A virtual-asset business in Georgia can reach the regulator's register one of two ways: through the National Bank of Georgia's (NBG) own registration process from a blank company, or by taking over a company that has already been through it. Buy a Ready-Made Crypto License in Georgia is about the second route, and choosing it reshapes what the buyer's team actually needs to check before signing anything. The question stops being only what the target will be allowed to do going forward and becomes what it already carries with it, meaning the rights, obligations, and track record built up before the sale. That is why ownership structure, the management team, internal controls, the IT system, and the compliance history all end up under examination.
Buy a Ready-Made Crypto License in Georgia: What the Deal Involves and the Rights the Investor Gains
Ask a Georgian lawyer to sell you just the paperwork and you will get a short answer: the framework has no procedure for it. What a buyer actually walks away with in every one of these deals is corporate ownership, an interest in the legal entity the NBG put on its register, since the regulatory status is a property of that entity rather than a permit a person can hold in their own name. "License" is the word everyone uses out of habit; the formal term underneath it is virtual asset service provider registration.
The registration itself belongs to the legal entity within the NBG's special regime and carries over when the company is re-registered in the cases the rules allow for.
How this status is granted, kept, and revoked is set out in the Rules on the Registration, Deregistration and Regulation of Virtual Asset Service Providers, approved by NBG Order No. 94/04.
One detail that catches buyers off guard: a "ready-made crypto license" is never a piece of paper that moves independently of the company. It is baked into that one legal entity, so a deal built around handing over "just the license" is already a red flag before anything else gets checked.
A ready-made crypto license in Georgia is tied to one specific company, its registered name, and its identification number, so buying it apart from the entity that holds it is not an option. Along with the entity, the buyer takes on its liabilities and, where the target is a joint-stock company, its shares together with its accumulated compliance record.
Foreign investors face no outright ban on owning such a company, though the incoming owner still goes through the vetting the regulator requires. What sets a ready-made VASP company in Georgia apart from an ordinary company is the lending restriction attached to it: a provider is barred from extending virtual assets as loans to individuals.
Buyers used to plain-vanilla M&A sometimes assume that restriction dies with the previous owner once a new one takes over. It does not: the prohibition rides with the VASP status itself, so whoever ends up in control inherits the same limit on day one.
Before a provider status is even granted, the NBG reviews how the service will actually be delivered. The filing has to document money and data flows, the parties to each settlement, how information is passed along, and which counterparties are involved. That is why, once you buy a VASP company in Georgia, reshaping the business model on your own afterward is not possible; any change to the declared list of services has to go through the NBG's established approval procedure first.
A separate regime applies to stable virtual assets. A standard crypto exchange license in Georgia, in the everyday commercial sense the term is normally used, does not by itself authorize a public offering of a stable virtual asset. That specific activity requires the registered VASP to obtain the National Bank's prior written approval under its own dedicated rules, which govern reserve backing, disclosure, and the underlying organizational arrangements.
The decision to buy a ready-made crypto business in Georgia does not touch the legal status of the Georgian lari. The Organic Law of Georgia "On the National Bank of Georgia" settles that question directly: the lari, not a digital asset, functions as legal tender, and a company's own service list only opens a narrow window for the specific virtual-asset activity the NBG has actually cleared it to run.
A change of participant in the company, correspondingly, is handled as a corporate matter. The National Bank reviews the change of ownership itself and the background of anyone gaining material influence over how the provider operates.
It is worth remembering that this vetting is not a rubber stamp triggered by the size of the check the buyer writes: a well-funded newcomer with a thin compliance background can be turned down just as readily as an under-capitalized one, since the NBG is assessing the person, not the price tag.
An alternative to buying an existing organization is VASP registration in Georgia through incorporating a new legal entity instead. Nobody gets a first-time review started without settling the state duty first, and the figure the National Bank sets for that duty is GEL 5,000.
Weighed against that timeline, the appeal of buying an existing VASP becomes obvious: a startup route can stretch out for months once extensions and corrections are counted, while an acquisition can close as soon as the regulatory approval on the ownership change comes through, on top of whatever the two sides need to agree commercially.
What Services a Licensed Georgian VASP Can Provide
Provider status under Georgian law belongs to a "registered person" carrying out one or more of the activities the legislation classifies as regulated. A crypto license in Georgia does not amount to blanket permission to transact in every kind of digital asset; the actual scope of authority is defined by whichever specific activities that particular provider has declared to the National Bank.
