Buying a ready-made VASP license in Georgia

Foreign entrepreneurs usually look for a platform already registered for work with virtual assets. That shortens the start-up process. Corporate re-registration is only one stage of a deal with an operating virtual asset provider, a VASP. In addition, the National Bank of Georgia (NBG) assesses incoming owners, persons in ultimate control and company managers against the requirements set for VASP status in Georgia.

This memorandum sets out how a company already holding VASP status is bought and what governs retention of that status after the owners change. It deals in turn with the target's earlier activity, its compliance record, its IT infrastructure and the possible grounds for deregistration. The term "VASP license" is in wide use, yet Georgian law provides for mandatory registration of that provider rather than for classic licensing.

Scope of what passes to the buyer

Provider status is no separate asset that could pass to another person on its own. The transaction is built around the legal person entered on the NBG's VASP register.

Foreign investors treat such structures as a way into the market through a company already in place. That can remove particular stages of the initial launch, though corporate re-registration remains only part of the process. A change among partners or shareholders triggers a separate NBG assessment of the incoming controlling persons and managers.

The corporate form determines what is bought: a participation interest in an LLC, shares in a JSC. With it the buyer takes control of a working company, together with:

• rights and obligations under concluded agreements;
• risks arising from earlier breaches of regulator requirements;
• financial resources and other assets;
• obligations still owed to customers and to business partners;
• the tax and litigation history.

Registration cannot be broken off and sold as one element of a business among others. Rights to a website, digital platform, domain name, trade designation or client portfolio may pass without conveying provider status. Regulated operations are lawful only for the party that controls the entity on the NBG register.

VASP status in Georgia attaches to a specific legal person, confirmed by NBG regulatory data and the administrative act issued in respect of it. Corporate information about the target must be checked against a separate source, the public registry kept by NAPR.

Once ownership changes, whoever now holds VASP status in Georgia must continue to satisfy every condition on which the regulated activity depends. A company without the relevant registration may not serve convertible virtual assets. Buying such a business therefore means verifying the corporate transfer, and with it whether buyer and company meet the requirements on management and office infrastructure, on technology and on AML/CFT.

Crypto license in Georgia: registration and central bank oversight

Market usage speaks of a license, though in substance the regime is a mandatory entry of the provider on a dedicated register. Principal regulatory powers sit with the NBG, which considers applications, supervises registered organizations and may annul any status it has granted.

Financial intelligence tasks rest with the Financial Monitoring Service. That body receives information on suspicious transactions and evaluates the material filed by the entities that owe reporting duties. Supervision over VASP status in Georgia joins central bank control to obligatory AML/CFT measures. To serve clients lawfully a legal entity must first complete registration and obtain provider status. These acts set the requirements:

• the Organic Law on the National Bank of Georgia;
• NBG Order No. 94/04, which sets out entry conditions, the grounds on which status ends and how VASPs are supervised;
• the Law on Facilitating the Prevention of Money Laundering and the Financing of Terrorism;
• the Law on Registration Fees;
• other instruments on sanctions restrictions, internal monitoring and information accompanying transfers.

First entry on the VASP register in Georgia costs GEL 5,000. It is charged for a new provider and forms no part of the purchase price of an operating organization that holds VASP status in Georgia. The registration act is not limited to a fixed term of one, three or five years, and remains in force only while the established conditions are met.

Georgian legislation on virtual assets grants the NBG wide supervisory powers. The regulator may request documents; carry out on-site and remote inspections; issue binding instructions; restrict particular operations; impose fines; and strike a company from the register. From January 1, 2026 the administrative act confirming registration must be on display at the head office and branches, on the website and in the application as well as through other service channels.

Registration grants no blanket permission over the whole field of virtual assets. The services a provider may offer are limited to those declared in its registration filing.

Permitted scope under a crypto license in Georgia

A company fixes the services it intends to offer before it obtains status. It gives the NBG those particulars, including asset categories, the settlement mechanism and its dealings with counterparties. The permitted profile follows the Organic Law cited above and the regulator's own requirements. Crypto-to-fiat exchange falls within the permitted scope. The permitted scope likewise covers swaps between one digital asset and another and their conversion into financial instruments. Permitted activities run to transfers and custody; to administration of the instruments conferring control over a virtual asset; to individual portfolio management; to credit operations; and to participation in an initial offering.

