Kazakhstan (KZ)

Licensing, Authorisation & Market Access

Kazakhstan's payment-market access runs on a dual track. The national Law on Payments and Payment Systems (26 July 2016, No. 11-IV LRK) is the core statute governing organisation and oversight of payment systems and payment-services market regulation, operating alongside a parallel authorisation regime administered by the Astana International Financial Centre's Astana Financial Services Authority. Within the national track, the National Bank of Kazakhstan requires non-bank payment organisations to complete a registration process before rendering payment services; unregistered activity is illegal and attracts statutory liability, making registration the operative market-access gate for non-bank payment-service providers, distinct from the bank-licensing track.

That bank-licensing track has just been substantially reformed. President Tokayev signed the New Law on Banks and Banking Activities on 16 January 2026, and it entered into force approximately sixty days later, around 17 March 2026, introducing a two-tier basic/universal bank licensing system and a digital-financial-asset/stablecoin legal category under National Bank oversight. This finding corrects an earlier baseline position that had described the law as still awaiting presidential signature; the correction is supported by corroborating reporting describing the law's enacted provisions, and both the signing event and the entry-into-force timeline are now treated as settled rather than pending.

The practical effect is a bifurcated but converging market-access architecture: banks now face a two-tier licensing calculus determining prudential scope, while non-bank payment organisations continue to operate under the registration-based gate that has applied since 2016, and AIFC-domiciled participants retain a third, parallel authorisation route through AFSA. Firms assessing Kazakhstan market entry should expect the bank-licensing tier question and the non-bank registration question to be resolved on materially different timelines and evidentiary standards, since one is now shaped by a freshly enacted statute while the other rests on longstanding NBK administrative practice.

Outlook

The New Banking Law's two-tier licensing system is now in force, but implementing regulations and NBK guidance on the basic/universal tier boundary have not yet been independently confirmed in this baseline; that operationalisation is the next milestone to track. The dual-track structure with AIFC/AFSA is expected to persist, since nothing in the current sourcing suggests convergence of the two authorisation regimes.

Conduct, Safeguarding & Financial Promotions

Kazakhstan's conduct regulation is being rebuilt around the now-in-force New Banking Law. The law introduces a behavioural-supervision regime that shifts bank oversight away from a purely financial-metrics focus toward fair treatment of clients, and it establishes a two-step complaint process escalating to a Unified Financial Ombudsman. Because the parent law is confirmed signed and in force, this conduct regime is now assessed as likely operative, though the ombudsman's specific commencement date has not been independently confirmed and the finding is therefore held at Assessed rather than High confidence.

Distinct from the New Banking Law, an established rule under existing payments legislation already governs agent conduct: a payment organisation that engages agents to accept payments on its behalf bears joint-and-several liability to customers for those agents' conduct, and must operate strictly within its authorised service scope. This agent-liability rule is a persistent feature of the payments-law framework rather than a product of the 2026 reform, and it functions as a standing safeguard for the non-bank payment-organisation channel that sits alongside - but separate from - the new bank-conduct regime.

Read together, Kazakhstan's conduct perimeter is expanding on two fronts simultaneously: banks gain a new behavioural-supervision layer and a unified dispute-escalation path, while non-bank payment organisations continue to carry pre-existing agent-liability exposure. The bank-PSP and non-bank-PI/EMI conduct tracks remain distinct in both legal basis and enforcement mechanism.

Outlook

The Unified Financial Ombudsman's operationalisation is flagged on the regulatory horizon for the second quarter of 2026; confirmation of its commencement, and of how the two-step complaint process interacts with the pre-existing agent-liability rule, is the next material development to watch in this module.

Stablecoins & Digital Money

Kazakhstan's digital-asset regime has undergone a substantive reclassification in this baseline. The historical position - under the Law on Digital Assets No. 193-VII, in force since 1 April 2023 - confined unsecured digital-asset circulation to the AIFC only. That confinement has since been superseded: a November 2025 amendment (Law No. 231-VIII) removed the AIFC-only restriction, and the now-in-force New Banking Law formalises digital tenge and stablecoin issuance under National Bank oversight, so unsecured digital assets and digital financial assets now circulate nationwide under national licensing rather than the earlier AIFC-confined, bifurcated model. This corrects an earlier baseline framing that had presented the nationwide opening and the DFA framework as parallel pending developments; both are now enacted, though the AIFC parallel track remains available for AIFC-registered participants.

