Rules for the Activity of Unbacked Digital Asset Exchange Operators — NBK — KZ


NATIONAL BANK OF THE REPUBLIC OF KAZAKHSTAN		DECISION OF THE BOARD
dated April 29, 2026 Astana city		No. 45 Astana city

On Approval of the Rules for the Activity of Unbacked Digital Asset Exchange Operators

In accordance with subparagraph 1) of part two of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Digital Assets in the Republic of Kazakhstan", the Board of the National Bank of the Republic of Kazakhstan DECIDES:

Approve the attached Rules for the Activity of Unbacked Digital Asset Exchange Operators (hereinafter – the Rules).
The Department of Payment Systems and Digital Financial Technologies of the National Bank of the Republic of Kazakhstan shall ensure, in the manner established by the legislation of the Republic of Kazakhstan:

1) jointly with the Legal Department of the National Bank of the Republic of Kazakhstan, the state registration of this decision in the Ministry of Justice of the Republic of Kazakhstan;

2) publication of this decision on the official website of the National Bank of the Republic of Kazakhstan after its official publication;

3) within ten working days after the state registration of this decision, submission of information on the implementation of the activity provided for in subparagraph 2) of this paragraph to the Legal Department of the National Bank of the Republic of Kazakhstan.

Supervision of the implementation of this decision is entrusted to the Deputy Chairman of the National Bank of the Republic of Kazakhstan responsible for this area.
This decision enters into force on May 1, 2026, and is subject to official publication.

Suspend until July 12, 2026, the action of:

subparagraph 6) of paragraph 1 of the Rules, establishing that during the suspension period, this subparagraph shall be in the following wording:

«6) information security requirements;»;

paragraph 6 of the Rules, establishing that during the suspension period, this paragraph shall be in the following wording:

«6. An employee of the National Bank authorized to receive and register correspondence, on the day of receipt of the application, carries out its reception, registration, and forwarding for execution to the department responsible for providing the state service (hereinafter – the responsible department). If an application is received after the end of working hours, on weekends, and holidays according to the labor legislation of the Republic of Kazakhstan, applications are received on the next working day.

When the service recipient submits an application through the "e-government" web portal, the status of acceptance of the application for the state service is automatically displayed in the personal account, indicating the date and time of receiving the result.

The National Bank receives information from relevant state information systems through the "e-government" gateway about documents confirming the identity of the service recipient's head, and about the state registration (re-registration) of the legal entity.»;

part seven of paragraph 8 of the Rules, establishing that during the suspension period, this part shall be in the following wording:

«On the "e-government" web portal, the result of providing the state service is sent to the service recipient's personal account in the form of an electronic document certified by an electronic digital signature (hereinafter – EDS) of the authorized person.»;

paragraph 9 of the Rules, establishing that during the suspension period, this paragraph shall be in the following wording:

«9. Information about the stage of providing the state service is updated automatically in the information system for monitoring the provision of state services.»;

paragraph twelve of paragraph 23 of the Rules, establishing that during the suspension period, this paragraph shall be in the following wording:

«procedures for ensuring information security;»;

part two of paragraph 36 of the Rules, establishing that during the suspension period, this part shall be in the following wording:

«An unbacked digital asset exchange operator ensures the continuous functioning of the internet resource, mobile application, information infrastructure, confidentiality, integrity, and availability of data of the information systems of the unbacked digital asset exchange operator.»;

Chapter 5 of the Rules, establishing that during the suspension period, this chapter shall be in the following wording:

«Chapter 5. Information Security Requirements

The storage period for information about information security incidents is at least 5 (five) years.
The unbacked digital asset exchange operator determines the procedure for taking urgent measures to eliminate the incident, its causes, and consequences.
The unbacked digital asset exchange operator maintains a log of information security incidents, reflecting all information about the information security incident, the measures taken, and proposed corrective measures.
A separate information security incident card is filled out for each information security incident, which includes information on the description of the incident, the date and time of occurrence, detection, and elimination of the incident, resulting consequences, damage, and measures taken.
The unbacked digital asset exchange operator manages information security risks, specifying the name, description, cause of occurrence, acceptable risk level, and action plan for its minimization in relation to the informatization objects of the unbacked digital asset exchange operator.
Information about information security incidents obtained during the monitoring of activities to ensure information security is subject to consolidation, systematization, and storage.
The unbacked digital asset exchange operator sends a notification in arbitrary form about the occurred information security incidents to the National Bank within 24 (twenty-four) hours from the moment of their detection, attaching an information security incident card.
The unbacked digital asset exchange operator ensures:

1) identification, authentication, and authorization of users;

2) registration and storage of information security events;

3) protection of information from unauthorized access, leakage, modification, destruction, and blocking.

4) backup and recovery of information;

5) compliance with the requirements of the legislation of the Republic of Kazakhstan "On Personal Data and Their Protection" when processing personal data on the platform;

6) secure execution of transactions.»;

Appendix 2 to the Rules, establishing that during the suspension period, this appendix shall be in the wording according to the appendix to this decision.


