Digital assets in Kazakhstan: what you buy and what KYC checks

Date checked: 18 October 2026.

Digital assets are property in electronic digital form recorded using a distributed data platform. Kazakhstan’s legal definition has further elements and expressly says such an asset is not legal tender. It does not follow that every file, app reward, or bank-account balance is a digital asset. Digital Assets Law, article 1.

A platform asks for a document and a selfie before someone buys a token. That check may establish the customer’s identity. On its own, it establishes neither the rights attached to the token nor the platform’s authority to provide the service. These are three different questions, even if the app presents them as one sign-up flow.

To understand an offer, ask in sequence what is being transferred, who provides the service, and what is checked about the customer. The following teaching example uses those questions and takes account of the change to national regulation effective from 1 May 2026.

A digital record is not necessarily a digital asset

In plain language, digital assets are property existing in digital form and recorded under the rules of a relevant distributed system, rather than merely information on a screen. “Property” matters: it is something a person owns or has rights in, not a way to display a balance in an app.

The law is more precise. It refers to electronic digital form, an assigned digital code, registration and immutability of information on a distributed data platform. It also mentions cryptography and computer calculations. Neither “we are online” nor “we use blockchain,” taken alone, settles the product’s legal nature. Article 1.

Suppose a company offers a token through an app. The screen displays a price, a buy button, and a balance. That says nothing about whether the customer receives a claim against an issuer, a digital financial instrument, or an unbacked asset. The interface shows how the customer interacts with the product, not what rights the purchase carries.

For an initial assessment, ask for a description of the instrument and its issuance documents, where documents are required for that type of asset. This is not a request to perform your own legal audit. The simpler aim is to avoid replacing “what do I own?” with “what does the app show?” If the operator cannot explain the object clearly, the next step is clarification of the product, not another selfie.

Unbacked assets and digital financial assets: a difference in rights

Under the current law, unbacked digital assets are digital assets that are not digital financial assets. This is a legal category, not a judgment on the owner’s honesty and not a synonym for unlawful trade. A market price does not itself imply underlying property or a claim against an issuer. Article 1.

The law divides digital financial assets (DFAs) into three groups. The first consists of assets backed by money, namely stablecoins. The second is backed by other objects: financial instruments, a financial asset, property rights, goods, and other property provided for by law, excluding money. The third consists of financial instruments issued in electronic digital form on a DFA operator’s platform. Article 5.

The National Bank’s official announcement gives examples: it names cryptocurrencies as unbacked assets and lists money-backed stablecoins, tokenized real assets, and digital forms of traditional financial instruments among DFAs. These are examples of classes, not an endorsement of every similarly named token as compliant with Kazakhstan’s law. National Bank announcement, 30 April 2026.

The law says separately that unbacked digital assets “are not recognized as a means of payment, financial instruments or financial assets.” A market price and the word “investment” in an advert do not change that national classification. The same wording should not automatically be imported into definitions under AIFC acts. Article 12-1, paragraph 2.

In the example, calling something a “goods token” does not reveal the terms for receiving the goods, performance of the obligation, or exercise of the holder’s rights. “Stablecoin” likewise does not prove that the claimed backing exists and is accessible. Comparing products on current price alone therefore misses the first question: what kind of right is promised? This is a way to read an offer, not advice to prefer one category over another.

How regulation changed on 1 May 2026

Regulation in Kazakhstan depends on the asset type, the provider’s activity, and the applicable legal regime. As of the date checked, the claim that “everything is permitted only through the AIFC” is outdated: the National Bank announced a systematic national regime from 1 May 2026. The corresponding amendments appear in the official text of the law; its former article 11 on exchanges was removed from that date. Law; National Bank explanation.

Under the national regime, distinguish an unbacked-asset exchange operator, a trading-platform operator, and a DFA-platform operator. The first needs a National Bank licence for dealing in, and exchanging, unbacked digital assets. The latter two are subject to registration. A company’s presence in the ordinary corporate register does not establish that it holds the relevant sectoral permission. Check its authority against the particular service, rather than the broad label “crypto company.” Articles 1 and 4; National Bank announcement.

The National Bank describes regulation of providers outside AIFC territory separately. For DFA circulation other than stablecoins, its announcement also names responsibilities of the Agency for Regulation and Development of the Financial Market. “The National Bank regulates everything” is no substitute for checking the division of powers. National Bank announcement.

The AIFC retains its own legal regime. The national categories above do not replace classification of an instrument under the centre’s acts. AFSA describes digital-asset service providers as AIFC participants licensed for one or more relevant regulated activities, such as running a platform, brokerage, or custody. Permission for one activity is not a blanket permission for every service. AFSA on providers.

Assess a Kazakhstani digital-asset offer through both the legal category of the asset and the particular provider’s regime, matching its permitted activity to the offered service. This article does not check individual companies, list approved tokens, or claim that every cross-border service is available to a customer in Kazakhstan.

The discussion reflects the rules as of 18 October 2026. Law No. 352-VIII of 23 July 2026 provides for further amendments, including to the Digital Assets Law. The amendments at issue take effect 60 calendar days after first official publication; the act’s record lists publication on 21 August 2026. On the date checked, that period had not yet expired, so future provisions are not presented here as current. Amendments and article 2; publication details.