Exactly which activities a given VASP may perform is fixed by the list of services it filed with the National Bank of Georgia, not by the registration itself. Through VASP services in Georgia, one company might be cleared only to convert virtual assets into fiat currency and back, while a neighbor on the same register runs a full stack: swapping one digital asset for another, executing transactions in financial instruments tied to those assets where the legal groundwork for that exists, transferring and safekeeping client holdings, administering the access credentials attached to them, and managing portfolios on an individual basis.
This is exactly why two companies holding the same VASP registration can be worth very different amounts on the secondary market: the paper status looks identical, but the declared activity behind it can be a single narrow function or a near-complete product suite.
Beyond serving clients directly, a VASP may separately declare that it runs a trading platform, extends credit in digital assets, or offers services tied to a primary issuance of such assets. A valid registration on its own tells a prospective buyer almost nothing about which of these a target is actually cleared to run, so the real due-diligence question is narrower and more specific than "is this VASP registered": it is which exact activities the NBG's own records attribute to that particular company.
A license to exchange crypto in Georgia, accordingly, presupposes that the VASP has specified the corresponding category of exchange operations when dealing with the National Bank. Its direct significant participant, any indirect owner, and the ultimate beneficial owner are all reviewed as a single category for this purpose.
A seller's marketing deck will happily list every service the company is theoretically capable of, which is not the same document as the one the NBG actually signed off on. Asking to see the filed service list itself, rather than a summary of it, is a small step that saves buyers from discovering the gap only after closing.
Terms for Owners and Executives When Control of a Georgian VASP Changes
An intention to buy a ready-made VASP in Georgia has to clear the NBG's approval process before it closes. Filings covering a planned change of significant owner, beneficial owner, or administrator are due at least 30 calendar days ahead of the change taking effect, a window that should not be confused with the 60-day period set for registering a new provider from scratch.
A separate track applies where a material change in ownership happens without a prior negotiated transaction, such as inheritance, a court ruling, or another corporate event affecting the company.
In a purchase of a crypto business in Georgia, that exception does not remove the prior-approval requirement itself; a person who has already come into control is, in the situations the rules cover, restricted in exercising the rights that come with that stake until the process is complete.
Because of that, re-registering a crypto license in Georgia is best structured as a share or asset purchase agreement in which the regulator's approval is made a closing condition. In the first stage the parties agree the terms and assemble the document package before anything closes; only then does the NBG's determination get carried out and the transfer of the stake or shares formally recorded.
Once corporate control changes hands, the regulator needs a clear picture of who will actually control the VASP and make its management decisions. The review accordingly reaches the full chain of controlling participants and shareholders, including ultimate beneficial owners and administrators, tracing it down to the individual people who exercise real control over the company.
Where the chain of ownership runs through several holding layers before reaching a real person, gathering the paperwork the NBG expects at every link is usually the single biggest time cost in the whole transaction, bigger, in most deals, than negotiating price.
In a purchase of a VASP in Georgia, the National Bank is entitled to look into where the incoming owners' assets and funds originate, their financial track record, and any involvement in other regulated organizations. It also reviews any history of insolvency, outstanding obligations of consequence, and links to activity that finances threats to public safety or to economic offenses.
How long a supporting certificate stays valid depends on its type, so anyone looking to buy a crypto company in Georgia as a foreigner should not assume the familiar blanket rule of "a document no older than three months" applies here.
This is one of the more common missteps among first-time buyers coming from other jurisdictions: they arrive with a set of background checks dated to a generic three-month rule and then have to redo part of the package once the NBG applies its own, shorter windows.
Georgian regulation sets the bar for "significant" deliberately low. A stake or voting power crossing the 10% mark brings scrutiny on its own, and so does any lesser stake that still amounts to real influence over the company; either way, ownership has to be traced all the way down to whoever the ultimate beneficial owner actually is. Sole-director setups do not survive the transition either, since a sole participant cannot simultaneously be the only director once the NBG is reviewing the file, which effectively forces the buyer toward at least two directors. Paperwork has its own shelf life here too: a certificate issued inside Georgia is only good for 15 days ahead of filing in the cases the rules specify, while one issued abroad stretches to 60 days.
Administrators are held to their own, separate professional criteria. Anyone weighing whether to buy a company with a crypto license in Georgia needs to work out in advance who will actually exercise the management and representative authority once the deal closes. The NBG looks at such individuals' education, professional background, reputation, and financial exposure. In the cases the rules specifically set out, a candidate needs at least two years of leadership experience in the financial sector or in virtual assets, and administrators are barred from holding the same role at another VASP at the same time, aside from the exceptions the rules carve out.
Contact our experts and get answers to your questions.
