Resolution of the Board of the National Bank of the Republic of Kazakhstan dated June 10, 2026 No. 58 on Amendments and Additions to Resolution No. 11 and Resolution No. 54

Astana city

On Amendments and Additions to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated February 28, 2022 No. 11 "On Approval of Requirements for Internal Control Rules for the Purpose of Combating the Legalization (Money Laundering) of Proceeds Derived from Criminal Activities, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction for Payment Organizations" and the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 25, 2025 No. 54 "On Approval of the Rules for Organizing the Activities of the Data Exchange Center for Payment Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan)"

The Board of the National Bank of the Republic of Kazakhstan RESOLVES:

1. Make the following amendments and additions to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated February 28, 2022 No. 11 "On Approval of Requirements for Internal Control Rules for the Purpose of Combating the Legalization (Money Laundering) of Proceeds Derived from Criminal Activities, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction for Payment Organizations" (registered in the Registry of State Registration of Normative Legal Acts under No. 27075):

in the Requirements for Internal Control Rules for the Purpose of Combating the Legalization (Money Laundering) of Proceeds Derived from Criminal Activities, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction for Payment Organizations, approved by the said Resolution:

paragraph 2 is to be worded as follows:

"2. Concepts used in the Requirements:

1) beneficial owner – a natural person:

who directly or indirectly owns more than twenty-five percent of participation shares in the authorized capital or issued (excluding preferred and repurchased by the company) shares of a client – a legal entity or a foreign entity without legal personality;

who exercises control over the client in any other way;

in whose interests the client carries out transactions with money and/or other property;

2) impeccable business reputation – the presence of facts confirming professionalism, integrity, including the absence of facts of the person committing unlawful actions (inaction) that led to insolvency, resulting in the forced liquidation of a financial organization, or to the classification of a bank as an insolvent bank, the absence of an unexpunged or unpaid criminal record, including the absence of a court decision that has entered into legal force on the application of criminal punishment in the form of deprivation of the right to hold a managerial position in a financial organization, banking and/or insurance holding and to be a major participant (major shareholder) of a financial organization for life, as well as the absence of relations with third parties (control and influence of third parties), the actions of which contributed to the legalization (money laundering) of proceeds derived from criminal activities, terrorism financing and financing of the proliferation of weapons of mass destruction, based on information from the authorized body for financial monitoring."

subparagraph 2) of paragraph 7 is to be worded as follows:

"2) information on automated digital systems and software used to carry out internal control for AML/CFT/CPF and to transmit messages to the authorized body for financial monitoring, including information on their developers;"

in paragraph 8:

subparagraphs 1) and 2) are to be worded as follows:

"1) ensuring the availability of developed and agreed with the executive body of the organization internal control rules and/or amendments (additions) to them, as well as monitoring of their compliance in the organization;

2) ensuring compliance with the legislation of the Republic of Kazakhstan on AML/CFT and on gambling business;"

subparagraph 7) is to be excluded;

subparagraph 1) of paragraph 9 is to be worded as follows:

"1) obtaining access to all premises of the organization, digital systems, telecommunications facilities, documents and files, within the limits allowing them to perform their functions in full, and in the manner provided for by the internal documents of the organization;"

in paragraph 12:

the first paragraph is to be worded as follows:

"12. The organization uses automated digital systems for the automation of processes regarding internal control for AML/CFT/CPF, which meet the following requirements:"

subparagraph 3) is to be worded as follows:

"3) ensuring the detection and taking of measures in accordance with the internal procedures of the organization, including taking into account characteristics corresponding to typologies, schemes and methods of legalization (money laundering) of proceeds derived from criminal activities, terrorism financing and financing of the proliferation of weapons of mass destruction of the authorized body for financial monitoring, related to:

