Joint Resolution of the Board of the Agency for Regulation and Development of the Financial Market of the Republic of Kazakhstan No. 99 and the Board of the National Bank of the Republic of Kazakhstan No. 72 on Approval of Rules for Biometric Authentication by Financial and Payment Organizations

AGENCY OF THE REPUBLIC OF KAZAKHSTAN FOR REGULATION AND DEVELOPMENT OF THE FINANCIAL MARKET		NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN
RESOLUTION OF THE BOARD		RESOLUTION OF THE BOARD
June 26, 2026 No. 99 Almaty		June 29, 2026 No. 72 Astana

JOINT RESOLUTION

On Approval of the Rules for Biometric Authentication by Financial and Payment Organizations, Including Cases of Mandatory Use and/or Filling with Biometric Data of the National Biometric Authentication System Obtained by the Identification Data Exchange Center of the National Bank of the Republic of Kazakhstan

In accordance with paragraph 6 of Article 48 of the Digital Code of the Republic of Kazakhstan, the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market and the Board of the National Bank of the Republic of Kazakhstan RESOLVE:

1. Approve the attached Rules for Biometric Authentication by Financial and Payment Organizations, Including Cases of Mandatory Use and/or Filling with Biometric Data of the National Biometric Authentication System Obtained by the Identification Data Exchange Center of the National Bank of the Republic of Kazakhstan (hereinafter – the Rules).
2. The Department of Information and Cybersecurity of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market shall, in the manner established by the legislation of the Republic of Kazakhstan, ensure:
3. jointly with the Legal Department of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market, the state registration of this joint resolution in the Ministry of Justice of the Republic of Kazakhstan;
4. placement of this joint resolution on the official website of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market after its official publication;
5. submission to the Legal Department of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market, within ten working days after the state registration of this joint resolution, information on the implementation of the measure provided for in subparagraph 2) of this paragraph.
6. Control over the implementation of this joint resolution[1] shall be entrusted to the Deputy Chairmen of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market and the Deputy Chairman of the National Bank of the Republic of Kazakhstan responsible for the relevant areas.
7. This resolution is subject to official publication and enters into force on July 12, 2026, except for subparagraph 2) and part two of paragraph 24, subparagraph 3) of paragraph 25, paragraphs 26 and 27 of the Rules, which enter into force on July 19, 2026.

Chairman of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market		Chairman of the National Bank of the Republic of Kazakhstan
M.E. Abilkasymova		T.M. Suleimenov

Approved by the joint resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market dated June 26, 2026 No. 99 and the Board of the National Bank of the Republic of Kazakhstan dated June 29, 2026 No. 72

Rules for Biometric Authentication by Financial and Payment Organizations, Including Cases of Mandatory Use and/or Filling with Biometric Data of the National Biometric Authentication System Obtained by the Identification Data Exchange Center of the National Bank of the Republic of Kazakhstan

