Start a Licensed Crypto Business in Kazakhstan

How to Start a Licensed Digital Asset Business in Kazakhstan

Kazakhstan runs two parallel regulatory frameworks for crypto businesses: the AIFC/AFSA offshore track and the National Bank’s onshore regime. Choosing the wrong one before investing in structure, capital, or technology is one of the most common and costly mistakes a digital-asset business can make. This guide helps you make that decision correctly.

The choice affects everything from entity structure and capital requirements to licensing procedures, governance, AML/CFT controls, and ongoing compliance obligations. This guide explains how to identify the right route, establish the correct legal entity, apply for authorisation, and build the infrastructure required to operate.

Depending on the activity and operating structure, a business may fall under the Astana International Financial Centre (AIFC) framework, regulated by the Astana Financial Services Authority (AFSA), or Kazakhstan’s national framework, administered by the National Bank of Kazakhstan and other relevant state authorities.

The distinction affects everything from entity structure and capital requirements to licensing procedures, governance, AML/CFT controls and technology obligations.

This guide explains how to choose the right regulatory route, establish a legal entity, apply for authorisation, and build the infrastructure required to operate.

Crypto in Kazakhstan: The Current Regulatory Landscape

Kazakhstan has established a structured regulatory framework for digital assets. The country’s Law on Digital Assets, adopted in 2023, established the initial legal framework for digital-asset activities and introduced a licensing regime for mining. Amendments adopted in January 2026 further expanded the national framework and introduced additional rules for digital-asset activities.

From 1 May 2026, the updated framework distinguishes between unsecured digital assets, such as cryptocurrencies, and digital financial assets (DFAs), including money-backed stablecoins, tokenised real-world assets, and digital representations of traditional financial instruments. The framework also introduced specific categories for digital-asset service providers and expanded the regulated use of unsecured digital assets through providers authorised by the National Bank.

For a business entering the market, the key point is that crypto activity can no longer be assessed as a generic crypto business. The exact service matters. An exchange, trading-platform operator, DFA platform, custodian or other service provider may fall under different requirements.

The first practical decision is identifying the specific service the business will provide and which regulator has jurisdiction over that activity. Operating without the appropriate authorisation can create legal, compliance and reputational risks.

Choosing Where to License: AFSA vs National Track

One of the most important decisions for a digital-asset business in Kazakhstan is choosing the appropriate regulatory route. The two broad frameworks are the AIFC/AFSA regime and the national Kazakhstan regime.

The AIFC provides a dedicated financial-services environment in which AFSA authorises firms under the AIFC Rules on Digital Asset Activities. Regulated activities include operating a Digital Asset Trading Facility, providing custody, dealing in investments, arranging custody, advising on Investments and arranging deals in Investments.

The national framework, meanwhile, has been expanded significantly in 2026. The National Bank now identifies digital-asset service providers including operators of digital financial-asset platforms, digital-asset trading platforms and exchanges for unsecured digital assets.

The appropriate route depends on the specific activity and legal structure, not on how the company describes itself.

Note: USD equivalents are indicative and subject to exchange-rate movements.

On the national side, the National Bank confirms a minimum charter capital of KZT 50 million for an unsecured digital-asset exchange operator and requires the operator to be established as a joint-stock company or limited liability partnership.

These figures should be treated as activity-specific regulatory capital requirements, not as a complete estimate of the cost of launching a business.

Step-by-Step: How to Set Up a Licensed Crypto Business in Kazakhstan

Step 1: Determine the business activity and regulatory route

First, clearly define the services the business plans to offer, such as exchange, trading, custody, brokerage, DFA platform or another digital-asset service.

Once you define the activity, determine which regulatory framework applies. This means assessing whether the business falls under the AIFC/AFSA framework or Kazakhstan’s national regulatory regime, and identifying the specific licence, registration or authorisation required.

Do this step before the company invests heavily in technology or corporate structuring. Choosing the wrong regulatory route can affect the entire operating model.

Step 2: Establish the appropriate legal entity

Once the regulatory route is clear, establish the entity required for that framework.

