You decide to exchange some crypto, and the service asks you to upload a passport, state where you work and estimate how much you plan to trade each month. The question follows naturally: why does an exchange service need any of this, and can you skip the paperwork?

If you live in Georgia, you have almost certainly been through something similar at your bank. Opening an account at Bank of Georgia or TBC involves the same kind of questionnaire about your occupation and sources of income. The procedure is called KYC (Know Your Customer), and it exists for one reason: a financial institution has to know who it is dealing with.

There is a point that rarely gets explained to customers. A licensed exchange service does not ask for documents because it prefers things that way, and it cannot make an exception for an individual client. This is a direct legal obligation, and a financial regulator checks that it is met. Below we look at where that obligation comes from, what exactly gets checked and how the process works in practice.

What KYC Means in Plain Terms

KYC stands for Know Your Customer. Behind the acronym sit three checks: the service confirms that the client is a real person, that they act on their own behalf rather than fronting for someone else, and that they do not appear on sanctions lists or in databases of people tied to financial crime.

All of this came out of banking long before crypto existed. Banks have been required to establish customer identity for decades, so that money of dubious origin does not pass through their accounts. In 2019 the same requirements were extended to virtual assets, and crypto services began screening clients by banking rules.

One detail matters for users: you go through verification once. Services rarely ask you to confirm your details again, usually when a document expires, your personal information changes or your activity drifts noticeably from what you declared.

Why KYC Is Mandatory: The Legal Basis

The requirement to screen customers does not originate inside the company. It travels down a chain: an international standard, then national law, and only then the internal rules of a given service. Here is each link in turn.

The International Layer: FATF Standards

FATF, the Financial Action Task Force, is an intergovernmental body that sets the global rules for fighting money laundering. It has no direct authority over companies, so it works through governments: countries align their legislation with its recommendations, and FATF assesses how seriously they went about it.

In 2019 the organization updated Recommendation 15 and extended its standards to virtual assets. Governments now have to register or license crypto services and require them to verify clients, monitor transactions and pass customer data along with transfers. The leverage here is real. A country that ignores the standards ends up on a high-risk list, after which its banks start running into trouble with international settlements. That damage lands on the whole economy rather than the crypto sector alone, which is why governments take the requirements seriously. Progress is uneven, though: FATF's 2025 assessment found roughly 21% of 138 reviewed jurisdictions in full compliance with Recommendation 15.

Georgia: AML Law and the VASP Regime

It all starts with the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism, adopted on October 30, 2019. The law lists obliged entities, meaning the businesses required to screen their customers, and sets out the measures they apply.

The virtual asset provisions took effect on January 1, 2023. They introduced mandatory registration of virtual asset service providers (VASPs) with the National Bank of Georgia, fit-and-proper requirements for directors and significant owners, and AML supervision. The registration procedure itself was approved by Order No. 94/04 of the Governor of the National Bank on June 13, 2023, and the regime has been in force since July 1, 2023.

A crypto exchange service operating in Georgia falls under the VASP definition, which makes it an obliged entity under the 2019 law. Several duties follow from that:

  • identify and verify customers according to the National Bank's rules;
  • appoint an officer responsible for anti-money-laundering compliance and maintain internal control procedures;
  • apply due diligence measures to any one-off transaction of 1,000 USD, 1,000 EUR or 3,000 GEL and above (in practice, services verify clients at sign-up, before the first trade, rather than working to thresholds);
  • run software that automatically flags unusual and suspicious transactions;
  • transmit sender and recipient data with virtual asset transfers, the rule known as the Travel Rule;
  • keep customer records for at least five years.

Anonymity is ruled out explicitly. A VASP may not handle privacy coins or use technical arrangements that make it impossible to identify the parties to a transaction and trace it. In short, the law closes off any option of dealing with a client blind.

Why a Service Cannot Make an Exception

This is where the everyday question lands: can I skip the documents? You cannot, and it has nothing to do with one company being stubborn. The National Bank of Georgia supervises VASP activity, and breaking identification rules earns a service formal warnings and fines. In serious cases its registration gets suspended or revoked. Nobody is going to gamble their right to operate on a single trade, however trustworthy the client looks.

For users, a simple rule follows. If a platform offers exchange without verification, there are two possibilities: either it is not registered as a VASP, or it is breaking the terms of its registration. Either way, there will be nobody to protect the customer. Checking costs nothing, since the National Bank of Georgia maintains a public VASP register at nbg.gov.ge.

This article is for general information and does not replace legal advice. Both the wording of regulations and supervisory practice change over time.

KYC and AML: Where the Line Runs

KYC almost always travels with a second acronym, AML (Anti-Money Laundering). The distinction is straightforward. KYC answers the question of who the customer is and happens once, at the start of the relationship. AML answers where the money came from and where it is going, and runs continuously. KYC sits inside the AML system as its first component.

Users run into AML too, though they do not always notice it. The service screens wallet addresses, with analytics systems examining coin history and flagging addresses that have surfaced in darknet markets or hacks. It asks about the origin of funds when a sum is large. And it passes sender and recipient data when you transfer to another platform, which is the Travel Rule mentioned above.

How KYC Works at GeCrypto, Step by Step

Registration and verification both happen on the GeCrypto online platform. You create an account in your dashboard, complete the check, and once your details are confirmed you can submit an exchange request. Five steps in total.

Step 1. Create an account. Enter your email address, fill in basic personal details and activate the account. Your dashboard opens after that, and verification starts from there.

Step 2. Upload an identity document.

A passport or a Georgian residence permit will do. The system scans the document and pulls the key details out of it automatically, so there is nothing to retype.