Chairman		T.M. Suleimenov

«CONSIGNED»

Ministry of Artificial Intelligence and Digital Development Republic of Kazakhstan

«CONSIGNED»

Ministry of National Economy
Republic of Kazakhstan

«CONSIGNED»

Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market

Approved by the decision of the Board of the National Bank of the Republic of Kazakhstan dated April 29, 2026 No. 45

Rules for the Activity of Unbacked Digital Asset Exchange Operators

Chapter 1. General Provisions

These Rules for the Activity of Unbacked Digital Asset Exchange Operators (hereinafter – the Rules) are developed in accordance with subparagraph 1) of part two of paragraph 1 of Article 4 of the Law of the Republic of Kazakhstan "On Digital Assets in the Republic of Kazakhstan" (hereinafter – the Digital Assets Law), with subparagraph 1) of Article 10 of the Law of the Republic of Kazakhstan "On State and Socially Responsible Services", and determine:

1) the procedure for licensing an unbacked digital asset exchange operator and qualification requirements for an unbacked digital asset exchange operator;

2) the list of documents submitted to the National Bank of the Republic of Kazakhstan (hereinafter – the National Bank) to obtain a license for dealer activity in the digital asset market – exchange operations with unbacked digital assets (hereinafter – license);

3) requirements for the managing employee and founders (participants) (one of the founders, participants, or shareholders), beneficial owner of an unbacked digital asset exchange operator;

4) requirements for the minimum size of the authorized capital of an unbacked digital asset exchange operator;

5) requirements for the organizational and legal form of an unbacked digital asset exchange operator;

6) requirements for cybersecurity;

7) the procedure for reorganization of an unbacked digital asset exchange operator;

8) the procedure for the activity of unbacked digital asset exchange operators;

9) the procedure for carrying out operations for the purchase, sale, and/or exchange of unbacked digital assets;

10) requirements for the system for analysis and control of operations;

11) restrictions and limits on client operations;

12) the procedure for interaction between unbacked digital asset exchange operators and second-level banks and the National Post Operator;

13) the procedure for opening and servicing digital asset wallets of clients.

Terms used in the Rules are applied in the meanings specified in the Digital Assets Law, the Law of the Republic of Kazakhstan "On Banks and Banking Activity in the Republic of Kazakhstan".

For the purposes of the Rules, the following basic terms are used:

1) exchange operations with unbacked digital assets – operations for the purchase and/or sale of unbacked digital assets carried out by an unbacked digital asset exchange operator;

2) access private key – unique cryptographic information generated in a specific sequence and used to make electronic digital signatures when carrying out operations with digital assets, as well as to access the digital asset wallet;

3) mnemonic phrase – a unique sequence of words intended to restore access to the digital asset wallet to all addresses created in the digital asset wallet;

4) cold digital asset wallet – a hardware device used to store or manage cryptographic keys, providing access to digital assets and conducting transactions with them;

5) hot digital asset wallet – a software tool used to store or manage cryptographic keys, providing access to digital assets and conducting transactions with them.

Chapter 2. Procedure for Licensing an Unbacked Digital Asset Exchange Operator

Paragraph 1. List of Documents Submitted to the National Bank to Obtain a License

A legal entity intending to obtain a license (hereinafter – the service recipient) submits an application to the National Bank in the form according to Appendix 1 to the Rules.

Documents and information specified in paragraph 6 of Article 12-2 of the Digital Assets Law are attached to the application.

An unbacked digital asset exchange operator carries out activities in accordance with the Digital Assets Law, the Law of the Republic of Kazakhstan "On Countering the Legalization (Money Laundering) of Proceeds Obtained by Criminal Means, Financing of Terrorism, and Financing of the Proliferation of Weapons of Mass Destruction" (hereinafter – the AML/CFT/CPF Law), the Rules, and documents specified in subparagraphs 4) and 5) of paragraph 6 of Article 12-2 of the Digital Assets Law.

In case of changes to the documents specified in subparagraphs 4) and 5) of paragraph 6 of Article 12-2 of the Digital Assets Law, the unbacked digital asset exchange operator notifies the National Bank of such changes within 10 (ten) working days from the submission of the new edition of the documents.

Paragraph 2. Procedure for Providing the State Service

"Issuance of a License for Dealer Activity in the Digital Asset Market – Exchange Operations with Unbacked Digital Assets"

The list of basic requirements for providing the state service "Issuance of a License for Dealer Activity in the Digital Asset Market – Exchange Operations with Unbacked Digital Assets" (hereinafter – state service), including the characteristics of the process, form, content, and result of providing the state service, is established in Appendix 2 to the Rules.
An employee of the National Bank authorized to receive and register correspondence, on the day of receipt of the application, carries out its reception, registration, and forwarding for execution to the department responsible for providing the state service (hereinafter – the responsible department). If an application is received after the end of working hours, on weekends, and holidays according to the labor legislation of the Republic of Kazakhstan, applications are received on the next working day.

The National Bank receives information from relevant state digital systems through the "e-government" gateway about documents confirming the identity of the service recipient's head, and about the state registration (re-registration) of the legal entity.

An employee of the responsible department within 2 (two) working days following the day of registration of the application for obtaining a license checks the completeness of the submitted documents.

In case of establishing the fact of incompleteness of the submitted documents, the responsible department within 2 (two) working days from the day of registration of the application prepares and sends a written reasoned refusal to further consideration of the application.

Upon establishing the fact of completeness of the submitted documents, the responsible department within the term of providing the state service considers the documents for their compliance with the requirements of the legislation of the Republic of Kazakhstan, prepares a draft license or a draft reasoned refusal.

If grounds for refusing to issue a license are identified, the National Bank sends the service recipient a preliminary decision on a reasoned refusal with a notification of the time and place of the hearing to provide the service recipient with the opportunity to express their position on the preliminary decision.

A notification of the hearing is sent no later than 3 (three) working days before the expiration of the application consideration term.

