Compliance Programs Under Georgian Law: What Is Mandatory
The most detailed statutory model for developing a corporate compliance program in Georgian law is the Georgian law on the prevention of money laundering and the financing of terrorism. In this corpus, Article 29 regulates the internal instruction and the compliance control system itself, Article 8 reflects the risk-based approach, Article 30 governs the group level, and Article 24 governs proportionality. This page is about program design — operational oversight and inspections are the subject of a sibling page.
For a company this means the documentary foundation of a compliance program must begin with Georgian statute rather than with international manuals: a program written otherwise will not withstand substantiation before the supervisory authority.
The Internal Instruction: the Core of the Program and Its Mandatory Elements
Under Article 29, the accountable person must introduce internal control policies, rules, systems and mechanisms proportionate to the nature and volume of its activity and the associated risks. To introduce the system, an internal instruction is developed, approved by the governing body or by a person holding leadership authority.
The internal instruction must define: the rights and duties of the head of the responsible person or structural unit and of its staff; staff selection rules for hiring persons of high qualification and reputation; the continuing staff training program; and an independent audit function for checking the effectiveness of the system.
The system must be headed at the top hierarchical level, with an effective opportunity to obtain information in due time and the right to decide independently on submitting reports; responsibility for effectiveness rests with a specific member of the governing body or a person holding leadership authority.
The Risk-Based Approach: the Design Principle of the Program
Article 8 requires the accountable person, considering the nature and volume of its activity, to introduce an effective system for assessing and managing risks. Assessment and recording proceed with appropriate periodicity, and for a head enterprise also at group level. The assessment is based on the client and the beneficial owner, the essence of their activity and its jurisdiction, the product, service or delivery channel, the transaction and other risk factors.
Before introducing a new technology, product or service, or before any other material change in business practice, the associated risks must be assessed. The client’s risk level is determined before a one-off transaction or the establishment of a relationship, and then periodically and upon material changes in circumstances. Effective measures are carried out to manage and reduce the identified risks.
In its assessment, the accountable person takes into account the national risk assessment report and action plan, as well as the instructions and recommendations of the Service and the supervisory authority. On request, it must substantiate to the supervisory authority that it assessed the risks properly and carried out effective measures — a program is judged by its documented ability to work, not by paper.