Resolution No. 91 of Kazakhstan’s financial regulator: when a bank needs biometrics and when it needs IDEC
When an online bank loan requires biometric authentication, how the 150 MCI threshold works, and why a selfie alone is not enough.
Date checked: 18 October 2026.
Resolution No. 91 of Kazakhstan’s Agency for Regulation and Development of the Financial Market (ARDFM), dated 15 May 2026, sets requirements for conducting banking activities. For a team issuing loans online, paragraphs 79–82 matter most: biometric authentication, how it must be carried out, and the retention of records. But it is too early to commission “biometrics under No. 91” without describing the customer journey. The duty to authenticate a person, the technical procedure, and the mandatory use of the Identification Data Exchange Center (IDEC) appear in different provisions and documents. Resolution No. 91.
A common mistake is to take a selfie, receive a positive response from a service, and assume the requirement has been met. The bank still needs to establish which image was used for comparison, how the person’s presence was checked, whether IDEC was required, and what records were retained. This article separates those questions using an online bank loan to an individual as an example.
Finding the right Resolution No. 91
If you are looking for “ARDFM Resolution 91,” check its date, 15 May 2026, and registration number, 38748. Its full title is “On the approval of Requirements for the conditions of conducting banking activities.” A number without a date is insufficient in a technical specification: it identifies neither the subject nor the edition of the act.
The document covers more than biometrics. Paragraph 1 describes requirements for banking activities, including the protection of consumers’ interests and the provision of information. Calling it a separate “liveness resolution” would be inaccurate. The act itself defines who it covers: “bank” includes, among others, second-tier banks, Islamic banks, branches of nonresident banks, and organizations carrying out certain banking operations. Its conditions cannot simply be applied to every company that checks users. No. 91, paragraph 1.
The preserved official version reflects an amendment made by Resolution No. 105 of 24 July 2026. Paragraph 5 of No. 91 generally brings the act into force sixty calendar days after its first official publication, while separately listing provisions that take effect on 1 October 2026. That does not mean all biometric requirements “began on 1 October.” The special date applies to the named provisions, including paragraph 83 on questionnaires. A working specification should identify the edition and the particular paragraph, rather than copy a general date from a news item. No. 91, paragraph 5 and edition notes.
Three questions: the duty, the procedure, and IDEC
The first question is whether the transaction requires biometric authentication. In the case considered here, paragraph 79 of No. 91 expressly prohibits concluding a bank loan agreement with an individual over the internet without it. The provision says “without conducting biometric authentication of the individual.” A one-time password does not replace that step: paragraph 80 provides for sending a password by push notification or SMS and conducting biometric authentication. It names two ways to perform the latter: IDEC services or biometric data obtained through the bank’s devices. The conditions in paragraph 81 must be considered separately. No. 91, paragraphs 79–80.
The second question is which checks make up the procedure. Paragraph 79 refers to ARDFM Resolution No. 54 of 3 April 2026. Its rules distinguish the capture of a current image, identification data, a reference image, and comparison. There is also a joint resolution: ARDFM No. 99 of 26 June and National Bank No. 72 of 29 June 2026. It regulates biometric authentication by financial and payment organizations and the circumstances in which IDEC is used. A current process needs to account for both applicable documents; the June act should not be treated as an automatic replacement for the April one. No. 54, paragraphs 1 and 6; joint rules, paragraphs 1 and 6.
The third question is when a specific route through IDEC is required. Paragraph 81 of No. 91 connects it to the amount of an unsecured consumer bank loan, fraud risk, and the conditions of an earlier check. Paragraph 24 of the joint rules lists further banking events, including remote account opening and initial registration in an app or on a website. “The amount is below the threshold” therefore does not complete the analysis of a customer journey. No. 91, paragraph 81; No. 99/72, paragraph 24.
This distinction makes the requirement testable. The bank first identifies the event and the required route, then checks how authentication is performed technically, and finally evaluates the records and the decision. Buying a face-comparison module first and looking for its legal basis afterward leaves the central question unanswered.
What the 150 MCI threshold changes
Paragraph 81 of No. 91 concerns a consumer bank loan that is not secured by a pledge of property. Its first part requires the authentication described in paragraph 80 to be performed through IDEC when the amount is 150 monthly calculation indices (MCI) or more. MCI is the monthly calculation index for the relevant financial year. It is more useful to keep the threshold in MCI here: converting it to tenge would require checking the index for the particular year. No. 91, paragraph 81.
Consider these teaching examples. They explain the provision; they are neither real applications nor approvals to issue a loan.
Situation | What paragraph 81 establishes | What else to check |
|---|---|---|
Unsecured consumer online loan of 149 MCI | The threshold in the first part has not been reached | High fraud risk, initial registration, account opening, and other grounds for using IDEC |
The same loan at exactly 150 MCI | “150 MCI or more” includes equality | Whether the exception for a previously checked customer and other grounds apply |
The same loan above 150 MCI; the customer has already been checked through IDEC | A threshold ground exists, as does a potentially relevant exception | Whether all three conditions hold together: retention of the relevant data, their currency, and comparison by the bank’s own system |
The wording contains a material distinction. Subparagraph 3 of paragraph 24 of No. 99/72 speaks of an amount exceeding the level set by No. 91, whereas No. 91 itself includes equality with the threshold. For a loan of exactly 150 MCI, the word “exceeding” in the referring provision alone cannot justify dispensing with IDEC while ignoring the direct wording “or more.” The legal analysis used to approve the process should address this point explicitly. This article does not invent a new rule to remove the difference between the two texts. No. 91; No. 99/72.
