Kazakhstan’s Agency for Regulation and Development of the Financial Market adopts annual cybersecurity assessment rules for financial institutions

Kazakhstan’s Agency for Regulation and Development of the Financial Market has adopted rules requiring financial institutions to assess their cybersecurity and incident response readiness at least once each calendar year. The framework follows previously outlined plans for supervisory cyber exercises and establishes procedures for identifying weaknesses, implementing corrective measures and verifying their effectiveness. The rules provide for documentary reviews of security policies and procedures, functional exercises testing staff readiness and coordination, and technical simulations testing incident detection, response and recovery of critical information assets. Scenarios will reflect current cyber threats, significant technological changes and previous assessment findings. Assessments will examine detection and recovery times, coordination between departments, compliance with response procedures and timely notification of management and the regulator. Technical simulations must take place in a controlled environment separate from live operations, without disrupting operational systems. Financial institutions must submit reports identifying deficiencies, response metrics, corrective measures and implementation deadlines. Follow-up testing must confirm that remediation is effective. In a pilot involving three second-tier banks, all three restored tested systems from backups after a simulated ransomware incident and met recovery targets. Coverage of all second-tier banks is planned for 2027. The agency will use assessment results to identify systemic risks and refine supervision, with exercises focused on improving preparedness rather than imposing sanctions for simulated outcomes.