Kazakhstan KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Kazakhstan.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Portable implementation guide
Get the PDF checklist
11 control areas · 38 implementation checks
Last reviewed: 7 November 2026 · Version 1.0
Download the checklistDirect answer
What does the Kazakhstan compliance checklist cover?
The Kazakhstan checklist translates primary KYC, KYB and AML rules into 11 control areas and 38 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- Primary AML law
- AML/CFT/CPF Law No. 191-IV of 28 August 2009, as amended
- FIU
- Agency for Financial Monitoring (AFM)
- Pre-transaction STR
- Immediately before conduct when recognized as suspicious
- Post-transaction STR
- By the next working day after recognition; special timing applies where suspension was impossible
- AML beneficial owner
- Natural person owning directly or indirectly more than 25%, then other control or benefit
- Records
- At least 5 years from transaction or relationship termination, as applicable
- Targeted sanctions
- Freeze immediately, no later than 1 working day after official listing
- FATF public lists
- Not listed at October 2026
Implementation detail
Kazakhstan compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingClassify the activity and supervisor before launch.3 items+
Determine whether each activity is a subject of financial monitoring.
- Implementation action
- Map banking, insurance, securities, payments, exchange, professional, digital-asset and other services to Article 3 and current sector rules; do not export one sector's requirements to another.
- Evidence to retain
- Perimeter memo, service map and source register.
- Primary citation
- AML/CFT/CPF Law, Article 3
Obtain every required licence, registration or permit.
- Implementation action
- Confirm National Bank, financial-market regulator, AFSA/AIFC, digital-development authority or other competent-authority requirements before operating.
- Evidence to retain
- Licence matrix, approvals and conditions.
- Primary citation
- Applicable financial, payments and digital-assets legislation
Use AFM and the correct sector supervisor.
- Implementation action
- Maintain a dated authority map and current electronic-reporting procedure for the entity type.
- Evidence to retain
- Authority map, portal access, procedures and acknowledgements.
- Primary citation
- AML/CFT/CPF Law, Articles 16-18
02Governance and risk assessmentControls must be risk-based, approved and tested.3 items+
Maintain an enterprise ML/TF/PF risk assessment.
- Implementation action
- Assess customer, geography, product, channel, technology, transaction and sanctions risks and update for material change.
- Evidence to retain
- Methodology, assessment, approval and change log.
- Primary citation
- AML/CFT/CPF Law; applicable internal-control requirements
Maintain internal-control rules and an accountable AML function.
- Implementation action
- Document governance, responsible officer, screening, monitoring, reporting, training, audit and escalation arrangements proportionate to the business.
- Evidence to retain
- Internal-control rules, appointment, training and test reports.
- Primary citation
- AML/CFT/CPF Law, Article 11
Apply current AFM risk indicators and sector rules.
- Implementation action
- Map official suspicious-transaction indicators and supervisor requirements into scenarios without treating indicators as exhaustive.
- Evidence to retain
- Rule inventory, scenario mapping and review record.
- Primary citation
- AML/CFT/CPF Law, Article 10; current AFM and sector rules
03Natural-person identificationCDD applies at relationship start and other statutory triggers.4 items+
Identify and verify the customer before establishing a relationship.
- Implementation action
- Record identity-document data, individual identification number where assigned, address and other required fields using reliable sources.
- Evidence to retain
- Identity record, verification result and provenance.
- Primary citation
- AML/CFT/CPF Law, Article 5(2)-(3)
Identify and verify representatives and authority.
- Implementation action
- Confirm the representative's identity and powers before accepting instructions and retain the mandate.
- Evidence to retain
- Representative KYC, mandate and validation.
- Primary citation
- AML/CFT/CPF Law, Article 5
Re-perform CDD when statutory triggers arise.
- Implementation action
- Refresh CDD for reportable or suspicious activity and where prior customer or beneficial-owner information is doubtful; apply sector-specific periodic updates.
- Evidence to retain
- Trigger log, refreshed records and review outcome.
- Primary citation
- AML/CFT/CPF Law, Article 5(2)
Do not permit anonymous or inadequately verified use.
- Implementation action
- Restrict activation or activity where required data cannot be obtained and document refusal, termination and reporting decisions.