Taking Over an Already-Licensed Crypto Company in Georgia: Office, IT System, and AML/CFT After the Deal
Anyone who plans to buy a ready-made crypto company in Georgia inherits a physical-presence obligation along with it: the regulated entity has to maintain a genuine footprint in the country. The VASP's head office has to sit on Georgian territory and function as the place where the business is actually run, kept separate from any third party's premises and set up so the NBG can carry out inspections there. Formal registration at a mass-registration address, without the operating infrastructure behind it, does not meet that standard.
A shared coworking desk with a mailbox rarely clears this bar on its own. Inspectors are looking for a working office that could plausibly run the business day to day, not a forwarding address that exists purely to satisfy the paperwork.
Representation is where buying VASP licenses in Georgia tends to catch out a buyer used to running things remotely. It is not enough for someone to sit on the corporate file as a listed contact; whoever is empowered to act for the company has to physically spend 14 calendar days of every month inside the country, and the underlying registration records have to bear that presence out rather than merely assert it.
Physical service points bring their own additional requirements. Buying a licensed crypto company in Georgia that operates walk-in service points means inheriting the obligation to maintain video surveillance there. Recordings have to be kept for at least 30 days, and if a camera stops working, restoring it is mandatory rather than optional.
In practice, this is the part sellers gloss over fastest when marketing a "turnkey" license: an idle surveillance camera or a monitoring system that was never properly configured can turn into weeks of remediation before the new owner is actually operational.
The technology stack is itself part of the VASP's registration file. Buying a regulated crypto business in Georgia means taking on responsibility for the system that has already been built, its functionality, where the data sits, and whether it matches the services the company declared. The platform has to log operations, keep records and event logs intact, and make that information available to the regulator on request.
None of that runs itself, either. A Georgian VASP needs someone accountable for keeping its anti-money-laundering and counter-terrorist-financing controls, known throughout the industry as AML/CFT, actually working rather than just documented on paper. That accountability has to sit with a named person inside the company, not a policy binder on a shelf, and the framework that person runs is built on two things working together: rating how risky a given client or transaction actually is, and then screening the people and the money behind it rather than taking either at face value.
A compliance officer inherited from the seller is not automatically a safe bet, whatever the org chart says: what matters is whether that person has actually been running the monitoring day to day, not just holding the title on paper since the last inspection.
Watching for that risk in real time means automated tooling that can flag activity outside the ordinary pattern before it becomes a problem rather than after, and the same setup has to reach into distributed-ledger activity specifically, since that is exactly where identifying participants and tracing where a virtual asset has actually moved gets harder.
Legal Due Diligence Before Acquiring a VASP Company in Georgia
A folder full of past paperwork can look reassuring and still say nothing about how the target has actually been run lately, which is why a buyer's team goes back to the source rather than taking the file at face value: the official register of virtual asset service providers the National Bank of Georgia maintains, which shows the registration date, the registered name, the identification number, and the individual administrative act under which the entry was made. Beyond that, the company's own records of its declared scope of services, its correspondence with the regulator, the authority held by its executives, and any court decisions involving it are all worth pulling before anything else.
Due diligence on a crypto company in Georgia does not stop at the present-day snapshot; it has to run backward through the corporate structure for the whole period before the deal. Ownership history belongs in that backward look, along with the identity of the ultimate beneficial owners and any pledges over shares or stakes. Options that were granted and agreements struck among the owners matter too, as does the scope of executives' authority and any litigation on the company's record. A defect from years earlier can still attach to the company today, which is precisely why none of these gets skipped.
To verify a crypto license in Georgia, the declared scope of activity needs to be checked against what the company actually does day to day. That means looking at its clients, the transactions it has entered into, its head office, staff, software, where its data is stored, and how that software is actually used. Software licensing deserves its own separate look: whatever system the seller is running at the point the license changes hands stays with the company once control passes, so the buyer needs to confirm that continuity is contractually secured rather than assumed.
Whoever buys the company inherits its AML/CFT paper trail whether they read it closely or not, which is exactly the argument for reading it closely. A legal review of a crypto business in Georgia has to get past the policy documents themselves and into how those policies actually played out. That means client identification as it was really applied, risk scoring, transaction monitoring logs, custody controls, and the record of what happened the last time something suspicious came through. Several other items are worth pulling on their own: the internal procedures alongside the organization's own risk assessment; the paper trail from past regulatory inspections and NBG correspondence; anything on higher-risk clients or sanctions-list hits. The agreements behind the relationship with servicing banks, payment providers, custodial services, and liquidity counterparties belong on the same list, together with whatever those contracts say happens to them the moment corporate control of the VASP changes hands.