Chapter 1. General Provisions

1. The Rules for Biometric Authentication by Financial and Payment Organizations, Including Cases of Mandatory Use and/or Filling with Biometric Data of the National Biometric Authentication System Obtained by the Identification Data Exchange Center of the National Bank of the Republic of Kazakhstan (hereinafter – the Rules), are developed in accordance with paragraph 6 of Article 48 of the Digital Code of the Republic of Kazakhstan (hereinafter – the Digital Code) and define the procedure for conducting biometric authentication by financial and payment organizations, including cases of mandatory use and/or filling with biometric data of the National Biometric Authentication System obtained by the Identification Data Exchange Center of the National Bank of the Republic of Kazakhstan (hereinafter – CIED).
2. The Rules use the concepts provided for by the Digital Code, the Laws of the Republic of Kazakhstan "On Banks and Banking Activity in the Republic of Kazakhstan", "On Payments and Payment Systems" (hereinafter – the Payment Law), "On State Regulation, Control and Supervision of the Financial Market and Financial Organizations", as well as the following concepts:
3. authenticated person – a natural person or a natural person acting on behalf of a legal entity, regarding whom the process of biometric authentication is conducted;
4. image authenticity verification technology – a set of software and technical methods and algorithms aimed at confirming the presence of a living natural person when obtaining biometric data (face image) by analyzing dynamic, volumetric, lighting and other characteristics of the image in real-time (Liveness Detection);
5. current face image – a face image obtained during a biometric authentication session;
6. reference face image – biometric data based on the face image of the authenticated person, contained in available sources and/or in the biometric data database of the National System of Biometric Authentication (hereinafter – NSBA), access to which is provided by CIED;
7. biometric authentication provider – an organization carrying out the receipt of a reliable current face image of the authenticated person and/or comparison of the current and reference face image samples of the authenticated person, including CIED;
8. database of verified images of the biometric authentication provider – a database created and stored by the biometric authentication provider, containing verified face images of authenticated persons who have successfully passed comparison with a reference sample from available sources and/or from the NSBA biometric data database via CIED, or obtained via hardware devices of the biometric authentication provider during the personal presence of the authenticated person;
9. biometric authentication customer – a financial or payment organization on whose behalf the biometric authentication process is carried out;
10. biometric data comparison system – a digital system carrying out image comparison;
11. biometric data verification system – a digital system carrying out the image authenticity verification procedure;
12. available sources – state databases including reference data of natural persons, reference images of natural persons, as well as individual identification numbers (hereinafter – IIN) of natural persons and/or business identification numbers (hereinafter – BIN) of legal entities;
13. person with a disability – a person having a health impairment with a persistent disorder of body functions, caused by diseases, injuries (wounds, trauma, concussions), their consequences, impairments, which leads to a limitation of life activity and the need for their social protection;
14. CIED rules – internal rules of the national center for managing the national digital financial infrastructure regulating the procedure for providing CIED services to financial and payment organizations for conducting authentication procedures.
15. Principles of use and protection of biometric data:
16. collection and storage of biometric data is carried out in accordance with Chapter 2 of the Rules;
17. biometric data are protected from unauthorized access and dissemination;
18. documentation of processes for the collection, storage and destruction of biometric data.
19. The biometric authentication customer approves the description of the biometric authentication process, information about biometric data verification and comparison systems, as well as criteria for making a decision on the success of biometric authentication, expressed in quantitative indicators.
20. Biometric authentication is conducted based on the face image of the authenticated person.

Chapter 2. Procedure for Biometric Authentication Based on the Face Image of the Authenticated Person

1. The process of biometric authentication based on the face image of the authenticated person includes the following stages:
2. obtaining a reliable current face image of the authenticated person;
3. obtaining a reference face image of the authenticated person from available sources and/or the NSBA biometric data database or a face image of the authenticated person from the database of verified images of the biometric authentication provider (hereinafter – verified image);
4. comparison of the current and reference face image of the authenticated person or comparison of the current and verified face image of the authenticated person (hereinafter – image comparison).
5. Obtaining a reliable current face image of the authenticated person, as well as the IIN, is carried out by the biometric authentication provider using software on a mobile device or computer. At the same time, the software implements at least the following protection measures: control of its own integrity, check for launch in an emulated environment, protection against substitution of the built-in camera of the device or computer.
6. When obtaining a reliable current face image of the authenticated person, in order to prevent substitution of the current face image of the authenticated person, a procedure for verifying the authenticity of the image is carried out, which includes sending to the authenticated person no less than three signals and/or commands aimed at creating visual changes in the frame, followed by analysis of the video stream for discrepancies with the directed signals and commands.

Identified discrepancy with any of the directed signals and/or commands leads to a repetition of the image authenticity verification procedure. Three unsuccessful repetitions mean a negative result of the image authenticity verification.

