Financial organisations of Kazakhstan have been obliged to assess the state of cybersecurity at least once a year. The checks will cover internet banking systems, payment services and client databases. In 2027, cyber exercises are planned to cover all second-tier banks.
WHAT CHECKS ARE ENVISAGED
According to the Agency for Regulation and Development of the Financial Market (ARDFM), the new rules were approved by resolution No. 151 of 30 October 2026.
The document envisages three types of cybersecurity checks:
- Documentary — examination of internal instructions, plans and information protection procedures.
- Functional — checking employees' readiness for cyber incidents and interaction in crisis situations.
- Technical — modelling cyber attacks to assess the ability to detect threats, respond to them and restore system operation.
The checks will take place in four stages: planning, preparation, conduct and analysis of results. Technical tests will be organised in a controlled test environment so as not to disrupt the operation of existing banking services.
THREE BANKS UNDERWENT A CYBER ATTACK TEST
The ARDFM has already conducted pilot cyber exercises with the participation of three second-tier banks.
Specialists simulated damage to a critical system by ransomware. After that, the banks had to restore its operation from backups on a test bench.
All three banks successfully coped with the task. The regulator confirmed the operability of the restored systems and the achievement of the established recovery indicators.
CYBER EXERCISES WILL BECOME ANNUAL
According to the new rules, financial organisations are obliged to assess the state of cybersecurity at least once per calendar year.
The checks will take into account the speed of detecting cyber incidents, the time taken to restore systems, the actions of employees and the timeliness of notifying management and the regulator.
In 2027, the ARDFM intends to cover all second-tier banks with cyber exercises.
HOW THE REMEDIATION OF VIOLATIONS WILL BE MONITORED
After the checks, financial organisations must submit reports to the regulator on the deficiencies identified, the results of their response and the deadlines for remedying the problems.
The ARDFM will be able to participate in the activities as an observer or co-organiser. The effectiveness of the measures taken will need to be confirmed by repeat checks.
The regulator emphasises that the main goal of cyber exercises is not to apply sanctions for mistakes in simulated situations, but to identify vulnerabilities and increase the readiness of financial organisations for real cyber attacks.
