Short version: buying, holding and selling digital assets as a private individual is not illegal in Kazakhstan. What is regulated sits on the other side of the counter — exchanging money for other people, collecting and paying out on their behalf, taking a spread. That needs a licence, doing it without one is a criminal matter, and people have already received custodial sentences. Most ordinary people who get into trouble did not get there by buying coins. They got there by drifting from "doing this for myself" into "doing this for others".
The line itself, and what sits on either side
Plenty of people have this backwards. They are cautious about buying — small amounts, nothing flashy — and then completely relaxed about posting "got USDT, DM me, we can talk price" in a group chat. The first carries almost no risk. The second is the one that ends badly.
Kazakhstan regulates digital assets the way most countries that have brought crypto inside a financial framework do: it regulates service providers, not holders. You buying USDT with your own money and sitting on it is, legally, not far off you buying a gold bar. The moment you start doing it for someone else — taking their tenge, handing them USDT, keeping a bit in the middle — you stop being a user and become an operator. Operators need a licence.
What makes this line easy to cross is that in real life it has no step in it. It starts with changing a small amount for someone from back home, and them insisting you keep something for the trouble. Then three or four people are asking. Then you notice it pays better than your actual job, so you set up a dedicated account for it. There is no day on which you think "today I started breaking the law", but from the regulator's side you crossed over at some point along that path.
This is not a hypothetical. Kazakhstani media have reported a resident of the Kostanay region being sentenced for unlicensed crypto exchange activity. We have not obtained an original notice or judgment that can be checked item by item, so we do not give a sentence length or money figure. Law enforcement has also publicly described batch actions shutting down illegal platforms and freezing cards. Treat the specifics as reported rather than verified — the point here is narrower: somebody really did cross this line, and really was prosecuted for it.
So read everything below against one question: is what I am doing "for me", or "for other people"?
Three things people say that do not hold up
"As long as I never cash out to a bank card, I'm fine." This conflates two separate things. Keeping funds out of the domestic banking system does make you less visible to domestic bank monitoring. It does not change what your activity is. If you are running an unlicensed exchange business, the settlement rail only affects the odds of being noticed. Treating "hard to spot" as "not a problem" is where a lot of people start.
"I use someone else's account, so it can't be traced to me." Using another person's account for collections makes the situation worse, not better. You keep the original problem and add a second one on top — and the person whose account it is, usually a family member or a friend, is the one who gets contacted first. It can also involve family members in explanations and evidence gathering, putting existing trust under strain.
"The amounts are small." Amount affects severity, not character. And "small" is relative: small per transaction, many transactions, over a long period, adds up to a large cumulative figure — and cumulative turnover is exactly the number that tends to appear in the case file.
What actually changed in May 2026
In one line: rules that used to sit in several different places were pulled into one dedicated law, and it became clear who issues licences, who supervises, and what unlicensed operation counts as. For an ordinary user, the practical change is that "grey area" is no longer a description that holds.
Before this, the picture was split. Inside the Astana International Financial Centre there was one regime, supervised by AFSA, which issues and oversees licences. Outside it things were vaguer — plenty of activity neither clearly permitted nor clearly prohibited. That split gave a lot of people the impression that nobody was watching.
From 1 May 2026 that changed. Digital assets have a systematic legal framework, operating a trading platform requires authorisation, and relevant entities go through registration with the National Bank. In parallel, the crypto payment card work the National Bank has been driving formalises a route between assets held on a licensed exchange and ordinary spending — a route open only to licensed institutions, which is itself a nudge: if you want to do this cleanly, do it where the licences are.
The "CryptoCity" concept at Alatau points the same way. Whatever it ends up looking like, a country setting aside a designated area to trial digital asset use is not the posture of a country trying to ban it. It is the posture of one trying to bring it inside the perimeter. For ordinary users that is usually good news: once the rules are legible, you can at least tell which side of them you are on.
Written in August 2026. Digital asset rules move quickly everywhere, and specific provisions, registration requirements and enforcement practice may already have moved. For anything that matters, work from the current official publication or take advice from a locally qualified lawyer. Nothing here is legal advice.
What "licensed" means and how to check it yourself
A licensed platform is one that holds the relevant authorisation from AFSA and appears in its public register. The only reliable way to establish that is to look the entity up in the register — not to read what the platform says about itself.
