KYC in Uzbekistan: building an evidence-based customer file
A practical map of identification, verification, beneficial ownership, risk and ongoing monitoring for KYC in Uzbekistan.
An authentic passport and a successful face comparison do not complete KYC. A bank or payment organisation still has to establish who is acting, who ultimately controls a legal entity, why the customer is opening the product and whether later activity stays consistent with the customer profile. Collapse those decisions into one identity_verified field and the file becomes hard to defend.
The Central Bank of Uzbekistan glossary defines customer due diligence as identity and authority checks, beneficial-owner identification and ongoing monitoring of relationships and transactions. In practice, KYC is a ledger of decisions, not a single document upload.
The five decisions a KYC workflow must keep separate
Decision | Control question | Evidence to retain |
|---|---|---|
Identification | What did the customer claim? | Original form, document and submitted values |
Verification | Which independent source confirmed it? | Source, timestamp, response and discrepancy handling |
Authority and control | Who acts and who ultimately controls the customer? | Authority evidence, ownership chain and reasoning |
Risk | What depth of review is required? | Factors, rating, approval and enhanced measures |
Monitoring | Does later activity still fit the profile? | Trigger, analysis, update and decision owner |
Keeping them apart catches a case that a conventional checklist misses. A person passes document, liveness and face checks, yet the relationship stays on hold because authority, beneficial ownership, source of funds or risk is still unresolved.
Uzbekistan does not have one checklist for every business
The national framework rests on Law No. 660-II and sector regulations. Commercial banks use the internal-control Rules registered as No. 2886 and subsequent amendments. Payment-system operators, electronic-money operators and payment organisations have separate Rules No. 3266. Securities-market professionals received updated rules registered as No. 3877 in 2026.
So the first implementation question is which regulated entity, product, channel and trigger you are designing for. The list of KYC fields follows from that answer. Do not copy a threshold or exception from one sector into another without a matching legal basis.
The common architecture stays the same across sectors:
establish the customer’s claimed identity and, where relevant, the representative’s authority;
verify material data against reliable sources;
identify and take reasonable steps to verify the beneficial owner;
understand the purpose and intended nature of the relationship;
rate risk and apply standard or enhanced measures;
monitor transactions and keep the file current.
The general What is KYC guide explains the terminology. For Uzbekistan, add the exact sector rule, its current edition and the organisation’s versioned decision policy.
A representative, a director and a beneficial owner answer different questions
A director's signature can show who commits the company, yet it does not reveal who ultimately controls it. A power of attorney sets out what the representative may do and does not make that person the beneficial owner. A legal-entity file therefore needs three separate evidence chains: the entity exists, the presenter may act, and the ownership or control conclusion can be reconstructed.
Trace ownership from current registration and corporate records through direct and intermediate owners to the relevant natural person. If nominal ownership does not explain effective control, the analyst records the additional sources, the discrepancies and the reasoning. A threshold borrowed from another country or sector cannot replace the criterion in the rule that currently applies.
Risk must change the depth of due diligence
“Opening an account” names a product and says nothing about expected behaviour. A usable profile links purpose, business activity, geography, expected counterparties and transactions (and, where the risk calls for it, source of funds or wealth) to an identified source and a control consequence.
Enhanced due diligence should state which factor opened the enhanced path, what evidence could resolve the uncertainty, who may accept residual risk and which outcome requires refusal, restriction or manual escalation. A longer questionnaire or an automatic rejection does neither job.
Biometric.Vision AML Screening can return candidate matches from the stated sanctions, PEP and other sources and support repeat monitoring. A candidate match carries no legal conclusion, so the organisation resolves identity, assesses context and documents its own decision.
What biometrics can prove—and what they cannot
Document verification extracts fields and analyses available document features. Face Match returns a similarity score between a current image and a reference portrait. Liveness evaluates whether the presentation displays the tested properties of a live capture rather than the attack types covered by the method.
Those signals help bind the presenter to the identity. They do not establish a representative’s authority, the ownership chain, a PEP match, source of funds or whether the relationship is legally acceptable.
In a 2025 official statement, the Central Bank described Face ID controls in bank and payment-organisation apps for new registration, password recovery and login from a new device. The statement covers biometric use in those specific scenarios. Nothing in it suggests that one biometric check completes the whole KYC process.
Personal-data rules require purpose-level analysis
Uzbekistan’s Personal Data Law No. ZRU-547, in the edition checked on 17 September 2026, defines biometric data and contains rules on consent, protection and storage. Amendments effective in 2026 changed the localisation framework and expressly address biometric and genetic data.
Article 3 of the same law also contains an exclusion for relationships arising from processing data obtained within the AML framework. Do not stretch that wording over the entire digital-onboarding stack. One selfie may be processed for identity verification, authentication, fraud prevention and AML-related controls, so map the legal basis, purpose, data objects, storage location, access, retention trigger and deletion evidence for each use.
KYC continues after onboarding
Periodic and event-driven reviews solve different problems. Periodic review keeps the file from ageing unnoticed. Event-driven review cuts the response time when ownership or management changes, a new geography appears, transaction behaviour shifts materially or screening produces a new candidate match.
Keep more than the current value in the audit trail. A reviewer needs the previous version, trigger, new source, change owner, revised risk rating and policy version. Without that history, the organisation can show today's state but cannot prove when or why the decision changed.
A defensible KYC file is reproducible
A reviewer should be able to reconstruct the decision without asking the original analyst:
the applicable entity, product, channel and version of the rule;
original and normalised customer data;
the source, time, version, response and error for every check;
separate document, liveness, face-comparison and screening results;
authority and beneficial-ownership evidence;
risk factors, exceptions and approvals;
the final decision, decision owner and next review trigger.
Biometric.Vision Orchestrator can connect document, face, liveness, AML-screening and manual-review steps in a versioned workflow. The applicable rule, thresholds, exceptions and the final customer decision remain the regulated organisation’s responsibility.
Sources
Ready to strengthen your customer checks?
500 checks free every month · no card · no contract · no sales call.
