Politically exposed persons: what Kazakhstani banks must check and what global PEP databases miss

Date checked: 15 October 2026.

This explains Kazakhstan’s requirements for information purposes. It does not replace an assessment of a specific case by a compliance team and local lawyer.

A public official, or PEP in the terminology commonly used by screening providers, is a person whose office or public function falls within the categories in article 1, subparagraph 3-3, of Kazakhstan’s AML/CFT Law. In a bank, this status matters when checking a customer, the customer’s representative, and a beneficial owner. It does not itself prove a crime or sanctions exposure. The bank establishes the person’s category, relationships, and risk level, then applies the relevant measures. Definition and article 8.

In a bank questionnaire, “Are you a PEP?” asks about the relevant office or function. Questions about a spouse and close relatives need to be read separately. PEP stands for politically exposed person. Providers and international standards use the term, but a commercial database’s PEP coverage must not automatically be equated with Kazakhstan’s legal definition.

The bank has two tasks: establish whom it is serving, and determine which regime applies to that person. A name match in a PEP database helps identify a candidate for investigation. It does not yet establish that the record concerns this customer. Nor does a lack of matches replace checks against official information available to the bank.

The eight paragraphs behind the definition

To determine who is a public official under Kazakhstan’s law, examine the office and function, not just the employer’s name. Article 1, subparagraph 3-3, of the AML/CFT Law lists seven categories. Its opening line is the first paragraph of the subparagraph, so the categories appear in paragraphs two through eight:

• a person holding a responsible state position;

• an official;

• a person authorized to perform state functions;

• a person carrying out management functions in a state organization or quasi-public-sector entity;

• a person appointed or elected to a position in a foreign state’s legislative, executive, administrative, or judicial body or armed forces;

• a person performing a public function for a foreign state;

• a person holding a senior position in an international organization established by states under international treaties.

The last wording was introduced by article 1, paragraph 14, of Law No. 311-VIII of 12 June 2026. The amendment took effect on 13 August 2026: the law was first officially published on 13 June, and article 2 brings this provision into force sixty calendar days after the day of publication. The consolidated record of No. 191-IV available when checked still showed the earlier wording with an amendment note. This article accounts for the amending law itself.

Kazakhstani forms sometimes use an abbreviation for a foreign public official; for example, Nurbank’s questionnaire for financial institutions, item 11.5, defines it. In a pair of domestic and foreign labels, the first denotes the general concept and the second specifies a foreign public function. The controlling reference for a Kazakhstani bank remains the definition’s paragraphs and article 8, not an interface abbreviation. Foreign function and foreign citizenship are different characteristics: citizenship alone does not establish a foreign public function.

“State enterprise employee” is likewise insufficient on its own: the law expressly refers to management functions. The person’s duties and applicable list need to be checked. Nor is every employee of an international company a PEP: the last category concerns senior roles in particular international organizations.

What a PEP question on a bank form means

On a bank form, a PEP question concerns public office or function and, where the form asks for it, a relationship with such a person. The customer’s practical task is to supply verifiable details; the bank’s is to compare the answer with documents and other sources. Article 5 allows a financial-monitoring entity to request necessary information, and requires a customer to provide details and documents needed for the entity to discharge its legal duties. Article 5, paragraphs 3–5.

Read the explanation to each field before answering. “Are you a PEP?”, “Is your spouse a PEP?”, and “Do you have a close relative who is a PEP?” are different questions. If a role is unclear, give the bank the full position, organization, country in which the function is performed, and dates of office; for a relative, state the relationship too. This is editorial advice on clarifying a form, not a universal form prescribed by law.

Teaching example. An applicant’s sister holds public office, while the applicant works in a private company. Their job does not become public office through kinship. They do, however, disclose their sister in response to a separate question about close relatives. The bank verifies her category and her relationship to the applicant. For a Kazakhstani category on the presidential list, the additional measures in article 8, paragraph 2, also depend on a high-risk classification.

Counterexample. A database finds another person with the applicant’s surname and a similar given name. The bank cannot transfer that person’s office to the customer, or answer the form on the customer’s behalf, before comparing identifiers. Date of birth, full name, office, and other available details help resolve the match. A name alone is insufficient.

In words, compare a search result with the person’s details. Record a false match; investigate an unresolved match further. For a confirmed person, identify the category. Definition paragraphs six through eight fall under article 8, paragraph 1; the bank’s corresponding additional measures also cover spouses and close relatives under paragraph 32 of its internal-control requirements. The presidential-list group, its spouses, and close relatives fall under article 8, paragraph 2, subject to high risk. The permissibility of starting a relationship remotely is a separate check.

Two regimes that the law does not name separately

Article 8 divides the definition’s categories. Paragraph 1 covers definition paragraphs six, seven, and eight: foreign public functions and leaders of the specified international organizations. Banking requirements expressly extend the corresponding additional measures to their spouses and close relatives too. Internal-control requirements, paragraph 32. In addition to ordinary due diligence, a financial-monitoring entity must:

1. Check whether the customer, representative, or beneficial owner is or is connected to a PEP, the PEP’s spouse, or close relatives.