The registration file shows precisely what a target may do. VASP status in Georgia does not automatically widen the product list after the purchase.

Registered services and the subject of a check.

What the market calls a crypto exchange license is often an entry limited to conversion alone. Such a provider may not launch custody services or run a trading venue without further formalities. Any change to the site, application, payment channel, token list or fund movement also calls for regulatory assessment.

A company applying to run an exchange must declare that it will operate a trading venue, and describe its architecture. Settlement scheme participants, software suppliers, storage of information and supervision of operations all appear in the file. Issuance of stable virtual assets has been governed since March 2026 by a separate NBG instrument. The buyer should match the registered lines of work against the intended business model in advance, since the existing status may not fit planned operations. So narrow a registration does not extend to wallet services, lending or an exchange without a change of documents. Buying a company that already has VASP status in Georgia shortens the corporate stage, but the need to approve new products and rebuild the operating scheme remains.

Legal structure of the transfer

A registered provider changes hands at corporate level. In an LLC the participation interest is re-registered, whereas a JSC transfers the agreed number of shares. NAPR enters the new owner in the corporate register.

Recording the share transfer does not equate to regulatory approval. The NBG separately assesses changes bearing on VASP status in Georgia. Both the entire ownership chain and the ultimate beneficiaries must therefore be disclosed before the acquisition, since a corporate register entry is no substitute for meeting the sector requirements.

A holding above 10% of capital or votes is significant. That status arises equally where a person can exercise material influence irrespective of the formal participation size. VASP status in Georgia survives only once control has been verified, whether direct or indirect. That check covers related persons, close relatives, voting arrangements and actual management.

The procedure comprises eight consecutive actions:

• checking the target's corporate and regulatory standing;
• identifying the direct buyer and the full ownership chain;
• preparing documents on the ultimate beneficiaries and future management;
• signing an agreement with conditions precedent;
• filing the particulars with the NBG;
• entering changes of corporate structure in the NAPR register;
• transferring legal and technical control;
• updating the particulars at the supervisory authority, credit institutions and settlement counterparties.

Re-registration becomes necessary where participation reaches 20, 30 or 50%, and equally where actual control is established. Planned changes go to the regulator before the deal closes. The new direct owner, indirect participant, ultimate beneficiary and administrator each pass a business reputation and financial soundness check.

Appointment of a director is subject to separate regulatory clearance. Appointing a new manager cannot be completed as a standard corporate action without sector assessment. Conditions precedent in the disposal agreement should cover NBG approval, the absence of regulatory restrictions and survival of the current registration.

An acquirer has no power to act for the company until the prescribed supervisory procedures are observed. After closing, the company lodges updated records with the NBG and the Public Registry, with its banks and payment operators and in its own systems. Earlier powers, digital keys and wallet access are subject to termination as soon as management changes hands.

Want to consult?

Contact our experts and get answers to your questions.

Book a consultation

Requirements applied to the incoming owner

The owner requirements behind VASP status in Georgia serve to establish who in fact controls the organization. A buyer discloses direct participants, intermediate companies and ultimate natural persons. An opaque chain, or an inability to identify the beneficiary, is a ground for refusing approval.

The NBG traces both the funding of the deal and the origin of the acquirer's wealth. Financial position, debts, instances of insolvency and participation in other regulated organizations all fall within the assessment. Bankruptcies of previously managed companies, enforcement proceedings and operations that harmed financial sector clients are analysed.

Candidates for VASP status in Georgia must produce criminal-record documents from states where they were resident over the last 10 years. A local certificate must be no more than 15 calendar days old at filing. Foreign records remain admissible for 60 days from issue. Materials from other states require apostille or legalization, translation into Georgian and official certification.

The scope of regulatory scrutiny follows the legal position of the person under review.

Criteria for checking transaction parties.

Documents for the purchase comprise ownership structure and certificates of no criminal record, plus income data, bank statements and professional experience. Managers of the provider must possess a qualification evidenced by specialist education or by management experience in finance or in a virtual asset business. A special rule applies where the sole partner is manager too: the structure must then include no fewer than two directors. No citizenship restrictions apply to owners and managers, so a foreign investor may control the company. Actual management is nonetheless exercised from the head office inside the country. The AML/CFT officer and the administrator are separate posts, each carrying responsibility of its own. Their duties may rest with a single specialist where such a combination does not breach the applicable rules.