For an AIFC structure, the business will need an appropriate AIFC participant and should consider registered office, substance, management and other applicable requirements.

For the national route, businesses should establish the appropriate Kazakhstan legal entity. For example, the National Bank’s current requirements for an unsecured digital-asset exchange operator specify a joint-stock company or limited liability partnership.

At this stage, founders should also identify shareholders, beneficial owners, directors, and senior management, and determine whether any residency, local-presence, or qualification requirements apply.

Step 3: Prepare the business and governance framework

The regulator will need to understand how the proposed business will operate.

The application and supporting materials should therefore cover the business plan, proposed activities, target customers, revenue model, ownership structure, organisational structure and management arrangements.

The governance framework should also identify responsibility for risk management, compliance, financial controls, technology and operational oversight.

For an AFSA-regulated Digital Asset Trading Facility, the rules require specific appointments: Senior Executive Officer, Finance Officer, Compliance Officer, Risk Manager, Money Laundering Reporting Officer, and a Chief Information Technology Officer responsible for IT operations and security oversight.

Step 4: Meet capital and fit-and-proper requirements

Capital requirements vary significantly by regulatory regime and activity.

A business should identify the applicable minimum before submitting its application and ensure it can demonstrate the required capital in the form and manner required by the regulator.

At the same time, prepare information on beneficial owners, directors and key personnel. Regulators may assess their experience, integrity, financial standing and suitability for the proposed role.

Capital should also be treated as an ongoing requirement, not simply an amount shown once during the application process.

Step 5: Establish AML/CFT and compliance controls

Digital-asset businesses need a compliance framework that matches the risks associated with their activities.Under Kazakhstan’s framework, both AFSA and the National Bank require digital-asset service providers to implement controls including:

• Customer identification and KYC
• Customer due diligence
• AML/CFT procedures
• Sanctions screening
• Transaction monitoring
• Suspicious-activity reporting
• Record keeping
• Risk assessment
• Travel Rule controls where applicable

The National Bank has specifically identified infrastructure, capital, risk management, compliance controls, and AML/CFT/CPF (counter-proliferation financing) as requirements applicable to digital-asset service providers.

These controls should be designed before launch, not added after the platform begins onboarding customers.

Step 6: Establish custody, technology and security infrastructure

The technology stack should reflect the services the business intends to provide.

For a business handling customer assets, this may include wallet infrastructure, private-key management, transaction-signing controls, access management, segregation of duties, and transaction-approval workflows.

Operational resilience is equally important. Businesses should have incident-response procedures, business-continuity plans and disaster-recovery arrangements in place before launch.

For exchanges and trading platforms, the technology environment typically includes matching or transaction engines, blockchain connectivity, monitoring systems, customer-account infrastructure and reporting tools.

Step 7: Submit the application and undergo regulatory review

Once the entity, capital, governance, compliance, and technology arrangements are in place, the business can submit the relevant application or registration materials.

The regulator may review corporate documentation, ownership, capital, governance, policies, systems and controls. Applicants should expect questions or requests for additional information where the regulator requires clarification.

Treat the application as a substantive regulatory process, not a simple administrative filing.

Step 8: Complete operational setup and go live

Authorisation is not the final step. Before launch, the business should complete banking and operational arrangements, integrate its technology systems, test customer onboarding and transaction workflows, establish monitoring and reporting processes and confirm that its activities remain within the scope of the authorisation.

The business can then begin operating in accordance with the permissions granted by the relevant regulator.

Indicative Costs and Timeline

The cost of establishing a licensed digital-asset business in Kazakhstan varies by regulatory route, licence category and business model. Regulatory capital alone ranges from USD 50,000 for Dealing in Investments as Agent to USD 500,000 for custody, with activities falling between these thresholds. National-track requirements are set separately in KZT. These figures cover minimum capital only.

The total cost depends on the regulatory route, licence category, capital requirement, technology model, and business complexity. Regulatory capital is only one component. Legal and regulatory advice, entity formation, compliance staffing, cybersecurity, custody infrastructure, banking arrangements and ongoing operational expenses can add substantially to the overall budget.

