Crypto License in Georgia 2026

Who actually needs registration and who may fall outside the VASP perimeter?

A business usually needs Georgia VASP analysis when it provides crypto services for clients, not only for itself. The strongest indicators that registration may be required are:

• operating a crypto exchange or brokerage desk for third parties;
• holding or controlling client assets or private keys;
• executing or arranging virtual asset transfers for customers;
• running an OTC desk where the company intermediates client trades;
• providing custodial wallet functionality or settlement services.

By contrast, some models may sit outside the core VASP perimeter or require only case-by-case analysis:

• proprietary trading with no client service element;
• mining-only operations that do not provide exchange or custody services to others;
• software-only vendors selling infrastructure without handling client assets;
• non-custodial wallet interfaces where the provider never controls private keys;
• certain DeFi frontends where the legal role depends on actual control, fee model, and user interaction design.

The underappreciated nuance is functional control. A company may call itself “non-custodial,” but if it can pause, route, approve, or practically control transfers, the legal analysis changes. This is why RUE starts Georgia projects with a scoping memo before company formation.

Activities Covered by a Crypto License in Georgia

A Georgia VASP analysis typically covers activities where the company provides crypto-related services to third parties with an intermediation, exchange, transfer, or custody element. Activities usually inside scope include:

• crypto-to-crypto exchange and crypto-to-fiat exchange;
• brokerage or arranged dealing for clients;
• custodial wallet services where the provider controls keys or transfer execution;
• virtual asset transfer services;
• OTC execution for customers.

Activities that should not be assumed to be automatically covered include:

• derivatives or leveraged products linked to crypto;
• token issuance, especially where securities, e-money, or collective investment rules may be relevant;
• staking, lending, yield products, or DeFi interfaces with complex control structures;
• white-label software sold without client-asset control.

The advanced distinction is between custodial and non-custodial design. The legal perimeter often turns on who controls private keys, who can initiate transfers, and whether the operator can practically intervene in user transactions.

Documents Required for a Georgia Crypto License Application

A strong Georgia VASP filing package normally includes:

• incorporation documents and registry extracts;
• shareholder and UBO disclosure documents;
• passports, IDs, CVs, and supporting records for directors and key persons;
• proof of address and office/lease documents;
• detailed business plan and financial projections;
• AML/CFT manual and business-wide risk assessment;
• KYC, sanctions, transaction monitoring, and reporting procedures;
• IT security policy, wallet governance description, and incident-response framework;
• vendor list for KYC, KYT, Travel Rule, hosting, and custody solutions;
• transaction flow maps and target market restrictions.

What regulators expect in the business plan and compliance pack

The business plan should read like an operating manual. It must explain customer types, onboarding logic, product flows, revenue model, excluded jurisdictions, outsourcing, governance, and risk controls. A two-page sales deck is not enough. The strongest applications also include a negative perimeter section stating which activities the company will not perform, such as derivatives, privacy-coin support, unhosted-wallet high-risk flows without EDD, or onboarding from sanctioned regions.

That negative perimeter is a subtle but powerful credibility signal because it shows the applicant understands not only what it wants to do, but also where it will deliberately stop.

The biggest trade-off: flexibility vs passporting

Georgia is usually chosen for speed, lower setup friction, and tax efficiency. It is usually not chosen for pan-European market access. If your commercial goal is to serve EU retail clients at scale, advertise across the European Union, or build a regulated institutional offering inside the EU, a MiCA license in Europe is often the more suitable long-term route.

Georgia works best when:

• the target market is not dependent on EU passporting;
• the founders want a faster launch and can accept banking workarounds;
• the business can maintain strong AML controls without the heavier EU cost base;
• cross-border offering is limited or carefully ring-fenced.

Georgia is usually a weaker fit when:

• the product needs direct EU retail scaling;
• institutional counterparties require EU-regulated status;
• the business model depends on broad fiat rails and card acquiring from day one;
• investors expect a MiCA migration path within the next funding cycle.

That is why RUE often compares Georgia with Lithuania, Malta, Dubai, and Singapore before recommending a final structure.