AML compliance in Kazakhstan for foreign companies: obligations and risks

AML compliance in Kazakhstan for foreign companies rests on one law: Law No. 191-IV of 28 August 2009 on counteracting the legalization (laundering) of criminal proceeds, the financing of terrorism and the financing of proliferation of weapons of mass destruction (the AML/CFT Law). If your Kazakhstan entity falls within the list of "subjects of financial monitoring", it must identify clients and their beneficial owners, adopt internal control rules, appoint a responsible officer, report certain transactions to the Financial Monitoring Agency, and freeze assets of listed persons. If it does not fall within the list, it still meets AML requirements indirectly, through its bank, and a documented policy makes that relationship far easier.

This article explains who is covered, what the obligations are in practice, what happens when they are ignored, and how a foreign-owned LLP or an AIFC company builds a working programme.

Who is a subject of financial monitoring

Article 3 of the AML/CFT Law lists the entities that carry direct obligations. The list is broader than many foreign groups expect. Beyond banks, insurers, securities firms and payment organizations, it includes:

• lawyers, legal consultants and other independent legal specialists, when they act for a client in real estate transactions, manage client money or accounts, or set up and manage companies;
• accounting organizations, professional accountants in business and audit firms;
• dealers in precious metals, precious stones and jewelry;
• real estate intermediaries;
• lessors operating without a license, microfinance organizations, pawnshops, gambling and lottery operators;
• mobile operators and operators dealing in unsecured digital assets;
• participants of the Astana International Financial Centre (AIFC) carrying out activities determined by the Astana Financial Services Authority (AFSA) in agreement with the state authorized body, following FATF recommendations.

Two practical conclusions follow. First, an ordinary trading or manufacturing LLP is usually not a subject of financial monitoring, even if it is foreign-owned. Second, a consulting, accounting, legal, real estate, fintech or corporate-services business very often is, and ownership by a foreign group does not change that.

The state authorized body is the Financial Monitoring Agency of the Republic of Kazakhstan (AFM), which reports directly to the President. Subjects of financial monitoring register in the AFM's online cabinet for subjects of financial monitoring and use it for reporting and for receiving risk assessments and requests.

Core obligations under the AML/CFT Law

Customer due diligence (KYC/CDD)

Article 5 requires due diligence of clients, their representatives and beneficial owners when a business relationship is established, when a transaction is carried out (including a suspicious one), and whenever there is doubt about information obtained earlier. The minimum content is fixed by law:

• for an individual: individual identification number (IIN), identity document details and address;
• for a legal entity: state registration details, business identification number (BIN), nature of activity and registered address;
• for foreign structures without legal personality (trusts and similar): name, registration number, place of business, and the founders and beneficiaries;
• for every client: identification of the beneficial owner, defined as an individual who directly or indirectly holds more than 25 percent of the capital, controls the client in another way, or in whose interest the transactions are made.

Where identification is impossible, Article 13 obliges the entity to refuse the relationship or the transaction. Enhanced measures apply to public officials, to non-face-to-face relationships and to higher-risk clients.

Internal control rules and a responsible officer

Article 11 requires each subject of financial monitoring to adopt internal control rules and programmes, approved by its management body, and to take responsibility for implementing them. The rules must contain at least:

• a programme for organizing internal control, including the appointment of a responsible person from senior management, not below the head of a structural unit, with an impeccable business reputation;
• a risk management programme classifying clients and services by risk level;
• a client identification programme;
• a programme for monitoring and studying client transactions, including complex and unusually large ones;
• a training programme for staff.

The rules are not a template to file and forget. The AFM's risk assessment of the entity's products and services must be reflected in them, and the document must match the size and complexity of the business.

Reporting to the AFM

Under Article 4, certain categories of transactions at or above statutory thresholds are subject to financial monitoring regardless of suspicion, and any suspicious transaction is reportable regardless of amount. Article 10 requires reports to be filed electronically through dedicated channels, in Kazakh or Russian. For threshold transactions the report is due no later than the working day following the day of the transaction; for suspicious transactions and for transactions matching published typologies the law sets its own short time limits. The AFM also sends requests through the cabinet, and responses have deadlines.

Targeted financial sanctions

Articles 12 and 12-1 establish two national lists: organizations and persons connected with the financing of terrorism and extremism, and those connected with financing the proliferation of weapons of mass destruction. Both are published on the AFM website. Under Article 13, within 24 hours of a listing being published the entity must freeze the listed person's transactions and report. Screening against these lists is therefore not optional for a subject of financial monitoring, and it is separate from commercial sanctions screening, which we cover in a dedicated article.

What non-compliance costs

Article 214 of the Code of Administrative Offences sets fines for subjects of financial monitoring, graded by the size of the business. Record-keeping failures, late or missing reports, false information and failure to answer AFM requests each carry their own range, from tens of monthly calculation indices (MCI) for small businesses to several hundred MCI for large ones. Repeat violations carry heavier penalties, and for licensed activities supervisory consequences follow separately.