- Evidence to retain
- Restriction, rationale and report assessment.
- Primary citation
- AML/CFT/CPF Law, Articles 5 and 13
04KYB, company information, and beneficial ownershipVerify legal existence, authority, ownership and ultimate control.4 items+
Verify the legal person or arrangement.
- Implementation action
- Obtain registration, legal form, address, governing documents, business purpose and authorized-person data and reconcile them with official records.
- Evidence to retain
- Registry extract, constitutional documents and validation log.
- Primary citation
- AML/CFT/CPF Law, Article 5
Identify natural-person beneficial owners through the statutory cascade.
- Implementation action
- Identify each natural person who directly or indirectly owns more than 25%; if ownership is doubtful or inconclusive, identify control by other means or the person in whose interests transactions are conducted.
- Evidence to retain
- Ownership chart, control analysis and verified identities.
- Primary citation
- AML/CFT/CPF Law, Articles 1 and 5
Understand legal-arrangement control.
- Implementation action
- Identify the natural persons occupying controlling or beneficial roles and document the legal basis and information sources.
- Evidence to retain
- Arrangement documents, role map and verification.
- Primary citation
- AML/CFT/CPF Law, beneficial-owner definition and Article 5
Resolve discrepancies instead of relying solely on registry data.
- Implementation action
- Compare customer evidence with the state legal-entities database and investigate inconsistent ownership, management or status information.
- Evidence to retain
- Registry results, discrepancy log and resolution.
- Primary citation
- AML/CFT/CPF Law, Article 5; state legal-entities database service
05PEPs, EDD, and remote onboardingHigher-risk relationships require enhanced controls.3 items+
Identify PEP exposure under current sector rules.
- Implementation action
- Screen customers, representatives and beneficial owners and apply approval, source-of-wealth, source-of-funds and enhanced-monitoring controls where required.
- Evidence to retain
- Screening, classification, approval and corroboration.
- Primary citation
- AML/CFT/CPF Law; applicable internal-control requirements
Apply enhanced due diligence to higher risk.
- Implementation action
- Obtain additional identity, ownership, purpose, wealth and funds evidence and increase monitoring and review frequency proportionately.
- Evidence to retain
- EDD checklist, evidence, approval and monitoring plan.
- Primary citation
- AML/CFT/CPF Law, Articles 5 and 11
Control non-face-to-face onboarding.
- Implementation action
- Use a method permitted by the competent supervisor, test impersonation and fraud controls, and preserve authentication and exception evidence.
- Evidence to retain
- Method assessment, session evidence and tests.
- Primary citation
- Applicable sector identification and internal-control rules
06Monitoring and suspicious reportingMonitoring must support AFM's event-specific reporting timelines.4 items+
Monitor transactions and relationships on a risk basis.
- Implementation action
- Detect threshold, complex, unusually large, unusual and suspicious activity; review scenarios and customer information periodically.
- Evidence to retain
- Scenario inventory, alerts, tuning and governance.
- Primary citation
- AML/CFT/CPF Law, Articles 4, 10 and 11
Report a suspicious transaction before conduct where required.
- Implementation action
- When an operation is recognized as suspicious before execution, report it to AFM immediately before conduct and follow AFM suspension instructions.
- Evidence to retain
- Recognition time, report, receipt and hold decision.
- Primary citation
- AML/CFT/CPF Law, Article 13(2)
Apply the correct timing where prior suspension is impossible or suspicion forms later.
- Implementation action
- For an operation that cannot be suspended, use the statutory three-hour-after-conduct or 24-hour-after-detection route as applicable; where recognized after conduct, report by the next working day.
- Evidence to retain
- Timeline, legal classification, report and acknowledgement.
- Primary citation
- AML/CFT/CPF Law, Article 13(2)
Prevent tipping off.
- Implementation action
- Restrict access and communications about reports, AFM requests and related assistance except where law permits.
- Evidence to retain
- Access controls, communication review and training.
- Primary citation
- AML/CFT/CPF Law, Article 10(5)
07Threshold reporting, wires, payments, and digital assetsDo not reduce transaction-specific reporting categories to one universal amount.4 items+
Configure each current financial-monitoring category separately.
