Cybersecurity and Operational Resilience After VASP Registration

It’s not enough precise to define a regulatory application as “We’re launching our cryptocurrency platform”.

Customers can convert cryptocurrency to fiat? Will the platform be able to move virtual assets? The company will be able to control clients’ wallets or private keys? Will it manage the trading platform or lend against digital assets?

These differences are important when seeking a crypto license in Georgia because the services the company plans to offer determine its preparation for the regulatory process as well as documentation, controls and capital requirements.

Georgia could be a desirable location for fintech firms but to enter its virtual-asset market today requires more than just registering a business and creating a website.

The definition of the service

In the framework outlined by PB Services, businesses providing covered virtual asset services to third-party clients must be registered as virtual asset service providers to the National Bank of Georgia.

The scope covers activities including virtual-asset exchange, transfer, administration of trading platforms and custody of cryptocurrency management. It is important to note that the provided regulations state that the concept of custody also applies to the administration of a customer’s private account or key.

The technical structure of the cryptocurrency product is important to its place in terms of regulation.

A founder interested to obtain a crypto licence in Georgia should map the customer’s journey in creating the application. What happens when a customer makes a deposit of their funds? Who owns the wallet? Can assets be traded, or transferred? Which authority authorizes the transactions?

The answers are clear and help determine what the firm will be doing.

Your Business Plan Should Describe the real business

VASP applications need more than an appealing pitch deck.

According to the provided information according to the provided information, the National Bank expects a detailed business plan containing financial projections covering at least three years, including revenues, expenses, as well as growth assumptions. The plan must also demonstrate genuine intent to do business in Georgia.

This requirement should be addressed early.

A business model designed to be used by investors addresses questions such as how quickly the company can grow. A regulation-based business plan should also explain how the operation will be conducted in a responsible manner.

Georgian applicants for a vasp license shouldn’t view the commercial model as if they were not connected. Instead, they should connect them.

AML can’t be added at the End

PB Services describes the preparation as a series of steps that cover anti-money laundering, as well as counter-terrorism controls.

The material provided specifically warns that just importing an AML policy from another state is insufficient because Georgian laws must be incorporated into the company’s framework.

Furthermore, the operating systems are essential. The business plan must demonstrate that the company’s system can identify potentially suspicious and related transactions.

It is essential to consider compliance as an element in the development of products. By creating a platform, then determining how AML will function it can lead to inefficient delays and have to redesign.

Capital Depends on the Services You Choose

The business model should be determined at an early stage is vital for a variety of reasons, including the requirement for capital.

In accordance with the requirements in the source materials for exchange and transfer, including kiosks have to be at or near 150,000 GEL. Management of a trading platform for trading requires 350,000 GEL and other covered services need 250,000 GEL. If there are multiple services offered the threshold which is the highest is used.

This is separate from ordinary capital for investment or operating. The application has to be accompanied by proof of the requested amount has been funded.

A founder planning to get crypto blockchain license in Georgia should consequently consider regulatory capital during financial planning not after the rest of the application has already been assembled.

Registration isn’t enough to complete the Compliance Work

The compliance calendar does not disappear at the moment of approval. The provided requirements detail regular obligations related to cybersecurity and risk management technology resilience and fraud risk, and retention of records, independent review and complaints from customers.

For instance an independent auditor’s view on the risk management framework should be obtained within 12 months of registration. The described complaint-handling rules also oblige businesses to take complaints in written, oral, or electronic form, review them within a maximum of one month, and then provide the data on complaints electronically to National Bank each month.

These details affect the way serious applicants should be approached when seeking licensing.

Instead of thinking of the Georgian VASP application as a set of documents that must be completed to get permission imagine it as a design for an regulated business.

It is vital that the company structure and technology, AML controls and regulatory capital, along with customer processes, are in sync.

Georgia continues to provide opportunities for fintech and crypto companies. Its regulatory framework offers a clear way to enter the market. The best place to begin is not by asking how fast a license can be granted.

It is essential to clearly describe what your crypto-business will do, and demonstrate that you’re able to adhere to Georgia’s rules.

Scroll to Top