Georgia's anti-money laundering and counter-terrorist financing duties depend on the business, activity and applicable supervisory rules. A bank, VASP, accountant and lawyer do not all have identical reporting responsibilities. The first task is to establish whether the person is an obliged entity for the activity in question and which authority supervises it.

The law and the authorities

The principal legislation is the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism. The current Georgian text and subsequent amendments should be checked together with the rules issued for the relevant sector.

The Financial Monitoring Service (FMS) is Georgia's financial intelligence unit. It receives and analyses reports and other information and disseminates the results to competent authorities where the statutory grounds exist. Its financial intelligence role is separate from sector-specific compliance supervision.

The National Bank of Georgia supervises AML/CFT compliance for specified financial-sector entities, including banks, payment service providers and VASPs. Other obliged entities have the supervisory arrangements prescribed by the law.

Which activities need assessment?

The law covers listed financial institutions and specified non-financial businesses and professions. Professional services may be covered when particular transactions or activities are undertaken; the fact that a person is a lawyer or accountant does not make every client instruction reportable in the same way.

The statutory exceptions and protections relating to legal advice, proceedings and professional secrecy also need to be applied correctly. A general website description cannot replace that activity-specific assessment.

Customer checks and beneficial ownership

Obliged entities need procedures for identifying and verifying customers, understanding the purpose of a relationship and identifying the individuals who ultimately own or control a client. The AML law's corporate beneficial-ownership test includes direct or indirect ownership of 25% or more of shares or voting rights, as well as control by other means.

A percentage is not the whole test. Ownership chains, voting arrangements, trusts and other means of control can require further examination. If no beneficial owner is identified after the necessary measures, the law specifies the treatment of the relevant senior management.

The risk assessment should consider the customer, geography, service, delivery channel and transactions. Higher risk may require enhanced measures, including investigation of source of funds or wealth where applicable. A bank's request for further documents is not, by itself, an accusation of wrongdoing.

Monitoring, reporting and records

Businesses must be able to identify unusual activity, investigate it and escalate suspicions through their approved procedures. A suspicious-activity reporting duty is not avoided simply because a transaction is below a monetary threshold. Staff also need clear instructions about confidentiality and prohibited disclosure.

The law generally requires relevant customer and transaction records to be kept for five years, with the starting point depending on the record and activity. A reasoned request from the competent authority can extend retention within the statutory limits. Other sectoral obligations may require different or additional records.

Reporting deadlines depend on the report and the applicable law or FMS rule. They should not be replaced with a single generic deadline for every notification.

VASP requirements in 2026

Providing regulated virtual asset services for another person requires NBG registration. Calling the business a technology company does not determine its classification. The registration system is separate from company incorporation.

The August 2026 amendments add general VASP capital and risk-management requirements, with transition dates for qualifying existing providers. Stablecoin initial offerings have separate approval, capital, reserve and reporting requirements, including the September 2026 changes. Our crypto and blockchain practice page explains those distinctions and links to the official rules.

Transfer-information requirements, often called the Travel Rule, also need a separate implementation assessment. They should be built into customer, transaction and technology procedures rather than treated as a paragraph in an AML manual.

A compliance review should test the actual operation

Confirm the obliged-entity status, regulator and services provided.
Update customer checks, beneficial-owner records and the business risk assessment.
Test transaction monitoring, escalation and reporting arrangements.
Allocate responsibility for sanctions, training, outsourced work and management oversight.
Check records, access controls, retention and incident handling.
Address deficiencies and retain evidence of the corrective work.

We review policies against the business's real activities, prepare legal documentation and assist with regulatory correspondence. A template manual or a foreign group's policy should not be assumed to satisfy Georgian requirements without adaptation.

Georgia's Anti-Money Laundering Framework: Compliance in 2026