GEL — exchange and/or transfer of virtual assets;
- 350,000 GEL — operation of a trading platform;
- 250,000 GEL — other types of VASP services.
If a company provides multiple services, the highest minimum capital requirement among those specified for these services applies.
Is it enough to simply deposit 150,000 GEL into a bank account to register as a VASP?
Not exactly. The law requires not just having a certain amount in the account, but maintaining supervisory capital.
When submitting a new application, a bank statement is used as one form of proof that the required capital has been deposited; however, after registration, the company must continuously meet the requirements regarding the amount and structure of its capital.
Do existing VASPs need to have capital of 150,000—350,000 GEL right now?
A transition period has been established for VASPs registered before the new requirements took effect.
They must meet the supervisory capital requirements by September 1, 2027.
However, it is not advisable to wait until the last minute to prepare: companies need to determine their capital structure in advance and ensure that it complies with NBG requirements.
Does the extension until 2027 apply to new companies?
No. The transition period applies only to already registered VASPs.
If a legal entity is registered in Georgia but has not yet obtained VASP registration, the company’s registration date alone does not grant it the status of an active VASP.
For new applicants, the capital requirements effectively become part of the registration process.
What will happen to VASP applications that were submitted before the new rules took effect?
A transitional exception applies to administrative proceedings initiated before the relevant changes took effect.
Such cases must be analyzed on a case-by-case basis, taking into account the date the application was submitted, the stage of review, and the specific set of services declared.
What new requirements have been introduced for risk management?
A VASP must have a comprehensive risk management system that covers, in particular:
- operational risks;
- cybersecurity;
- IT infrastructure;
- fraud risk;
- outsourcing;
- business continuity;
- data quality and security;
- risks specific to particular VASP services.
The regulator expects not only the existence of internal documents but also their actual implementation.
Are VASPs required to conduct penetration testing?
Yes. For critical information systems, penetration testing must be conducted at least once a year.
For other systems—based on the level of risk, but no less frequently than once every three years.
Regular vulnerability scanning is also required—at least twice a year.
Do VASPs need an independent IT audit?
The new requirements mandate an independent verification of compliance with specific elements of the risk management and cybersecurity frameworks.
Therefore, for a VASP to operate fully, it must now account not only for legal and AML expenses but also for the costs of external audits, penetration testing, and cybersecurity assessments.
What has changed regarding the handling of customer complaints?
Starting January 1, 2027, VASPs must receive, record, and review customer complaints.
Written or electronic complaints must be reviewed within the established timeframe, and information about complaints must be organized and submitted to the National Bank as part of the required reporting.
What fines are imposed on VASPs?
Depending on the violation, fines can range from 1,000 to 50,000 GEL.
However, a monetary fine is not the only possible risk. The NBG may also issue mandatory orders, restrict operations, impose restrictions on the distribution of profits, take measures against administrators, and, in serious cases, revoke a VASP’s registration.
Can a VASP director or administrator be personally fined?
Yes. The new system provides for the personal liability of VASP administrators for certain violations and failure to properly fulfill their duties.
Thus, regulatory risk now exists not only for the company itself but also for its executives.
What new requirements have been introduced for stablecoin issuers?
VASPs that issue stable virtual assets are now required to submit regular reports to the NBG.
The regulator receives information on the number of tokens issued and redeemed, the volume and composition of reserves, the pegged currency, and the degree of coverage of liabilities.
Stablecoins are also subject to specific requirements regarding reserve assets and their collateralization.
Is Georgia closing its market to crypto companies?
No. Rather, the market model is changing.
Georgia continues to develop its fintech and crypto industries, but is gradually transitioning from a relatively simple VASP registration model to full-fledged financial supervision.
For serious companies, this may enhance the quality and reputation of the jurisdiction, but it will become significantly more difficult for small and nominal VASPs to meet the requirements financially.
Will it become more difficult to obtain a VASP license in Georgia?
Yes.
Applicants must now consider not only company registration, AML procedures, and infrastructure, but also supervisory capital, risk management, cybersecurity, internal processes, and ongoing compliance costs.
Therefore, it is advisable to structure a VASP project before submitting an application to the NBG.
What should existing VASPs do now?
First and foremost, they should conduct a regulatory gap analysis:
- verify the adequacy and structure of capital;
- analyze the current risk management framework;
- review cybersecurity policies and actual IT processes;
- prepare for penetration testing and vulnerability scanning;
- establish a complaints management process;
- review outsourcing arrangements;
- determine whether actual operations align with the approved service scheme;
- develop a plan to bring the company into compliance by the 2027 deadlines.
What should an investor or entrepreneur who is just planning to launch a VASP in Georgia consider?
First and foremost, you need to define a specific business model and the range of regulated services.
This will determine the minimum capital requirements, technical infrastructure, company structure, and compliance costs.
The approach of “obtaining the broadest possible VASP registration just in case” is becoming significantly less effective: each additional service can increase the regulatory burden.