ML/TF/CPF;

illegal production, circulation and/or transit of drugs;

organization of the activities of financial pyramids;

making payments and money transfers to providers of digital asset services that are not participants of the International Financial Center "Astana", licensed or registered with the National Bank of the Republic of Kazakhstan (hereinafter – National Bank) providers of digital asset services and participants of the special regulatory regime of the National Bank, the activities of which are related to digital assets;

making payments and/or money transfers to electronic casinos and internet casinos, as well as foreign bookmakers and/or totalizators that do not have licenses to engage in gambling business activities in the Republic of Kazakhstan;

risks of age categories of persons;

corruption;

with operations of states (territories) that do not perform or insufficiently perform the recommendations of the Financial Action Task Force (FATF), compiled by the authorized body for financial monitoring;

and other criteria approved by the internal documents of the Organization;"

in paragraph 15:

subparagraph 1) is to be worded as follows:

"1) non-residents of the Republic of Kazakhstan;"

subparagraph 6) is to be worded as follows:

"6) persons who have made three or more payments to the organizer of the gambling business within the last 6 (six) months, except for payments made through a legal entity ensuring the functioning of the unified accounting system, or a legal entity attracted by it in accordance with Article 12-2 of the Law of the Republic of Kazakhstan "On Gambling Business";"

subparagraph 18) is to be excluded;

subparagraphs 21) and 22) are to be excluded;

in paragraph 17:

subparagraph 2) is to be worded as follows:

"2) services for accepting cash for making a payment without opening a bank account of the sender of money for an amount exceeding five hundred thousand tenge;"

subparagraph 4) is to be excluded;

paragraph 20-1 is to be added with the following content:

"20-1. In accordance with the requirements of Article 5 of the Law on AML/CFT and Article 44 of the Law of the Republic of Kazakhstan "On Payments and Payment Systems", the organization carries out client authorization in the mobile application using authentication means that ensure confirmation of the client's identity using the client's biometric data, in the case of:

1) primary registration of the client in the mobile application;

2) change of the device from which the client uses the organization's mobile application;

3) independent change of the contact phone number by the client.

When conducting biometric authentication of the client, the organization ensures the storage of a recording of the video conference session with the client or the obtained current image of the client using motion detection technology for at least five years from the date of termination of business relations with the client, including based on outsourcing.

The organization uses the means of the National Bank's data exchange center for identification data to conduct biometric authentication for the purpose of identifying the client's identity:

1) establishing business relations with the client remotely by opening an electronic wallet, except for cases of opening an electronic wallet by non-identified owners of electronic money;

2) conducting periodic updates of client data by the organization in accordance with the Law on AML/CFT."

paragraph 21 is to be worded as follows:

"21. The organization carries out identification of the client (his representative) and the beneficial owner, as well as establishes the intended purpose of business relations or a one-time transaction (deal) in the following cases:

1) establishing business relations with the client, except for the sale of electronic money for an amount not exceeding three times the size of the monthly calculation indicator, as well as the distribution of payment cards, the amount of which does not exceed two hundred thousand tenge;

2) making a one-time transaction (deal) by the client for an amount:

exceeding five hundred thousand tenge when accepting cash for deposit into a bank account of a natural person using equipment (device) intended for accepting cash, including by making several transactions (deals) in one calendar day;

exceeding five hundred thousand tenge when accepting non-cash payments and/or money transfers without using a bank account;

exceeding two hundred thousand tenge when carrying out an operation using a payment card that is not a means of access to a bank account;

3) making a threshold transaction (deal) by the client;

4) detection of a suspicious transaction (deal) by the client;

5) existence of grounds for doubt about the reliability of previously obtained data about natural and legal persons."

paragraph 21-1 is to be worded as follows:

"21-1. The organization takes measures to prevent its involvement in unlawful activities, carrying out transactions related to the further acquisition of unbacked digital assets on digital asset exchanges that are not participants of the International Financial Center "Astana", providing services for managing digital asset platforms, through providers of digital asset services that are not licensed or registered with the National Bank and participants of the special regulatory regime of the National Bank, the activities of which are related to digital assets."

paragraph 21-4 is to be worded as follows:

"21-4. When entering into business relations with the organization for the purpose of ensuring the acceptance of payments in its favor, the service provider presents the organization with reliable information about the activity being provided, including, indicating the full list of types of services planned to be provided.