The next part of paragraph 81 provides for a bank decision to authenticate through IDEC when fraud risk is high, regardless of the amount. The “under 150” branch must therefore not automatically produce “IDEC is unnecessary.” Amount and risk are different conditions.
Finally, the third part makes an exception to the requirement in the first part for a customer previously identified using biometric authentication through IDEC. It sets three conditions together: the relevant biometric data have been retained, they are current, and the bank compares the person using its own systems. Being an “existing customer,” or having an old selfie, does not itself establish those conditions. The exception is not written as a cancellation of all other grounds for using IDEC. No. 91, paragraph 81.
When a selfie does not complete the check
A selfie shows what image has been captured now. Liveness detection, or an authenticity check of the image, helps establish the presence of a live person during capture. Comparison asks a different question: does the current face match a reference or verified image? A positive result in one operation is not a positive result in another. The rules separate these steps and their records. No. 99/72, paragraphs 2, 6 and 9–13.
For the authenticity check described in the rules, at least three signals and/or commands must cause visible changes in the frame while the video stream is analyzed. A mismatch leads to a repeat of the procedure; three unsuccessful repeats mean a negative result. This is not a universal instruction to “ask the customer to blink three times.” The rules describe a relationship among signals, changes, and analysis. The vendor’s particular flow should be assessed against those requirements. No. 54, paragraph 8; No. 99/72, paragraph 8.
There are limits to scope, too. Paragraph 1 of No. 54 excludes processes carried out by organizations through their own hardware devices. Requirements for a mobile check should not be applied to every hardware scenario without qualification. Nor does the customer’s smartphone become a “bank device” merely because it runs the bank’s app. That is a question of actual architecture and legal classification, rather than a button’s name.
The service result should not be turned into a promise that fraud is absent. Under the joint rules, the customer organization decides whether authentication succeeded on the basis of the checks and its approved criteria. A successful face match does not show that the customer understands the loan terms or is acting without outside pressure. The biometric result and the decision on the financial transaction therefore need to remain distinct in the process description. No. 99/72, paragraphs 4 and 15.
What to ask the team and the vendor
The useful outcome of a discussion is a coherent description of one customer journey. Follow the path from registration to signing the agreement and ask four concrete questions.
Why this route? State the loan type, its amount relative to MCI, the fraud-risk assessment, any earlier IDEC check, and other events in paragraph 24. “That is how the SDK is configured” does not explain the legal ground.
Where did the comparison image come from? Record the source of the reference or verified image and who performs each check. No. 99/72 distinguishes current, reference, and verified images. An arbitrary profile photo does not become a reference image when its database field is renamed.
Which results can be produced? The rules provide for electronic documents recording the authenticity check and the comparison, whether they succeeded or failed. The provider signs them with a digital signature, and the customer organization retains them. The comparison document is also kept in the provider’s database of verified images if such a database exists. A
passed=trueflag alone does not describe the prescribed set of results. No. 99/72, paragraphs 9–13.How do the result, decision, and retention relate? Paragraph 82 of No. 91 requires records of an online loan agreement to be retained for at least five years after the parties’ obligations end. Under paragraph 27 of No. 99/72, consents obtained through IDEC and its authentication results remain in IDEC for at least five years after receipt and processing. Paragraph 28 starts a different clock for the information it lists at the bank: at least five years from the end of the business relationship. Paragraph 16 separately refers to the rules for retaining financial-service documents. These provisions cannot be collapsed into “delete everything five years after the selfie.” No. 91, paragraph 82; No. 99/72, paragraphs 16 and 27–28.
These are questions for accepting a process, not a complete list of a bank’s duties. Consent, information security, and other requirements remain separate conditions. Chapter 3 of the joint rules, for example, regulates consent when IDEC is used. A diagram of the journey does not replace checking those conditions.
Why “verification law” points to several documents
The search “verification law” does not identify a particular act. For a banking scenario, first establish the transaction, the regulated entity, and the applicable rules. Here, No. 91 sets the banking conditions; No. 54 explains the procedure to which No. 91 expressly refers; and No. 99/72 regulates authentication by financial and payment organizations and when IDEC is used. For microfinance organizations, paragraph 29 of the joint rules instead refers to separate requirements in No. 92. A threshold for bank loans cannot be transferred to a microloan merely because the app screens look alike. No. 99/72, paragraphs 24 and 29.
Start with one real transaction in your organization: identify the provision, the ground for using IDEC, the comparison source, and the records to retain. The discussion with a biometric vendor then becomes concrete: the team can check which steps are covered, where integration ends, and what evidence is missing. “We comply with Resolution No. 91” remains an untestable general promise without these details.
Primary sources
The official pages were accessed on 15 October 2026; the database displayed a status date of 12 October 2026. Check for subsequent changes before implementation.
ARDFM No. 91 of 15 May 2026: conditions for banking activities — principally paragraphs 79–82.
ARDFM No. 54 of 3 April 2026: biometric authentication — scope and verification procedure.
ARDFM No. 99 / National Bank No. 72: joint rules — mechanism, records, and IDEC cases. The general commencement date is 12 July 2026; separate provisions listed in paragraph 4 of the resolution took effect on 19 July 2026.
Originally published in Russian. Adapted for English readers.
This article is for information only and does not replace advice from a qualified lawyer.
Ready to strengthen your customer checks?
500 free checks a month for a year · no card · no contract · no sales call.