Verifying the target before purchase

Assessment of VASP status in Georgia starts by confirming its holder's current standing in the NBG register. Next come the administrative act and declared services, then the operating schemes, the notices and the correspondence with the regulator. The public list does not reveal every fine or instruction, nor supervisory procedures in progress.

Legal review encompasses the charter, founding agreement, NAPR extract and amendment history. Pledges of shares and options call for separate examination, as do arrangements among participants, court disputes and enforcement proceedings. Where the corporate register diverges from NBG data, an explanation is required before signature.

A full audit assesses the following groups of information:

• the business ownership scheme and restrictions envisaged for owners;
• supervisory authorities' requirements and measures already taken;
• IT solutions, internet resources and applications;
• AML/CFT documents and processes for detecting and preventing the legalization of unlawful funds, client files included;
• intellectual property rights;
• accounting and tax documentation;
• HR records and the credentials of the managers;
• agreements with banks and payment operators.

Internal control mechanisms come under the same scrutiny. It covers client identification, disclosure of ultimate beneficiaries, the treatment of politically exposed persons and sanctions screening. Reports made to the Financial Monitoring Service are examined as well, along with observance of the information retention periods.

A check on the holder of VASP status in Georgia extends to the legal structure and, beyond it, the technology behind the business. Buyers must study the lawful grounds for using software and domain names, the terms on which server and cloud services are supplied, and how wallets and access credentials are controlled. The system must log operations, record user actions and detect suspicious or unusual activity automatically.

A dormant target carries a distinct risk of its own. The regulator may cancel registration where the organization has not begun to supply services within six months of entry, or has stopped work for longer than that period.

Requirements on premises, AML/CFT and IT

Rules for providers require a principal office inside the country. Core management processes must run at the officially stated location. A virtual location, post-office box or nominal workplace does not confirm actual presence.

VASP status in Georgia presupposes physical separation of its own premises from those of outsiders. Documents, employees and electronic systems must be open to NBG inspection. Absence from the declared address, or obstruction of an inspection, constitutes grounds for sanctions and for withdrawal of registration.

Under VASP status in Georgia regulated servicing may not pass to agents. No third party may take on clients, conduct exchange, run the cash desk or operate behind the company's registration as an unregulated front. Foreign citizenship of the director is admissible, though remote nominal management does not replace work from the head office.

An acquirer reviews the following operational components:

• the compliance rulebook and the procedures for analysing risks arising from the business;
• the in-house AML/CFT procedures and the risk-scoring system behind them;
• mechanisms for keeping cryptographic keys and client assets;
• digital mechanisms for recording transactions;
• web resources, software solutions and registered domain names;
• user action logs;
• settlement channels, among them bank accounts and payment instruments;
• the automated mechanism controlling transactional activity.

Regulatory conditions for registering a provider depend on the client service model. Where cash settlement is used, video surveillance must cover the cashier area, the internal space and the adjoining territory at the head office and at every branch. The provider keeps recordings for no less than 30 days and produces them on the regulator's demand.

To introduce remote KYC a provider must pass the prescribed approval procedure. The platform in use must keep a record of client liabilities, trace data adjustments and retrieve necessary information promptly from the head office. A change of software platform, site, application, service supplier or storage location requires notice to the regulator.

Buying a company that already holds VASP status in Georgia gives no guarantee that banking service will continue. The instruments set no universal requirement that the account be with a Georgian bank, yet settlement infrastructure must correspond to the registered scheme. Once the ultimate owner changes, a financial organization or payment operator may start a fresh compliance review and decline further service.

Conclusion

A ready-made VASP in Georgia is acquired as a legal person already entitled to operate as such. The new owner takes control, while the company itself stays subject to National Bank requirements. A thorough check of an operating VASP license in Georgia presupposes analysis of the corporate structure and the controlling persons. It extends to the procedures against money laundering and the financing of crime, the technology and the regulatory record. Serious breaches that surface may bear on whether registration survives, and on the banking relationships behind it.