Georgia KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Georgia.
- Last reviewed
- Last reviewed:
- Version
- Version 1.1
Portable implementation guide
Get the PDF checklist
11 control areas · 39 implementation checks
Last reviewed: 9 November 2026 · Version 1.1
Download the checklistDirect answer
What does the Georgia compliance checklist cover?
The Georgia checklist translates primary KYC, KYB and AML rules into 11 control areas and 39 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- Primary AML law
- Law on Facilitating the Prevention of Money Laundering and Financing of Terrorism
- FIU
- Financial Monitoring Service of Georgia
- General occasional-transaction CDD
- Above GEL 15,000, including linked transactions
- Occasional funds-transfer CDD
- Above GEL 3,000, including linked transfers
- Suspicious reporting
- On the day reasonable suspicion arises
- Beneficial owner
- 25% or more, more than 25%, other control, then manager
- Records
- 5 years; extension up to 5 more years may be requested
- FATF public lists
- Not listed at October 2026
Implementation detail
Georgia compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingClassify the activity and supervisor before launch.3 items+
Determine whether each activity is an accountable-person activity.
- Implementation action
- Map banking, payment, lending, securities, insurance, gambling, legal, accounting, real-estate, precious-metals, virtual-asset and other services to the current statutory perimeter; do not transfer one sector's rules to another.
- Evidence to retain
- Perimeter memo, service map and source register.
- Primary citation
- AML/CFT Law, Articles 3-4
Obtain every required licence or registration.
- Implementation action
- Confirm National Bank or other competent-authority requirements before banking, payment, electronic-money, securities, insurance, lending, exchange or virtual-asset activity.
- Evidence to retain
- Licence matrix, approvals, registrations and conditions.
- Primary citation
- Applicable sector law and supervisory rules
Use FMS and the correct sector supervisor.
- Implementation action
- Maintain a dated authority map and the prescribed electronic or written reporting procedure for the entity type.
- Evidence to retain
- Authority map, portal access and acknowledgements.
- Primary citation
- AML/CFT Law, Articles 4, 25-26 and 38
02Governance and risk assessmentControls must be risk-based, approved and tested.3 items+
Document institutional and customer ML/TF risk assessments.
- Implementation action
- Assess customer, beneficial owner, geography, product, service, transaction, delivery-channel and group risks with appropriate periodicity and on material change.
- Evidence to retain
- Methodology, assessments, approvals and remediation.
- Primary citation
- AML/CFT Law, Articles 7-8
Maintain a compliant internal-control system.
- Implementation action
- Document governance, responsible staff, CDD, screening, monitoring, reporting, training and independent audit proportionate to nature, volume and risk.
- Evidence to retain
- Instructions, appointments, training and audit reports.
- Primary citation
- AML/CFT Law, Article 29
Keep controls aligned with current FMS and supervisory instruments.
- Implementation action
- Map official typologies, indicators and subordinate acts to scenarios and review them after legal, product or risk change.
- Evidence to retain
- Rule inventory, mapping and change log.
- Primary citation
- AML/CFT Law; current FMS and supervisory acts
03Natural-person identificationCDD applies before relationships and at statutory triggers.5 items+
Identify and verify the customer and intended relationship.
- Implementation action
- Use reliable independent sources; establish purpose, intended nature and expected transaction profile before service, subject only to a documented statutory exception.
- Evidence to retain
- Identity record, verification result, purpose and provenance.
- Primary citation
- AML/CFT Law, Articles 10 and 12
Apply general occasional-transaction CDD above GEL 15,000.
- Implementation action
- Aggregate linked transactions and complete CDD when the total exceeds GEL 15,000 or foreign-currency equivalent.
- Evidence to retain
- Aggregation logic, alert and completed CDD.
- Primary citation
- AML/CFT Law, Article 11(1)(b)
Apply occasional funds-transfer CDD above GEL 3,000.
- Implementation action
- Aggregate linked one-time transfers and complete CDD when the total exceeds GEL 3,000 or foreign-currency equivalent.
- Evidence to retain
- Transfer aggregation, alert and CDD record.
- Primary citation
- AML/CFT Law, Article 11(1)(c)
Identify representatives and verify authority.
