A Development Partner in Armenia or Georgia Instead of Poland: What Changes for an EU Fintech Under GDPR, DORA and the Contract

For an EU fintech, a development firm in Armenia or Georgia needs more contract work than one in Poland. If its engineers can see personal data, the contract needs a transfer tool such as the standard contractual clauses, and the dispute clause should lead to a decision that can be enforced there. If DORA covers you and the service supports a critical or important function, your risk assessment must also ask about data protection and law enforcement in that country. Engineering checks, sanctions screening, code ownership and most contract terms work as in Poland.

What changes compared with a firm in Poland, and what stays the same?

Poland is in the EU, and Armenia and Georgia are not. Most of the difference follows from that:

• Data: if an engineer at a company in Yerevan or Tbilisi can see your customers' personal data, that access counts as a transfer out of the EU. Access from Warsaw does not
• DORA: for services that support critical or important functions, a provider outside the EU adds two questions to your risk assessment, on data protection and on enforcing the law in its country
• Disputes: a court judgment from another EU country is recognised in Poland under EU rules. In Armenia and Georgia, an arbitration award is easier to enforce than a court judgment
• Registers: the European e-Justice Portal searches Polish and other EU business registers in one place. Armenian and Georgian companies are in their own national registers, partly in Armenian or Georgian

The rest does not depend on the country: meeting the engineers who will do the work, a written assignment of the code to your company, repositories and cloud accounts in your company's name, sanctions screening of the firm and its owners, and most of the contract terms that DORA lists.

How many working hours do we share with a team in Yerevan or Tbilisi?

Armenia and Georgia stay on UTC+4 all year, according to the IANA time zone database. EU countries move their clocks forward on the last Sunday of March and back on the last Sunday of October. Yerevan and Tbilisi are therefore three hours ahead of Frankfurt, Paris and Warsaw in winter and two hours ahead in summer.

With a 9-to-6 working day on both sides, a team in Yerevan shares six office hours with Frankfurt in winter and seven in summer. With London it shares five hours in winter and six in summer. Plan the daily call, code reviews and releases inside that window, and write the shared hours into the contract.

Before you sign, hear the engineers and the person who will lead the work day to day use your team's working language on a video call.

Is it a data transfer if the engineers only log in from Yerevan?

Yes, if they can see personal data. The European Data Protection Board, which brings together the EU's data protection authorities, wrote in its Guidelines 05/2021 that “remote access from a third country (even if it takes place only by means of displaying personal data on a screen, for example in support situations, troubleshooting or for administration purposes)” also counts as a transfer when the guidelines' three criteria for a transfer are met. They are met when the engineers work for a separate company, such as your development partner.

The simplest way to limit the transfer is to keep personal data out of the engineers' reach: test data, masked copies, and access to production only when needed and logged. The article on outsourcing AI development without your data leaving describes that setup.

An adequacy decision lets personal data flow to a country without further safeguards. As of 26 October 2026, the European Commission's list of such decisions includes neither Armenia nor Georgia. For both countries, the usual tool is the standard contractual clauses, ready-made contract terms the Commission adopted on 4 June 2021.

For a development company that works on your data under your instructions, the part of the clauses that applies is Module 2, for transfers from a controller to a processor. If your fintech itself processes the data for business clients, Module 3, for transfers from a processor to a processor, applies instead. The Commission's questions and answers on the clauses say that with Module 2 you “do not need to enter into a separate data processing agreement”, because it already contains the terms Article 28 of the GDPR requires. The text of the clauses cannot be changed, apart from choosing the modules and options, filling in the annexes and adding safeguards.

Before signing, both sides have to assess “whether the laws and practices of the third country of destination” could stop the company from keeping to the clauses. The questions and answers also list what to look at, such as the categories and format of the data and the length of the processing chain.

A UK fintech works under the UK GDPR instead. UK adequacy rules cover Poland as part of the European Economic Area and do not cover Armenia or Georgia. For transfers there, the Information Commissioner's Office names the International Data Transfer Agreement and the International Data Transfer Addendum, which is added to the EU clauses, and asks for a transfer risk assessment as well.

What does DORA ask when the provider is outside the EU?

DORA, the EU's Digital Operational Resilience Act, has applied since 17 January 2025. It covers banks, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues and other financial entities. Its rules apply to ICT services, the regulation's term for technology services. Whether a development contract counts as one depends on what it includes, such as support, maintenance or hosting after launch, so ask your compliance team first.

If it does count, you stay “fully responsible” for your obligations under DORA, in the words of Article 28, and record the contract in your register of information, DORA's record of ICT contracts. Article 30 lists terms every such contract needs, among them the countries where the services are provided and the data is processed, advance notice before those locations change, and the return of your data if the provider fails or the contract ends. A firm in Poland has to accept these terms too.