- Implementation action
- Maintain a legal table of Article 4 transaction types, amounts, aggregation and exemptions for the entity; report covered operations by the applicable deadline.
- Evidence to retain
- Threshold table, configurations, test cases and reports.
- Primary citation
- AML/CFT/CPF Law, Articles 4 and 10
Carry required wire-transfer information.
- Implementation action
- Apply current originator, beneficiary, missing-data, screening and intermediary controls for the institution's role.
- Evidence to retain
- Field matrix, samples, screening and repair queue.
- Primary citation
- AML/CFT/CPF Law; applicable sector rules
Classify payment and electronic-money services before launch.
- Implementation action
- Map payment initiation, processing, wallets, acquiring, transfers and electronic money to the Law on Payments and Payment Systems and National Bank requirements.
- Evidence to retain
- Product memo, registration or licence and control tests.
- Primary citation
- Law on Payments and Payment Systems
Use the correct digital-asset perimeter.
- Implementation action
- Classify secured and unsecured digital assets and obtain the required National Bank, digital-development authority or AFSA/AIFC licence before exchange or platform activity; do not rely on an in-principle approval as authority to operate.
- Evidence to retain
- Classification, licence, register check and AML programme.
- Primary citation
- Law on Digital Assets; current National Bank and AIFC rules
08Targeted financial sanctionsUse the live official lists and act without delay.3 items+
Screen current terrorism, extremism and proliferation-financing lists.
- Implementation action
- Screen customers, owners, representatives and transactions at onboarding, continuously or periodically according to risk, and on list updates.
- Evidence to retain
- List version, screening logs and match decisions.
- Primary citation
- AML/CFT/CPF Law, Article 12
Freeze listed property immediately.
- Implementation action
- Implement the statutory freeze without delay and no later than one working day after official publication of the listing, subject only to express statutory exceptions.
- Evidence to retain
- Listing, freeze timestamp, asset inventory and report.
- Primary citation
- AML/CFT/CPF Law, Article 12(1-1)
Control releases and permitted access.
- Implementation action
- Release or permit access only on documented legal authority and preserve every condition and communication.
- Evidence to retain
- Authority decision, conditions and release record.
- Primary citation
- AML/CFT/CPF Law, Article 12
09Records and authority accessRecords must reconstruct the complete customer and transaction lifecycle.3 items+
Retain CDD and relationship records for at least five years.
- Implementation action
- Run the period from relationship termination and preserve customer files, correspondence, ownership analysis and review results.
- Evidence to retain
- Retention schedule, source records and retrieval test.
- Primary citation
- AML/CFT/CPF Law, Article 11
Retain reportable, suspicious and unusual-operation records for at least five years.
- Implementation action
- Run the period from transaction completion and preserve analysis, decision and reporting evidence.
- Evidence to retain
- Case archive, schedule and integrity controls.
- Primary citation
- AML/CFT/CPF Law, Article 11
Respond to AFM requests within the applicable deadline.
- Implementation action
- Operate controlled production procedures for the general three-working-day deadline and the next-working-day deadline for suspicious-transaction analysis requests, subject to any lawful extension.
- Evidence to retain
- Request log, production, approval and receipt.
- Primary citation
- AML/CFT/CPF Law, Article 10
10Privacy, biometrics, breaches, and transfersAML processing remains subject to Kazakhstan privacy and security law.4 items+
Document the lawful basis and purpose for personal-data processing.
- Implementation action
- Map collection, processing, notices, consent or statutory authority, access rights, correction, blocking, destruction and retention.
- Evidence to retain
- Data map, notices, legal-basis register and rights log.
- Primary citation
- Law on Personal Data and their Protection
Protect identity and biometric data.
- Implementation action
- Minimize collection and apply security, access, accuracy, liveness and deletion controls proportionate to sensitivity and permitted purpose.
- Evidence to retain
- Assessment, architecture, tests and approvals.
- Primary citation
- Law on Personal Data and their Protection
Control transfers and third parties.
- Implementation action
- Confirm consent or another lawful basis, destination protection, contracts and localization requirements before third-party or cross-border transfers.
- Evidence to retain
- Transfer map, legal assessment, safeguards and notices.