- Implementation action
- Verify the person acting for the customer and obtain a duly certified document establishing representation authority.
- Evidence to retain
- Representative KYC, mandate and validation.
- Primary citation
- AML/CFT Law, Article 10(2)
Stop or refuse when required CDD cannot be completed.
- Implementation action
- Do not establish or continue the relationship or complete the occasional transaction; consider whether an FMS report is required.
- Evidence to retain
- Failure record, decision, escalation and reporting assessment.
- Primary citation
- AML/CFT Law, Article 10(6)
04KYB and beneficial ownershipVerify existence, authority, ownership and ultimate control.4 items+
Verify the legal person or legal arrangement.
- Implementation action
- Obtain reliable registry and constitutional evidence, business purpose, management, representation and ownership/control structure.
- Evidence to retain
- Registry extract, governing documents and validation.
- Primary citation
- AML/CFT Law, Articles 10, 12 and 13
Apply the statutory beneficial-owner cascade.
- Implementation action
- Identify natural persons owning directly or indirectly 25% or more, or more than 25% of voting shares as expressed in Article 13, and persons exercising ultimate control; if none exists after all possible measures, identify persons with managerial authority.
- Evidence to retain
- Ownership chart, control analysis, identities and fallback rationale.
- Primary citation
- AML/CFT Law, Article 13(1)-(4)
Identify trust and similar-arrangement parties.
- Implementation action
- Identify settlor, trustee, protector if any, beneficiaries or beneficiary class and every other ultimate controller, using the current Georgian legal terminology.
- Evidence to retain
- Arrangement documents, role map and verification.
- Primary citation
- AML/CFT Law, Article 13(5)-(6)
Resolve registry and customer-data discrepancies.
- Implementation action
- Compare official registry, constitutional, customer and reliable-source data and escalate inconsistent ownership, management, authority or status.
- Evidence to retain
- Search results, discrepancy log and resolution.
- Primary citation
- AML/CFT Law, Articles 10 and 13
05PEPs, EDD, and remote onboardingHigher-risk relationships need enhanced controls.3 items+
Identify PEPs, family members and close associates.
- Implementation action
- Screen customers and beneficial owners; obtain senior-management approval, establish source of wealth/funds and apply enhanced ongoing monitoring where required.
- Evidence to retain
- Screening, classification, approval and corroboration.
- Primary citation
- AML/CFT Law, Article 21
Apply enhanced measures for higher risk.
- Implementation action
- Obtain additional identity, ownership, purpose, source and transaction evidence and increase monitoring proportionately.
- Evidence to retain
- EDD checklist, evidence, approval and monitoring plan.
- Primary citation
- AML/CFT Law, Articles 18-19
Control non-face-to-face onboarding.
- Implementation action
- Use methods permitted by the applicable supervisor and preserve authentication, liveness, fraud, exception and test evidence.
- Evidence to retain
- Method assessment, session record and tests.
- Primary citation
- AML/CFT Law, Articles 10-12; applicable supervisory rules
06Monitoring and suspicious reportingDetection and reporting must meet event-specific timing.4 items+
Monitor relationships and examine unusual activity.
- Implementation action
- Detect related, complex, unusually large or unusual-pattern transactions without apparent economic or lawful purpose; document purpose, grounds and enhanced monitoring.
- Evidence to retain
- Scenarios, alerts, analysis, tuning and governance.
- Primary citation
- AML/CFT Law, Articles 10(5) and 20
Report suspicious transactions and attempts to FMS.
- Implementation action
- Submit the prescribed report on the same day that reasonable suspicion arises, through the current electronic or written route.
- Evidence to retain
- Suspicion timestamp, report, receipt and rationale.
- Primary citation
- AML/CFT Law, Articles 25(1) and 26(1)-(2)
Distinguish other prescribed reports from suspicion reports.
- Implementation action
- Maintain a current table of FMS-designated transaction types, circumstances and filing deadlines; do not treat CDD thresholds as universal reporting thresholds.
- Evidence to retain
- Legal table, configurations, tests and reports.
- Primary citation
- AML/CFT Law, Articles 25(2)-(5) and 26(3)-(5)
Prevent tipping off and protect reporters.
- Implementation action
- Restrict access and communications concerning examination, reports and FMS measures except where the law permits.