A binder of AML policies that reads well is not the same evidence as a log showing those policies actually caught something. The gap between the two is exactly where a buyer's real exposure tends to hide, and it rarely shows up unless someone goes looking for it specifically.
There is a separate track worth closing out before signing anything: how the VASP has actually handled its tax position, as opposed to what the regulatory file says about it. That means whether returns have been filed and what is owed has been paid, any discrepancies between the two, outstanding liabilities, and where the account with the Georgian tax authority currently stands. Registering with the National Bank does not, by itself, create a blanket 0% rate or exempt the company from the Tax Code, however favorably the wider tax environment is often described.
Sellers pitching Georgia's tax regime tend to quote the headline number and stop there, leaving out that the favorable rate applies to specific, correctly structured activity rather than to the company automatically. Confirming which of the target's actual revenue lines qualify, rather than assuming all of them do, belongs on the buyer's own checklist, not the seller's.
A clean AML file and a spotless registration record can still sit alongside an unpleasant tax surprise, since the two reviews run on entirely separate tracks. Treating tax due diligence as an afterthought is one of the more expensive assumptions a buyer can make here.
How to Structure the Purchase of a Ready-Made Crypto License in Georgia and Keep VASP Status
The question of how to buy a ready-made crypto license in Georgia does not reduce to a single signature; it runs on two parallel tracks that happen to share a closing date. One track is purely commercial, between buyer and seller. The other belongs to the NBG, and the same regime-violation risk sits on both, so neither can simply be skipped to save time.
On the commercial side, the target's standing has to be confirmed first: its entry in the official VASP register, the NBG's individual administrative act covering it, its declared lines of business, and its record of dealing with the regulator over the years it has operated. Only once that picture is clear does it make sense to work out who on the buying side will end up holding significant or indirect participation, who will carry ultimate beneficial owner status, and who will fill the key management posts, since the National Bank will be vetting those exact people once the filing goes in.
Price, the size of the stake or block of shares changing hands, and the seller's obligations get settled between the parties before anything is signed. What actually closes the transaction, though, is not that signature but the NBG's own determination: the regulatory handover proceeds only once the agreed preconditions are met, one of which is typically that determination itself.
Coordinating the commercial closing with the regulatory filing deadline is where deals most often slip: a signature that lands even a few days after the NBG's window has already passed forces the whole approval sequence to restart.
That is what makes the National Bank filing itself the hinge of the whole transaction: documentation on the planned change of significant owners, beneficial owners, and administrators has to reach the NBG ahead of completion, inside whatever deadline the rules attach to that particular change. Only after that clears does the National Agency of Public Registry (NAPR) update the corporate record to reflect the new stakes or shares, which is the point the deal is actually finished, not the point the contract was signed.
Two different moments can trigger the loss of VASP status, and buyers inheriting an existing registration should keep both in mind: something wrong with how the company was registered in the first place, or something it did wrong afterward, while actually operating. On the registration side, that means having submitted inaccurate information at the outset. The operating side covers considerably more ground. A provider can lose status for falling short on AML/CFT requirements or reporting duties, or for refusing to produce documents the NBG has asked for. Obstructing an inspection counts the same way, as does running without a monitoring system that actually matches the declared activity. Mishandling the procedure for changing significant owners, beneficial owners, or administrators is its own separate trigger. So is sitting idle for an extended stretch with no real activity. An elevated risk tied to financial misconduct, financing of unlawful activity, sanctions evasion, or untraceable transactions closes out the list, alongside the entity's own dissolution or other serious violations that keep repeating.
A surprising number of these grounds trace back to something the previous owner did, or failed to do, long before the sale, which is exactly why the due diligence steps described earlier are not a formality: a buyer who skips them can inherit a status that is already halfway to being pulled.
It also helps to remember that losing status is not always a single dramatic event. Regulators generally have room to freeze a company's activity temporarily while a problem gets fixed before reaching for the more drastic step of pulling the registration outright, so a buyer's first question about any red flag in the file should be which of the two outcomes actually happened, not just that something happened.
Buying a ready-made crypto business with a license in Georgia deserves particular caution wherever a seller offers to hand over the authorization separately from the company itself, tries to keep the NBG out of the process, suggests the business can run without a genuine office, or claims that every category of crypto service is instantly available the moment the deal closes.
None of those promises are technically possible under the regime described above, which is exactly why they are worth treating as a warning sign rather than a selling point: a buyer who hears any of them is better off walking the target back through the verification steps in this article before signing anything.