2. Assess the PEP’s reputation regarding involvement in money laundering, terrorist financing, and financing the proliferation of weapons of mass destruction.

3. Obtain written permission from a senior manager to start or continue relationships with such customers.

4. Take available measures to establish the source of the customer’s, representative’s, or beneficial owner’s money and/or other property.

5. Apply enhanced due diligence to customers, representatives, and beneficial owners on an ongoing basis.

Paragraph 1 does not make these additional duties conditional on first assigning high risk. Paragraph 2 concerns PEPs on a list approved by Kazakhstan’s President, their spouses, and close relatives who have been assigned a high risk level. The same five measures apply to them with that condition. Paragraph 3 excludes the categories in definition paragraphs six through eight from the presidential list.

For banks, the internal-control requirements, approved by ARDFM Board Resolution No. 18 of 22 March 2020, explain the check in paragraph 32: it is made when identifying a customer and determining the beneficial owner. They describe Kazakhstani categories by definition paragraphs two through five and also link enhanced measures to high risk. That wording does not cancel the law’s reference to the presidential list.

Paragraph 17 of the requirements treats PEPs, spouses, and close relatives as customer types that increase risk. It should not be read as “every PEP has already been assigned high risk.” The bank needs an assessment and documented decision under its rules. Checks continue after onboarding: paragraph 25, subparagraph 4, expressly covers existing customers, while article 5, paragraph 3, requires ongoing review of the relationship and updated information.

Twelve months: whose rule is it?

Article 8, paragraph 4, continues the provisions of paragraph 2 for a PEP on the President’s list, their spouse, and close relatives for twelve months from the end of the PEP’s authority. This is a period for a specific regime, not a universal rule for deleting a record from every PEP database. Article 8, paragraphs 2 and 4.

Article 8 gives no equivalent period for foreign categories or leaders of international organizations. That implies neither automatic removal of risk after a year nor perpetual application of every measure to every former official. Current risk and ordinary due-diligence duties must be assessed separately under article 5.

The international approach explains why a database setting may differ from this Kazakhstani period. Paragraphs 44–45 of the 2013 FATF PEP guidance recommend assessing residual influence and risk after someone leaves office. This is guidance, not an independent Kazakhstani rule. Removing a person from internal checks merely because a commercial record expires would substitute a provider setting for legal and risk analysis.

Close relatives under the code, not intuition

Article 8 names spouses and close relatives separately. Article 1, paragraph 1, subparagraph 13, of the Marriage and Family Code defines close relatives as parents, children, adoptive parents and adopted children, full and half siblings, grandparents, and grandchildren. Article 8 names a spouse separately from this list.

A parent-in-law, son-in-law, nephew, or business partner does not become a close relative under that definition. Being outside the list does not remove ordinary due diligence: the person could have their own PEP status, be a beneficial owner, or present other risk factors. A case file should distinguish “close relative” from other grounds for a check.

FATF Recommendation 12 uses “family members” and “close associates.” Those terms cannot simply be inserted into Kazakhstan’s statute. In paragraph 1461 of the 2023 mutual evaluation of Kazakhstan, assessors noted coverage of spouses and close relatives and a gap concerning close associates; they identified a separate regime for AIFC financial organizations. This article concerns bank procedures under national law, not AIFC rules.

The wording “belonging and/or involvement” in article 8, paragraph 1, subparagraph 1, does not allow a bank to declare every acquaintance of a PEP a close relative. If it considers further connections as risk factors, the basis should be recorded separately. A disputed individual case calls for compliance and legal assessment.

Where does a bank get information if it has no list?

Kazakhstan’s official list of public officials and a commercial PEP database serve different purposes. Under article 16, subparagraph 13-7, of the AML/CFT Law, the authorized body maintains a list of people on the presidential list, their spouses, and close relatives. Article 18, paragraph 7, requires government and quasi-public bodies to provide the prescribed details within three working days of such a PEP’s election or appointment.

Official list. Paragraph 787 of the EAG’s 2023 report describes the national PEP list as available in regulated entities’ accounts on the Financial Monitoring Agency (FMA) site. The assessors also wrote about connected persons on the list. This describes the situation at the evaluation date, not the current contents or portal interface. An arbitrary internet list of names cannot replace the official source. A bank should clarify current access through its official FMA channel.

Questionnaire and documents. A customer’s answer can reveal offices and relationships absent from a commercial database, but it needs checking. Paragraph 25 of the banking requirements covers document validity, information accuracy, and updating the case file. A “no” on the form does not make a screening hit irrelevant, while a “yes” does not settle the person’s identity.

Commercial PEP database and open sources. These help search for domestic and foreign functions, name variations, and relationships. Check the particular provider’s coverage: categories, source of information, date of update, and handling of former officials. “PEP” in a sales description does not prove access to the FMA’s official list or complete reproduction of it.

