Custodial wallet / SaaS in Georgia

National Bank of Georgia (NBG): The central bank is the sole licensing and supervisory authority for VASPs in Georgia.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets (custody services).

Required License: VASP Authorization from the NBG.

Legal Entity: The applicant must be a legal entity registered in Georgia.

Minimum Capital Requirements:

Applicants must meet minimum share capital requirements. The specific amounts are typically defined in NBG resolutions.

As of recent implementations, the required share capital for a VASP is 1,000,000 GEL (Georgian Lari).

A significant local presence is required, including:

A registered office in Georgia.

Applicants must establish and implement robust Anti-Money Laundering (AML) and Know Your Customer (KYC) policies and procedures in compliance with the Law of Georgia on Facilitating the Suppression of Money Laundering and the Financing of Terrorism and relevant NBG regulations.

Customer due diligence (CDD) and enhanced due diligence (EDD) procedures.

Reporting of suspicious transactions (STRs) to the Financial Monitoring Service of Georgia (FMS).

Risk assessment frameworks (business-wide and customer-specific).

Appointment of an AML/CFT officer.

Law of Georgia on Facilitating the Suppression of Money Laundering and Terrorism Financing (Law N5183-IIs, adopted December 29, 2006, as amended): This is the fundamental AML/CFT law in Georgia. It was significantly amended in 2023 to explicitly include Virtual Asset Service Providers (VASPs) as "obliged entities" (or "reporting entities"), bringing them under the scope of AML/CFT regulations.

National Bank of Georgia (NBG) Resolution N111/04 of July 13, 2023, "On Approving the Rules for Regulation of Activities of Virtual Asset Service Providers": This crucial resolution by the NBG provides detailed rules and guidelines for the licensing, supervision, and AML/CFT compliance of VASPs. It elaborates on the requirements stipulated in the main AML law.

National Bank of Georgia (NBG) Resolution N111/04 of July 13, 2023, "On Approving the Rules for Regulation of Activities of Virtual Asset Service Providers": This crucial resolution by the NBG provides detailed rules and guidelines for the licensing, supervision, and AML/CFT compliance of VASPs. It elaborates on the requirements stipulated in the main AML law.

Identification and Verification of the Customer:

For Individuals: Obtaining and verifying details such as full name, date and place of birth, address, nationality, and identification document details (e.g., passport or ID card number, issuing authority, expiry date). Verification typically involves reliable, independent source documents or data.

For Legal Entities: Obtaining and verifying the legal entity's name, legal form, registration number, registered address, and the names of individuals authorized to act on behalf of the entity. Verification involves official corporate documents.

Identification of Beneficial Owner(s):

Identifying the natural person(s) who ultimately own or control the customer, and verifying their identity. This applies to both individual and legal entity customers. For legal entities, this typically means identifying individuals holding 25% or more of the shares or voting rights, or otherwise exercising control.

Purpose and Intended Nature of the Business Relationship:

Continuously monitoring the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including the source of funds or wealth.

Enhanced Due Diligence (EDD):

Simplified Due Diligence (SDD):

Identification of Suspicion: VASPs must establish systems and controls to identify transactions or activities that are unusual or give rise to a suspicion of money laundering or terrorism financing.

Reporting Obligation: If a VASP knows, suspects, or has reasonable grounds to suspect that funds are the proceeds of a criminal activity, or are related to terrorism financing, it must promptly report this to the LEPL Financial Monitoring Service of Georgia.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that a STR has been, or will be, submitted.

Duration: Records must be kept for a period of at least five years following the termination of a business relationship or the date of an occasional transaction.

Types of Records:

No specific "custodial license" for digital assets.

No explicit crypto-specific asset segregation rules.

The GDBF, in its supervisory role, would expect sound internal controls and accounting practices to clearly distinguish customer assets from company assets, regardless of explicit crypto-specific rules.

No specific mandate for cold storage in Georgia's current laws or guidance.

As of my last update (early 2024), there is no specific, comprehensive digital asset custody legislation actively moving through the Georgia General Assembly that would create a distinct licensing framework or specific rules for digital asset custodians (like those seen in states such as Wyoming or New York).