The AFSA framework provides specific capital requirements for digital-asset activities, while the National Bank sets capital requirements for national digital-asset service providers.

Entity formation may be completed before the full regulatory process, but licensing can take considerably longer because the regulator must assess the applicant’s business, governance, capital and controls. Licensing timelines depend on the type of authorisation, the regulator, and how prepared the applicant is. Complex applications typically take several months from submission to decision. Entity formation can be completed beforehand and should not be treated as part of the licensing timeline.

How to Verify an Authorised Crypto Company in Kazakhstan?

Before dealing with a digital-asset business, investors, banks and counterparties should verify that the company is authorised for the activity it claims to provide.

For AIFC-regulated firms, AFSA maintains a public register of authorised firms. AFSA maintains a public register of authorised firms at https://publicreg.myafsa.com/, which users should check when confirming whether a firm or individual is authorised.

The National Bank also maintains registers covering national digital-asset service providers, including unsecured digital-asset exchange operators, digital financial-asset platform operators and trading-platform operators.

When conducting due diligence, check:

• The legal name of the company
• Its licence, registration or authorisation status
• The activities for which it is authorised
• The current status of that authorisation
• Whether the services being offered match the authorised activities

This distinction matters. A company being listed in a register does not necessarily mean it is authorised to provide every type of digital-asset service.

What regulations apply to crypto companies after licensing?

Obtaining a licence does not remove a business’s regulatory responsibilities. In many respects, it marks the beginning of the more demanding part of operating a regulated business.

Digital-asset service providers may need to maintain ongoing AML/CFT/CPF controls, conduct transaction monitoring, keep appropriate records and provide regulatory reports. Governance and risk-management arrangements must also remain effective as the business grows.

Technology and cybersecurity controls require continuing attention. A regulated exchange or custodian must treat security as a continuous obligation. Access controls, key management, incident response and business-continuity arrangements require ongoing monitoring and testing, not a one-time implementation.

Businesses handling customer assets may also have additional obligations concerning custody, safeguarding and asset segregation.

Kazakhstan’s framework is continuing to develop. The National Bank’s 2026 framework introduced new digital-financial-asset categories and a broader structure for regulated digital-asset service providers, while the regulator continues to publish implementing rules and requirements.

For operators, this means building regulatory monitoring into the compliance function. The requirements in place when the business obtained its authorisation may not remain the final requirements throughout its operating life.

 How Liminal can help

Obtaining regulatory approval is only one part of launching a digital-asset business. Exchanges, custodians, and other regulated operators also need secure infrastructure to manage wallets, private keys, and on-chain transactions.

Liminal provides institutional custody and wallet infrastructure for digital-asset businesses. Its MPC-based architecture supports private-key management and transaction signing. Transaction governance features include approval workflows, access controls, transaction policies and audit trails.

Multi-chain wallet infrastructure can also support deposits, withdrawals and treasury operations across different networks. Where applicable, compliance integrations can connect wallet operations with KYT, AML screening and Travel Rule workflows.

APIs and enterprise integrations can help connect custody infrastructure with existing treasury, payment and internal systems.

Liminal supports the technology and operational infrastructure that regulated digital-asset businesses need after licensing. It does not replace Kazakhstan’s licensing, registration or regulatory requirements.

Building a Licensed Digital-Asset Business in Kazakhstan

Before setting up a digital-asset business in Kazakhstan, start with one question: what will the business do?

Once the activity is defined, the business can determine whether it belongs within the AIFC/AFSA framework or the national regime. From there, the process involves establishing the appropriate entity, meeting capital and governance requirements, preparing the regulatory application, implementing AML/CFT controls and building the necessary technology and security infrastructure.

The 2026 framework makes this regulatory mapping particularly important because Kazakhstan now has a broader national framework covering unsecured digital assets and digital financial assets, alongside the established AIFC regime.

Settle the regulatory route before building the operating model. Once authorised, the focus shifts to maintaining compliance, protecting customer assets and ensuring that the infrastructure can support secure operations as the business scales.