Operating a crypto exchange in Georgia: what the law demands
Opening a cryptocurrency exchange in Georgia is governed not by a separate exchange-licensing statute but by the regime of the Law of Georgia on the Prevention of Money Laundering and Terrorism Financing: the virtual asset service provider is listed directly among accountable persons, and this status obliges an exchange to maintain the full set of client identification, transfer-accompaniment and internal control duties owed to its own customers. On this page we explain the concepts that operate within this regime, what the law demands regarding the client, and how an exchange should build its processes.
The exchange as an accountable person
In the list of accountable persons, within the group of financial institutions, the law names the virtual asset service provider directly. An exchange that provides clients with services in virtual assets thereby becomes an accountable person before the state — obliged to carry out the preventive measures established by law towards its clients. This status is not a formality: the law prohibits establishing or continuing a business relationship, and concluding or executing a one-off transaction, where the accountable person cannot carry out the prescribed measures, and in such a case it must examine whether a ground for submitting a report exists.
The core concepts through which an exchange operates
The law's definitions govern the exchange's daily operations. An account is a unique means of recording a client's money, securities, electronic money or convertible virtual asset with a commercial bank, brokerage company, payment service provider or virtual asset service provider. Identification is the obtaining of data about a person that make it possible to trace the person and distinguish the person from any other; verification is the obtaining of information enabling the accountable person to double-check the accuracy of the identification data obtained and, in the case of a beneficial owner, to be sure that the owner's identity is known to it. A client is a person who establishes a business relationship with the accountable person or concludes a one-off transaction with it in order to use its services. A suspicious transaction is a transaction for which a well-founded suspicion exists that it was prepared or executed on the basis of unlawfully obtained property, for the purpose of money laundering, or is connected with the financing of terrorism.
Convertible virtual asset transfers
The operational core of an exchange — the movement of assets — is defined by law as a transfer of a convertible virtual asset: an operation performed by digital means, by the initiator or on the initiator's instruction or with the initiator's consent, to make the asset available to a recipient. Two requirements attach to these transfers: the provider must ensure that a transfer or receipt is accompanied by the accompanying information determined under the procedure established by the supervisory organ; and the provider of the recipient must examine the existence of a ground for reporting where the transfer does not fully contain the identification data of the initiator or the recipient. In practice this means that the account and transfer system of the exchange must be designed from the outset for the transmission and retention of these data.
Preventive measures towards clients
The law obliges the accountable person, in the prescribed cases, to carry out preventive measures: identification of the client and verification of the client relying on a reliable, independent source; identification of the beneficial owner and taking reasonable measures to verify the owner; establishing the purpose and intended nature of the business relationship; and monitoring of the business relationship. In identification, the person acting in the client's name must also be identified and a document confirming the authority of representation, duly certified, must be obtained; towards a legal person, the structure of ownership and control must be studied; in establishing the purpose, the essence of the client's activity must be determined and information on the expected character, volume and frequency of transactions obtained. Monitoring entails examining a transaction for its consistency with the information known about the client, the client's commercial or professional activity and the client's risk level, and periodically updating the data obtained. Where a person is connected with sanctions, the law prohibits the relationship and requires a report to the service.
How we can help
We assist in assessing an exchange model against the criteria of an accountable person: we determine which of your services triggers which requirement, draft the client onboarding and verification procedures, and plan the technical implementation of accompanying information and monitoring. Contact us — we will assess your project under the current legislation.
For an exchange it also matters that the list of preventive measures covers the full client cycle — from first contact to the end of the relationship: even a one-off transaction rests on the same rules as a continuing relationship, and monitoring requires the data to be updated when the information known about the client changes. That is why an exchange preparing for an audit should not start by writing documents: the first step is to determine which operations remain entirely uncontrolled and where that creates risk. Our approach begins precisely with this analysis — first a map of the processes, and only then the documentary and technical completion.
The institution of the beneficial owner deserves separate mention: identifying the natural person behind a legal entity or another structure is often the hardest stage, especially where control structures are spread across several jurisdictions. At this stage the law demands reasonable measures — meaning a documented attempt and a record of the outcome, which becomes the basis for defending the position of the exchange during an inspection. The data-update requirement works by the same logic: a client onboarded once is not a permanent result, and a change in the risk level demands a review of the procedures.