Olzhas Kizatov, deputy chair of the Agency for Regulation and Development of the Financial Market of the Republic of Kazakhstan, outlined the risk management and internal control requirements introduced for microfinance organizations from Jan. 1, 2026. The framework moves the sector from targeted controls addressing overborrowing and fraud toward comprehensive risk management as its loan portfolio has grown 3.5 times in five years to KZT 1.5 trillion. Supervisory experience had found uneven risk controls, insufficiently documented procedures and template approaches that were not always integrated into decision-making. Microfinance organizations must align risk management with their strategy, establish internal policies and formal procedures, conduct annual self-assessments and implement management reporting and a three-lines-of-defense structure. The framework focuses on credit, operational and compliance risks while requiring each organization to identify other material exposures arising from its business model. Proportionality allows limited liability companies more flexibility in organizing risk management, compliance and internal audit functions, while joint stock companies must maintain separate units. Organizations whose issued securities and attracted borrowings represented at least 10% of total liabilities at the start of 2026 have been required to comply since July 1, 2026, with the requirements applying to other microfinance organizations from Jan. 1, 2027.

Original source