In practice the more painful consequence is often not the fine. A bank that receives a poor answer to an AML inquiry may hold a payment, close the account or refuse to open one. For a foreign-owned company that depends on cross-border settlements, an account freeze stops the business.

How a foreign-owned company sets this up

Step 1. Classify the entity

Check Article 3 against the actual activities of the Kazakhstan entity, not the group's global business line. A holding LLP that only owns shares is treated differently from an LLP that provides accounting services to third parties. If the answer is "not a subject", document the analysis: banks and auditors ask for it.

Step 2. Register with the AFM and adopt the rules

A subject of financial monitoring registers in the AFM cabinet, adopts internal control rules by a decision of its management body, appoints the responsible officer and documents that person's qualifications. The rules are drafted in Kazakh or Russian; a parallel English version for the group is useful but is not the official text.

Step 3. Build the client file

Design the onboarding questionnaire so that it collects everything Article 5 requires and the evidence behind it: registration extracts, ownership charts down to the individual beneficial owner, identity documents, source of funds where the risk level requires it. The register of beneficial owners introduced by Article 6-1 of the law is a useful cross-check for Kazakhstan counterparties.

Step 4. Screen and monitor

Set the screening routine: AFM lists at onboarding and on each list update, plus any commercial sanctions lists the group applies. Define what "unusual" means for your business and who reviews flagged transactions.

Step 5. Train and test

The law requires a training programme. In practice the AFM and banks look for evidence: attendance records, test results, dates. An annual review of the rules against legislative changes closes the loop.

AIFC companies: two layers

An AIFC participant lives under two regimes at once. The Kazakhstan AML/CFT Law applies to it as a subject of financial monitoring where AFSA has designated its activity, and the AIFC Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Rules apply as AFSA's own rulebook. AFSA's published guidance states that Relevant Persons file suspicious and threshold transaction reports with the Kazakhstan financial intelligence unit through its portal and submit an annual AML return to AFSA within two months after the end of each year.

The AIFC registration application already asks whether the company will carry out designated non-financial activities (real estate, precious metals, high-value goods, company services). If the answer is yes, the applicant names a Money Laundering Reporting Officer with relevant experience and uploads AML policies before registration is complete. For licensed financial firms the compliance function is assessed at the authorization stage.

Item	LLP under Kazakhstan law	AIFC participant
Governing rules	AML/CFT Law No. 191-IV	AML/CFT Law (where designated) plus AIFC AML Rules
Regulator	AFM; sector supervisors	AFM and AFSA
Responsible officer	Person from senior management under Art. 11	MLRO under AIFC AML Rules
Reporting	AFM cabinet	FIU portal plus annual AML return to AFSA
When set up	On becoming a subject of financial monitoring	At registration or licensing stage

Questions and answers

Our LLP is 100 percent foreign-owned and trades goods. Are we a subject of financial monitoring?
Usually not, unless the goods are precious metals, stones or jewelry, or the company also provides services from the Article 3 list. You will still face bank KYC on every account opening and on larger payments, so a short internal policy and a clean ownership file are worth having.

Who can be the responsible officer?
The law requires a person from senior management, not below the head of a structural unit, with an impeccable business reputation. The position can be combined with other duties in a small company, but the appointment must be documented and the person must actually perform the function.

Can we use the group's global AML policy?
As a basis, yes. As the official document, no. The internal control rules must reflect the Kazakhstan law's structure, the AFM's risk assessment of your products, the national lists and the reporting deadlines. We usually keep the group policy as a parent document and adopt Kazakhstan rules underneath it.

What does the bank want when it asks for our "compliance policy"?
Typically the internal control rules or an equivalent policy, the ownership structure with identified beneficial owners, and, for specific payments, contracts and documents showing the economic purpose. A prepared answer within the bank's deadline usually releases the payment; silence usually does not.

How long does it take to build a basic programme?
For a company with a clear business model, a basic document package and team training take from a few weeks. The exact timeline depends on the line of business and on whether AFSA licensing is involved, and is confirmed after a rapid diagnostic.

How SHANYRAQ Legal can help

Our compliance services cover the full cycle: a rapid diagnostic of which requirements apply to your entity, turnkey internal AML/CFT control rules and KYC procedures aligned with Kazakhstan law and, for AIFC participants, with AFSA rules; counterparty due diligence with a clear conclusion; screening set-up; hands-on staff training in Russian and English; and support when a bank or the AFM asks questions. Corporate structuring and ownership documentation are handled by our corporate law team. Document lists for onboarding are available in our document checklists.

Current as of 28.09.2026. This material is for general information; requirements and fees are set by the competent authorities and are confirmed on the date of engagement.