- Evidence to retain
- Access controls, communication review and training.
- Primary citation
- AML/CFT Law, Article 28
07Wires, payments, thresholds, and virtual assetsTreat transaction categories and regulated products separately.4 items+
Carry and screen required transfer information.
- Implementation action
- Apply current originator, beneficiary, intermediary, missing-data and screening controls for the institution's role.
- Evidence to retain
- Field matrix, samples, screening and repair queue.
- Primary citation
- AML/CFT Law; applicable National Bank transfer rules
Classify payment and electronic-money services before launch.
- Implementation action
- Map each service to the Payment System and Payment Services Law and obtain National Bank registration or other authorization required for the role.
- Evidence to retain
- Product memo, registration result and tests.
- Primary citation
- Law on Payment System and Payment Services; NBG Decree No. 77/04
Register and control virtual-asset services.
- Implementation action
- Confirm the activity perimeter and National Bank VASP registration before launch; apply AML/CFT, governance and transfer-information rules for the service.
- Evidence to retain
- Classification, registration, conditions and control tests.
- Primary citation
- Organic Law on NBG; VASP registration rule; AML/CFT Law
Apply sector-specific thresholds separately.
- Implementation action
- Configure the current thresholds for VASP, precious-metals, gambling, border-cash and other relevant categories rather than applying the general GEL 15,000 trigger universally.
- Evidence to retain
- Sector table, configuration and test results.
- Primary citation
- AML/CFT Law, Article 11
08Targeted financial sanctionsUse live official designations and act under the statutory procedure.3 items+
Screen current UN and applicable domestic measures.
- Implementation action
- Screen customers, owners, representatives and transactions at onboarding, on list updates and throughout the relationship according to risk.
- Evidence to retain
- List version, logs and match decisions.
- Primary citation
- AML/CFT Law, Chapter X
Block prohibited dealings and report relevant matches.
- Implementation action
- Do not establish or continue relationships or complete transactions where Article 10(7) applies; submit the required FMS report and apply the competent authority's seizure or restriction procedure.
- Evidence to retain
- Designation, decision timestamp, asset inventory and report.
- Primary citation
- AML/CFT Law, Articles 10(7)-(8), 25 and 40-44
Control permitted credits, access and release.
- Implementation action
- Credit, release or permit access only where the law and documented competent-authority instruction allow it; preserve every condition and decision.
- Evidence to retain
- Authority instruction, conditions and release record.
- Primary citation
- AML/CFT Law, Chapter X
09Records and authority accessRecords must reconstruct decisions and transactions.3 items+
Retain CDD, analysis, account and correspondence records for five years.
- Implementation action
- Run the period from relationship termination or occasional transaction and preserve records in evidentially usable form.
- Evidence to retain
- Retention schedule, archive and retrieval test.
- Primary citation
- AML/CFT Law, Article 27(1) and (5)
Retain transaction and reporting records for five years.
- Implementation action
- Retain comprehensive transaction data and FMS reports, instructions and protocols; support a lawful extension requested by FMS or a supervisor for up to five additional years.
- Evidence to retain
- Transaction archive, reports, extension holds and tests.
- Primary citation
- AML/CFT Law, Article 27(2)-(4)
Produce requested information within the applicable deadline.
- Implementation action
- Operate controlled retrieval, approval and production procedures; FMS requests under Article 25(6) are due within two working days.
- Evidence to retain
- Request log, production, approval and receipt.
- Primary citation
- AML/CFT Law, Articles 25(6), 26(5) and 27(5)
10Privacy, biometrics, incidents, and transfersAML processing remains subject to current privacy and security law.4 items+
Document lawful, fair and proportionate processing.
- Implementation action
- Map purpose, legal basis, transparency, minimization, accuracy, storage, rights and AML retention under the current Personal Data Protection Law.
- Evidence to retain
- Data map, notices, legal-basis register and rights log.
- Primary citation
- Personal Data Protection Law
Protect biometric and other special-category data.
- Implementation action
- Use special-category data only under an applicable legal condition and apply access, security, accuracy, liveness, vendor and deletion controls.
- Evidence to retain
- Assessment, architecture, tests and approvals.