- Primary citation
- Law on Personal Data and their Protection, cross-border-transfer provisions
Use applicable incident and sector reporting rules.
- Implementation action
- Maintain an incident workflow that identifies the competent authority, affected systems, notification triggers and deadlines without inventing a universal breach deadline.
- Evidence to retain
- Incident chronology, legal assessment, notices and remediation.
- Primary citation
- Personal-data law and applicable sector cybersecurity rules
11Practical evidence packsEvidence must reconstruct decisions end to end.3 items+
Maintain an onboarding pack.
- Implementation action
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk, privacy and approvals.
- Evidence to retain
- Complete sample and retrieval result.
- Primary citation
- Operational control supporting AML/CFT/CPF Law, Article 5
Maintain reporting and sanctions case packs.
- Implementation action
- Link trigger, classification, decision time, report, receipt, confidentiality, freeze and authority communications.
- Evidence to retain
- Case pack, timeline and access record.
- Primary citation
- AML/CFT/CPF Law, Articles 10, 12 and 13
Maintain a launch and legal-change pack.
- Implementation action
- Record perimeter, licences, transaction categories, reporting, sanctions, privacy, vendors, source versions and tests.
- Evidence to retain
- Signed pack, source register and approvals.
- Primary citation
- Official sources listed below
Primary-source register
15 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- AML/CFT/CPF Law No. 191-IVAgency for Financial Monitoring · Primary legislation - official English text
- AML/CFT/CPF Law - current official repository recordAdilet Legal Information System · Primary legislation - official English text
- Agency for Financial MonitoringGovernment of Kazakhstan · Official FIU and regulator portal
- Internal-control requirements for banking-operation and microfinance organizationsAgency for Financial Monitoring · Official sector requirements
- State database - Legal entitiesMinistry of Justice · Official registry service
- Law on Personal Data and their ProtectionAdilet Legal Information System · Primary legislation - official English text
- National Bank of KazakhstanNational Bank of Kazakhstan · Official financial and payments regulator
- Law on Payments and Payment SystemsAdilet Legal Information System · Primary legislation - official English text
- Digital asset industry frameworkGovernment of Kazakhstan · Official regulatory overview
- AFSA public registerAstana Financial Services Authority · Official licence register
- Kazakhstan 2023 mutual evaluationFATF / EAG · Authoritative mutual evaluation
- Kazakhstan EAG follow-up report 2026FATF / EAG · Authoritative follow-up assessment
- FATF increased-monitoring statement - October 2026FATF · Authoritative current public-list status
- FATF call-for-action statement - October 2026FATF · Authoritative current public-list status
- Law and rules on State SymbolsGovernment of Kazakhstan · Official flag-use law and rules
Direct answers
Kazakhstan KYC, KYB and AML questions
Who receives suspicious-transaction reports?+
The Agency of the Republic of Kazakhstan for Financial Monitoring (AFM), through the prescribed electronic channel for the reporting entity.
When is a suspicious transaction reported?+
A transaction recognized as suspicious before execution is reported immediately before conduct. Different statutory timing applies when suspension is impossible or suspicion forms after execution.
Is there one universal reportable-transaction threshold?+
No. Article 4 uses transaction-specific categories, amounts and conditions. Configure the current table for the entity and transaction type.
How is an AML beneficial owner identified?+
Start with natural persons directly or indirectly owning more than 25%, then examine control by other means or the natural person in whose interests transactions are conducted.
How long are AML records retained?+
At least five years, measured from transaction completion or relationship termination depending on the record type.
How quickly must listed property be frozen?+
Immediately and no later than one working day after the official listing is published, subject to express statutory exceptions.
Are digital-asset services regulated?+
Yes. The perimeter depends on the asset and activity; licences or permissions may involve the National Bank, the digital-development authority or AFSA/AIFC.
Is Kazakhstan on a FATF public list?+
No at the October 2026 statements. That is not a low-risk determination.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General information, not legal advice. Reviewed 7 November 2026. Confirm the controlling Kazakh or Russian text, current sector rules, transaction-reporting categories, reporting channels, sanctions lists, privacy requirements and licensing conditions with AFM, the competent supervisor and qualified Kazakhstan counsel.