Custody in the Language of the Law — What Virtual Asset Service Means
The Organic Law of Georgia on the National Bank of Georgia defines a virtual asset as a digital expression of value that is interchangeable and not unique, is the subject of digital transfer or trading and is used for investment and/or payment purposes. A convertible virtual asset is a virtual asset that has an equivalent market value in national or foreign currency, in another virtual asset or in a financial instrument. The whole category system for services is built around convertible assets, and custody is one of its central categories.
The law recognises as virtual asset service: the exchange of convertible virtual assets (including through self-service kiosks) into currency, other assets or instruments; transfer; and the storage/administration of a convertible virtual asset or of the instruments required to use it, which give control over the asset; as well as portfolio management (other than collective portfolio management), administration of a trading platform, lending of the asset and services around an initial offering. For a custody business model the decisive formula is “storage/administration that gives control over the virtual asset” — it determines that managing private keys and administering other control instruments fall under the same regime. A VASP is a person that provides such services for the benefit of another person.
Registration with the National Bank — the Entry Gate
Article 52-5 of the law sets a strict entry rule: a virtual asset service provider must register with the National Bank of Georgia and satisfy its requirements. The rules for registration, deregistration and regulation are established by a normative act of the National Bank. It is impermissible to provide the service by a person that is not a provider registered with the National Bank or a financial sector representative whose own sectoral legislation grants it that authority. When planning a custody service, this means the choice of structure — a standalone company or a member of an existing group — must begin with an analysis of the registration requirements.
The specialisation norm matters no less: a provider is prohibited from carrying out any activity other than the provision of virtual asset services, the auxiliary activity necessary for them and the exchange of its own virtual asset. A custodian concurrently running another business breaches this boundary — in structuring, the restriction must be planned at group level.
National Bank Requirements for Custodians
Article 52-5 grants the National Bank broad powers that touch every layer of a custody business. The bank may require and receive information on the sources of the provider’s capital and on the direct and beneficial owners of a significant share; by legal act it sets requirements for holders of a significant share and suitability criteria for administrators. It establishes the minimum supervisory capital and its calculation, criteria towards capital and assets, and generally the requirements flowing from the category of service provided.
For custody, the storage and risk block is central: the bank sets standards for the storage of virtual assets and for the management of risks — including operational and cybersecurity risks — and requires a general risk-management framework and effective internal control. Additionally, to protect consumer rights the bank issues dedicated legal acts and establishes a liquidation procedure for providers. Supervision encompasses written instructions, additional requirements, restrictions and sanctions; for a defined term and/or condition the bank may even release a provider from particular norms.
Inspection, Restrictions and Sanctions
The National Bank inspects a provider on-site and/or remotely for compliance with legislation and with its own requirements, audits accounting documents, reporting components and other materials, and within its competence demands any information, including confidential information. The sanctioning toolkit is powerful: for violation of the law and of the bank’s legal acts, the bank imposes a sanction on the provider and its administrator under its own procedure, including a monetary fine, which is paid into the state budget.
The international sanctions contour deserves separate note: the bank may suspend or restrict particular activities or operations of a provider or of an authorised financial sector representative — including by types of virtual assets — and also business relations with other providers, where these generate increased money laundering or terrorism financing risks, a risk of evading international financial sanctions, or hinder the traceability of executed transactions and supervision. A custody structure must be designed against these risk scenarios in advance.
Frequently Asked Questions
What counts as custody under the law?
The storage/administration of a convertible virtual asset or of instruments required to use it, giving control over the asset — one of the categories of virtual asset service, treated as a VASP category subject to National Bank registration.
Can custody be provided without registration?
No. Providing the service by an unregistered person is impermissible; the only exception is a financial sector representative whose own regulatory legislation grants it the authority.
What activities may a provider pursue?
Only virtual asset services, the auxiliary activity necessary for them and the exchange of its own virtual asset. Any other business must be carved out into a separate structure.
What does the National Bank require on capital and security?
Minimum supervisory capital and its calculation, criteria towards capital and assets, standards for storage and for operational and cybersecurity risk management, plus a risk-management framework and internal control.
How We Help on Legal.ge
The Legal.ge team steers custody business structuring from registration to supervisory readiness: we select the legal form and group structure with the specialisation limit in mind, prepare the capital and ownership file, draft storage and cybersecurity policies and run the registration process with the National Bank. Contact us to assess your project and build a compliant plan.