Paragraph 61 of FATF’s guidance says that use of commercial databases is neither required by its recommendations nor sufficient for compliance with Recommendation 12. That captures the tool’s limit: a useful search is not the whole procedure. Guidance, section V.D.

Name variants and transliteration make matching harder. A similar record should prompt comparison of other identifiers, not an accusation or automatic assignment of status. If the source lacks enough identifiers, the result remains unresolved until more information is obtained.

The cost of errors in both directions

Compliance teaching scenario. A search finds a person with the applicant’s name. The record shows public office but a different date of birth. Assigning status without review conflates two people. Ignoring the hit solely because the applicant ticked “no” would miss a signal. The useful outcome is to determine whom the record concerns and retain the reason for the decision; conflicting data call for clarification.

Conversely, a search may find nothing while an applicant discloses a senior public function. “Clear” means only that no match was found within the database’s sources and search settings. The bank still checks the office, identifies the category, and applies the relevant regime. In both cases, the decision rests on facts about the person, not one interface flag.

The Wolfsberg Group’s 2017 PEP guidance associates overbroad databases and undifferentiated enhanced checks with a weakened risk-based approach. That professional view does not waive article 8. Manual review separates a real office and relationship from a similar name, allowing the bank to apply the regime for the established category.

FATF’s perspective

In the June 2026 FATF standards, Recommendation 12 distinguishes foreign PEPs from domestic PEPs and persons with prominent functions in an international organization. For the latter group, additional measures relate to higher-risk relationships. Kazakhstan’s article 8 puts leaders of the specified international organizations in paragraph 1. A standard international form or PEP-service setting therefore needs to be checked against the national provision.

Kazakhstan’s 2023 mutual evaluation rated Recommendation 12 “largely compliant.” That describes technical compliance of the system at the assessment date, not an individual bank. In the first 2026 follow-up report, the Recommendation 12 rating remained LC. Neither a rating nor FATF guidance replaces the applicable Kazakhstani act.

Remote onboarding has limits

Article 5, paragraph 9, subparagraph 3, of the law prohibits establishing a relationship remotely with a customer assigned a risk level requiring enhanced measures under paragraph 7 and the organization’s internal-control rules. Its exception concerns electronic insurance contracts for which premiums and/or payouts pass through bank accounts. It is not a general exception for opening a bank account.

PEP status alone does not dictate one channel decision. The bank must establish the category, assess risk, and apply the other requirements for the chosen scenario. High-quality biometrics or no hit in a commercial database cannot override the prohibition where its conditions are met. An in-person visit, conversely, does not automatically approve service.

A practical checkpoint is to determine status and risk before starting a remote relationship. If information about the office emerges later, the bank reassesses the case under general due-diligence rules. That fact alone does not prove the initial remote account opening broke the law.

What list screening cannot check

Screening compares supplied data with sources. It does not itself establish that the document and name belong to the person before the camera. Remote identity verification and a search for public function complement each other. An impersonated presenter or altered document may distort the input; a positive result in one control does not validate the other.

Kazakhstan’s regulator separately sets requirements for biometric authentication. Paragraphs 7–8 of the rules approved by ARDFM Resolution No. 54 of 3 April 2026 address software protection and image-authenticity checks. These are a distinct control, not a way to recognize PEPs by their face. The applicable regime, commands, and settings must be checked against the rules and implementation, rather than a module name such as “liveness.”

Customer identification, beneficial-owner identification, and PEP-status assessment also differ. A company may have a PEP among its beneficial owners; checking the legal entity’s name alone misses that question. Article 8 therefore names the customer, representative, and beneficial owner separately.

What our module covers

Biometric.Vision’s AML-screening page describes checks against sanctions lists, PEP data, and local stop lists; transliteration handling; match ranking; and referral of disputed hits for manual review. Screening can form part of a broader eKYC request. The page also describes ongoing monitoring and alerts for new matches. These are the vendor’s published capabilities at the date checked, not results of independent testing.

A public description of local stop lists does not establish that the module can access a restricted FMA portal. That integration cannot be assumed without documented checks of configuration and sources. Deciding whether a record belongs to the customer, which PEP category applies, how much risk is present, which measures are needed, and which channel is permissible remains the bank’s responsibility. An API response is neither a legal opinion nor regulatory permission.

What to check in your own process

Start with one reviewed customer record. Can it show the office and dates, information source, basis of the relationship, resolution of any hit, and chosen article 8 regime? If it holds only a PEP flag, the next task is to reconstruct the reason for the decision, not add another list merely to increase the number of checks.

Then check two branches: is the high-risk condition applied to the paragraph 2 group, and has that group’s twelve-month period been turned into automatic deletion of every former PEP? Finally, compare the timing of the remote-channel decision with article 5, paragraph 9. These are process checkpoints, not instructions to refuse a particular person.

When selecting a technical system, use the AML-screening description to request the source list, an example match result, and the handoff procedure for staff. Those materials help establish which part of the process the service covers and what decisions the bank must still document.

Originally published in Russian. Adapted for English readers.

This article is for information only and does not replace advice from a qualified lawyer.