Kazakhstan KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Kazakhstan.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Guide d’implémentation portable
Obtenir la checklist PDF
11 domaines de contrôle · 38 contrôles d’implémentation
Dernière revue: 7 November 2026 · Version 1.0
Télécharger la checklistRéponse directe
Que couvre la checklist de conformité pour Kazakhstan ?
La checklist pour Kazakhstan traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 38 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- Primary AML law
- AML/CFT/CPF Law No. 191-IV of 28 August 2009, as amended
- FIU
- Agency for Financial Monitoring (AFM)
- Pre-transaction STR
- Immediately before conduct when recognized as suspicious
- Post-transaction STR
- By the next working day after recognition; special timing applies where suspension was impossible
- AML beneficial owner
- Natural person owning directly or indirectly more than 25%, then other control or benefit
- Records
- At least 5 years from transaction or relationship termination, as applicable
- Targeted sanctions
- Freeze immediately, no later than 1 working day after official listing
- FATF public lists
- Not listed at October 2026
Détail d’implémentation
Exigences et actions de conformité pour Kazakhstan
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingClassify the activity and supervisor before launch.3 éléments+
Determine whether each activity is a subject of financial monitoring.
- Action d’implémentation
- Map banking, insurance, securities, payments, exchange, professional, digital-asset and other services to Article 3 and current sector rules; do not export one sector's requirements to another.
- Preuves à conserver
- Perimeter memo, service map and source register.
- Source primaire
- AML/CFT/CPF Law, Article 3
Obtain every required licence, registration or permit.
- Action d’implémentation
- Confirm National Bank, financial-market regulator, AFSA/AIFC, digital-development authority or other competent-authority requirements before operating.
- Preuves à conserver
- Licence matrix, approvals and conditions.
- Source primaire
- Applicable financial, payments and digital-assets legislation
Use AFM and the correct sector supervisor.
- Action d’implémentation
- Maintain a dated authority map and current electronic-reporting procedure for the entity type.
- Preuves à conserver
- Authority map, portal access, procedures and acknowledgements.
- Source primaire
- AML/CFT/CPF Law, Articles 16-18
02Governance and risk assessmentControls must be risk-based, approved and tested.3 éléments+
Maintain an enterprise ML/TF/PF risk assessment.
- Action d’implémentation
- Assess customer, geography, product, channel, technology, transaction and sanctions risks and update for material change.
- Preuves à conserver
- Methodology, assessment, approval and change log.
- Source primaire
- AML/CFT/CPF Law; applicable internal-control requirements
Maintain internal-control rules and an accountable AML function.
- Action d’implémentation
- Document governance, responsible officer, screening, monitoring, reporting, training, audit and escalation arrangements proportionate to the business.
- Preuves à conserver
- Internal-control rules, appointment, training and test reports.
- Source primaire
- AML/CFT/CPF Law, Article 11
Apply current AFM risk indicators and sector rules.
- Action d’implémentation
- Map official suspicious-transaction indicators and supervisor requirements into scenarios without treating indicators as exhaustive.
- Preuves à conserver
- Rule inventory, scenario mapping and review record.
- Source primaire
- AML/CFT/CPF Law, Article 10; current AFM and sector rules
03Natural-person identificationCDD applies at relationship start and other statutory triggers.4 éléments+
Identify and verify the customer before establishing a relationship.
- Action d’implémentation
- Record identity-document data, individual identification number where assigned, address and other required fields using reliable sources.
- Preuves à conserver
- Identity record, verification result and provenance.
- Source primaire
- AML/CFT/CPF Law, Article 5(2)-(3)
Identify and verify representatives and authority.
- Action d’implémentation
- Confirm the representative's identity and powers before accepting instructions and retain the mandate.
- Preuves à conserver
- Representative KYC, mandate and validation.
- Source primaire
- AML/CFT/CPF Law, Article 5
Re-perform CDD when statutory triggers arise.
- Action d’implémentation
- Refresh CDD for reportable or suspicious activity and where prior customer or beneficial-owner information is doubtful; apply sector-specific periodic updates.
- Preuves à conserver
- Trigger log, refreshed records and review outcome.
- Source primaire
- AML/CFT/CPF Law, Article 5(2)
Do not permit anonymous or inadequately verified use.
