Custodial wallet / SaaS in Kazakhstan

License Type: Firms typically seek a license for "Providing Digital Asset Custody Services" under the AIFC Digital Asset Business Rules. This falls under the broader category of "Digital Asset Business."

AIFC Digital Asset Business Rules (DABR): Contains specific requirements for firms involved in digital asset activities.

AIFC Conduct of Business Rules (COB): General rules for how firms must conduct business with clients.

AIFC Prudential Rules (PRU): Rules related to capital, risk management, and financial soundness.

AIFC Anti-Money Laundering and Counter-Terrorist Financing Rules (AML): Mandatory for all regulated firms.

Mandatory Segregation: Licensed custodians are required to segregate client digital assets from their own proprietary assets. These assets must be clearly identifiable as client assets.

Trust Accounts/Safeguarding: Assets must be held in a manner that protects clients' interests, typically implying a trust or fiduciary arrangement where client assets are not subject to the custodian's creditors in case of insolvency.

Private Key Management: Detailed policies and procedures for the generation, storage, backup, and recovery of private keys are mandatory. This strongly implies the use of offline (cold) storage for a significant portion of client assets, especially those not actively traded.

Robust Cybersecurity: Firms must implement and maintain robust cybersecurity frameworks to protect client digital assets from theft, loss, or unauthorized access. This includes multi-factor authentication, encryption, and secure network protocols.

Capital Requirements: Licensed firms must meet specific minimum capital requirements (financial resources) based on the nature and scale of their business, as detailed in the Prudential Rules. This serves as a buffer against operational losses.

Regulatory Reference: AIFC Digital Asset Business Rules 2020 (DABR), specifically Part 3 (General Requirements for Digital Asset Business) and other relevant sections detailing specific activities.

AIFC Financial Services Authority (AFSA): The independent regulator of the AIFC, responsible for licensing, supervision, and enforcement of financial services, including virtual asset activities.

License Type: Providing Custodian (Digital Assets) services.

Must be incorporated or established as a legal entity within the AIFC.

Maintain a physical office presence in the AIFC.

Have key personnel (e.g., CEO, Compliance Officer) primarily based in the AIFC.

Custodian (Digital Assets): Typically USD 300,000 (or KZT equivalent).

Adherence to AIFC AML Rules, which are aligned with FATF (Financial Action Task Force) recommendations.

Law of the Republic of Kazakhstan "On Counteracting Legalization (Laundering) of Criminal Proceeds and Financing of Terrorism" (No. 191-IV dated August 28, 2009, as amended): This is the primary AML/CFT law. It designates the Financial Monitoring Agency (FMA) as the competent authority and outlines the obligations of "financial organizations" and other reporting entities (which, under FATF standards, includes VASPs). It requires reporting entities to identify customers, monitor transactions, and report suspicious activities, including those related to terrorism financing and proliferation, which often involves sanctions screening.

Financial Monitoring Agency (FMA): The FMA is Kazakhstan's Financial Intelligence Unit (FIU) and the primary body responsible for enforcing AML/CFT laws, including monitoring compliance with international sanctions.

Compliance: VASPs must screen customers and transactions against the UN Security Council Consolidated List (individuals and entities associated with terrorism and proliferation of weapons of mass destruction, and other sanction programs).

Compliance: VASPs must screen against OFAC's Specially Designated Nationals And Blocked Persons List (SDN List) and other relevant sanctions lists specific to programs (e.g., Russia/Ukraine, Iran, North Korea).

AFM: Kazakhstan clamps down on illegal crypto mining farms (This link provides context on various AFM actions, including illegal crypto-related activities.)

Entity Targeted: Numerous unregistered cryptocurrency mining farms operated by various individuals and organizations across the country. Violation Type: Unlicensed business activity, illegal electricity consumption, tax evasion, sometimes money laundering, and operating outside the legal framework for crypto mining. Outcome: Shut down of operations, seizure of equipment (hundreds of thousands of mining devices), criminal charges against operators, and significant administrative fines. While individual penalty amounts for each entity are not publicly disclosed, the total economic impact and asset seizures were substantial. For instance, in 2022 alone, the AFM reported stopping 51 illegal mining farms and confiscating equipment worth billions of tenge.

Entity Targeted: Operators and websites of unregistered cryptocurrency exchanges and peer-to-peer trading platforms. Violation Type: Unlicensed financial activity, facilitation of illegal financial operations (e.g., fraud, money laundering), violation of financial regulations. Penalty Amount: Not specified as a direct fine in publicly available reports. Outcome: Blocking of website access, criminal charges against individuals involved, seizure of funds (if traceable).

Kazinform: Financial Monitoring Agency blocks 138 websites for illegal online casinos, cryptocurrencies (This article from Jan 2024 highlights ongoing efforts against illegal online platforms, including those related to cryptocurrencies, demonstrating continuous enforcement.)

Entity Targeted: Individuals and organized groups operating pyramid schemes and financial frauds that solicited investments in cryptocurrencies. Violation Type: Financial fraud, creation and promotion of financial pyramids, illegal attraction of funds, money laundering. Penalty Amount: Not specified as a single fine, but involves restitution to victims, asset forfeiture, and criminal sentences (imprisonment).

AFM: Financial Monitoring Agency prevented a financial pyramid scheme using crypto currency (This example from Nov 2022 details a specific case of a pyramid scheme involving cryptocurrency.)