Approval of Requirements for Internal Control Rules to Counter Money Laundering, Terrorist Financing, and Proliferation Financing for Digital Financial Asset Issuers with Fiat-Backed Stablecoins

NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN		DECISION OF THE BOARD
dated April 10, 2026 Astana city		No. 31 Astana city

On Approval of Requirements for Internal Control Rules to Counter Money Laundering (Proceeds of Crime), Terrorist Financing, and Proliferation Financing for Issuers of Digital Financial Assets Whose Underlying Asset is Money (Stablecoins)

In accordance with the third paragraph of paragraph 3-2 of Article 11 of the Law of the Republic of Kazakhstan "On Countering Money Laundering (Proceeds of Crime), Terrorist Financing, and Proliferation Financing," the Board of the National Bank of the Republic of Kazakhstan DECIDES:

1. Approve the attached Requirements for Internal Control Rules to Counter Money Laundering (Proceeds of Crime), Terrorist Financing, and Proliferation Financing for Issuers of Digital Financial Assets Whose Underlying Asset is Money (Stablecoins) (hereinafter – Requirements).

2. The Department of Payment Systems and Digital Financial Technologies of the National Bank of the Republic of Kazakhstan shall ensure, in the manner established by the legislation of the Republic of Kazakhstan:

1) jointly with the Legal Department of the National Bank of the Republic of Kazakhstan, the state registration of this decision in the Ministry of Justice of the Republic of Kazakhstan;

2) the placement of this decision on the official website of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this decision, the submission to the Legal Department of the National Bank of the Republic of Kazakhstan information on the implementation of measures provided for in sub-item 2) of this paragraph.

3. Supervision of the implementation of this decision shall be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan in charge.

4. This decision shall enter into force on May 1, 2026, and shall be subject to official publication.

Suspend until July 12, 2026, the operation of:

1) sub-item 1) of paragraph 8 of the Requirements, establishing that during the suspension period, this sub-item shall operate in the following edition:

«1) obtaining access to all premises of the issuer, information systems, telecommunications equipment, documents and files, within the limits allowing them to perform their functions in full, and in the manner provided for by the internal documents of the issuer;»;

2) paragraph 10 of the Requirements, establishing that during the suspension period, this paragraph shall operate in the following edition:

«10. The issuer, for the automation of processes regarding internal control to counter ML/TF/PF, uses automated information systems that meet the requirements of the organization's internal control.».

Chairman		T.M. Suleimenov

"AGREED"

Agency of the Republic of Kazakhstan for Financial Monitoring

Approved

by the Decision of the Board of the National Bank of the Republic of Kazakhstan dated April 10, 2026 No. 31

Requirements

for Internal Control Rules to Counter Money Laundering (Proceeds of Crime), Terrorist Financing, and Proliferation Financing for Issuers of Digital Financial Assets Whose Underlying Asset is Money (Stablecoins)

Chapter 1. General Provisions

1. These Requirements for Internal Control Rules to Counter Money Laundering (Proceeds of Crime), Terrorist Financing, and Proliferation Financing for Issuers of Digital Financial Assets Whose Underlying Asset is Money (Stablecoins) (hereinafter – Requirements) are developed in accordance with the third paragraph of paragraph 3-2 of Article 11 of the Law of the Republic of Kazakhstan "On Countering Money Laundering (Proceeds of Crime), Terrorist Financing, and Proliferation Financing" (hereinafter – the AML/CFT Law).

The Requirements apply to issuers of digital financial assets whose underlying asset is money (stablecoins) (hereinafter – issuers).

2. The Requirements use the concepts provided for by the Laws of the Republic of Kazakhstan on AML/CFT and "On Digital Assets in the Republic of Kazakhstan," as well as the following concepts:

1) unusual transaction (deal) – a transaction (deal) of a client subject to mandatory review in accordance with paragraph 4 of Article 4 of the AML/CFT Law, taking into account the indicators for determining a suspicious transaction defined by the authorized body conducting financial monitoring and taking other measures to counter money laundering (proceeds of crime), terrorist financing, and proliferation financing (hereinafter – authorized body) in accordance with paragraph 2 of Article 10 of the AML/CFT Law, as well as those developed independently by issuers;

2) ML/TF/PF risk management – a set of measures taken by issuers to identify, assess, monitor ML/TF/PF risks, as well as to minimize them (regarding services, clients, and transactions carried out by clients);

3) money laundering (proceeds of crime), terrorist financing, and proliferation financing risks (hereinafter – ML/TF/PF risks) – risks of intentional or unintentional involvement of issuers in processes of money laundering (proceeds of crime), terrorist financing, and proliferation financing (hereinafter – ML/TF/PF);

4) threshold transaction – a client's transaction with money and/or other property subject to financial monitoring in accordance with paragraph 1 of Article 4 of the AML/CFT Law.