- Action d’implémentation
- Restrict activation or activity where required data cannot be obtained and document refusal, termination and reporting decisions.
- Preuves à conserver
- Restriction, rationale and report assessment.
- Source primaire
- AML/CFT/CPF Law, Articles 5 and 13
04KYB, company information, and beneficial ownershipVerify legal existence, authority, ownership and ultimate control.4 éléments+
Verify the legal person or arrangement.
- Action d’implémentation
- Obtain registration, legal form, address, governing documents, business purpose and authorized-person data and reconcile them with official records.
- Preuves à conserver
- Registry extract, constitutional documents and validation log.
- Source primaire
- AML/CFT/CPF Law, Article 5
Identify natural-person beneficial owners through the statutory cascade.
- Action d’implémentation
- Identify each natural person who directly or indirectly owns more than 25%; if ownership is doubtful or inconclusive, identify control by other means or the person in whose interests transactions are conducted.
- Preuves à conserver
- Ownership chart, control analysis and verified identities.
- Source primaire
- AML/CFT/CPF Law, Articles 1 and 5
Understand legal-arrangement control.
- Action d’implémentation
- Identify the natural persons occupying controlling or beneficial roles and document the legal basis and information sources.
- Preuves à conserver
- Arrangement documents, role map and verification.
- Source primaire
- AML/CFT/CPF Law, beneficial-owner definition and Article 5
Resolve discrepancies instead of relying solely on registry data.
- Action d’implémentation
- Compare customer evidence with the state legal-entities database and investigate inconsistent ownership, management or status information.
- Preuves à conserver
- Registry results, discrepancy log and resolution.
- Source primaire
- AML/CFT/CPF Law, Article 5; state legal-entities database service
05PEPs, EDD, and remote onboardingHigher-risk relationships require enhanced controls.3 éléments+
Identify PEP exposure under current sector rules.
- Action d’implémentation
- Screen customers, representatives and beneficial owners and apply approval, source-of-wealth, source-of-funds and enhanced-monitoring controls where required.
- Preuves à conserver
- Screening, classification, approval and corroboration.
- Source primaire
- AML/CFT/CPF Law; applicable internal-control requirements
Apply enhanced due diligence to higher risk.
- Action d’implémentation
- Obtain additional identity, ownership, purpose, wealth and funds evidence and increase monitoring and review frequency proportionately.
- Preuves à conserver
- EDD checklist, evidence, approval and monitoring plan.
- Source primaire
- AML/CFT/CPF Law, Articles 5 and 11
Control non-face-to-face onboarding.
- Action d’implémentation
- Use a method permitted by the competent supervisor, test impersonation and fraud controls, and preserve authentication and exception evidence.
- Preuves à conserver
- Method assessment, session evidence and tests.
- Source primaire
- Applicable sector identification and internal-control rules
06Monitoring and suspicious reportingMonitoring must support AFM's event-specific reporting timelines.4 éléments+
Monitor transactions and relationships on a risk basis.
- Action d’implémentation
- Detect threshold, complex, unusually large, unusual and suspicious activity; review scenarios and customer information periodically.
- Preuves à conserver
- Scenario inventory, alerts, tuning and governance.
- Source primaire
- AML/CFT/CPF Law, Articles 4, 10 and 11
Report a suspicious transaction before conduct where required.
- Action d’implémentation
- When an operation is recognized as suspicious before execution, report it to AFM immediately before conduct and follow AFM suspension instructions.
- Preuves à conserver
- Recognition time, report, receipt and hold decision.
- Source primaire
- AML/CFT/CPF Law, Article 13(2)
Apply the correct timing where prior suspension is impossible or suspicion forms later.
- Action d’implémentation
- For an operation that cannot be suspended, use the statutory three-hour-after-conduct or 24-hour-after-detection route as applicable; where recognized after conduct, report by the next working day.
- Preuves à conserver
- Timeline, legal classification, report and acknowledgement.
- Source primaire
- AML/CFT/CPF Law, Article 13(2)
Prevent tipping off.
- Action d’implémentation
- Restrict access and communications about reports, AFM requests and related assistance except where law permits.
- Preuves à conserver
- Access controls, communication review and training.
- Source primaire
- AML/CFT/CPF Law, Article 10(5)
07Threshold reporting, wires, payments, and digital assetsDo not reduce transaction-specific reporting categories to one universal amount.4 éléments+
Configure each current financial-monitoring category separately.
