One Structure — Many Jurisdictions
A gambling operator working across several jurisdictions finds itself in a single KYC/AML space: the obligations of the Georgian accountable person extend to the activity of the group’s other members as the Law on Facilitating the Suppression of Money Laundering and Terrorism Financing defines. Three norms create the frame of this space: enhanced preventive measures, high-risk jurisdictions and group-level compliance control.
The practical conclusion is simple: multi-jurisdictionality does not dissolve KYC/AML — it consolidates it into one system on loan. That is why planning the structure should begin with the design of compliance, and not the other way around.
Enhanced Preventive Measures
Article 18 provides: the accountable person is obliged, in accordance with the identified risks, towards a client assigned to a high level of risk, in addition to the general preventive measures, to carry out the following: obtain additional information on the assets and activity of the client and/or beneficial owner; increase the frequency of updating identification data; obtain additional information on the intended nature of the business relationship, including the purposes and grounds of expected transactions; and obtain senior management permission to establish or continue the relationship.
This last element — management permission — is a question of organisational design: in a group structure it must be determined who is “senior management” in each jurisdiction and at which level this decision converges. Otherwise a high-risk relationship begins in one country and continues in another without the control the first one had.
High-Risk Jurisdictions
Article 19 defines: a high-risk jurisdiction is a country or territory where the anti-money-laundering and counter-terrorist-financing system has serious deficiencies. The list is approved by the National Bank of Georgia on the submission of the Service and amended as necessary. Towards a person located in such a jurisdiction, the accountable person must carry out risk-, relationship- and transaction-proportionate enhanced measures.
The frame also covers specific cases: where the client is a legal entity registered in a high-risk jurisdiction, its branch registered in Georgia, or its management or operation is carried out from there; where the client’s registration and/or actual residence is there; and where the transaction is made through a financial institution located in that jurisdiction. Exceptions exist too: for a Georgian citizen or a foreigner with a residence permit enhanced measures are not mandatory; likewise where the financial institution in that jurisdiction is a subsidiary of a Georgian one and the group-level compliance system ensures risk management. The international block — the public statements of the Financial Action Task Force — is a separate ground for measures by the competent authority.
Group-Level Compliance Control
Article 30 is the central norm: an accountable person that is a head enterprise registered in Georgia is obliged to implement a group-level compliance control system which defines the rules for the dissemination of information among the group’s members; the rules for providing to the person or unit responsible for the system’s operation, and to the group’s members, information on clients, beneficial owners and their transactions; and mechanisms for protecting confidentiality.
The design of information flows inside the system is no less important: the study of unusual transactions, the detection of suspicious transactions and risk assessment work only when current data from every member of the group converges in one analytical centre. Two decisive provisions complete it: a subsidiary or branch registered in another jurisdiction must fulfil the requirements of the Georgian law where the legislation of its jurisdiction of location is less strict; and where that jurisdiction restricts the fulfilment of these requirements, the accountable person is obliged to timely provide information to the supervisory authority and take additional measures. Where the measures are insufficient, the supervisory authority is entitled to demand the restriction or even cessation of the activity of the subsidiary or branch.
Practice shows that the weak point of such systems is not the norms but execution: local teams perceive the group standard as an alien burden and keep parallel records. The solution is for the unified system to be a working instrument rather than a document: shared client bases, end-to-end queues for enhanced measures and a single journal of management decisions. Then compliance ceases to depend on the diligence of an individual employee and becomes a property of the architecture itself.
Frequently Asked Questions
What does a high-risk client require?
Additional information on assets and activity, increased frequency of updates, substantiation of the purposes of transactions and senior management permission to start or continue the relationship.
Where does the accountable person learn about high-risk jurisdictions?
From the list approved by the National Bank, subject to updating on the submission of the Service.
How do Georgian requirements extend to foreign subsidiaries?
Through the group-level system: where local law is less strict, the Georgian standard applies; where it restricts — informing the supervisor and additional measures are needed.
Can cessation of a branch be demanded?
Yes — where measures are insufficient, the supervisory authority may demand the restriction or cessation of the subsidiary’s or branch’s activity.
How We Help on Legal.ge
We will build a unified multi-jurisdictional KYC/AML system: risk assessment, procedures of enhanced measures, group-level control provisions and the rules of supervisory communication. Contact us on Legal.ge — many jurisdictions in one structure are governed only by one system.