3. Internal control to counter ML/TF/PF is carried out by issuers for the purpose of:

1) ensuring compliance with the requirements of the AML/CFT Law;

2) maintaining the effectiveness of the issuers' internal control system at a level sufficient to manage ML/TF/PF risks, taking into account the features of digital financial assets and applied technologies and associated risks (operational, reputational, legal);

3) excluding the involvement of issuers, their officials, and employees in ML/TF/PF processes.

4. Within the framework of organizing internal control to counter ML/TF/PF, issuers develop and adopt internal control rules to counter ML/TF/PF (hereinafter – internal control rules).

Internal control rules include programs provided for by Article 11 of the AML/CFT Law, which are developed independently by issuers in accordance with the Requirements and are internal documents of the issuers or a set of such documents.

Chapter 2. Program for Organizing Internal Control to Counter ML/TF/PF

5. In the manner established by the internal documents of the issuer, the issuer appoints a person responsible for the implementation and compliance with internal control rules (hereinafter – responsible employee), who has higher education and an impeccable business reputation in accordance with the AML/CFT Law and the Law of the Republic of Kazakhstan "On Digital Assets in the Republic of Kazakhstan."

6. The program for organizing internal control to counter ML/TF/PF includes, but is not limited to:

1) the procedure for recording information, as well as storing documents and information obtained during the implementation of internal control to counter ML/TF/PF;

2) the procedure for applying targeted financial sanctions and checking the client (his representative) and beneficial owner for inclusion in the list of organizations and persons associated with terrorist financing and extremism, compiled in accordance with Article 12 of the AML/CFT Law (hereinafter – List), and the list of organizations and persons associated with proliferation financing, compiled in accordance with Article 12-1 of the AML/CFT Law (hereinafter – PF List);

3) the procedure for terminating the action of targeted financial sanctions upon the exclusion of information about the client (his representative) and beneficial owner from the List and the PF List;

4) the procedure for informing employees of issuers about facts of violations of the AML/CFT Law, as well as internal control rules, committed by employees of issuers;

5) a description of requirements to counter ML/TF/PF established by legal entities that control the issuers (if any).

7. The functions of the responsible employee in accordance with the program for organizing internal control to counter ML/TF/PF include, but are not limited to:

1) ensuring the availability of internal control rules developed by the issuer and/or amendments (additions) thereto, as well as monitoring their compliance;

2) organizing the submission and controlling the submission of reports to the authorized body in accordance with the AML/CFT Law;

3) informing the management of issuers about identified clients included in the List, the PF List, and measures taken to apply targeted financial sanctions;

4) making decisions on recognizing client transactions as suspicious and the necessity of sending reports to the authorized body in the manner provided for by the internal documents of the issuers;

5) making or agreeing with the management of issuers decisions on suspending or refusing to carry out client transactions in cases provided for by the AML/CFT Law and/or contracts with clients, and in the manner provided for by the internal documents of the issuer.

8. To perform the assigned functions, the responsible employee is endowed with the following powers, including, but not limited to:

1) obtaining access to all premises of the issuer, digital systems, telecommunications equipment, documents, and files, within the limits allowing them to perform their functions in full, and in the manner provided for by the internal documents of the issuer;

2) ensuring the confidentiality of information obtained in the course of performing their functions.

9. The issuer ensures the conduct of an independent assessment of the effectiveness of the internal control system to counter ML/TF/PF, taking into account a risk-based approach.

Such an assessment may be conducted by a person or organization not involved in the implementation of internal control rules.

10. The issuer, for the automation of processes regarding internal control to counter ML/TF/PF, uses digital systems that meet the requirements of the organization's internal control.

Chapter 3. ML/TF/PF Risk Management Program

11. For the purpose of organizing ML/TF/PF risk management, the issuer develops an ML/TF/PF risk management program.

12. In implementing the ML/TF/PF risk management program, the issuer takes into account published information from the ML/TF/PF risk report in accordance with paragraph 6 of Article 11-1 of the AML/CFT Law.

13. The ML/TF/PF risk management program includes, but is not limited to:

1) the procedure for organizing ML/TF/PF risk management;

2) the methodology for assessing ML/TF/PF risks, taking into account the main categories of risks (by client type, country risk, and service/product risk) regarding:
client risk level; exposure of the issuer's services (products) to ML/TF/PF risks;

3) the procedure for assigning, deadlines, and grounds for reviewing client risk levels.