- Action d’implémentation
- Maintain a legal table of Article 4 transaction types, amounts, aggregation and exemptions for the entity; report covered operations by the applicable deadline.
- Preuves à conserver
- Threshold table, configurations, test cases and reports.
- Source primaire
- AML/CFT/CPF Law, Articles 4 and 10
Carry required wire-transfer information.
- Action d’implémentation
- Apply current originator, beneficiary, missing-data, screening and intermediary controls for the institution's role.
- Preuves à conserver
- Field matrix, samples, screening and repair queue.
- Source primaire
- AML/CFT/CPF Law; applicable sector rules
Classify payment and electronic-money services before launch.
- Action d’implémentation
- Map payment initiation, processing, wallets, acquiring, transfers and electronic money to the Law on Payments and Payment Systems and National Bank requirements.
- Preuves à conserver
- Product memo, registration or licence and control tests.
- Source primaire
- Law on Payments and Payment Systems
Use the correct digital-asset perimeter.
- Action d’implémentation
- Classify secured and unsecured digital assets and obtain the required National Bank, digital-development authority or AFSA/AIFC licence before exchange or platform activity; do not rely on an in-principle approval as authority to operate.
- Preuves à conserver
- Classification, licence, register check and AML programme.
- Source primaire
- Law on Digital Assets; current National Bank and AIFC rules
08Targeted financial sanctionsUse the live official lists and act without delay.3 éléments+
Screen current terrorism, extremism and proliferation-financing lists.
- Action d’implémentation
- Screen customers, owners, representatives and transactions at onboarding, continuously or periodically according to risk, and on list updates.
- Preuves à conserver
- List version, screening logs and match decisions.
- Source primaire
- AML/CFT/CPF Law, Article 12
Freeze listed property immediately.
- Action d’implémentation
- Implement the statutory freeze without delay and no later than one working day after official publication of the listing, subject only to express statutory exceptions.
- Preuves à conserver
- Listing, freeze timestamp, asset inventory and report.
- Source primaire
- AML/CFT/CPF Law, Article 12(1-1)
Control releases and permitted access.
- Action d’implémentation
- Release or permit access only on documented legal authority and preserve every condition and communication.
- Preuves à conserver
- Authority decision, conditions and release record.
- Source primaire
- AML/CFT/CPF Law, Article 12
09Records and authority accessRecords must reconstruct the complete customer and transaction lifecycle.3 éléments+
Retain CDD and relationship records for at least five years.
- Action d’implémentation
- Run the period from relationship termination and preserve customer files, correspondence, ownership analysis and review results.
- Preuves à conserver
- Retention schedule, source records and retrieval test.
- Source primaire
- AML/CFT/CPF Law, Article 11
Retain reportable, suspicious and unusual-operation records for at least five years.
- Action d’implémentation
- Run the period from transaction completion and preserve analysis, decision and reporting evidence.
- Preuves à conserver
- Case archive, schedule and integrity controls.
- Source primaire
- AML/CFT/CPF Law, Article 11
Respond to AFM requests within the applicable deadline.
- Action d’implémentation
- Operate controlled production procedures for the general three-working-day deadline and the next-working-day deadline for suspicious-transaction analysis requests, subject to any lawful extension.
- Preuves à conserver
- Request log, production, approval and receipt.
- Source primaire
- AML/CFT/CPF Law, Article 10
10Privacy, biometrics, breaches, and transfersAML processing remains subject to Kazakhstan privacy and security law.4 éléments+
Document the lawful basis and purpose for personal-data processing.
- Action d’implémentation
- Map collection, processing, notices, consent or statutory authority, access rights, correction, blocking, destruction and retention.
- Preuves à conserver
- Data map, notices, legal-basis register and rights log.
- Source primaire
- Law on Personal Data and their Protection
Protect identity and biometric data.
- Action d’implémentation
- Minimize collection and apply security, access, accuracy, liveness and deletion controls proportionate to sensitivity and permitted purpose.
- Preuves à conserver
- Assessment, architecture, tests and approvals.
- Source primaire
- Law on Personal Data and their Protection
Control transfers and third parties.
- Action d’implémentation
- Confirm consent or another lawful basis, destination protection, contracts and localization requirements before third-party or cross-border transfers.
