How to Buy a Ready-Made VASP License in Georgia

The route is fast, but the buyer inherits the seller's history along with the seller's registration. Check before signing that licensing conditions have been met and that the file carries no regulatory breach. Check too that AML/KYC procedures (the mechanisms for preventing money laundering and verifying clients) work in practice rather than on paper, and that the operation still meets current supervisory requirements. Below I explain how a purchase of this kind runs, what becomes of the registered status once control moves, which tests apply to incoming owners and to directors, and what can strip a company of its right to serve crypto clients.

What a VASP License in Georgia Actually Buys

You cannot buy the license on its own. The NBG grants VASP status to a named legal entity, and only after checking that the entity meets the requirements the law lays down, its compliance procedures and the standing of the people behind it included. The status has no life apart from its holder. Equity is what changes hands: shares in a firm that already sits on the VASP register. The members change, the beneficial owners change and, where the deal calls for it, so does the management body, in the form prescribed by Georgian law and by the supervisor's rules. What the buyer owns after closing is a working entity, not a permission. It can go on exchanging and transferring digital assets, running crypto wallets, holding client assets in custody and doing whatever else its registration covers. Corporate documents exist, the internal control system runs, the entity cleared regulatory and compliance procedures once already, and the buyer's outlay on building all of that is far smaller.

All of that assumes the target withstands inspection. A VASP registration in Georgia proves that the NBG was satisfied on the day of entry and proves nothing about the years that followed. The buyer needs five answers before closing.

• whether the mandatory compliance procedures are genuinely in place;
• what the business has actually done since incorporation;
• the current standing of its registration;
• how it has performed against the requirements binding on it;
• whether any supervisory restriction is running against it.

How the NBG Supervises a Registered Provider

Registration is compulsory in Georgia, and supervision does not stop once it is granted. Each VASP counts as an accountable entity for anti-money-laundering purposes and has to run its own internal rules on customer identification, on record keeping that covers clients and transactions alike, on transaction monitoring and on risk assessment. The supervisor may check whether those rules are followed and take enforcement measures where it finds a breach. That supervisory power is what stands behind a Georgia crypto license.

Supervision runs on a second track, aimed at the people who run and own the firm. Fit and proper criteria apply to everyone who takes decisions inside the company, testing reputation, competence and reliability, and they extend to direct and indirect holders of a significant shareholding. Nor does registration close the matter: the regulator monitors registered providers continuously, adds requirements, publishes binding instructions, can restrict particular operations and intervenes where the law is broken or where money-laundering and sanctions-circumvention risk starts to rise. Anyone acquiring a registered provider by share purchase inherits that supervision along with the entity.

Two Routes to a Georgia Crypto License: Buying In or Applying

The choice hinges on the investor's goals, on how soon the project must launch and on the demands placed on the corporate set-up. Georgia's crypto market draws international entrepreneurs and financial groups planning cross-border expansion. Buying a firm already on the register brings them a filing history, working compliance procedures and an organizational base that banks, payment partners and other market participants recognize.

Groups that cannot afford a break in operations reach the same conclusion. Where the project is an exchange, a currency exchange service, a virtual-asset storage platform or another regulated digital product, the team can put its effort into the product, into clients and into growth rather than into a first application. That advantage holds only if the target passes inspection. Registration erases nothing of the target's past: neither how it has operated, nor how it has performed under AML/CFT (the global benchmark for controls on money laundering and on the funding of unlawful activity), nor what obligations remain open with a regulator.

Applying from scratch gives the investor the opposite advantage. You build the structure yourself, choose who holds the equity and design internal processes around the business you actually intend to run. That is why founders who want control over the source of their funds, over governance and over how compliance is organized usually apply. The founder does the work: incorporating the entity, drafting the internal documentation, implementing anti-money-laundering procedures, then filing the application, with its supporting papers, to the NBG for entry in the VASP register. An applicant starting from nothing spends more time and more organizational resources on a crypto license in Georgia, because the infrastructure that satisfies a supervisor must be built rather than inherited: internal control, identification and verification of customers, risk management, record keeping, compliance with financial monitoring rules. What the founder gets in return is a wholly transparent structure, with no previous owner's activity to investigate.

A decision to buy makes a preliminary legal audit obligatory. Its scope has to run to everything set out below.

