Kazakhstan: technology regulation at a glance

Framework: Law of the Republic of Kazakhstan No. 193-VII 'On Digital Assets in the Republic of Kazakhstan' (in force 1 April 2023; comprehensively amended effective 1 May 2026), applied on a dual track by (i) the National Bank of Kazakhstan (NBK) on the mainland and (ii) the Astana Financial Services Authority (AFSA) inside the Astana International Financial Centre (AIFC), whose AFSA Rulebook on Digital Asset Activities has been in force since 1 January 2024.

Kazakhstan operates a comprehensive, in-force digital-assets regime under Law No. 193-VII, which distinguishes 'unsecured digital assets' (cryptoassets) from 'digital financial assets' (DFAs, including money-backed stablecoins and tokenised assets). A major 2026 tranche of amendments came into force on 1 May 2026, extending licensing of unsecured-crypto exchange operators and registration of trading-platform / DFA-platform operators from the AIFC bubble to the whole country under NBK supervision. Presidential Decree of 7 July 2026 layered on tax incentives for regulated crypto activity, a stablecoin cross-border-payments track and further liberalisation of mining, cementing the country's 'regulated crypto hub' stance.

Framework: Law No. 230-VIII of the Republic of Kazakhstan 'On Artificial Intelligence' (signed 17 November 2025, in force 18 January 2026), supported by the Concept for AI Development 2024-2029 and the Ministry of Artificial Intelligence and Digital Development

Kazakhstan enacted its first standalone AI law on 17 November 2025, establishing a risk-based regulatory framework covering development, deployment, and prohibited uses of AI systems, which entered into force on 18 January 2026. The law is complemented by the government-approved AI Development Concept 2024-2029 (adopted July 2024) and the forthcoming Digital Code (effective 11 July 2026). Oversight is vested in the dedicated Ministry of Artificial Intelligence and Digital Development, led by Deputy Prime Minister Zhaslan Madiyev.

Framework: Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 'On Personal Data and Its Protection' (as amended through Law No. 211-VIII of 16 July 2025); supervised by the Ministry of Digital Development, Innovations and Aerospace Industry

Kazakhstan has a standalone comprehensive personal data protection law in force since 2013, substantially amended in 2021, 2022, 2024, and 2025. The 2024 amendments (Law No. 44-VIII ZRK of 11 December 2023, in force 11 February 2024) introduced mandatory breach notification, a prohibition on collecting physical copies of identity documents, and empowered ministerial unscheduled inspections. A parallel, GDPR-aligned regime applies separately within the Astana International Financial Centre (AIFC).

Framework: Law No. 11-VI 'On Payments and Payment Systems' (26 July 2016, as amended); Law 'On Banks and Banking Activities' (adopted 25 December 2025, pending presidential signature); regulator: National Bank of Kazakhstan (NBK) for the national market; Astana Financial Services Authority (AFSA) within the Astana International Financial Centre (AIFC)

Kazakhstan operates a mature, dual-track licensing and registration regime for digital payments and fintech. The National Bank of Kazakhstan registers and supervises payment organisations under the 2016 Payments Law, which was overhauled in December 2025 with a sweeping new Banking Law introducing proportional licensing, a digital tenge (CBDC) legal foundation, and enhanced consumer protection. In parallel, the AIFC/AFSA provides a separate, internationally oriented licensing framework for fintech firms, including a phased Money Services framework that entered force in October 2025 and January 2026.

Framework: Kazakhstan Ministry of Foreign Affairs / Ministry of Digital Development, amended Visa Classification under the Law on Migration of Population; programs administered via egov.kz and Astana Hub portal (2025)

Kazakhstan introduced two dedicated remote-worker pathways in early 2025: the B9-1 Digital Nomad Residency (a 10-year residence permit for IT professionals, no minimum income required, launched as a pilot in March 2025) and the B12-1 Neo Nomad Visa (a 1-year multiple-entry visa for remote workers earning ≥ USD 3,000/month, extendable up to 4 years). A separate Golden Visa (investor visa) requiring a USD 300,000 investment was launched in May 2025. The programmes are operational and have attracted applicants from over 20 countries.

Framework: Law on Online Platforms and Online Advertising (No. 18-VIII, 2023); Law on Communications; Ministry of Digital Development and Ministry of Culture and Information as primary regulators

Kazakhstan operates a heavily restricted internet environment underpinned by the 2023 Law on Online Platforms, which compels major platforms to appoint local representatives and remove government-designated content on demand or face blocking. The state routinely censors websites, conducts deep-packet inspection (DPI) and TLS man-in-the-middle (MITM) attacks to block media and circumvention tools, and prosecutes individuals for online speech. Freedom House rated Kazakhstan 'Not Free' with a Freedom on the Net score of 4/100 in 2025.

Framework: Law on Informatization No. 418-V ZRK (24 November 2015); Law on Personal Data and its Protection No. 94-V (21 May 2013, as amended); Law No. 44-VIII ZRK on Amendments to Legislative Acts on Information Security, Informatization and Digital Assets (11 December 2023, effective 11 February 2024 / 1 July 2024); Concept for Digital Transformation, ICT Development and Cybersecurity 2023-2029 (Government Resolution No. 269, 28 March 2023); supervised by the Committee for Information Security, Ministry of Digital Development, Innovations and Aerospace Industry (MDDI), and KZ-CERT / National Coordination Centre for Information Security (NCCIS)

Kazakhstan operates a comprehensive, cross-sectoral cybersecurity regime anchored in the 2015 Law on Informatization, which obliges all operators of information systems to implement information-security measures, undergo audits, and report incidents. The December 2023 omnibus amendments (Law No. 44-VIII) materially tightened obligations, introducing a statutory definition of a personal-data security breach, a one-business-day breach-notification duty to the MDDI, and expanded state-oversight powers. The overarching strategic framework is the Cyber Shield of Kazakhstan concept (first adopted 2017, updated 2022) now embedded in the 2023-2029 Cybersecurity Development Concept.

Framework: Entrepreneurial Code of the Republic of Kazakhstan (No. 375-V, 2015, as amended); Law on State Registration of Legal Entities, Branches and Representative Offices (No. 562-IV, 2012); Law on Investments (No. 373-II, 2003, as amended)

Kazakhstan permits 100% foreign ownership in the vast majority of sectors, with company formation (typically an LLP) completable online via egov.kz in as little as one business day. Sector-specific caps apply in media, certain telecommunications, air transport, and strategic subsoil resources, but outside these areas the process is transparent and investor-friendly. A January 2026 reform replaced earlier priority/special investment project mechanisms with new contractual investment incentive forms.