- Preuves à conserver
- Transfer map, legal assessment, safeguards and notices.
- Source primaire
- Law on Personal Data and their Protection, cross-border-transfer provisions
Use applicable incident and sector reporting rules.
- Action d’implémentation
- Maintain an incident workflow that identifies the competent authority, affected systems, notification triggers and deadlines without inventing a universal breach deadline.
- Preuves à conserver
- Incident chronology, legal assessment, notices and remediation.
- Source primaire
- Personal-data law and applicable sector cybersecurity rules
11Practical evidence packsEvidence must reconstruct decisions end to end.3 éléments+
Maintain an onboarding pack.
- Action d’implémentation
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk, privacy and approvals.
- Preuves à conserver
- Complete sample and retrieval result.
- Source primaire
- Operational control supporting AML/CFT/CPF Law, Article 5
Maintain reporting and sanctions case packs.
- Action d’implémentation
- Link trigger, classification, decision time, report, receipt, confidentiality, freeze and authority communications.
- Preuves à conserver
- Case pack, timeline and access record.
- Source primaire
- AML/CFT/CPF Law, Articles 10, 12 and 13
Maintain a launch and legal-change pack.
- Action d’implémentation
- Record perimeter, licences, transaction categories, reporting, sanctions, privacy, vendors, source versions and tests.
- Preuves à conserver
- Signed pack, source register and approvals.
- Source primaire
- Official sources listed below
Registre des sources primaires
15 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- AML/CFT/CPF Law No. 191-IVAgency for Financial Monitoring · Primary legislation - official English text
- AML/CFT/CPF Law - current official repository recordAdilet Legal Information System · Primary legislation - official English text
- Agency for Financial MonitoringGovernment of Kazakhstan · Official FIU and regulator portal
- Internal-control requirements for banking-operation and microfinance organizationsAgency for Financial Monitoring · Official sector requirements
- State database - Legal entitiesMinistry of Justice · Official registry service
- Law on Personal Data and their ProtectionAdilet Legal Information System · Primary legislation - official English text
- National Bank of KazakhstanNational Bank of Kazakhstan · Official financial and payments regulator
- Law on Payments and Payment SystemsAdilet Legal Information System · Primary legislation - official English text
- Digital asset industry frameworkGovernment of Kazakhstan · Official regulatory overview
- AFSA public registerAstana Financial Services Authority · Official licence register
- Kazakhstan 2023 mutual evaluationFATF / EAG · Authoritative mutual evaluation
- Kazakhstan EAG follow-up report 2026FATF / EAG · Authoritative follow-up assessment
- FATF increased-monitoring statement - October 2026FATF · Authoritative current public-list status
- FATF call-for-action statement - October 2026FATF · Authoritative current public-list status
- Law and rules on State SymbolsGovernment of Kazakhstan · Official flag-use law and rules
Réponses directes
Questions KYC, KYB et AML pour Kazakhstan
Who receives suspicious-transaction reports?+
The Agency of the Republic of Kazakhstan for Financial Monitoring (AFM), through the prescribed electronic channel for the reporting entity.
When is a suspicious transaction reported?+
A transaction recognized as suspicious before execution is reported immediately before conduct. Different statutory timing applies when suspension is impossible or suspicion forms after execution.
Is there one universal reportable-transaction threshold?+
No. Article 4 uses transaction-specific categories, amounts and conditions. Configure the current table for the entity and transaction type.
How is an AML beneficial owner identified?+
Start with natural persons directly or indirectly owning more than 25%, then examine control by other means or the natural person in whose interests transactions are conducted.
How long are AML records retained?+
At least five years, measured from transaction completion or relationship termination depending on the record type.
How quickly must listed property be frozen?+
Immediately and no later than one working day after the official listing is published, subject to express statutory exceptions.
Are digital-asset services regulated?+
Yes. The perimeter depends on the asset and activity; licences or permissions may involve the National Bank, the digital-development authority or AFSA/AIFC.
Is Kazakhstan on a FATF public list?+
No at the October 2026 statements. That is not a low-risk determination.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General information, not legal advice. Reviewed 7 November 2026. Confirm the controlling Kazakh or Russian text, current sector rules, transaction-reporting categories, reporting channels, sanctions lists, privacy requirements and licensing conditions with AFM, the competent supervisor and qualified Kazakhstan counsel.