Listen to the article
Kazakhstan will require all commercial banks and other financial institutions to undergo cybersecurity readiness assessments at least once a year under rules approved by the Agency for Regulation and Development of the Financial Market on 30 October 2026. The agency announced the requirement on 6 November, with full inclusion of all commercial banks planned for 2027.
The assessments go beyond paper reviews. Banks will be required to test how staff actually respond when an attack occurs, and regulators will run simulated cyberattacks against systems including mobile banking platforms, payment services and customer databases. All tests will take place in controlled environments to avoid disrupting customers during the exercises.
Regulators will measure how quickly institutions detect an intrusion and how long recovery takes. Any weaknesses uncovered must be remediated, and follow-up checks will verify that the fixes hold. The framework therefore creates a recurring cycle of testing, repair and re-examination rather than a one-off compliance exercise.
The agency said three banks that participated in pilot drills had already demonstrated a core capability: all three successfully restored systems from backups after simulated ransomware attacks in which data was encrypted. Ransomware — malware that locks or encrypts files and demands payment for their release — has disrupted financial institutions and critical infrastructure in multiple countries in recent years, making backup integrity a central concern for regulators globally.
Fraud cases falling, but cross-border crime draws UN proposal
The new rules arrive against a backdrop of declining but still substantial online fraud. Kazakhstan’s Ministry of Internal Affairs recorded approximately 15,000 cases of online fraud in the first nine months of 2026, down from roughly 19,000 over the same period a year earlier — a reduction of about a fifth.
Interior Minister Yerzhan Sadenov has proposed establishing a regional centre of the United Nations Office on Drugs and Crime in Astana to address cybercrime that crosses national borders. According to the minister, the centre would support cooperation among countries on cross-border investigations and help trace stolen funds. No timeline or formal commitment to the proposal was announced alongside the cybersecurity rules.