Kazakhstan

That bank-licensing track has just been substantially reformed. President Tokayev signed the New Law on Banks and Banking Activities on 16 January 2026, and it entered into force approximately sixty days later, around 17 March 2026, introducing a two-tier basic/universal bank licensing system and a digital-financial-asset/stablecoin legal category under National Bank oversight. This finding corrects an earlier baseline position that had described the law as still awaiting presidential signature; the correction is supported by corroborating reporting describing the law's enacted provisions, and both the signing event and the entry-into-force timeline are now treated as settled rather than pending.

The practical effect is a bifurcated but converging market-access architecture: banks now face a two-tier licensing calculus determining prudential scope, while non-bank payment organisations continue to operate under the registration-based gate that has applied since 2016, and AIFC-domiciled participants retain a third, parallel authorisation route through AFSA. Firms assessing Kazakhstan market entry should expect the bank-licensing tier question and the non-bank registration question to be resolved on materially different timelines and evidentiary standards, since one is now shaped by a freshly enacted statute while the other rests on longstanding NBK administrative practice.

Outlook

The New Banking Law's two-tier licensing system is now in force, but implementing regulations and NBK guidance on the basic/universal tier boundary have not yet been independently confirmed in this baseline; that operationalisation is the next milestone to track. The dual-track structure with AIFC/AFSA is expected to persist, since nothing in the current sourcing suggests convergence of the two authorisation regimes.

Distinct from the New Banking Law, an established rule under existing payments legislation already governs agent conduct: a payment organisation that engages agents to accept payments on its behalf bears joint-and-several liability to customers for those agents' conduct, and must operate strictly within its authorised service scope. This agent-liability rule is a persistent feature of the payments-law framework rather than a product of the 2026 reform, and it functions as a standing safeguard for the non-bank payment-organisation channel that sits alongside - but separate from - the new bank-conduct regime.

Read together, Kazakhstan's conduct perimeter is expanding on two fronts simultaneously: banks gain a new behavioural-supervision layer and a unified dispute-escalation path, while non-bank payment organisations continue to carry pre-existing agent-liability exposure. The bank-PSP and non-bank-PI/EMI conduct tracks remain distinct in both legal basis and enforcement mechanism.

Outlook

The Unified Financial Ombudsman's operationalisation is flagged on the regulatory horizon for the second quarter of 2026; confirmation of its commencement, and of how the two-step complaint process interacts with the pre-existing agent-liability rule, is the next material development to watch in this module.

Within that AIFC parallel track, the Astana Financial Services Authority's AIFC Stablecoin Framework - covering capital, redemption, reserve-asset and disclosure requirements for single-currency-backed fiat stablecoins - has in fact been in force since 1 January 2024. An earlier reading had described this framework as a future expansion; that framing is now understood to be stale, and the framework should be treated as an established, operating regime rather than a pending one.

The net effect is that Kazakhstan now runs two live, parallel stablecoin/digital-asset regimes - a nationwide track under the amended digital-assets law and New Banking Law, and an AIFC-specific track under the AFSA framework in force since 2024 - rather than a single bifurcated regime with one side still pending.

Outlook

With both the nationwide and AIFC tracks now confirmed in force, the next material development to track is how National Bank licensing practice under the New Banking Law's DFA/stablecoin category interacts with the AIFC's separate AFSA authorisation for entities operating across both tracks.

On the operational side, the National Bank of Kazakhstan launched an Anti-Fraud Center in August 2024 to respond to fraudulent activity, block suspicious money transfers, and maintain a blacklist of suspicious mobile numbers. This builds on an earlier 2022 NBK directive requiring financial institutions to follow mandatory cybersecurity protocols, indicating a steady build-out of operational-resilience tooling over the past several years rather than a single reform event.

Both elements - the statutory critical-infrastructure obligation and the NBK's operational anti-fraud tooling - are assessed as steady-state and unchanged this cycle, in contrast to the escalating trajectories visible in the licensing and digital-asset modules.

Outlook

No near-term change to this module's statutory basis is indicated in current sourcing; the Anti-Fraud Center's operational metrics and any expansion of its blacklist/blocking mandate are the items most likely to generate incremental developments.

On data security, Visa- and Mastercard-facing entities that handle card data in Kazakhstan must comply with PCI DSS, which functions as a scheme-mandated overlay enforced through issuer/acquirer scheme contracts rather than as a domestic statute. In the absence of an identified domestic acquiring or interchange statute, PCI DSS compliance and the systemic-designation framework are the two operative controls in this module.

Outlook

No domestic interchange-fee cap, surcharging rule, or acquiring-specific statute has been identified to date (see the related merchant-acquiring gap logged under W8); this remains a coverage gap to close in future research cycles rather than a signal of forthcoming regulatory change.

That same corridor is now under sanctions pressure. The European Union's 19th sanctions package, adopted 23 October 2025, places VTB Bank Kazakhstan under a transaction ban specifically for its connectivity to Russian financial-messaging and payment systems, including Mir and SBP. However, operational severance of VTB Bank Kazakhstan from these rails is not independently confirmed by current sourcing - the EU source confirms only that the transaction ban was imposed, and the National Bank of Kazakhstan has stated the bank remains locally operational. Confidence in the severance question is accordingly held at Assessed rather than High, a downward correction from an earlier baseline reading that had over-stated confidence on this point.