Within that AIFC parallel track, the Astana Financial Services Authority's AIFC Stablecoin Framework - covering capital, redemption, reserve-asset and disclosure requirements for single-currency-backed fiat stablecoins - has in fact been in force since 1 January 2024. An earlier reading had described this framework as a future expansion; that framing is now understood to be stale, and the framework should be treated as an established, operating regime rather than a pending one.

The net effect is that Kazakhstan now runs two live, parallel stablecoin/digital-asset regimes - a nationwide track under the amended digital-assets law and New Banking Law, and an AIFC-specific track under the AFSA framework in force since 2024 - rather than a single bifurcated regime with one side still pending.

Outlook

With both the nationwide and AIFC tracks now confirmed in force, the next material development to track is how National Bank licensing practice under the New Banking Law's DFA/stablecoin category interacts with the AIFC's separate AFSA authorisation for entities operating across both tracks.

Operational Resilience & Critical Infrastructure

Kazakhstan's operational-resilience baseline for payments runs through general critical-infrastructure law rather than a payments-specific cybersecurity statute. Critical (information) infrastructure operators, a category that captures core payment-system operators, must assess and manage cyber risk under Article 54 of Law No. 418-V 'On Informatization' (24 November 2015), reinforced by the 2023-2029 national Digital Transformation/Cybersecurity Concept adopted under Resolution No. 269.

On the operational side, the National Bank of Kazakhstan launched an Anti-Fraud Center in August 2024 to respond to fraudulent activity, block suspicious money transfers, and maintain a blacklist of suspicious mobile numbers. This builds on an earlier 2022 NBK directive requiring financial institutions to follow mandatory cybersecurity protocols, indicating a steady build-out of operational-resilience tooling over the past several years rather than a single reform event.

Both elements - the statutory critical-infrastructure obligation and the NBK's operational anti-fraud tooling - are assessed as steady-state and unchanged this cycle, in contrast to the escalating trajectories visible in the licensing and digital-asset modules.

Outlook

No near-term change to this module's statutory basis is indicated in current sourcing; the Anti-Fraud Center's operational metrics and any expansion of its blacklist/blocking mandate are the items most likely to generate incremental developments.

Scheme & Network Compliance

Kazakhstan's scheme and network compliance baseline centres on the National Bank's Payment Systems Register. The Interbank Money Transfer System (IMTS), operated by the National Payment Corporation, is classified in that register as the systemically important payment system, processing more than 97% of foreign-exchange, securities and banking-sector payments; Visa, by contrast, is classified in the same registry as merely an 'important' - not systemically important - payment system.

On data security, Visa- and Mastercard-facing entities that handle card data in Kazakhstan must comply with PCI DSS, which functions as a scheme-mandated overlay enforced through issuer/acquirer scheme contracts rather than as a domestic statute. In the absence of an identified domestic acquiring or interchange statute, PCI DSS compliance and the systemic-designation framework are the two operative controls in this module.

Outlook

No domestic interchange-fee cap, surcharging rule, or acquiring-specific statute has been identified to date (see the related merchant-acquiring gap logged under W8); this remains a coverage gap to close in future research cycles rather than a signal of forthcoming regulatory change.

Payment Corridor Dynamics

Kazakhstan's payment corridors are shaped by two simultaneous forces: deepening CIS/Russia connectivity and rising sanctions pressure on that same connectivity. Russia's Fast Payment System (SBP) has expanded cross-border to include Kazakhstan among nine countries, and Kazakhstan sits among the top five countries by SBP transfer volume received from Russia, within a group (with Armenia, Belarus, Tajikistan and Uzbekistan) that together accounts for more than 90% of that volume. This SBP corridor, alongside SPFS messaging connectivity, functions as the principal CIS/Russia payment rail for Kazakhstan.

That same corridor is now under sanctions pressure. The European Union's 19th sanctions package, adopted 23 October 2025, places VTB Bank Kazakhstan under a transaction ban specifically for its connectivity to Russian financial-messaging and payment systems, including Mir and SBP. However, operational severance of VTB Bank Kazakhstan from these rails is not independently confirmed by current sourcing - the EU source confirms only that the transaction ban was imposed, and the National Bank of Kazakhstan has stated the bank remains locally operational. Confidence in the severance question is accordingly held at Assessed rather than High, a downward correction from an earlier baseline reading that had over-stated confidence on this point.

Outlook

The unresolved question of VTB Bank Kazakhstan's actual operational connectivity to SPFS/SBP - transaction-ban designation versus genuine severance - is the single most consequential open item in this module and the one most likely to generate a material update in the next cycle.