What KYC checks and why CDD matters

KYC means “know your customer.” In an everyday app, it often means checking a document and identity. Customer due diligence (CDD) is broader than matching one photograph. AFSA’s guidance covers identifying and verifying the customer, identifying the beneficial owner, understanding the purpose of the relationship, and continuing to examine transactions. AFSA AML FAQ.

These are distinct tasks, not the same document pack for every customer. AIFC rules link the scope of checks to risk: higher risk calls for enhanced due diligence, while simplified measures are allowed in eligible lower-risk cases. Simplified checks must not be chosen automatically or where money laundering is suspected. AML Rules, paragraphs 6.1.1–6.1.2 and 8.1.1–8.1.2.

The distinction is particularly clear for a corporate customer. Identifying its representative does not identify who ultimately owns or controls it. Establishing its beneficial owner does not by itself explain the source of funds for a particular transaction. Those are separate facts, checked in light of the customer and its risk; one biometric comparison cannot provide them all.

Open full-size diagram

In words: the asset description establishes the subject and rights; checking the provider establishes its authority to offer the service; KYC/CDD concerns the customer and relationship. A result in one area does not settle the other two.

There is a specific rule for national exchange operators. Paragraph 30 of their activity rules links service to due-diligence measures. Remote services for residents require biometric authentication through IDEC. For nonresidents, identification may use IDEC and/or third-party remote-identification services, subject to Kazakhstan’s law and internal-control rules. This provision cannot be extended without a separate check to every platform, customer category, or AIFC activity. Exchange-operator rules, paragraph 30.

Anti-money laundering (AML) covers a broader program of organizational measures. AFSA’s FAQ places customer identification beside risk assessment, transaction monitoring, internal control, training, and audit. “KYC passed, therefore AML is complete” erases much of that work. AFSA also explains that AIFC participants whose activity is subject to financial monitoring must follow both the national AML/CFT law and AIFC rules. The centre’s own regime does not remove national AML duties.

One token, three independent questions

Return to the hypothetical purchase. First, what exactly does the customer acquire? The answer should describe the asset and rights, not just its exchange rate and attractive screen. If an issuer’s obligation is promised, its terms matter. If an unbacked asset is transferred, its lack of DFA status cannot be hidden behind “everything is verified by blockchain.”

Second, who carries out the transaction for the customer? The brand name may need to be matched with the company named in the contract. Check the legal entity, applicable regime, type of permitted activity, and current status of that permission. Completing user registration answers none of these questions. This is an editorial way to separate checks, not a legal opinion on a particular transaction.

Third, why does the platform request these details from this customer? A document check may establish identity. Another question may clarify the relationship’s purpose or the source of funds. If circumstances change after account opening, ongoing checks remain relevant even though the customer passed onboarding long ago. AFSA’s guidance explicitly describes examining transactions throughout a relationship in light of known customer information and risk.

An onboarding employee can record separate outcomes: “identity verified,” “asset category established,” and “provider authority checked.” This is a suggested reasoning aid, not a prescribed reporting form. It prevents a technical success from quietly turning into blanket transaction approval.

Checks that work together

Matching a face to a document, screening against lists, and examining transactions answer different questions. The first connects a person to presented data. The second finds potential matches against defined sources and rules. The third considers behavior and the flow of funds. Actual capabilities depend on the system selected; no accuracy, database completeness, or guaranteed detection rate is claimed here.

Choosing one tool to replace the whole process gets the task wrong. A face match does not prove that funds were lawfully obtained. Conversely, no risk found in a single transaction does not identify the account holder. An outside screening service does not make all relationship decisions for the organization: applicable rules, responsible staff, and exception handling are still needed.

Start a discussion about implementation with the check’s purpose: which data are needed, what result the system returns, and where an ambiguous case goes. Only then discuss automation. A vendor’s “complete KYC/AML with one button” claim is not a useful comparison without the checks and limits behind it.

How to start the conversation with a platform

Ask the platform to explain what is being purchased and name the legal entity providing the service. Then clarify its regime and permitted activity. Treat its KYC request separately: what details are checked, for what purpose, and what happens when no result is obtained. Submit documents through the organization’s verified channel; a request for a selfie does not itself authenticate the requester.

Open full-size diagram

With those questions answered, “what are digital assets?” becomes more useful than a dictionary definition: the customer distinguishes the digital object, the provider’s right to offer a service, and checks on the service’s customer. None of these answers predicts future price, guarantees an investment, or recommends a transaction.

Main sources

• Kazakhstan’s Digital Assets Law: definitions, DFA types, provider regimes, and changes from 1 May 2026.

• National Bank: regulation of digital-asset circulation, 30 April 2026.

• Rules for unbacked-digital-asset exchange operators, especially paragraph 30.

• AFSA: digital-asset service providers.

• AFSA AML FAQ, public regulatory guidance that does not replace the full applicable rules.

Originally published in Russian. Adapted for English readers.

This article is for information only and does not replace advice from a qualified lawyer.