This deserves a moment, because it is the easiest place to be misled. Plenty of platforms put "regulated", "fully compliant" or "holds an international licence" on a page. None of those phrases carries any legal weight on its own. "Holds an international licence" might refer to a permission from an unrelated offshore jurisdiction that has nothing to do with digital assets.
Do it the other way round. Open the AFSA public register first, search the entity name, and see whether the record exists and what type of authorisation it covers. The type matters: operating a trading facility and providing custody are different permissions, and a firm may hold only one of them.
One thing that is easy to miss: the AFSA register only covers firms inside the Astana International Financial Centre. Since May 2026, digital asset platforms operating outside the centre are licensed and registered by the National Bank instead, on a separate list. So failing to find a firm in AFSA's register does not by itself prove it is unlicensed — establish which jurisdiction it claims to operate in, then check that side. If it appears on neither list while soliciting local customers, the picture is a good deal clearer.
One local wrinkle worth knowing: Binance in Kazakhstan involves two distinct things — a locally licensed entity holding AFSA authorisation, and the global platform serving users worldwide. They differ in scope, available assets and fiat rails, and a lot of people conflate them. That comparison has its own guide.
If you would rather not re-derive the process every time, we built a verification checklist generator — it does not hold a list of licensed firms, deliberately, because a stale list is more dangerous than no list. It produces the checklist you then work through against the official register.
The four columns that matter
A register entry is not a yes/no. Miss any of these and you have not really checked:
- Does the entity name match? A platform's brand and its registered operating entity are frequently different. What you need to confirm is that the service you are actually using is operated by the entity in the register. That name is in the terms of service — the "this agreement is between you and X" line at the top. X is your counterparty.
- Does the permission cover what you want to do? A firm might be authorised to run a trading facility but not to hold assets for you. That means matching your trades is inside the perimeter and safeguarding your coins is not.
- Is the status current? Registers usually retain history, including lapsed, suspended and withdrawn entries. Seeing the name and stopping there can mean you are looking at a record that expired long ago.
- Are there conditions attached? Some authorisations are conditional — professional clients only, or certain products excluded. If you are a retail user and the condition says professional only, that licence is not about you.
A hypothetical example: a brand-name search returns a similarly named but different firm, and the reader closes the tab without checking. Compare the exact legal entity, permissions, status and conditions, then retain the record you checked.
Three features that separate personal use from a business
Regulators typically look for three things when deciding whether you are providing a service: continuity (not a one-off), an open-ended set of counterparties (not just people you know), and a profit motive (a spread or a fee). All three present, and you are in licensable territory.
Here is the same idea as a table you can hold your own situation against. It is not a statute — it is the three features above applied to situations people actually find themselves in:
| What you are doing | Continuity | Open-ended | Profit | Which side |
|---|---|---|---|---|
| Buying USDT with your own tenge and holding it | — | — | — | Personal use |
| Helping a parent operate their account once | No | No | No | Personal use |
| Occasionally swapping at cost with a friend | No | No | No | Personal, but watch it becoming routine |
| Standing quotes in a group chat | Yes | Yes | Yes | A business, needs a licence |
| Collecting export receipts for your own company | Yes | No | Depends | Separate FX and settlement rules apply |
| Acting as a "merchant" on a spread | Yes | Yes | Yes | Unambiguously a business |
That last row needs saying plainly. In English-speaking crypto circles "being a P2P merchant" gets discussed like a side hustle. In any jurisdiction that has brought crypto inside a financial framework, it is a money services business: licensing, customer due diligence, suspicious activity reporting. Kazakhstan is not an exception to that.
Calling it a favour does not replace a review of the facts. Record counterparties, frequency, quotes, charges and the source of funds, then check the applicable requirements. We have no legal basis for treating a number of people within a number of months as a safe harbour.
A concrete step: review the bank records for handling other people’s payments, quoting rates and receiving fees. Keep orders, messages and source-of-funds evidence alongside them. Do not decide whether to continue by counting transfers. The short self-assessment organises facts; it determines neither legality nor licensing requirements.