The hearing is conducted no later than 2 (two) working days from the day of notification.

An application for obtaining a license is considered by the National Bank within 20 (twenty) working days from the day of submission by the service recipient of the complete package of documents and information specified in paragraph 3 of the Rules.

An employee of the responsible department within 3 (three) working days following the day of acceptance by the authorized person of the National Bank (hereinafter – authorized person) of the corresponding decision, sends the service recipient a notification of the issuance of a license with the attached license or a reasoned refusal to issue a license.

On the "e-government" web portal, the result of providing the state service is sent to the service recipient's personal account in the form of an electronic document certified by an electronic digital signature (hereinafter – EDS) of the authorized person.

Information about the stage of providing the state service is updated automatically in the digital system for monitoring the provision of state services.
The National Bank issues a license to the service recipient in Kazakh and Russian languages in the form according to Appendix 3 to the Rules.
A copy of the license must be placed on the main page of the official website (if any) of the unbacked digital asset exchange operator and in a place accessible for viewing by clients of the unbacked digital asset exchange operator, in case of providing the service through physical branches and/or self-service points.

Paragraph 3. Procedure for Reorganization

of an Unbacked Digital Asset Exchange Operator

In case of making a decision on voluntary reorganization, an unbacked digital asset exchange operator informs the National Bank about this within 10 (ten) working days from the day of making the corresponding decision.
A reorganizing unbacked digital asset exchange operator informs its clients about the reorganization being carried out by publishing a corresponding announcement in the media and on its website.
Licensing of an operator formed as a result of the reorganization of an unbacked digital asset exchange operator is carried out in accordance with the requirements of the Digital Assets Law and the Rules.
An unbacked digital asset exchange operator within 3 (three) working days from the day the court decision on the termination of the activity of the unbacked digital asset exchange operator enters into legal force, or from the day of making a decision on voluntary termination of activity by reorganization (merger, consolidation, division, separation, transformation) or liquidation, sends a notification in arbitrary written form to the National Bank, attaching supporting documents.

Paragraph 4. Procedure for Appealing Decisions, Actions (Inaction) of the National Bank and (or) Its Officials

on Issues of Providing the State Service

Appealing decisions, actions (inaction) of the National Bank and (or) its officials on issues of providing the state service is carried out in writing to the head of the National Bank.

The service recipient's complaint specifies their name, postal address, outgoing number, and date of submission of the complaint.

The complaint is signed by the head of the service recipient.

Confirmation of the acceptance of the complaint is its registration (stamp, incoming number, and date) in the chancellery of the National Bank, indicating the surname and initials of the person who accepted the complaint, the term, and place of receiving the answer to the submitted complaint.

A complaint from the service recipient on issues of providing the state service, received by the National Bank, is considered within 5 (five) working days from the day of its registration.

In case of disagreement with the results of the provided state service, the service recipient appeals to the authorized body for evaluation and control of the quality of providing state services.

A complaint from the service recipient, received by the authorized body for evaluation and control of the quality of providing state services, is considered within 15 (fifteen) working days from the day of its registration.

In case of disagreement with the results of the complaint consideration, the service recipient appeals to the court in the manner established by the legislation of the Republic of Kazakhstan.

Chapter 3. Qualification Requirements for an Unbacked Digital Asset Exchange Operator and Other Requirements for Its Activity

An unbacked digital asset exchange operator is created in the organizational and legal form of a joint-stock company or a limited liability company.
The minimum size of the authorized capital of an unbacked digital asset exchange operator is 50 (fifty) million tenge.

The authorized capital of an unbacked digital asset exchange operator is formed exclusively in money in the national currency of the Republic of Kazakhstan.

Founders (participants) (one of the founders, participants, or shareholders), beneficial owners of an unbacked digital asset exchange operator are physical and legal entities – residents and non-residents of the Republic of Kazakhstan, with the exception of:

1) persons who do not have an impeccable business reputation;

2) persons included in the list of organizations and persons associated with financing terrorism, extremism, and/or financing the proliferation of weapons of mass destruction, in accordance with the AML/CFT/CPF Law;

3) persons registered (residing) in a state (territory) that does not perform or insufficiently performs the recommendations of the Financial Action Task Force (FATF).

For the purposes of this subparagraph, a state (territory) that does not perform or insufficiently performs the recommendations of the Financial Action Task Force (FATF) is understood as a state (territory) included in the list compiled by the authorized body for financial monitoring in accordance with the AML/CFT/CPF Law.

The managing employee of an unbacked digital asset exchange operator is a physical person – a resident of the Republic of Kazakhstan, with the exception of:

1) persons specified in subparagraphs 1), 2), and 3) of paragraph 20 of the Rules;

2) persons who do not have higher education.

It is prohibited to elect or appoint as the head of the executive body of an unbacked digital asset exchange operator a person:

1) who was a head, member of the management body, head, member of the executive body, chief accountant of a financial organization within a period of not more than one year prior to the decision to apply a resolution regime to a bank, a decision to revoke the license of a financial organization, resulting in its liquidation and/or termination of activity in the financial market, or the entry into legal force of a court decision on the forced liquidation of a financial organization or its bankruptcy in the manner determined by the legislation of the Republic of Kazakhstan or the legislation of the state, a resident of which is a financial organization – a non-resident of the Republic of Kazakhstan;

2) who was previously the head of the executive body of an unbacked digital asset exchange operator excluded from the register of unbacked digital asset exchange operators. The ground specified in this subparagraph is applied for five consecutive calendar years from the date of exclusion of the unbacked digital asset exchange operator from the register of unbacked digital asset exchange operators;

3) who does not have an impeccable business reputation.