Industry Structure & Commercial Dynamics

Kazakhstan's banking and payments market is concentrated and bank-led. Of 23 licensed second-tier banks, the top five - Halyk, Kaspi, Bank CenterCredit, Otbasy and ForteBank - hold approximately 67% ($88.3 billion) of sector assets as of 1 January 2025. Within that group, government data indicates that Kaspi.kz and Halyk Bank together handle approximately 80% of domestic payments, an extraordinary degree of duopoly concentration in payments specifically rather than banking assets generally.

Fintech growth in Kazakhstan follows a distinctive pattern relative to many other emerging-market jurisdictions: it is achieved through bank-led super-app ecosystems rather than through standalone non-bank disruptors displacing incumbents. This bank-led model means that the market-structure and product-innovation trajectories in this jurisdiction (see W9) are substantially driven by the same small set of incumbent institutions that dominate the concentration picture here.

Outlook

Given the scale of the Kaspi/Halyk duopoly, any regulatory or commercial development affecting either institution - including Kaspi's international-acceptance expansion (see W13) - carries outsized market-structure significance for Kazakhstan relative to jurisdictions with more fragmented payments markets.

Legal & Litigation

Kazakhstan's legal and litigation theme this cycle is dominated by sanctions exposure and a new domestic money-muling offence. VTB Bank Kazakhstan remains the only locally licensed, sanctions-listed financial institution in the country, a position that traces back to the 2022 restructuring of the Kazakh subsidiaries of Sberbank, VTB and Alfa-Bank following US and other sanctions on their Russian parents. Commentary characterises Kazakhstan's overall posture as 'managed-risk' rather than blanket de-risking - the country continues to accommodate Russian-linked institutions under enhanced controls rather than excluding them outright.

On the domestic-enforcement side, an amendment to the Criminal Code (Article 232-1), effective 2025, criminalises transferring bank-account, e-wallet or internet-banking access to third parties for payments - the domestic money-muling offence - with penalties ranging from a fine to five years' imprisonment. This functions as a domestic criminal-law complement to the November 2025 AML reform package addressed in W11.

Outlook

Sanctions-related enforcement action involving VTB Bank Kazakhstan, and the first prosecutions under the new money-muling provision, are the two developments most likely to generate the next material update in this module.

Merchant Acquiring & Risk

This module remains the thinnest in Kazakhstan's coverage this cycle. No domestic interchange-fee cap, surcharging rule, or high-risk merchant-category-code classification regime has been identified in current sourcing. In their absence, the operative controls governing merchant-acquiring risk are indirect: the agent joint-and-several liability rule applying to payment organisations (see W1b) and the scheme-level PCI DSS overlay applying to card-data handling (see W4).

This is a logged coverage gap rather than a substantive finding of an unregulated market; merchant-acquiring operations are a known under-indexed research vector in the methodology, and this baseline flags the gap explicitly for targeted follow-up rather than asserting that no such regime exists.

Outlook

Targeted research into Kazakhstan's domestic acquiring and interchange rules is flagged as a priority for the next research cycle; until that gap is closed, this module should be read as thin-coverage rather than genuinely no-regulation.

Product Innovation & Market Development

Kazakhstan's product-innovation trajectory is advancing on two fronts. The Digital Tenge central bank digital currency is live and in use for public-finance scenarios, including a November 2025 road-repair financing programme jointly announced by the National Bank of Kazakhstan and the Ministry of Finance - one of the more advanced CBDC-in-production programmes in the post-Soviet space. Separately, the National Bank's Instant Payment System (IPS), originally launched in June 2022, has been upgraded to enable 24/7 instant interbank transfers and payments using a mobile phone number or QR code between clients of different banks, underpinning continued growth in P2P and merchant QR payments.

A further product-access development sits on the regulatory horizon rather than in the confirmed-live category: full implementation of Open Banking/Open API product-access scenarios is expected in the fourth quarter of 2026, following a mid-pilot phase, which would extend account-to-account product access beyond the IPS rails already in operation.

Outlook

The Open API/Open Banking rollout expected in Q4 2026 is the principal item to track in this module; its interaction with the existing IPS rails and with the bank-led market structure described in W6 will determine whether product innovation broadens payment-market access beyond the Kaspi/Halyk duopoly or reinforces it.

Consumer Protection & APP Fraud

Kazakhstan's consumer-protection framework is consolidating around a single forthcoming institution. The pending Unified Financial Ombudsman will replace separate banking, insurance and microfinance ombudsman mechanisms with a three-tier complaints system - institution, then ombudsman, then the Agency - covering the full range of financial-services complaints rather than sector-specific channels. This sits alongside a broader package of anti-fraud consumer measures, including biometric identification for first loans, a loan opt-out mechanism, and the money-mule criminalisation addressed in W7.

