AML, KYC and responsible gaming for online operators in Georgia

Georgia runs a regulated gambling market with clear expectations on player identity, anti-money-laundering controls and player protection. For an online operator, these three areas are not separate projects. They share the same data, the same player journey and, on a well-built platform, the same automation layer. This guide sets out what the framework asks of operators and how we build it into the product from day one.

The legal backbone: the 2019 AML/CFT law

The core statute is the Law of Georgia on Facilitating the Prevention of Money Laundering and the Financing of Terrorism, adopted by Parliament on 30 October 2019 and published on the Legislative Herald of Georgia (matsne.gov.ge). It has been updated since then, and a further amendment package reached parliamentary committees in November 2025, so operators should always work from the current consolidated text.

Gambling businesses sit inside this framework as obliged entities. In practice that covers casinos, slot salons, sportsbooks and systemic-electronic (online) platforms. Being an obliged entity means a licensed operator carries a defined set of duties:

• identify and verify customers and, where relevant, beneficial owners;
• apply a risk-based approach, with enhanced measures for higher-risk players and politically exposed persons;
• monitor transactions and report to the Financial Monitoring Service;
• keep identification, verification and monitoring records in a form that is protected and retrievable for inspections;
• maintain internal policies, a designated compliance function and staff training.

Georgia's national risk assessment of 2019 rated the gambling sector as high risk for money laundering, which is why regulators and the Financial Monitoring Service pay close attention to it. An operator that arrives with documented controls and clean data trails has a much smoother licensing and supervision experience.

The Financial Monitoring Service

The Financial Monitoring Service of Georgia (FMS) is the country's financial intelligence unit. Operators send it two kinds of report: suspicious transaction reports, filed when the operator knows or reasonably suspects that funds are criminal proceeds or linked to terrorism financing, and reports on specified threshold transactions and series of transactions defined in the FMS rules. Reports are submitted electronically, and the FMS rules on record-keeping and reporting have been in force since an order of 5 June 2020.

The most useful design principle here is simple: every report you may ever need to file should be reconstructable from your own data. That means player identity, funding sources, deposits, wagers, wins and withdrawals all tied to one player record with a timestamped audit trail.

Customer due diligence and identity verification

Due diligence in an online setting starts at registration. The standard sequence is:

1. Capture identity data. Full name, personal number, date of birth and contact details are recorded accurately and completely for every registered player.
2. Verify remotely. Remote onboarding relies on electronic identification and verification that meets technical and procedural safeguards, typically a document check combined with a liveness or face-match step.
3. Screen. Check the player against sanctions lists and politically exposed person lists, then assign a risk rating.
4. Escalate when risk warrants. Higher-risk players, including high-turnover patrons and PEPs, trigger enhanced due diligence such as source-of-funds and source-of-wealth evidence.
5. Re-check over time. Ratings are refreshed as behaviour changes, not just at sign-up.

Player protection under Georgian rules

Age limit

Georgian citizens under 25 are prohibited from entering gambling premises or taking part in gambling, online or on land. For foreign citizens and stateless persons the minimum age is 18. An online platform therefore needs to know the player's nationality and date of birth from a verified document before the first wager, and the age rule must be enforced in code rather than by policy.

The national exclusion registry

The Revenue Service of Georgia manages a national exclusion registry of citizens who are barred from gambling on any licensed platform, online or offline. People can enter it themselves by applying through the Revenue Service, a family member can request a restriction that is confirmed by a court, and certain groups such as public-sector employees are listed automatically. Registration lasts five years. Removal is possible only if the person loses Georgian citizenship or by court decision at least three years after registration. The Revenue Service reported 1,577,247 people in the registry as of December 2025, which shows how central this control is to the market.

For a platform, the registry is a hard gate: a player who is excluded must not be able to register, deposit or play, and the check belongs in the same verification flow as identity and age.

Operator tools

Beyond the registry, licensed operators are expected to run eligibility checks, provide self-exclusion, display responsible gambling information and tools, and keep advertising away from vulnerable groups. We build these in as standard player-facing features: deposit and session controls, reality checks, time-outs and a clear route to self-exclusion.

How a modern platform automates all of this

Done manually, these obligations slow onboarding and burden the compliance team. Done in the platform, they become a background process. This is how we approach each layer.

KYC provider integration

Document capture, liveness detection and data extraction are handled by a specialist identity provider through an API. The platform receives a pass, fail or review result and stores the evidence against the player record. Because the provider sits behind an abstraction layer, an operator can switch or add providers without rebuilding the player journey.

Automated screening

Sanctions and PEP screening run at onboarding and again continuously, so a player who is later listed is flagged without anyone having to remember to re-run a check. Age, nationality and registry status are evaluated in the same pass, and a failed gate stops registration or play immediately.

Transaction monitoring

A rules engine watches deposits, withdrawals and gameplay for patterns that compliance teams care about: rapid deposit-and-withdraw cycles with little play, funding from many sources, sudden jumps in turnover, and activity inconsistent with the player's declared profile. Rules are configurable, every alert is logged, and analysts can open a case, request documents and decide whether a suspicious transaction report is needed. When it is, the report is assembled from the case file instead of being rebuilt by hand.

AI-assisted risk scoring

Machine-learning models complement the rules by combining signals such as device and location data, payment behaviour, play patterns and verification results into a single player risk score. The score ranks the review queue so analysts spend their time on the players who matter most, and it can also surface early signs of harm so responsible gaming interventions happen sooner. Decisions stay explainable: each score lists the factors behind it, and a human makes the final call on reports and account actions.

Audit trail and reporting

Every verification, alert, decision and report is written to an immutable log. When a regulator or the FMS asks a question, the answer is a query, not a project.

Where to start

The fastest route to a compliant launch is to treat identity, AML and responsible gaming as one design problem from the beginning. Scalara Labs Georgia builds iGaming platform technology from our Tbilisi hub, with verification, monitoring and player-protection tooling designed around Georgian requirements. If you are planning a launch or upgrading an existing platform, talk to our team about a compliance architecture that fits your market.