The Rules for the Activity of an Unbacked Digital Asset Exchange Operator, approved by the management body of an unbacked digital asset exchange operator, contain the following information:

list, description, and procedure for providing services provided to clients;

rights and obligations of the unbacked digital asset exchange operator and clients;

procedures for client identification and verification;

procedure and conditions for the operation of physical branches and self-service points when providing such activity;

procedure and deadlines for settlement of transactions with digital assets;

information on sources of liquidity replenishment and realization of excess liquidity in digital assets;

description of the procedure and mechanisms for the functioning of the system for analysis and control of operations;

procedure and conditions for opening and maintaining digital asset wallets;

procedure and list of questions for determining client qualification;

addresses of digital asset wallets of the unbacked digital asset exchange operator, indicating the name of the blockchain network on which the digital asset wallets are opened;

procedures for ensuring cybersecurity;

procedure for dispute resolution and consideration of client complaints, including the procedure for calculating compensation for damages caused and the mechanism for returning money and digital assets. The amount of compensation is determined based on the actual damage caused to the client, arising from the fault of the unbacked digital asset exchange operator when providing services.

The document defining the procedure for interaction between the unencumbered digital asset exchange operator and a second-level bank and/or the National Post Operator, with the digital asset exchange, with other providers of digital asset services providing access to unencumbered digital assets, includes, but is not limited to:

1) the procedure for opening bank accounts in banks and/or with the National Post Operator for servicing the exchange operator's clients' transactions;

2) the terms for storing clients' funds and the unencumbered digital asset exchange operator's funds;

3) the terms for servicing by the bank and/or the National Post Operator transactions for digital asset deals;

4) the procedure for opening digital asset wallets and conducting transactions by the unencumbered digital asset exchange operator on digital asset exchanges and through digital asset service providers, including foreign licensed organizations providing access to unencumbered digital assets.

Chapter 4. Procedure for Carrying Out the Activity of Unencumbered Digital Asset Exchange Operators

Clients of the unencumbered digital asset exchange operator are natural and legal persons.
Transactions for the purchase and sale of unencumbered digital assets with resident clients of the Republic of Kazakhstan are carried out by the unencumbered digital asset exchange operator in the national currency.

Transactions for the purchase and sale of unencumbered digital assets with non-resident clients of the Republic of Kazakhstan are carried out by the unencumbered digital asset exchange operator in the national and/or foreign currency.

Transactions with unencumbered digital assets are carried out by the unencumbered digital asset exchange operator in its own name and at its own expense.

To provide the service, the unencumbered digital asset exchange operator accepts applications from clients for the purchase and sale of unencumbered digital assets.

The unencumbered digital asset exchange operator stores unencumbered digital assets on cold and/or hot digital asset wallets.
Before a client makes a transaction, the unencumbered digital asset exchange operator brings to the client's attention information about the risks associated with the purchase, sale, and ownership of unencumbered digital assets, which includes, but is not limited to:

1) a statement that unencumbered digital assets are not a means of payment;

2) a statement that unencumbered digital assets are not backed by the state and the acquisition of unencumbered digital assets may lead to a complete loss of money and other objects of civil rights (including as a result of the volatility of the cost of unencumbered digital assets, technical failures (errors), commission of unlawful actions, including theft);

3) a statement that persons carrying out transactions with unencumbered digital assets through unencumbered digital asset exchange operators independently bear responsibility for changes in the cost of the unencumbered digital asset.

Risk information is posted on the main page of the unencumbered digital asset exchange operator's internet resource or on a separate page of this internet resource with measures taken to draw visitors' attention to it.

The unencumbered digital asset exchange operator services clients only after taking measures for proper client verification as provided for by the Law on AML/CFT/CPF.

Biometric authentication of resident clients of the Republic of Kazakhstan when providing services remotely is carried out through the National Bank's Data Exchange Center for Identification Data (hereinafter – the Data Exchange Center).

Identification of non-resident clients of the Republic of Kazakhstan is carried out through the Data Exchange Center and/or third-party remote identification services, provided that the legislation of the Republic of Kazakhstan and the Internal Control Rules developed in accordance with the requirements of the Law on AML/CFT/CPF are observed.

The unencumbered digital asset exchange operator connects to the National Bank's Center for Data Exchange on Payment Transactions with Fraud Indicators (hereinafter – the Anti-Fraud Center) by establishing technical interaction with the digital system of the Anti-Fraud Center operator.

The unencumbered digital asset exchange operator stores information about digital asset transactions for at least 5 (five) years from the date of termination of business relations with the client.

The unencumbered digital asset exchange operator stores information obtained as a result of proper verification for at least 5 (five) years from the date of termination of business relations with the client.

When providing clients with services for opening and servicing digital asset wallets, the unencumbered digital asset exchange operator ensures the security and proper storage of mnemonic phrases and private keys of clients' digital asset wallets.

The unencumbered digital asset exchange operator does not disclose mnemonic phrases and private keys of clients' digital asset wallets to clients and is responsible to clients for their safety.

Mnemonic phrases, private keys, passwords for the personal account (if a personal account is opened) and clients' digital asset wallets are stored by the unencumbered digital asset exchange operator in a secure environment that excludes unauthorized access by third parties.

The unencumbered digital asset exchange operator implements a set of organizational and technical information protection measures, including the use of cryptographic protection tools.