1. Based on the results of the image authenticity verification, regardless of the success of the verification, an electronic document is formed in the biometric data verification system, containing:
2. the result of the authenticity verification of the current face image;
3. IIN;
4. a list of signals and/or commands selected by the system, a set of images corresponding to the signals and/or commands with an indication of the used signals and/or commands;
5. details of the biometric authentication customer (name, BIN, address);
6. date and time of the image authenticity verification;
7. details of the biometric authentication provider (name, BIN, address).
8. The electronic document resulting from the image authenticity verification is certified by the electronic digital signature of the biometric authentication provider who carried out the verification and is stored with the biometric authentication customer.
9. Biometric data comparison is carried out by comparing the face image of the authenticated person obtained as a result of authenticity verification with the reference face image or verified image. The algorithm for forming the comparison result is determined by the biometric authentication provider.
10. Based on the results of image comparison, regardless of the success of the verification, an electronic document is formed in the biometric data comparison system, containing:
11. the face image of the authenticated person obtained as a result of image authenticity verification;
12. IIN;
13. the result of image comparison;
14. details of the biometric authentication customer (name, BIN, address);
15. date and time of image comparison;
16. details of the biometric authentication provider (name, BIN, address).
17. The electronic document resulting from biometric data comparison:
18. is certified by the electronic digital signature of the biometric authentication provider who carried out the image comparison;
19. is saved in the database of verified images of the biometric authentication provider who carried out the image comparison, if such a database exists;
20. is stored with the biometric authentication customer.
21. In order to ensure confidentiality, as well as to prevent substitution of transmitted data, encryption of communication channels used within the biometric authentication process, going beyond the digital infrastructure of the biometric authentication provider or the biometric authentication customer, is ensured.
22. Based on the results of image authenticity verification, image comparison results, as well as criteria determined in accordance with paragraph 4 of the Rules, the biometric authentication customer makes a decision on the success of biometric authentication.
23. Storage of the results of image authenticity verification, image comparison results and the final decision on the success of biometric authentication is carried out by the biometric authentication customer in accordance with the requirements of the Payment Law, as well as requirements for document storage imposed on the financial service within which biometric authentication was carried out, ensuring the ability to extract and provide these results upon request in the form of an electronic document suitable for visual perception without the use of data conversion procedures (except for electronic digital signature verification means) and containing information necessary to confirm the authenticity and validity of the electronic digital signature.

Chapter 3. Procedure for Conducting Biometric Authentication via CIED, as well as Cases of Mandatory Use and/or Filling with Biometric Data of the NSBA Obtained by CIED

1. Connection of financial and payment organizations to CIED and receipt by said organizations of information about the results of biometric authentication via CIED is carried out in accordance with the CIED Rules. The CIED Rules are posted on the official website of the national center for managing the national digital financial infrastructure.
2. In cases provided for by paragraphs 24, 29 and 30 of the Rules, a financial and/or payment organization obtains the consent of the authenticated person to conduct biometric authentication and the consent of the authenticated person to the collection, processing and presentation, including to third parties if necessary, of his personal data, confirmed by means of an identification instrument.

A financial and/or payment organization conducts a video conference session with the authenticated person using devices available to the authenticated person and/or other devices of the organization, or uses image authenticity verification technology using CIED or independently selected third-party solutions.

The substantive part of the video conference session (list of control questions, if any), as well as the list and volumes of services provided by financial and/or payment organizations, are established independently by financial and/or payment organizations.

1. A financial and/or payment organization transmits to CIED the IIN of the authenticated person or the BIN of the legal entity on whose behalf the authenticated person acts, and the image of the authenticated person obtained from a video conference session or using image authenticity verification technology during biometric authentication.
2. Regarding an authenticated person who is a person with a disability, a financial and/or payment organization, before the start of the biometric authentication procedure, ensures the possibility of choosing a method of obtaining a face image by conducting a video conference session or using image authenticity verification technology.
3. CIED using software determines the degree of compliance by biometric indicators of the image obtained from a video conference session or when using image authenticity verification technology with the reference face image of the authenticated person from available sources and/or from the NSBA database. Video recordings of authenticated persons' appeals are stored in the financial and/or payment organization for no less than five years from the date of termination of business relations with the client.
4. It is permissible to provide CIED additional services to financial and payment organizations for conducting authentication, provided for by the CIED Rules.
5. Face images of authenticated persons transmitted by financial and/or payment organizations to CIED from a video conference session or using image authenticity verification technology are used by CIED for the purposes of biometric authentication and/or filling the NSBA database.