In the event that the service provider is a foreign payment service provider, the organization additionally takes the following measures:

1) checks for the presence of a permit document (license, registration, etc.) of the corresponding body of the state of which the foreign payment service provider is a resident, confirming the right to provide payment services;

2) checks for the presence of impeccable business reputation of the foreign payment service provider, including its founders and managers, by collecting information from open sources;

3) evaluates the measures taken by the payment service provider, including foreign, for AML/CFT/CPF;

4) studies the list of service providers to whom the foreign payment service provider can accept payments, including information on the assigned Merchant Category Codes for operations using payment cards;

5) studies the list of service providers to whom the foreign payment service provider can accept payments, including information on the activities they provide for operations using electronic money;

6) other measures provided for by the internal documents of the organization."

subparagraph 3) of paragraph 21-5 is to be worded as follows:

"3) Merchant Category Code;"

paragraph 21-7 is to be worded as follows:

"21-7. Within the framework of interaction with foreign payment service providers (payment intermediaries) to whom the organization accepts payments for goods/services/services of third parties, the organization establishes a list of permissible types of goods/services/services for payment as an appendix to the concluded contract.

The appendix includes the following information on:

1) types of goods, works or services permissible for payment within the framework of the contract (indicating OKED/categories);

2) names of platforms or sites through which sales are made;

3) list of prohibited categories for payment (in a separate section);

4) identifiers or Merchant Category Codes through which funds are accepted.

In the event of a violation by the payment service provider (payment intermediary), including foreign, of the obligation to carry out the acceptance of payments exclusively according to the list of permissible types of goods/services/services approved by the organization, the organization immediately takes measures to suspend business relations with such payment service provider (payment intermediary)."

paragraph 21-8 is to be worded as follows:

"21-8. The organization, which is an operator of an electronic money system, allows opening no more than three electronic wallets for one owner of electronic money within one electronic money system.

The organization takes measures to enhance monitoring of operations of clients – owners of two or more electronic wallets within one electronic money system."

paragraph 22 is to be worded as follows:

"22. Information obtained in accordance with paragraphs 21 and 21-7 of the Requirements is entered (included) by the organization into the client dossier, which is stored in the organization throughout the entire period of business relations with the client and for at least five years from the date of their termination or the making of a one-time transaction (deal), taking into account the possibility of their use as evidence in court, so that they can be timely available to the authorized body, as well as other state bodies in accordance with their competence.

Documents and information on transactions with money and/or other property, including those subject to financial monitoring, suspicious transactions, as well as the results of the study of complex, unusually large and other unusual transactions, are subject to storage by organizations for at least five years after the transaction."

2. Make the following amendments to the Resolution of the Board of the National Bank of the Republic of Kazakhstan dated August 25, 2025 No. 54 "On Approval of the Rules for Organizing the Activities of the Data Exchange Center for Payment Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan)" (registered in the Registry of State Registration of Normative Legal Acts under No. 36742):

the preamble is to be worded as follows:

"In accordance with subparagraph 34) of the second paragraph of part two of paragraph 19 of the Regulation on the National Bank of the Republic of Kazakhstan, approved by the Decree of the President of the Republic of Kazakhstan dated December 31, 2003 No. 1271 "On Approval of the Regulation and Structure of the National Bank of the Republic of Kazakhstan", the Board of the National Bank of the Republic of Kazakhstan RESOLVES:"

The Rules for Organizing the Activities of the Data Exchange Center for Payment Transactions with Signs of Fraud (Anti-Fraud Center of the National Bank of the Republic of Kazakhstan) (hereinafter – Rules), approved by the said Resolution, are to be worded in the edition according to the appendix to this Resolution.

3. The Department of Payment Systems and Digital Financial Technologies of the National Bank of the Republic of Kazakhstan is to ensure in the manner established by the legislation of the Republic of Kazakhstan:

1) jointly with the Legal Department of the National Bank of the Republic of Kazakhstan, the state registration of this Resolution in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this Resolution on the official internet resource of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this Resolution, submission to the Legal Department of the National Bank of the Republic of Kazakhstan of information on the implementation of measures provided for in subparagraph 2) of this paragraph.