The difference is in one part of the risk assessment, for services that support critical or important functions, the functions whose failure would seriously harm your business or your compliance. For any such provider, Article 29 asks you to consider the insolvency rules that would apply and any constraint on “the urgent recovery of the financial entity's data”. For a firm in Armenia or Georgia, those are Armenian or Georgian rules. For a provider “established in a third country”, it adds “the compliance with Union data protection rules and the effective enforcement of the law in that third country”.

Ask the firm where its people and servers will work on your system, and how you get your code and data back if the firm stops working for you. Ask your lawyers whether a decision in your favour can be enforced there. Contracts for these services also need audit and access rights and an exit strategy with a transition period, wherever the provider is.

Can we enforce a contract with a company in Armenia or Georgia?

Yes, if you plan the route before you sign. A decision against the company has to be enforced where its accounts and property are, which is usually its own country.

An arbitration award is easier to enforce. Armenia, Georgia and Poland are all parties to the New York Convention of 1958, under which contracting states recognise and enforce arbitral awards made in other contracting states. The UNCITRAL status table shows the Convention in force for Georgia since 1994 and for Armenia since 1998. Armenia applies it only to awards made in another contracting state and to disputes its law treats as commercial.

Court judgments are harder. Inside the EU, the Brussels Ia Regulation has a judgment from a German or French court recognised in Poland without a special procedure. Poland is also covered, through the EU, by the Hague Judgments Convention of 2019, which has applied to the UK since 1 July 2025. As of 26 October 2026, neither Armenia nor Georgia is a party to that convention or to the Hague Choice of Court Convention of 2005, according to the Hague Conference's status tables.

So for a firm in Armenia or Georgia, ask your lawyer about an arbitration clause with its seat, the legal home of the arbitration, in a Convention country. Ask also how a judgment from your own courts would be treated there. For critical or important functions, that answer is part of what DORA asks you to consider.

Is a firm in Armenia or Georgia a sanctions risk compared with one in Russia or Belarus?

Not as a country. As of 26 October 2026, the EU Sanctions Map shows EU sanctions regimes for Russia and for Belarus and none for Armenia or Georgia. The UK's list of sanctions regimes and the US Treasury's list of sanctions programs have none for Armenia or Georgia either.

A country without a regime does not clear any company in it. Search the company, each owner named in the register, the director and the receiving bank on the EU's consolidated list of financial sanctions, and on the UK Sanctions List if you are a UK firm. In its Best Practices for the effective implementation of restrictive measures, updated on 3 July 2024, the Council of the EU treats an entity as owned by a listed person from “50% or more of the proprietary rights”. Paying such an entity will in principle count as making funds available to the listed person indirectly.

Ask, too, where each engineer on your project will work from, and get a sanctions lawyer's view before you sign if anyone would work from Russia or Belarus. The article on choosing a company in Eastern Europe or the Caucasus explains the US rules on this.

If your group includes a US company, also check where the firm's owners and engineers live: the Justice Department's Data Security Program, in effect since 8 April 2025, names six “countries of concern”, Russia among them, and not Belarus, Armenia or Georgia. Under it, a US company may give a vendor organised in Russia access to the personal financial data of more than 10,000 US persons, counted over the preceding twelve months, only if it meets the program's security and compliance requirements. The rule also reaches a non-US vendor that is 50% or more owned by such companies or by people who live mainly in Russia. An engineer who lives mainly in Russia is a covered person too, whoever employs them.

Which company do we sign with, and how do we check that it is real?

Sign with the company that employs the engineers on your project. If a firm offers a contract with its EU or US company while the engineers work for its Armenian or Georgian one, ask to see how the code and the rights pass from one company to the other and then to you.

Then find the company in its official register yourself. In Armenia that is the register of legal entities of the Ministry of Justice, at e-register.moj.am. In Georgia it is the register of the National Agency of Public Registry. For a Polish company, the European e-Justice Portal searches the national business registers. The article on choosing a company in Eastern Europe or the Caucasus explains what each register shows and what to compare it with.

A real company can still stop work halfway through. The article on a dedicated team that stays covers the checks for that risk. The DORA terms above also protect you here: your code in your repositories, your data returned in a usable format, and a transition period while you move.

Where does amBrain fit?

amBrain, which publishes this blog, is a Yerevan, Armenia software engineering company, so the Armenian side of this article applies to it. Its services include “Trading terminal development, order management systems, and FIX protocol exchange integration.” It has been building software since 2019 and works in three formats: full delivery, a dedicated team, or engineers embedded in your team.

Its line on ownership is “The client keeps full ownership of the product and the code, except our reusable components.” If amBrain is on your shortlist, ask it the questions above as you would any other firm: whether it signs the standard contractual clauses, where each engineer works, whether it accepts the Article 30 terms, and which reusable components it means.

This article is not legal advice: have a lawyer read the contract before you sign it.