Face images of authenticated persons obtained by CIED from financial and/or payment organizations and having passed verification with compliance results of no less than 95% authenticity and no less than 95% compliance with the reference face image are used to fill the NSBA database.

1. Banks, branches of non-resident banks of the Republic of Kazakhstan and organizations carrying out certain types of banking operations (hereinafter – banks), when providing electronic banking services for the purpose of identifying the authenticated person, use CIED services for providing biometric authentication in the following cases:
2. establishing business relations with the authenticated person remotely by opening a bank account;
3. creating an electronic digital signature and issuing a certificate of electronic digital signature to the authenticated person by a bank that is an accredited certification center of the Republic of Kazakhstan, in cases provided for by part two of this paragraph;
4. exceeding the amount of a bank loan established by the Requirements for Conditions for Banking Activity, approved by the Resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market dated May 15, 2026 No. 91 "On Approval of the Requirements for Conditions for Banking Activity" (registered in the Registry of State Registration of Normative Legal Acts under No. 38748);
5. primary registration of the authenticated person in a mobile application and/or on the bank's website;
6. in other cases, in accordance with the Requirements for Internal Control Rules for the Purpose of Combating the Legalization (Money Laundering) of Proceeds Obtained by Criminal Means, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction for second-level banks, branches of non-resident banks of the Republic of Kazakhstan and the National Postal Operator, approved by the Resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market dated March 22, 2020 No. 18 "On Approval of the Requirements for Internal Control Rules for the Purpose of Combating the Legalization (Money Laundering) of Proceeds Obtained by Criminal Means, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction for second-level banks, branches of non-resident banks of the Republic of Kazakhstan and the National Postal Operator" (registered in the Registry of State Registration of Normative Legal Acts under No. 20160).

In the event that the authenticated person has not previously been authenticated in person at a bank or using biometric authentication via CIED, the bank creates an electronic digital signature for the authenticated person and issues a certificate of electronic digital signature upon the authenticated person passing biometric authentication via CIED.

1. Banks transmit to CIED the consents of the authenticated person:

2. for the collection and processing of his personal data, including biometric data;

3. for conducting biometric authentication of the authenticated person using CIED;

4. for creating electronic digital signature keys and issuing a certificate of electronic digital signature, including those obtained during the personal presence of the authenticated person at the bank.

5. CIED carries out the collection and registration of consents of the authenticated person provided for by paragraph 25 of the Rules, with the possibility of their withdrawal by the authenticated person in accordance with the legislation of the Republic of Kazakhstan.

6. Consents of authenticated persons obtained via CIED, as well as the results of biometric authentication by CIED, are subject to storage in CIED for no less than 5 (five) years from the moment of their receipt and processing.

7. Banks ensure the storage of information about the consents of the authenticated person used in providing electronic banking services, the image of the authenticated person using image authenticity verification technology, video recordings of video conference sessions with the authenticated person, as well as the results of biometric authentication of the authenticated person, for no less than 5 (five) years from the date of termination of business relations with the authenticated person.

8. Microfinance organizations use CIED services for biometric authentication of authenticated persons when exceeding the amounts of microcredit established by the Requirements for Microfinance Activity, approved by the Resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market dated May 15, 2026 No. 92 "On Approval of the Requirements for Microfinance Activity" (registered in the Registry of State Registration of Normative Legal Acts under No. 38746).

9. Payment organizations that are operators of electronic money systems ensure biometric authentication of electronic money owners via CIED in accordance with the requirements of part three of paragraph 5 of Article 42 of the Payment Law.

10. ↑