Step 3. Complete the KYC questionnaire.

Here you provide your registered address, the approximate amount you expect to exchange per month, your line of work and industry, your position, and the reason you chose GeCrypto.

This step raises more questions than any other, so it is worth explaining. The law requires services to take a risk-based approach: assess the risk each customer presents and weigh their transactions against what is known about them. Your answers about work and expected volumes build a customer profile. If someone states they will be exchanging modest sums and a week later runs a trade an order of magnitude larger, the system notices and asks for an explanation. Without a baseline profile there is nothing to compare against, and telling a routine transaction from a suspicious one becomes impossible. The questionnaire does a specific job, then, rather than collecting data for its own sake.

Step 4. Document and data checks.

Once the questionnaire is submitted, GeCrypto's AML service takes over. It confirms that the document is genuine, matches the details in it against your answers, searches for you on sanctions lists, establishes whether you hold politically exposed person status, and cross-checks wanted-persons databases and other control lists.

Two of those are worth unpacking. Sanctions lists name the individuals and organizations that international and national rules forbid doing business with. Politically exposed person (PEP) status applies to government officials, heads of state-owned companies and people close to them. On its own it does not mean a refusal of service, but it moves the client into a higher-risk category where transactions get a closer look.

Step 5. Account confirmation.

All that remains is to wait for the verification status in your dashboard to change. Once the check clears, your account becomes verified and exchange requests open up. Before that point you cannot submit a request, and that comes down to legal requirements rather than site settings.

KYC for Sole Proprietors and Companies

Individual entrepreneurs and legal entities go through a more extensive procedure: a separate KYC questionnaire, registration and corporate documents, and an extract from the state register. The exact list depends on the type of client and the legal form of the business.

The reasoning is simple. With a business, checks cover not only the person who shows up to arrange the exchange but the ownership structure down to the ultimate beneficial owners, the actual people behind the company. Otherwise a legal entity becomes a convenient screen, and setting up companies for exactly that purpose is a standard move in laundering schemes.

How This Differs from KYC on Trading Platforms

Crypto exchanges, where most newcomers start, work differently. Their verification is tiered: the basic level needs minimal data but comes with low limits, and every level above it asks for more documents and raises the ceiling. Someone can spend a long time on the first tier and only run into a check when they try to withdraw a large amount.

A licensed exchange service works the other way around. You clear verification once, before you start, and it opens up the whole service. The difference comes down to jurisdiction, since the large trading platforms are mostly registered outside Georgia and follow their own regulator's rules. The principle is the same everywhere, though: every licensed service has to establish who its customer is, and only the execution varies.

Is It Safe to Submit Your Documents?

The second common objection goes like this: what if my data leaks? It is a fair question and deserves a straight answer.

Licensed services are required by their regulator to protect customer data. That means encryption in transit and at rest, a limited group of staff with access to documents, incident response procedures and legal liability for a breach. The five-year retention period set by law cuts both ways, since it also means the data is held under defined rules rather than indefinitely and however the company pleases.

Leaks do happen in this industry, and there is no point pretending otherwise. The conclusion runs elsewhere: send documents only to services you can check. Before verifying, work through four points. Is the service listed in a financial regulator's register? Is a legal entity named? Is there a physical address? Is there a published privacy policy? In Georgia the first and most important of those takes a minute, through the VASP register on the National Bank's website.

Exchanging Without KYC: Why It Is a Bad Idea

Searches like "exchange without verification" remain popular, and the motivation is understandable: people want speed and fewer steps. Here is what that saving actually costs.

First, you have no contract, no protection and nobody to complain to. If funds get stuck, the rate is recalculated at the last moment or the operator stops replying, there is no one to turn to. Stories about exchange services vanishing along with customer money repeat with depressing regularity.

The second risk arrives later. Coins from an anonymous exchange can carry a criminal history, and it surfaces when you try to move them onto a regulated platform or sell them. The funds get frozen pending an origin check, and you will have nothing to show that the purchase was legitimate.

Third, the space for anonymous exchange is shrinking worldwide. The MiCA regulation came into full force in the European Union on July 1, 2026, requiring crypto services to obtain authorization and verify their customers, and dozens of countries are rolling out the Travel Rule.

A word on the "buy a ready-made KYC account" offers that circulate in messengers. These are accounts registered on someone else's documents or on forged ones. Using one is illegal, and the buyer has no claim to the money at all: formally it belongs to another person, and the account gets blocked at the first review. You would have nothing to show that the funds are yours.

FAQ

Is KYC mandatory for crypto exchange in Georgia?

Yes. A VASP registered with the National Bank of Georgia counts as an obliged entity under anti-money-laundering law and has to establish its customer's identity. A service cannot waive the check at a user's request.

What documents do I need for verification?

An individual needs a passport or a Georgian residence permit. Entrepreneurs and companies also need registration and corporate documents, including an extract from the state register.

How long does the check take?

Most checks run automatically, so the status usually updates quickly. If something needs a second look, a poorly photographed document for instance, a specialist reviews the case and it takes longer.

Why does the questionnaire ask about my occupation and exchange volumes?

Those answers form the customer profile that the service later compares transactions against. The approach is required by law and makes it possible to tell routine trades from unusual ones that warrant attention.

What is the difference between KYC and AML?

KYC establishes the customer's identity at the outset. AML monitors transactions continuously, looking at the origin of funds, address history and suspicious transfers. KYC sits within the AML system.

Can I exchange crypto without verification?

Not with a registered service. Platforms offering anonymous exchange operate outside regulation, which leaves the customer without legal protection and at risk of receiving assets with a problematic history.