Kazakhstan KZ

Kazakhstan sits outside the EU AML Package's direct perimeter: it is an autonomous, non-EEA jurisdiction, so the AML Regulation (Reg (EU) 2024/1624), the sixth AML Directive, and the AMLA Regulation (Reg (EU) 2024/1620) establishing the Anti-Money Laundering Authority do not apply to it and no 6AMLD transposition tracking is applicable here. Globally, the EU AML Package sets the structural direction for beneficial-ownership transparency and the shift from purely national supervision toward a hybrid EU-level regime under AMLA's direct and indirect supervision; in Kazakhstan, the directly relevant developments this cycle sit elsewhere, in domestic data-infrastructure reform and in the country's own standing mutual-evaluation record.

The most directly relevant development this cycle is the Personal Data Law amendments under Law No. 326-VIII, signed 24 June 2026, which create a register of entities processing personal data and a separate personal-data-breach register, both effective 25 August 2026, together with a risk-based classification of controllers into small, medium and large categories. This is not a beneficial-ownership registry in the FATF Recommendation 24 sense — it does not identify or register the natural persons who ultimately own or control legal entities — but it builds adjacent data-transparency and recordkeeping infrastructure that obliged entities may draw on for KYC and customer due-diligence purposes.

That adjacency matters because of a standing gap identified in Kazakhstan's 2023 EAG Mutual Evaluation Report. The evaluation found Kazakhstan compliant or largely compliant on 33 of 40 FATF Recommendations overall, with substantial effectiveness in risk understanding and in the Financial Intelligence Unit's use of financial intelligence, but it specifically flagged shortcomings in the identification of beneficial owners in the context of transactions carried out by natural persons, and in domestic PEP identification. The new Personal Data Law registers, however useful for general data governance, do not on their own close this natural-person beneficial-ownership identification gap; they sit adjacent to it rather than resolving it.

No development directly reforming Kazakhstan's corporate beneficial-ownership registration regime — as distinct from personal-data registers — was evidenced this cycle. The structural gap identified in 2023 therefore remains the operative baseline against which any future BO-registry reform in Kazakhstan should be measured.

Outlook

Watch for whether Kazakhstan's own AML/CFT reform track, running under Government Resolution No. 934's 2025-2027 action plan, produces any discrete beneficial-ownership-registry measure addressing the natural-person identification gap the 2023 EAG evaluation flagged. No such measure has been evidenced to date. Globally, the AMLA direct/indirect supervision perimeter continues to develop under the EU AML Package, but as a non-EEA jurisdiction Kazakhstan sits outside that perimeter and any future EU-level development there would only be indirectly relevant to Kazakhstan's own regime.

Kazakhstan's own crypto-regulatory perimeter changed materially this cycle. On 1 May 2026, a comprehensive national regulatory framework governing digital-asset circulation entered force under the Law 'On Digital Assets in the Republic of Kazakhstan.' The National Bank of Kazakhstan now licenses unsecured-digital-asset exchange operators and registers digital-financial-asset (DFA) and trading-platform operators that sit outside the Astana International Financial Centre. This is a confirmed, primary-sourced development directly from the National Bank's own publication, and it represents the most significant single change to Kazakhstan's digital-asset supervisory architecture in this cycle, extending formal AML/CFT-relevant oversight to a segment of the market that had previously operated under the AIFC's separate regime alone or without any registered supervisory touchpoint.

This new national licensing framework sits inside, and is reinforced by, a broader coordinated AML/CFT effort. Government Resolution No. 934 adopts a 44-initiative action plan for 2025-2027 spanning banking, digital assets, foreign trade, real estate and gaming. Among its digital-asset-specific measures, the resolution mandates a sectoral AIFC digital-asset risk assessment, establishment of a national register of high-risk crypto wallets by the end of 2026, and the blocking of unlicensed VASP mobile applications. This is reported with probable rather than confirmed confidence, resting on vendor/compliance commentary rather than the primary resolution text, but it describes a coherent programme of work rather than an isolated measure, and it is consistent with the direction the National Bank's own May 2026 licensing action already signalled.

Together, these two developments indicate that Kazakhstan's digital-asset AML/CFT architecture is moving from a partial, AIFC-centric footprint toward a genuinely national supervisory perimeter, with specific forthcoming deliverables — the high-risk-wallet register, the AIFC risk assessment, and VASP app-blocking — that will test whether the expanded licensing perimeter translates into operational AML/CFT capability rather than remaining a licensing exercise alone.

Outlook

The national high-risk crypto-wallet register, due under Resolution 934 by the end of 2026, is the most concrete near-term deliverable to watch: it would be the first operational AML/CFT tool built specifically for Kazakhstan's newly-licensed digital-asset exchange sector. The sectoral AIFC digital-asset risk assessment mandated by the same resolution, expected around Q4 2026, should also clarify how the national NBK regime and the AIFC's own regime are intended to interact from an AML/CFT risk-assessment perspective. Primary retrieval of Resolution 934's full text remains a gap and would sharpen confidence in the specific commitments described here.