4) the procedure for identifying and assessing ML/TF/PF risks arising before the development (launch) of new products and new business practices, including new transmission mechanisms, as well as the use of new or emerging technologies for both new and existing products.

14. When assessing ML/TF/PF risks, the issuer takes into account the features of the issuance, placement, circulation, and redemption of digital financial assets whose underlying asset is money, including risks associated with their conversion into money, the speed and volume of transactions, as well as the use in cross-border transactions.

15. Types of clients, whose status and/or activities increase ML/TF/PF risks, include, but are not limited to:

1) public officials, their spouses, and close relatives;

2) foreign financial organizations;

3) persons carrying out the issuance and circulation of unbacked digital assets within the territory of the Astana International Financial Centre;

4) clients carrying out transactions using digital asset wallets not serviced by digital asset service providers, in the absence of sufficient information about the purpose and nature of transactions;

5) legal entities and individual entrepreneurs whose activities are associated with intensive cash turnover, including:
gambling business organizers, as well as persons providing services or receiving income from online casino activities outside the Republic of Kazakhstan; persons providing tourist services, as well as other services associated with intensive cash turnover;

6) insurance (reinsurance) organizations, insurance brokers, carrying out activities in the "life insurance" industry;

7) persons carrying out activities as insurance agents;

8) persons carrying out intermediary activities in the purchase and sale of real estate;

9) non-profit organizations in the organizational and legal form of funds, religious associations;

10) persons located (registered) in foreign states specified in paragraph 17 of the Requirements, as well as branches and representative offices of such persons located in the Republic of Kazakhstan;

11) additional types of clients determined by the issuer (if any), whose status and/or activities increase ML/TF/PF risks.

16. Types of clients, whose status and/or activities decrease ML/TF/PF risks, include, but are not limited to:

1) state bodies of the Republic of Kazakhstan, including the National Bank of the Republic of Kazakhstan, the authorized body for regulation, control, and supervision of the financial market and financial organizations, as well as legal entities controlled by state bodies of the Republic of Kazakhstan;

2) legal entities created in the organizational and legal form of state institutions or state enterprises, as well as national holding companies, or legal entities, 100 percent of the voting shares (participation shares) of which belong to the national holding company;

3) second-tier banks, insurance (reinsurance) organizations – residents of the Republic of Kazakhstan, professional participants of the securities market – residents of the Republic of Kazakhstan.

17. The issuer conducts an assessment of country risk associated with conducting activities in foreign states (territories) specified in this paragraph, by providing services to clients from such foreign states, carrying out transactions with the participation of such foreign states.

Foreign states (territories), transactions with which increase ML/TF/PF risks, are:

1) foreign states (territories) included in the list of states (territories) not implementing or insufficiently implementing the recommendations of the Financial Action Task Force (FATF), compiled by the authorized body in accordance with paragraph 4 of Article 4 of the AML/CFT Law;

2) foreign states (territories) subject to international sanctions (embargoes) adopted by resolutions of the United Nations Security Council;

3) foreign states (territories) characterized as offshore zones according to the list of offshore zones established by the National Bank of the Republic of Kazakhstan;

4) foreign states (territories) determined by the issuer as presenting high ML/TF/PF risks based on other factors (information on corruption levels, illegal production, circulation, and/or transit of drugs, information on support for international terrorism, etc.).

18. When assessing the exposure of the issuer's services to ML/TF/PF risks in accordance with the risk factors specified in paragraphs 12, 13, and 14 of the Requirements, the issuer takes into account additional information affecting the final risk level, including, but not limited to:

1) the number of reports on suspicious client transactions sent by the issuer to the authorized body;

2) the number of reports on threshold client transactions sent by the issuer to the authorized body.

19. In the framework of implementing the ML/TF/PF risk management program, the issuer takes measures to classify clients, taking into account the categories and risk factors specified in paragraphs 12, 13, and 14 of the Requirements.

Chapter 4. Program for Identifying Clients (Their Representatives) and Beneficial Owners

20. For the purpose of implementing the requirements of the AML/CFT Law regarding the due diligence of the client (his representative) and beneficial owner, issuers develop a program for identifying clients (their representatives) and beneficial owners.

Identification of the client (his representative) and beneficial owner consists of measures carried out by issuers to record and verify the accuracy of information about the client (his representative), identify the beneficial owner, and record information about him, as well as to establish and record the intended purpose of business relations.

21. Information obtained during client identification is entered by issuers into the client's file, which is stored by issuers throughout the entire period of business relations with the client and for at least 5 (five) years from the date of their termination.