Access to the specified information is provided to authorized employees of the unencumbered digital asset exchange operator based on an employment contract with the employee, the employee's job description, and/or an order of the head of the unencumbered digital asset exchange operator granting access to the employee.

The unencumbered digital asset exchange operator keeps a record of all actions performed with the specified information, including their transfer, copying, and destruction.

Access to information must be immediately restricted or revoked in the event of an employee's dismissal and/or change in job duties.

Access to the client's personal account is carried out using a login and password, which can be changed or restored (in case of loss) upon the client's request and after confirmation of their identity by the unencumbered digital asset exchange operator in accordance with paragraph 30 of these Rules.

To conduct a transaction with unencumbered digital assets, the unencumbered digital asset exchange operator receives money from the client to its current bank account or unencumbered digital assets to its digital asset wallet address and transfers counter-performance to the client in the form of money or unencumbered digital assets, depending on the type of transaction with unencumbered digital assets, within 2 (two) business days from the moment of receiving money or digital assets from the client.
The unencumbered digital asset exchange operator carries out transactions for the sale of unencumbered digital assets for cash national currency by opening physical branches and/or self-service points, as well as remotely via a mobile application or other remote service method.
The unencumbered digital asset exchange operator does not carry out transactions for the purchase of unencumbered digital assets from the client for cash currency.

The unencumbered digital asset exchange operator's transactions for the purchase of unencumbered digital assets from clients are carried out only remotely, including via a mobile application or other remote service method.

When carrying out activities through physical branches, self-service points, and/or via a mobile application or other remote service method, the unencumbered digital asset exchange operator ensures the display of the status and information about the provided service in the client's personal account (if a personal account is opened), as well as monitors the status of physical branches and self-service points in real time (operational status, amount of cash in the cash register and bill acceptor).

The unencumbered digital asset exchange operator ensures the continuous operation of the internet resource, mobile application, digital infrastructure, confidentiality, integrity, and availability of data of the unencumbered digital asset exchange operator's digital systems.

The unencumbered digital asset exchange operator ensures the crediting of cash balances to its own bank account within the timeframes established by the internal acts of the unencumbered digital asset exchange operator, but no less than 1 (one) time per month.
In the event of providing services through the opening of physical branches, the exchange operator ensures compliance with the following requirements:

1) the branch is a standalone building or is located inside commercial or office premises (buildings);

2) the branch is equipped with an alarm system connected to a security guard post, as well as a panic button;

3) information about the unencumbered digital asset exchange operator (name, contacts, and license of the unencumbered digital asset exchange operator) is displayed in a visible place for clients;

4) an employee of the unencumbered digital asset exchange operator identifies the client before conducting each of their transactions in accordance with the Law on AML/CFT/CPF.

In the event of providing services through a self-service point, the exchange operator ensures compliance with the following requirements:

1) the self-service point transmits data on conducted transactions to the unencumbered digital asset exchange operator;

2) the self-service point has protection against hacking;

3) information about the owner of the self-service point (name, contacts, and license of the unencumbered digital asset exchange operator) is displayed in a visible place for clients;

4) the equipment identifies the client before conducting each of their transactions;

5) maintenance of the self-service point.

After providing the service for the purchase or sale of unencumbered digital assets, the unencumbered digital asset exchange operator ensures the issuance to the client of a document confirming the transaction as provided for in the contract with the client, as well as the viewing of the history of conducted transactions.
It is permitted for the unencumbered digital asset exchange operator to acquire and sell unencumbered digital assets to their issuers for the purpose of carrying out activities provided for by these Rules.

Acquisition or sale of unencumbered digital assets from digital asset service providers licensed (permitted) by regulatory authorities of foreign states is permitted in an amount not exceeding 50 (fifty) percent of the total volume of unencumbered digital assets acquired or sold to digital asset service providers over the last 6 (six) calendar months.

The unencumbered digital asset exchange operator uses different bank accounts for the company's operational activities and for carrying out transactions provided for by the license.

Chapter 5. Cybersecurity Requirements

43. The storage period for information about cybersecurity incidents is not less than 5 (five) years.

44. The unencumbered digital asset exchange operator determines the procedure for taking urgent measures to eliminate a cybersecurity incident, its causes, and consequences.

45. The unencumbered digital asset exchange operator keeps a log of cybersecurity incidents reflecting all information about the cybersecurity incident, measures taken, and proposed corrective measures.

46. A separate cybersecurity incident card is filled out for each cybersecurity incident, which includes information on the description of the incident, date and time of occurrence, detection, and elimination of the incident, resulting consequences, damage, and measures taken.

47. The unencumbered digital asset exchange operator manages cybersecurity risks by specifying the name, description, cause of occurrence, acceptable risk level, and action plan for its minimization with respect to the digital objects of the unencumbered digital asset exchange operator.

48. Information about cybersecurity incidents obtained during monitoring of cybersecurity assurance activities is subject to consolidation, systematization, and storage.

49. The unencumbered digital asset exchange operator sends a notification in free form to the National Bank about cybersecurity incidents that have occurred within 24 (twenty-four) hours from the moment of their detection, along with a cybersecurity incident card.

50. The unencumbered digital asset exchange operator ensures:

1. user identification, authentication, and authorization;
2. registration and storage of cybersecurity events;

3) protection of information from unauthorized access, leakage, modification, destruction, and blocking.

4) backup and recovery of information;

5) compliance with the legislation of the Republic of Kazakhstan "On Personal Data and Their Protection" when processing personal data on the platform;

6) secure transaction execution.

