Is there a separate security statute for the crypto business?

No. There is no stand-alone regime; the binding requirements flow from accountable-person status — the virtual asset service provider is on the list of financial institutions and must implement a compliance control system.

What is the accompanying information for a convertible virtual asset transfer?

It is information materially connected with a transfer or receipt, whose composition is determined by the supervisory organ under an established procedure. The provider must ensure its accompaniment, and the receiving provider examines whether a reporting ground exists if the transfer lacks identification data.

What must the internal instruction contain?

The rights and duties of the responsible person or unit, staff selection rules, a continuing training programme and an independent audit function to check the system's effectiveness. The instruction is approved by the governing body or a person with managerial authority.

What is the penalty for non-compliance?

Failure to comply with the statutory requirements results in a warning, and a repeated act in a fine of 1 000 lari. A special, separate liability regime applies to accountable persons.

Crypto Security Compliance in Tbilisi, Georgia

Crypto business security: which rules are binding

There is no separate cybersecurity statute for the crypto business in Georgia — not for exchanges and not for wallet-service providers. The binding legal frame that imposes security and control requirements on such a business flows from its status as an accountable person: by listing the virtual asset service provider among financial institutions, the Law of Georgia on the Prevention of Money Laundering and Terrorism Financing obliges it to implement a compliance control system and to ensure that transfers are accompanied by the required accompanying information. On this page we explain what this means in practice and what consequences a breach carries.

Accountable-person status and its circle

The law defines three groups of accountable persons: financial institutions, persons engaged in non-financial activity and public institutions. The virtual asset service provider is listed directly among financial institutions — alongside commercial banks, microfinance organizations, payment service providers and others. The crypto business thus receives its security standards not from a stand-alone act but from the common regime extended to the whole financial sector. Moreover, the law's requirements extend to other persons conditionally: an advocate or a notary, for example, becomes an accountable person where he or she serves a client in matters that include the management of money, securities or convertible virtual assets, management of a bank account, creation of a legal person or the purchase and sale of shares. Certain forms of professional activity — including the giving of legal advice and representation before a court — fall outside these requirements.

Convertible virtual asset transfers and accompanying information

The law separately defines the operation of a transfer of a convertible virtual asset: an operation performed by digital means, by or on the instruction or with the consent of the initiator, to make a convertible virtual asset available to a recipient; the initiator and the recipient may be one and the same person. Two direct requirements attach to these operations. First, the virtual asset service provider must ensure that a transfer or receipt of a convertible virtual asset is accompanied by accompanying information determined under the procedure established by the supervisory organ. Second, the provider of the recipient of a convertible virtual asset must examine whether a ground exists for submitting a report where the transfer does not fully contain the identification data of the initiator or the recipient in accordance with the established procedure. Technically this means that the transfer system must be built from the start so that accompanying data are recorded and retained — retrofitting this onto a running platform is far more expensive.