22. The program for identifying the client, his representative, and beneficial owner includes, but is not limited to:

1) the procedure for accepting clients for service, including the procedure, grounds, and deadlines for the issuer's decision to refuse to establish business relations and/or carry out a transaction, as well as to terminate business relations;

2) the procedure for identifying the client (his representative) and beneficial owner, including the features of simplified and enhanced due diligence procedures for the client;

3) a description of measures aimed at identifying among clients (their representatives) and beneficial owners, who are being serviced or accepted for service, public officials, their spouses, and close relatives.

With respect to clients, their representatives, and/or beneficial owners classified as public officials, their spouses, and close relatives, the issuer applies enhanced due diligence measures, as well as enhanced monitoring of transactions and more frequent updating of information about such clients.

4) the procedure for checking the client (his representative) and beneficial owner for inclusion in the List and the PF List.

5) the procedure for ensuring the transparency of digital asset transfers, including the procedure for obtaining, transmitting, and storing information about the sender and recipient of digital assets when carrying out transactions with digital assets, as well as the procedure for employees of the issuer to act in the absence, incompleteness, or contradiction of such information.

Within the framework of this procedure, the issuer ensures the obtaining and recording of information about the sender and recipient of digital assets, including, but not limited to, the following:

information about the transaction, including the type of digital asset, amount, date, and time of the transaction, the blockchain (distributed ledger) used, and other information provided for by the internal documents of the issuer.

information about the sender of digital assets:
surname, name, patronymic (if any) or the name of the legal entity; information allowing identification of the client; digital asset wallet address or other unique identifier used to carry out the transaction; if available – information about the digital asset service provider servicing the sender;

information about the recipient of digital assets:
surname, name, patronymic (if any) or the name of the legal entity; digital asset wallet address or other unique identifier of the recipient; if available – information about the digital asset service provider servicing the recipient.

6) the features of applying due diligence measures when transferring digital assets to digital asset wallet addresses not serviced by digital asset service providers, or when receiving digital assets from such addresses, including risk-based measures to establish and verify information about the owner (beneficial owner) of such digital asset wallet, conducting enhanced identification and enhanced monitoring of transactions in cases provided for by the internal documents of the issuer.

23. Measures to identify the beneficial owner of the client, establish the structure of his ownership and management, are carried out based on the charter documents and the register of shareholders (register of participants) of such a client, the Register of Beneficial Owners of Legal Entities (hereinafter – Register of BO), posted on the website of the authorized body for financial monitoring, or information obtained from other sources.

24. Information about identified beneficial owners is entered into the Register of BO.

Chapter 5. Program for Monitoring and Reviewing Client Transactions

25. For the purpose of implementing the requirements of the AML/CFT Law regarding the due diligence of the client, as well as the identification and submission to the authorized body of reports on threshold and suspicious transactions, the issuer develops a program for monitoring and reviewing client transactions.

26. Within the framework of the program for monitoring and reviewing client transactions, the issuer carries out measures to update and/or obtain additional information about clients (their representatives) and beneficial owners, including information about the source of funding for transactions carried out by clients, as well as to review client transactions and identify threshold, unusual, and suspicious transactions.

27. The program for monitoring and reviewing client transactions includes, but is not limited to:

1) a list of indicators of suspicious transactions, compiled based on the indicators for determining a suspicious transaction defined by the authorized body in accordance with paragraph 2 of Article 10 of the AML/CFT Law, as well as those developed independently by issuers;

2) the procedure, grounds, and deadline for the responsible employee's decision to qualify a client's transaction;

3) the procedure for submitting reports on threshold and suspicious transactions to the authorized body.

28. In case of doubts about the correctness of qualifying a transaction as threshold, as well as in case of identifying an unusual or suspicious transaction, the employee of the issuer who identified such transaction sends a report on such transaction to the responsible employee.

Chapter 6. Program for Training and Educating Issuer Employees on ML/TF/PF Countermeasures

29. The purpose of the program for training and educating issuer employees on ML/TF/PF countermeasures (hereinafter – training program) is to provide issuer employees with knowledge and form skills necessary for them to comply with the requirements of the legislation of the Republic of Kazakhstan on countering ML/TF/PF, as well as internal control rules and other internal documents of the issuer in the field of countering ML/TF/PF.

30. The training program is developed in accordance with the requirements for financial monitoring subjects regarding preparation and training in the field of combating money laundering, terrorist financing, and financing the proliferation of weapons of mass destruction, as specified in paragraph 8 of Article 11 of the Law on AML/CFT/FP.