Chapter 6. Requirements for the System of Analysis and Control of Transactions

Requirements for the system of analysis and control of transactions include, but are not limited to:

1) monitoring and tracking transactions with digital assets, including the identification of suspicious client actions;

2) monitoring transactions in real time and notifying the responsible person/unit for compliance with the Law on AML/CFT/CPF;

3) conducting an assessment of the client's digital asset wallet and assigning a risk level to the client's digital asset wallet;

4) conducting an analysis of the client's digital asset wallet for the use of services that increase the anonymity of the transaction and complicate the determination of the chain of holders of the digital asset.

Chapter 7. Restrictions and Limits on Client Transactions

It is not permitted for the unencumbered digital asset exchange operator to establish business relations with:

1) individuals under 18 (eighteen) years of age;

2) other persons included in the list of organizations and persons associated with the financing of terrorism and extremism, as well as in the list of organizations and persons associated with the financing of the proliferation of weapons of mass destruction in accordance with the Law on AML/CFT/CPF.

The unencumbered digital asset exchange operator services clients for transactions with unencumbered digital assets depending on their qualification.

The determination of the client's qualification for transactions with digital assets is carried out by the unencumbered digital asset exchange operator by assessing the client's knowledge using a questionnaire (test).

The questionnaire (test) is formed based on questions that cover, but are not limited to the following:

1) the client's experience and tenure in working with digital assets;

2) the client's experience using digital asset wallets, indicating their types and names;

3) types of instruments based on digital assets, regarding which the client has practical experience in conducting transactions;

4) a note on the client's acceptance of risks associated with the irreversibility of digital asset transactions;

5) a note on the client's acceptance of risks associated with the loss of access to the digital asset wallet;

6) a note on the client's acceptance of risks associated with the high volatility of digital assets;

7) a note on the client's acceptance of risks associated with the absence (or limitation) of state guarantees for digital assets;

8) a note on the client's acceptance of risks associated with the possibility of suspending transactions with unencumbered digital assets if they are recognized as suspicious in accordance with the Law on AML/CFT/CPF;

9) a note on the client's acceptance of risks associated with the possibility of excluding the unencumbered digital asset from the list defined in paragraph 57 of these Rules;

10) a note on the client's familiarity with the requirement to comply with the requirements of tax, currency legislation, the Law on AML/CFT/CPF, and other laws of the Republic of Kazakhstan when conducting transactions with digital assets.

The questionnaire (test) includes at least 10 (ten) questions with the choice of one or more correct answers.

The unencumbered digital asset exchange operator establishes a minimum passing score (as a percentage of the total number of questions), below which the client is recognized as insufficiently qualified to conduct transactions with unencumbered digital assets.

The minimum passing score cannot be lower than 80 (eighty) percent.

Re-taking the client's knowledge assessment is available to the client after 30 (thirty) calendar days from the last attempt.
The unencumbered digital asset exchange operator services transactions of clients with sufficient qualification without applying restrictions and limits.

With respect to clients with insufficient qualification, the unencumbered digital asset exchange operator applies the following limits and restrictions on transactions:

1) for the purchase of unencumbered digital assets – up to 7,000,000 (seven million) tenge per day;

2) for the sale of unencumbered digital assets – up to 7,000,000 (seven million) tenge per day.

The unencumbered digital asset exchange operator services transactions for the purchase and/or sale of the following types of unencumbered digital assets:

1) BTC;
2) ETH;
3) USDT;
4) XRP;
5) BNB;
6) SOL;
7) USDC;
8) TRX;
9) DOGE;
10) ADA;
11) BCH;
12) LINK;
13) LEO;
14) XLM;
15) SUI;
16) LTC;
17) AVAX;
18) DAI;
19) HBAR;
20) SHIB;
21) TON;
22) CRO;
23) DOT;
24) UNI;
25) MNT;
26) TAO;
27) PEPE;
28) AAVE;
29) BGB;
30) OKB;
31) NEAR;
32) ETC;
33) USDE;
34) ASTER;
35) ICP;
36) WLD;
37) KCS;
38) SKY;
39) POL;
40) APT;
41) ONDO;
42) KAS;
43) RLUSD;
44) PYUSD;
45) ATOM;
46) ARB;
47) ALGO;
48) RENDER;
49) FIL;
50) VET;
51) FLR;
52) BONK;
53) XDC;
54) QNT;
55) PUMP;
56) GT;
57) SEI;
58) STX;
59) CAKE;
60) FET;
61) NEXO;
62) OP;
63) XTZ;
64) CRV;
65) CHZ;
66) IMX;
67) LDO;
68) AERO;
69) INJ;
70) TUSD;
71) GRT;
72) TIA;
73) EURC.

The unencumbered digital asset exchange operator refuses the client the transaction with the unencumbered digital asset if the unencumbered digital asset is not provided for in paragraph 57 of these Rules.


Appendix 1 to the Rules for the Activity of Unencumbered Digital Asset Exchange Operators

National Bank

Republic of Kazakhstan

Application

(name and business identification number of the unencumbered digital asset exchange operator)

requests to issue a license to carry out the activity of an unencumbered digital asset exchange operator

Location of the unencumbered digital asset exchange operator:

(postal code, city (region), district, street, house number (office)

(phone, email address, internet resource (if available)

Information on the state registration (re-registration) of the unencumbered digital asset exchange operator:

(name of the document, number and date of issue, issued by)

List of submitted documents:

1) ______;
2) ______;
3) ______;
4) ______;
5) ______;
6) ______;

Information on the head (members) of the executive body of the unencumbered digital asset exchange operator:

General Information:


Surname, First Name, Patronymic (if any)	______ (in accordance with the identity document, in case of change of surname, first name, patronymic - indicate when and for what reason changes occurred)
Individual Identification Number
Data of the identity document	(name of the document, number, series (if any) and date of issue, issued by)
Place of Residence	(place of residence, including home and office phone numbers, as well as email address)
Citizenship

Full list of places of work and positions


No.	Period of work (month/year)	Name of organization, positions held
1.