• everything the registration record shows;
• everything the NBG has received so far;
• the corporate paperwork;
• who the members are, and who the beneficial owners are;
• the AML/CFT track record;
• any breach, and any restriction imposed on activity.

Reviewing a target before purchase, I look closely at five further areas.

• how far internal AML/KYC policies and risk-management procedures have been built out;
• any gap between declared activities and actual operations;
• what tax reporting reveals about outstanding liabilities;
• the operating record, plus contracts signed with clients and counterparties;
• whether Georgian law is satisfied by the corporate set-up as it stands.

Buying costs more up front than incorporating and applying does. The premium buys speed to market and a lighter administrative load. Both routes end in the same registered status; what separates them is the timetable, and how much of a previous owner's past the buyer must verify.

Services a Registered VASP May Offer

A company may not go beyond what it told the regulator at registration, and the business model, the internal procedures and the compliance record narrow the range further. Before formalizing a purchase, check the registration record, the declared services and whether the declared model matches what the new owner intends to sell.

Registered providers exchange virtual assets for other virtual assets, and for fiat currency, whether Georgian or foreign. A second service line moves virtual assets between users, or between wallets, and the provider must meet financial monitoring requirements as it does so, from customer identification through checks on transactions to AML/CFT procedures. The same regulation reaches custody and administration of client assets, so a provider offering those needs an internal management system, the technological infrastructure to support it and written procedures for:

• protecting client assets;
• wallet management;
• keeping operations secure;
• access control.

Buyers who ask about a crypto exchange license usually mean exchange services, and in Georgia those fall under VASP registration. Buyers can also acquire an exchange platform outright, and then the platform warrants as much scrutiny as the corporate file: its architecture, its order-handling rules, who takes part in the operating model, how transactions are controlled, how risk is managed.

How Corporate Control Passes to the Buyer

A transaction of this kind transfers corporate rights, and the National Agency of Public Registry (NAPR) records the resulting change of members or shareholders. It is worth bringing in specialists. Advisers who have handled transfers inside regulated financial and crypto structures know which risks to price, how to test a target against the requirements binding on it and how to ensure an orderly transfer of control. Here is the sequence I run when a client sets out to acquire a licensed Georgian entity.

The non-disclosure agreement

The parties open with a non-disclosure agreement, which protects the target's confidential information and allows the seller to disclose the internal documentation the buyer needs for that review.

At that point the buyer receives registration papers, details of the ownership structure, evidence of VASP status, internal AML/KYC policies, financial statements, agreements signed with clients and partners, and anything else bearing on the legal and commercial condition of the target.

Due diligence on the target

Full review comes first; re-registration to a new owner comes after. VASP due diligence looks as hard at the registered status as at the balance sheet, establishes what the business really is, surfaces the legal, regulatory and financial risk inside it, and answers whether the deal is worth doing. Advisers go through the whole file.

• AML/CFT policies;
• how ownership is arranged;
• owners direct and indirect, ultimate beneficial owners, directors;
• corporate documents;
• reporting, financial and fiscal;
• domains, applications and the software behind them;
• banking and payment-provider agreements;
• intellectual property.

The regulator's interest is narrower and sharper: who can influence decisions in practice, exercise control or direct what management does. That is why advisers measure incoming owners and directors against standards of business reputation, reliability and transparency, and they test NBG compliance, anti-money-laundering duties included, as a separate exercise. The buyer should see the rest as well: financial position, tax exposure, live contracts, any current or anticipated dispute, dealings with state authorities, the internal controls actually running. Findings drive the terms, and the buyer decides with the whole file in front of them.

The share purchase agreement

Once the findings are acceptable, the parties draft the share purchase agreement. Buying a firm is not buying a standalone asset. The equity interest comes with every right, every obligation and the whole history attached to it. The agreement sets out:

• the price of the target;
• the manner and timing of payment;
• which documents and corporate materials transfer;
• the seller's obligations before and after closing;
• warranties that no hidden liabilities exist;
• each party's liability for breach.

Where the target is licensed, the agreement should also record what happens to that registration: that the status survives the transfer, that supervisory requirements continue to be met, and that any change-of-control approval is obtained and any notification given before control passes.

