DeFi protocol frontend in Georgia
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Georgia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD/EDD (identification and verification of customers, beneficial owners, business purpose) under Law N5183-IIs and NBG Resolution N111/04.
- Ongoing transaction monitoring to ensure consistency with customer risk profile.
- Reporting of suspicious transactions (STRs) to LEPL Financial Monitoring Service of Georgia.
- Risk assessment frameworks (business-wide and customer-specific) required.
- Appointment of an AML/CFT officer.
- Record-keeping for at least 5 years post-relationship or transaction (CDD info, transaction records, STR correspondence, risk assessments).
- No-tipping-off prohibition regarding STR submissions.
- Simplified Due Diligence (SDD) permitted in lower-risk scenarios as defined by NBG.
Key Restrictions
- Operator must be a legal entity registered in Georgia with a registered office in Georgia.
- Must obtain a VASP Authorization from the National Bank of Georgia (NBG) if the frontend performs any regulated VASP activity (exchange between virtual assets and fiat, exchange between virtual assets, transfer of virtual assets, custody/safekeeping, or participation in issuance/sale of virtual assets).
- Minimum share capital of 1,000,000 GEL required for VASP license.
- Sufficient operational capital to cover operational risks must be maintained.
- Fee-taking from users for frontend services likely triggers classification under VASP categories (exchange/transfer), making licensing mandatory.
- Geofencing/KYC obligations are mandatory — the NBG's AML rules apply to all VASPs; a 'permissionless-only' frontend with no screening likely violates KYC/CDD requirements.
Key Risks
- Enforcement risk: Operating without a VASP license while taking fees or facilitating transfers could expose operator to NBG enforcement actions, fines, or criminal liability.
- Regulatory ambiguity: Whether a purely non-custodial frontend that only routes users to smart contracts (without taking custody) falls under 'transfer of virtual assets' is not explicitly clarified — NBG may take an expansive view.
- If the frontend does not take fees and merely provides informational access, it may fall outside VASP definitions, but this is untested in Georgian jurisprudence.
- High licensing burden (1,000,000 GEL capital) may be prohibitive for smaller DeFi projects.
- AML compliance obligations (CDD, transaction monitoring) are structurally difficult for non-custodial frontends that do not control the smart contracts.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
National Bank of Georgia (NBG): The central bank is the sole licensing and supervisory authority for VASPs in Georgia.
Exchange between virtual assets and fiat currencies.
Exchange between one or more forms of virtual assets.
Transfer of virtual assets.
Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets (custody services).
Participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.
Required License: VASP Authorization from the NBG.
Legal Entity: The applicant must be a legal entity registered in Georgia.
Minimum Capital Requirements:
As of recent implementations, the required share capital for a VASP is 1,000,000 GEL (Georgian Lari).
In addition, VASPs must maintain sufficient operational capital to cover their operational risks and costs.
Applicants must establish and implement robust Anti-Money Laundering (AML) and Know Your Customer (KYC) policies and procedures in compliance with the Law of Georgia on Facilitating the Suppression of Money Laundering and the Financing of Terrorism and relevant NBG regulations.
Customer due diligence (CDD) and enhanced due diligence (EDD) procedures.
Reporting of suspicious transactions (STRs) to the Financial Monitoring Service of Georgia (FMS).
Risk assessment frameworks (business-wide and customer-specific).
Appointment of an AML/CFT officer.
A significant local presence is required, including:
A registered office in Georgia.
Law of Georgia on Facilitating the Suppression of Money Laundering and Terrorism Financing (Law N5183-IIs, adopted December 29, 2006, as amended): This is the fundamental AML/CFT law in Georgia. It was significantly amended in 2023 to explicitly include Virtual Asset Service Providers (VASPs) as "obliged entities" (or "reporting entities"), bringing them under the scope of AML/CFT regulations.
National Bank of Georgia (NBG) Resolution N111/04 of July 13, 2023, "On Approving the Rules for Regulation of Activities of Virtual Asset Service Providers": This crucial resolution by the NBG provides detailed rules and guidelines for the licensing, supervision, and AML/CFT compliance of VASPs. It elaborates on the requirements stipulated in the main AML law.
Identification and Verification of the Customer:
Purpose and Intended Nature of the Business Relationship:
Continuously monitoring the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including the source of funds or wealth.
Identification of Suspicion: VASPs must establish systems and controls to identify transactions or activities that are unusual or give rise to a suspicion of money laundering or terrorism financing.
Reporting Obligation: If a VASP knows, suspects, or has reasonable grounds to suspect that funds are the proceeds of a criminal activity, or are related to terrorism financing, it must promptly report this to the LEPL Financial Monitoring Service of Georgia.
No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that a STR has been, or will be, submitted.
Duration: Records must be kept for a period of at least five years following the termination of a business relationship or the date of an occasional transaction.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A DeFi frontend serving Georgian residents that takes fees or facilitates transfers/exchange of virtual assets is a regulated VASP requiring an NBG license (1,000,000 GEL capital, local entity, full AML/KYC program); a purely non-fee informational frontend may fall outside VASP definitions but the boundary is untested.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?