Presence of an unexpunged or unpaid criminal record	Yes/No (if yes, indicate the details of the court verdict, article of the Criminal Code of the Republic of Kazakhstan)
If previously was a head, member of the governing body, head, member of the executive body, chief accountant of a financial organization, within a period of no more than one year prior to the decision on the conservation of the financial organization or forced purchase of its shares, revocation of the license of the financial organization, leading to its liquidation and/or cessation of activity in the financial market, or entry into legal force of a court decision on the forced liquidation of the financial organization or its bankruptcy in the manner determined by the Law of the Republic of Kazakhstan of March 7, 2014 "On Rehabilitation and Bankruptcy"	Yes/No (if yes, the name of the organization, position, details of the decision on the conservation of the financial organization or forced purchase of its shares, revocation of the license of the financial organization, leading to its liquidation and/or cessation of activity in the financial market, or the court decision entering into legal force on the forced liquidation of the financial organization or its bankruptcy in the manner determined by the Law of the Republic of Kazakhstan of March 7, 2014 "On Rehabilitation and Bankruptcy" is indicated)
Other information (if any)

I confirm that the attached information has been checked by me and is true and complete.

I agree to the use of information constituting a state secret protected by law.

First Head of the unencumbered digital asset exchange operator:

or person authorized to sign

surname, first name, patronymic (if any) signature

Appendix 2

to the Rules for the Activity of

Unencumbered Digital Asset Exchange

Operators

List of Main Requirements for Providing the State Service

"Issuance of a License for Dealer Activity in the Digital Asset Market – Exchange Operations with Unencumbered Digital Assets"


1.	Name of the Service Provider	National Bank of the Republic of Kazakhstan
2.	Methods of providing the state service	Web portal of the "digital government" www.egov.kz, www.elicense.kz (hereinafter - the portal), the registry office of the service provider.
3.	Term of provision of the state service	Within twenty working days from the date of registration of the application and the full list of documents;
4.	Form of provision of the state service	Electronic (partially automated) and paper.
5.	Result of the state service	Notification of the issuance of a license with a copy of the license or a reasoned refusal to provide the state service. Form of the result of the state service: electronic/paper.
6.	The amount of the fee charged from the service recipient when providing the state service, and the methods of its collection in cases provided for by the legislation of the Republic of Kazakhstan	The license fee for the issuance of a license is 30 (thirty) monthly calculation indicators. Payment of the license fee is made in cash or non-cash form through second-level banks, branches of non-resident banks, or organizations carrying out certain types of banking operations, in non-cash form through the payment gateway of the "digital government".
7.	Schedule of the service provider, the State Corporation and information objects	1) service provider - from Monday to Friday from 9.00 to 18.30 with a lunch break from 13.00 to 14.30, except weekends and holidays, in accordance with the labor legislation of the Republic of Kazakhstan. Schedule for receiving documents and issuing results of the state service - from Monday to Friday from 9.00 to 17.30 with a lunch break from 13.00 to 14.30; 2) portal - around the clock, except for technical breaks due to repair work (if the service recipient applies after the end of working hours, on weekends and holidays, according to the labor legislation of the Republic of Kazakhstan, the acceptance of applications and issuance of the results of the state service is carried out on the next working day).
8.	List of documents necessary for the provision of the state service	1) application in the form according to Appendix 1 to the Rules for the activity of unencumbered digital asset exchange operators, containing in particular information about the head (members) of the executive body (with a copy of the diploma (diplomas) and a document confirming the employment activity of the employee in accordance with the Labor Code of the Republic of Kazakhstan); 2) documents confirming the payment of the charter capital; 3) charter, except in cases where the unencumbered digital asset exchange operator carries out activities under a standard charter; 4) a document defining the procedure for the interaction of the unencumbered digital asset exchange operator with a bank or the National Post Operator, with the digital asset exchange or other persons providing access to unencumbered digital assets; 5) rules for the activity of the unencumbered digital asset exchange operator, approved by the management body of the unencumbered digital asset exchange operator; 6) a document confirming the authority of the person to submit the application and the documents and information attached to it.
9.	Grounds for refusal to provide the state service established by the laws of the Republic of Kazakhstan	1) inaccuracy and (or) incompleteness of information and (or) information in documents submitted for obtaining a license for exchange operations with unencumbered digital assets; 2) submission of an incomplete package of documents or non-compliance of documents with the requirements of this Law and the regulatory legal act of the National Bank of the Republic of Kazakhstan; 3) non-compliance of the head of the executive body of the unencumbered digital asset exchange operator with the established requirements; 4) the presence of an unexpunged or unpaid criminal record of the beneficial owner. In case of refusal to issue a license, the legal entity repeatedly submits an application for a license after eliminating the reasons that led to the refusal to obtain a license for the unencumbered digital asset exchange operator, or makes a decision to change its name or reorganization or liquidation. Failure to eliminate the reasons that led to the refusal to issue a license to the unencumbered digital asset exchange operator is a ground for refusal to reconsider.
10.	Other requirements taking into account the specifics of the provision of the state service, including provided in electronic form and through the State Corporation	Addresses of places of provision of the state service are located on the portal and on the official Internet resource of the service provider: www.nationalbank.kz, section "State Services". The service recipient is granted access to obtain information about the procedure and status of the state service in remote access mode through the Unified Contact Center for the provision of state services. Contact phone numbers of information services on the provision of the state service are located on the official Internet resource of the service provider: www.nationalbank.kz, section "State Services". Unified Contact Center for the provision of state services: 8-800-080-7777, 1414