Notably, no UK-style mandatory authorised-push-payment fraud reimbursement scheme has been identified in Kazakhstan; consumer protection against payment fraud is instead being built around the ombudsman-plus-anti-fraud-measures model rather than a liability-shifting reimbursement mandate.

Outlook

The Unified Financial Ombudsman's operationalisation, expected in the second quarter of 2026, is the key milestone for this module; its actual dispute-resolution throughput once live will indicate whether the three-tier model delivers faster consumer redress than the sector-specific mechanisms it replaces.

AML/CFT & Financial Crime

This module is sourced from the Sentinel.gi feed and is carried here as payments-context provenance rather than original illicit-finance analysis, which is out of scope for this monitor and routed instead to the Financial Intelligence Monitor. Kazakhstan's AML/CFT regime tightened materially via a November 2025 reform package, effective 20 November 2025, comprising new money-mule criteria, a high-risk crypto-wallet registry, and blocking of unlicensed crypto exchanges.

That tightening sits against a standing baseline: Kazakhstan's 2023 FATF Mutual Evaluation rated the country Substantially Effective on seven of eleven FATF effectiveness criteria (Highly Effective on none), and Kazakhstan does not appear on the FATF strategic-deficiencies list. The November 2025 reforms represent an incremental strengthening of an already-adequate baseline rather than a response to a deficiency finding.

For substantive illicit-finance analysis of these developments, readers are directed to the Sentinel.gi feed and the corresponding Financial Intelligence Monitor coverage; this sub-brief confines itself to noting the payments-market-structure implications, principally the new compliance burden the crypto-wallet registry and exchange-blocking measures place on payment and digital-asset service providers operating in Kazakhstan.

Outlook

Continued Sentinel-fed reporting on implementation of the crypto-wallet registry and unlicensed-exchange blocking will be the primary source of forward developments in this module.

Correspondent Banking, Settlement & Access

Kazakhstan's correspondent-banking access is structurally sound at the bank level: correspondent relationships with Citi, JPMorgan Chase and BNY, combined with Kazakhstan's IMF Article VIII convertibility commitment (which requires the servicing bank to notify the National Bank of transfers exceeding $50,000), give licensed second-tier banks an established settlement-access base. This module's analytical spine, however, is the asymmetry between that bank-level access and the position of non-bank payment institutions: the correspondent-banking claims underpinning this baseline are specifically documented at the bank_psp level, and no equivalent correspondent or settlement-access finding for non-bank payment organisations or e-money institutions has been identified in current sourcing - an asymmetry consistent with non-bank PSPs' reliance on partner-bank settlement rails rather than direct correspondent relationships.

That bank-level access base is now layered with sanctions-driven de-risking pressure. The EU's 19th sanctions package restricts settlement access for Kazakh (and Belarusian) banks connected to Russian financial-messaging and payment systems via a transaction ban. This illustrates Kazakhstan's broader 'managed-risk' correspondent-banking positioning - continued access for the banking sector overall, with sanctions pressure concentrated on specific Russian-linked institutions - rather than a blanket de-risking of the jurisdiction.

Outlook

Watch for whether sanctions-driven de-risking pressure remains contained to Russian-linked institutions like VTB Bank Kazakhstan or begins to affect correspondent terms for the broader Kazakh banking sector; the bank/non-bank access asymmetry noted above also remains a research gap worth closing in future cycles.

Commercial Intelligence (M&A, Investment & Product)

Two discrete commercial events define Kazakhstan's trailing-twelve-month commercial-intelligence picture. Kaspi.kz completed two acceptance-partnership restructurings: a partnership with UnionPay International achieving near-full UnionPay card acceptance (November 2025), and a partnership with Alipay+ (August 2025). Both events expand Kaspi.kz's international card-acceptance footprint; the financial terms of both partnerships were not publicly disclosed.

Separately, ForteBank issued Kazakhstan's first international perpetual Additional Tier 1 (AT1) Eurobond in November 2025, advised by law firm Dentons - a first-of-kind capital-markets instrument for a Kazakh bank. The amount raised was not publicly disclosed in available sourcing.

Both events are commercial rather than regulatory in character: Kaspi.kz's partnerships are product/acceptance-network expansions distinct from any structural M&A trend, and ForteBank's Eurobond is a discrete capital-raising event rather than a market-structure shift.

Outlook

Further Kaspi.kz international-acceptance partnerships, and any follow-on AT1 or other capital-markets issuance by Kazakh banks, are the items most likely to populate this module in the next cycle.