4. Control over the implementation of this Resolution is to be entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan in charge.

5. This Resolution enters into force after the expiration of ten calendar days from the date of its first official publication, except for paragraphs thirty-third, thirty-fourth, thirty-fifth, thirty-sixth, thirty-seventh, thirty-eighth of paragraph 1, which enter into force from June 11, 2026, paragraphs forty-first, forty-second, fifty-third, fifty-fourth, fifty-fifth, fifty-sixth, fifty-seventh, fifty-eighth, fifty-ninth, sixtieth, sixty-first, sixty-second of paragraph 1, which enter into force from July 1, 2026, paragraphs tenth, eleventh, seventeenth, eighteenth, twentieth, twenty-first of paragraph 1, which enter into force from July 12, 2026, paragraph 15 of the Rules, Appendix 2 to the Rules, which enter into force from July 19, 2026.

It is established that from July 12, 2026:

paragraphs 5 and 6 of the Rules are to operate in the following edition:

"5. A participant of the anti-fraud center connects to the anti-fraud center by establishing technical interaction with the digital system of the anti-fraud center in the manner determined by the internal documents of the anti-fraud center and agreed with the authorized body in the field of protection of personal data, in compliance with the requirements for ensuring the security of protected information established by the Digital Code of the Republic of Kazakhstan and the laws of the Republic of Kazakhstan "On Personal Data and Their Protection", "On Banks and Banking Activity in the Republic of Kazakhstan", "On Cybersecurity", "On Communications".

6. A message about a payment transaction with signs of fraud, received from an organization and/or a law enforcement body through the digital system of the anti-fraud center for inclusion of the sender of money and/or the beneficiary (recipient of money) in the databases on events of carrying out a payment transaction with signs of fraud (hereinafter – database on events) and/or on attempts to carry out a payment transaction with signs of fraud (hereinafter – database on attempts), is included in the database on attempts or on events immediately after receipt by the anti-fraud center and becomes available to all participants of the anti-fraud center.

The digital system of the anti-fraud center ensures sequential recording of the message sent by the organization about a payment transaction with signs of fraud to the anti-fraud center, confirming:

1) sending of the message by the organization to the anti-fraud center;

2) receipt of the message by the anti-fraud center and its further sending to the addresses of participants of the anti-fraud center;

3) delivery and receipt of the message by participants of the anti-fraud center;

4) response to the message from other participants of the anti-fraud center."

part four of paragraph 21 of the Rules is to operate in the following edition:

"A message about an unlawful incident, received from a second-level bank or a payment organization through the digital system of the anti-fraud center for inclusion of the sender of money and/or the beneficiary (recipient of money) in the database on persons involved in unlawful incidents, is included immediately after receipt of the message by the anti-fraud center and becomes available to all participants of the anti-fraud center."

the first paragraph of paragraph 29 of the Rules is to operate in the following edition:

"29. A message about a payment transaction with signs of fraud is sent by an organization and/or a law enforcement body in digital form in the format established by the internal documents of the anti-fraud center, indicating the following details when making a payment and/or money transfer using:"

It is established that from July 19, 2026, paragraph 3 of the Rules is to operate in the following edition:

"3. Participants of the anti-fraud center are:

1) financial organizations;

2) payment organizations providing payment services provided for in subparagraphs 8) and 9) of paragraph 1 of Article 12 of the Law on Payments;

3) mobile network operators;

4) credit bureaus;

5) law enforcement bodies, national security bodies, law enforcement agencies;

6) National Bank of the Republic of Kazakhstan (hereinafter – National Bank);

7) authorized body for regulation, control and supervision of the financial market and financial organizations;

8) authorized body for financial monitoring;

9) other persons determined by the decision of the National Bank."

Chairman		Suleimenov T.M.

"AGREED"

Agency of the Republic of Kazakhstan

for regulation and development

of the financial market

"AGREED"

Ministry of Internal Affairs

of the Republic of Kazakhstan

"AGREED"

Ministry of Artificial

Intelligence and Digital Development

of the Republic of Kazakhstan

"AGREED"

Agency of the Republic of Kazakhstan

for financial monitoring