Appendix 3

to the Rules for the activity of

unencumbered digital asset exchange operators

License

for dealer activity in the digital asset market – exchange operations with unencumbered digital assets

No._____ from «__» ______ 20_ year

______

(name of the service recipient, place of state registration, business identification number of the legal entity)

(index, region, city, district, street, house number, office)

This license grants the right to carry out exchange operations with unencumbered digital assets

Authorized person of the service provider ______ ______ (surname, name, patronymic (if any) (position)

(signature or electronic digital signature)

Approved

by the resolution of the Board of Directors

of the National Bank

of the Republic of Kazakhstan

from __ ______ 2026 year No. ___

Appendix 2

to the Rules for the activity of

unencumbered digital asset exchange operators

List of basic requirements for the provision of the state service

"Issuance of a license for dealer activity in the digital asset market – exchange operations with unencumbered digital assets"


1.	Name of the Service Provider	National Bank of the Republic of Kazakhstan
2.	Methods of providing the state service	Web portal of the "electronic government" www.egov.kz, www.elicense.kz (hereinafter - the portal), the registry office of the service provider.
3.	Term of provision of the state service	Within twenty working days from the date of registration of the application and the full list of documents;
4.	Form of provision of the state service	Electronic (partially automated) and paper.
5.	Result of the state service	Notification of the issuance of a license with a copy of the license or a reasoned refusal to provide the state service. Form of the result of the state service: electronic/paper.
6.	The amount of the fee charged from the service recipient when providing the state service, and the methods of its collection in cases provided for by the legislation of the Republic of Kazakhstan	The license fee for the issuance of a license is 30 (thirty) monthly calculation indicators. Payment of the license fee is made in cash or non-cash form through second-level banks, branches of non-resident banks, or organizations carrying out certain types of banking operations, in non-cash form through the payment gateway of the "electronic government".
7.	Schedule of the service provider, the State Corporation and information objects	1) service provider - from Monday to Friday from 9.00 to 18.30 with a lunch break from 13.00 to 14.30, except weekends and holidays, in accordance with the labor legislation of the Republic of Kazakhstan. Schedule for receiving documents and issuing results of the state service - from Monday to Friday from 9.00 to 17.30 with a lunch break from 13.00 to 14.30; 2) portal - around the clock, except for technical breaks due to repair work (if the service recipient applies after the end of working hours, on weekends and holidays, according to the labor legislation of the Republic of Kazakhstan, the acceptance of applications and issuance of the results of the state service is carried out on the next working day).
8.	List of documents necessary for the provision of the state service	1) application in the form according to Appendix 1 to the Rules for the activity of unencumbered digital asset exchange operators, containing in particular information about the head (members) of the executive body (with a copy of the diploma (diplomas) and a document confirming the employment activity of the employee in accordance with the Labor Code of the Republic of Kazakhstan); 2) documents confirming the payment of the charter capital; 3) charter, except in cases where the unencumbered digital asset exchange operator carries out activities under a standard charter; 4) a document defining the procedure for the interaction of the unencumbered digital asset exchange operator with a bank or the National Post Operator, with the digital asset exchange or other persons providing access to unencumbered digital assets; 5) rules for the activity of the unencumbered digital asset exchange operator, approved by the management body of the unencumbered digital asset exchange operator; 6) a document confirming the authority of the person to submit the application and the documents and information attached to it.
9.	Grounds for refusal to provide the state service established by the laws of the Republic of Kazakhstan	1) inaccuracy and (or) incompleteness of information and (or) information in documents submitted for obtaining a license for exchange operations with unencumbered digital assets; 2) submission of an incomplete package of documents or non-compliance of documents with the requirements of this Law and the regulatory legal act of the National Bank of the Republic of Kazakhstan; 3) non-compliance of the head of the executive body of the unencumbered digital asset exchange operator with the established requirements; 4) the presence of an unexpunged or unpaid criminal record of the beneficial owner. In case of refusal to issue a license, the legal entity repeatedly submits an application for a license after eliminating the reasons that led to the refusal to obtain a license for the unencumbered digital asset exchange operator, or makes a decision to change its name or reorganization or liquidation. Failure to eliminate the reasons that led to the refusal to issue a license to the unencumbered digital asset exchange operator is a ground for refusal to reconsider.
10.	Other requirements taking into account the specifics of the provision of the state service, including provided in electronic form and through the State Corporation	Addresses of places of provision of the state service are located on the portal and on the official Internet resource of the service provider: www.nationalbank.kz, section "State Services". The service recipient is granted access to obtain information about the procedure and status of the state service in remote access mode through the Unified Contact Center for the provision of state services. Contact phone numbers of information services on the provision of the state service are located on the official Internet resource of the service provider: www.nationalbank.kz, section "State Services". Unified Contact Center for the provision of state services: 8-800-080-7777, 1414

Similar documents from other regulators