- Primary citation
- Personal Data Protection Law
Perform DPIAs and manage incidents where required.
- Implementation action
- Assess high-risk processing, keep a documented incident workflow and apply the current controller, processor, notification and recordkeeping duties.
- Evidence to retain
- DPIA, incident chronology, notices and remediation.
- Primary citation
- Personal Data Protection Law, including DPIA and security provisions
Control international transfers and processors.
- Implementation action
- Confirm the applicable transfer condition, safeguards, contracts and representative or authorization requirements before transfer.
- Evidence to retain
- Transfer map, legal assessment, safeguards and notices.
- Primary citation
- Personal Data Protection Law
11Practical evidence packsEvidence must reconstruct decisions end to end.3 items+
Maintain an onboarding pack.
- Implementation action
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk, privacy and approvals.
- Evidence to retain
- Complete sample and retrieval result.
- Primary citation
- Operational control supporting AML/CFT Law, Articles 10-13
Maintain reporting and sanctions case packs.
- Implementation action
- Link trigger, classification, decision time, report, receipt, restriction, confidentiality and authority communications.
- Evidence to retain
- Case pack, timeline and access record.
- Primary citation
- AML/CFT Law, Articles 25-28 and Chapter X
Maintain a launch and legal-change pack.
- Implementation action
- Record perimeter, licences, thresholds, reporting, sanctions, privacy, vendors, source versions and control tests.
- Evidence to retain
- Signed pack, source register and approvals.
- Primary citation
- Official sources listed below
Primary-source register
14 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- AML/CFT Law - Legislative HeraldLegislative Herald of Georgia · Primary legislation - official repository
- Financial Monitoring Service of GeorgiaFinancial Monitoring Service of Georgia · Official FIU portal
- FMS reporting FAQFinancial Monitoring Service of Georgia · Official reporting guidance
- National Bank AML/CFT supervisionNational Bank of Georgia · Official supervisory guidance
- Law on payment services and implementing frameworkNational Bank of Georgia · Official legal source index
- Payment service provider registrationNational Bank of Georgia · Official registration guidance
- VASP registration rule noticeNational Bank of Georgia · Official registration guidance
- National Agency of Public RegistryNational Agency of Public Registry · Official company registry
- Personal Data Protection LawLegislative Herald of Georgia · Primary legislation - official repository
- Georgia fourth enhanced follow-up report 2025FATF / MONEYVAL · Authoritative follow-up assessment
- Georgia third enhanced follow-up report 2024FATF / MONEYVAL · Authoritative follow-up assessment
- FATF increased-monitoring statement - October 2026FATF · Authoritative current public-list status
- FATF call-for-action statement - October 2026FATF · Authoritative current public-list status
- Procedure for use of Georgian state symbolsLegislative Herald of Georgia · Primary legislation - official flag-use rules
Direct answers
Georgia KYC, KYB and AML questions
Who receives suspicious-transaction reports?+
The Financial Monitoring Service of Georgia through its prescribed reporting route.
When must suspicion be reported?+
On the same day that reasonable suspicion arises; the rule covers suspicious transactions and attempts.
When does general occasional-transaction CDD apply?+
When a transaction or linked transactions exceed GEL 15,000 or the foreign-currency equivalent, subject to sector-specific rules.
Do funds transfers have a separate CDD trigger?+
Yes. A one-time transfer or linked transfers above GEL 3,000 trigger CDD under Article 11(1)(c).
How is a beneficial owner identified?+
Apply the statutory 25% ownership/voting and other ultimate-control tests, then the managerial-authority fallback after all possible measures.
How long are AML records retained?+
Five years under Article 27, with a possible requested extension of no more than five additional years.
Do payment providers and VASPs need authorization?+
Payment providers require the applicable National Bank registration or authorization, and VASPs are subject to National Bank registration and regulation.
Is Georgia on a FATF public list?+
No at the October 2026 statements. Georgia nevertheless remains in MONEYVAL enhanced follow-up, and absence from a public list is not a low-risk determination.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General information, not legal advice. Reviewed 9 November 2026. Confirm the controlling Georgian text, current FMS and sector rules, reporting forms and portal, designated transaction categories, sanctions implementation, privacy duties and licensing conditions with the competent authority and qualified Georgian counsel.