Outlook

The unresolved question of VTB Bank Kazakhstan's actual operational connectivity to SPFS/SBP - transaction-ban designation versus genuine severance - is the single most consequential open item in this module and the one most likely to generate a material update in the next cycle.

Fintech growth in Kazakhstan follows a distinctive pattern relative to many other emerging-market jurisdictions: it is achieved through bank-led super-app ecosystems rather than through standalone non-bank disruptors displacing incumbents. This bank-led model means that the market-structure and product-innovation trajectories in this jurisdiction (see W9) are substantially driven by the same small set of incumbent institutions that dominate the concentration picture here.

Outlook

Given the scale of the Kaspi/Halyk duopoly, any regulatory or commercial development affecting either institution - including Kaspi's international-acceptance expansion (see W13) - carries outsized market-structure significance for Kazakhstan relative to jurisdictions with more fragmented payments markets.

On the domestic-enforcement side, an amendment to the Criminal Code (Article 232-1), effective 2025, criminalises transferring bank-account, e-wallet or internet-banking access to third parties for payments - the domestic money-muling offence - with penalties ranging from a fine to five years' imprisonment. This functions as a domestic criminal-law complement to the November 2025 AML reform package addressed in W11.

Outlook

Sanctions-related enforcement action involving VTB Bank Kazakhstan, and the first prosecutions under the new money-muling provision, are the two developments most likely to generate the next material update in this module.

This is a logged coverage gap rather than a substantive finding of an unregulated market; merchant-acquiring operations are a known under-indexed research vector in the methodology, and this baseline flags the gap explicitly for targeted follow-up rather than asserting that no such regime exists.

Outlook

Targeted research into Kazakhstan's domestic acquiring and interchange rules is flagged as a priority for the next research cycle; until that gap is closed, this module should be read as thin-coverage rather than genuinely no-regulation.

A further product-access development sits on the regulatory horizon rather than in the confirmed-live category: full implementation of Open Banking/Open API product-access scenarios is expected in the fourth quarter of 2026, following a mid-pilot phase, which would extend account-to-account product access beyond the IPS rails already in operation.

Outlook

The Open API/Open Banking rollout expected in Q4 2026 is the principal item to track in this module; its interaction with the existing IPS rails and with the bank-led market structure described in W6 will determine whether product innovation broadens payment-market access beyond the Kaspi/Halyk duopoly or reinforces it.

Notably, no UK-style mandatory authorised-push-payment fraud reimbursement scheme has been identified in Kazakhstan; consumer protection against payment fraud is instead being built around the ombudsman-plus-anti-fraud-measures model rather than a liability-shifting reimbursement mandate.

Outlook

The Unified Financial Ombudsman's operationalisation, expected in the second quarter of 2026, is the key milestone for this module; its actual dispute-resolution throughput once live will indicate whether the three-tier model delivers faster consumer redress than the sector-specific mechanisms it replaces.

That tightening sits against a standing baseline: Kazakhstan's 2023 FATF Mutual Evaluation rated the country Substantially Effective on seven of eleven FATF effectiveness criteria (Highly Effective on none), and Kazakhstan does not appear on the FATF strategic-deficiencies list. The November 2025 reforms represent an incremental strengthening of an already-adequate baseline rather than a response to a deficiency finding.

For substantive illicit-finance analysis of these developments, readers are directed to the Sentinel.gi feed and the corresponding Financial Intelligence Monitor coverage; this sub-brief confines itself to noting the payments-market-structure implications, principally the new compliance burden the crypto-wallet registry and exchange-blocking measures place on payment and digital-asset service providers operating in Kazakhstan.

Outlook

Continued Sentinel-fed reporting on implementation of the crypto-wallet registry and unlicensed-exchange blocking will be the primary source of forward developments in this module.

That bank-level access base is now layered with sanctions-driven de-risking pressure. The EU's 19th sanctions package restricts settlement access for Kazakh (and Belarusian) banks connected to Russian financial-messaging and payment systems via a transaction ban. This illustrates Kazakhstan's broader 'managed-risk' correspondent-banking positioning - continued access for the banking sector overall, with sanctions pressure concentrated on specific Russian-linked institutions - rather than a blanket de-risking of the jurisdiction.

Outlook

Watch for whether sanctions-driven de-risking pressure remains contained to Russian-linked institutions like VTB Bank Kazakhstan or begins to affect correspondent terms for the broader Kazakh banking sector; the bank/non-bank access asymmetry noted above also remains a research gap worth closing in future cycles.

Separately, ForteBank issued Kazakhstan's first international perpetual Additional Tier 1 (AT1) Eurobond in November 2025, advised by law firm Dentons - a first-of-kind capital-markets instrument for a Kazakh bank. The amount raised was not publicly disclosed in available sourcing.

Both events are commercial rather than regulatory in character: Kaspi.kz's partnerships are product/acceptance-network expansions distinct from any structural M&A trend, and ForteBank's Eurobond is a discrete capital-raising event rather than a market-structure shift.

Outlook

Further Kaspi.kz international-acceptance partnerships, and any follow-on AT1 or other capital-markets issuance by Kazakh banks, are the items most likely to populate this module in the next cycle.