Kazakhstan will require banks to assess their readiness for cyberattacks at least once a year under new rules aimed at limiting disruptions to online banking and payment services. The financial regulator plans to include all commercial banks in the program in 2027.
Kazakhstan’s Agency for Regulation and Development of the Financial Market approved the new rules on October 30, 2026, and announced them on November 6. The requirement also applies to other financial institutions.
The assessments will review banks’ security plans and test how staff respond to an attack. They will include simulated cyberattacks on systems such as mobile banking, payment services, and customer databases. These tests will take place in controlled environments to avoid disrupting customers.
Detection and recovery times will be measured, and any weaknesses identified must be addressed. Follow-up checks will assess whether the fixes are effective.
The agency said all three banks that took part in pilot drills successfully restored systems from backups after simulated ransomware attacks in which data was encrypted.
Separately, Kazakhstan recorded about 15,000 cases of online fraud in the first nine months of 2026, down from about 19,000 over the same period a year earlier, according to the Ministry of Internal Affairs.
Interior Minister Yerzhan Sadenov has proposed opening a regional center of the United Nations Office on Drugs and Crime in Astana to combat cybercrime. The center would help countries cooperate on cross-border investigations and trace stolen funds.