Registering the change of ownership

After signature the parties formalize the transfer. NAPR records the new composition of members or shareholders. The firm must then meet NBG disclosure requirements on new owners, ultimate beneficial owners and the people who will run it. The new owner does not take immediate command of a licensed company. Until the handover of corporate governance is complete, the seller has to hand over documentation, internal systems and access to corporate tools in good order, and the buyer has to establish working relationships with banks, payment partners and other counterparties.

Taxes a Licensed Crypto Company Pays in Georgia

A VASP license in Georgia carries neither a separate tax regime nor a special rate. A provider selling virtual asset services pays what any Georgian-registered company pays, with the outcome turning on its activity, its income sources and the structure of its operations.

Corporate income tax stands at 15%. Georgia charges it on distributed profit, so the liability arises not when the profit is earned but when the firm does certain things with it, including distribution to members and the payment of dividends. A registered provider therefore pays nothing on what it makes from virtual asset operations or from client services, provided the profit stays inside the firm and returns to development, to funding current activity or to reserves. A crypto company earning commissions on exchange, on custody of client digital assets or on running its trading platform pays no tax while that money goes to infrastructure, to staff or to expansion; the charge arises only when it pays its owners. On distribution the company withholds 5% from dividends, unless a double tax treaty says otherwise.

The VAT rate is 18%, and the consequences turn on which services the provider sells. An exchange, a currency exchange service and a custody provider do not attract the same tax treatment, so before buying a crypto business in Georgia, establish precisely which services it provides and which of them fall within VAT.

A foreign buyer's main question is usually how money will move between the Georgian company and its owner abroad. Work that out in advance. How ownership is structured decides most of it; where the members are tax resident decides much of the rest; and a double tax treaty is not always available to them. The mechanics of paying dividends and the handling of payments across borders between related companies belong to that same calculation.

A well-chosen ownership structure keeps fiscal risk manageable and stops the same income attracting obligations in more than one jurisdiction.

VASP License Cost: What the Purchase Adds Up To

Several costs run together in one purchase: the legal review of the target, the transfer of corporate rights, the preparation and legalization of documents, support around the deal itself, and the work of adapting the business to its new owner's plans. All of it sits inside the price of a firm that carries VASP registration. Buyers who ask about the VASP license price are therefore asking, in effect, what the firm that holds it costs.

The target itself absorbs most of the money. Its price turns on how long it has existed and on what its record looks like on breaches and regulatory findings. It turns, too, on which AML/KYC procedures are already implemented, on whether bank accounts and payment infrastructure come with it, and on whether staff, technical solutions and an operating history come with it.

Three pricing tiers have emerged in practice.

• EUR 30,000 to 60,000 for a basic structure carrying VASP registration and no operating history;
• from EUR 60,000 where the structure is developed, banking relationships exist, compliance is built and extra infrastructure comes with it;
• EUR 150,000 and above for a firm with an operating history, a client base, a technology platform or other assets.

State fees for registering the change are modest. Corporate rights in a licensed provider pass through NAPR, which charges around EUR 70 at standard speed and about EUR 130 for expedited handling. Around that the buyer pays for drafting the purchase agreement, for translating and certifying documents of foreign members and for preparing corporate resolutions. Advisers charge EUR 3,000 to 8,000 on average when the target is a crypto company in Georgia.

Running costs follow. Accounting support runs to roughly EUR 200 to 800 a month, scaled to how many transactions the firm processes; AML/KYC and compliance support runs from EUR 500 to EUR 2,000. Those fees usually cover the accounts, tax work, dealings with fiscal authorities and oversight of mandatory procedures. Add the registered office, EUR 300 to 1,000 a year, and corporate secretarial services, between EUR 500 and EUR 2,000 a year. Companies that outsource AML/KYC pay EUR 500 to 1,500 a month for basic cover, and EUR 1,500 to 5,000 where a provider monitors transactions continuously. Running an in-house compliance department costs more than either, because qualified specialists stay on the payroll.

Gathered into one place, the numbers for a Georgian VASP company bought ready-made look like this.

Conclusion

An investor buying a VASP license in Georgia acquires the company that holds it. Market entry is quick for that reason, and the administrative load stays light. Because the status belongs to the registered entity and moves nowhere by itself, the deal stands on its legal review: the corporate set-up, the AML/CFT position, the regulatory risk the buyer agrees to carry.

I handle these transactions from start to finish: due diligence, checks on documents and corporate history, negotiation, the agreement transferring corporate rights, registration of the changes and the handover of control.