Why cards get frozen, and what is really being frozen
Cards are almost never frozen because "you bought crypto". They are frozen because the pattern of activity on the account trips anti-money-laundering monitoring: many small inbound transfers in a short window, scattered and unfamiliar counterparties, in and out amounts that nearly match, money leaving as soon as it lands. None of that depends on whether the money was clean.
This is the galling part. You can be entirely the victim — you sold some USDT, and the tenge you were paid turned out to be proceeds of someone else's fraud, which you had no way to know. When the upstream case opens, accounts along the payment chain can be frozen, and yours is on the chain.
P2P is especially exposed to this because your counterparty is an unknown individual and you cannot verify where their money came from. The exchange applies its own controls, but it has no reach into the banking rail. So this risk is structural. It cannot be removed, only reduced.
The ways to reduce it are unglamorous:
- Keep trading and living expenses distinguishable. Separate records help explain activity but do not isolate a freeze; other accounts in your name may be restricted.
- Check counterparty age and completed trades. New accounts with single-digit trade counts and template-looking profiles are not worth the marginally better rate.
- Use the actual order amount. Do not alter digits or split payments to evade review; no shape of amount establishes safety.
- Keep evidence. Order screenshots, chat logs, platform reference numbers. If you are ever frozen, that is the only material you have to explain yourself with.
- Check the source of incoming funds. Leaving funds for a while does not resolve a source issue. Pause and check with the bank when something is unclear.
What to do once it has already happened is its own guide. One thing to carry from it: your first move is not to find a fixer. It is to establish at the branch whether this is the bank's own control measure or a freeze at the request of law enforcement. Those two run down completely different paths, and guessing wrong wastes the days that matter most.
Does using an offshore exchange break the law
For an individual user, there is currently no provision making personal use of an offshore platform a criminal matter — the licensing obligation sits on the platform. But "not a criminal offence" and "the regulator is content with it" are two different things: AFSA has issued a public warning about unlicensed platforms, and named them. That distinction is what this section is about.
People often assume that using an unlicensed platform makes them the offending party. It does not work that way. The licensing obligation sits on the platform. A platform soliciting business locally without authorisation has a problem; that problem is the platform's.
But the regulator has given users explicit guidance, and this part matters. On 29 April 2026 AFSA published a public warning about unlicensed digital asset platforms, stating that organising the circulation of digital assets within Kazakhstan without the appropriate licence is prohibited, and naming several platforms marketing locally without one (the notice listed OKX, HTX, Bitget and MEXC).
The same notice gave users advice, of which two items are the practical ones: check a platform's regulatory status in the AFSA public register before using it, and refrain from transferring funds or digital assets to entities whose regulatory status is unclear.
Note where the line falls: what is prohibited is a platform operating without authorisation, not you using one. But once the regulator has named names, "I did not know it was unlicensed" stops being available — checking is something you can do yourself, and are advised to. How to check is in verifying a licence, or use the checklist tool.
That is not the same as saying there is no cost. At least three things are worth accepting:
- Nobody is on your side when it goes wrong. Licensed firms are bound by local supervision, complaints channels and asset segregation requirements. If an offshore platform fails you, asserting your rights in an unfamiliar jurisdiction costs more than most people will ever spend.
- The fiat rail is more fragile. Offshore platforms often depend on third parties or P2P for local currency, and that is precisely the leg where problems concentrate.
- Rules can move. No provision aimed at individuals today does not mean none next year. Parking long-term value on a rail whose rules may change is an exposure in itself.
Record the purposes of long-term holdings and short-term working balances separately, and check the permitted route for each. A smaller amount or shorter holding period does not relax authorisation requirements or establish compliance.
If you are running a trading business, this section is not enough
A significant share of English-speaking readers here are not private individuals — they are running import/export, contracting or consultancy work with money moving across borders. That is a different regime.
The distinction: settlement is governed by FX and cross-border payment rules, and crypto is only the instrument you chose. Even where the digital asset side is fully compliant, your money movements still have to satisfy currency, tax and customs requirements independently. Receiving an invoice payment in USDT does not become a compliant export receipt just because the coins came from a licensed venue.
The common trap is treating cost savings as the only variable. Bank rails are slower, dearer and more paperwork-heavy — all true. They also give you something a chain of addresses does not: an explainable money trail. When a tax officer or a bank asks where the funds came from, a customs declaration and a bank advice answer the question directly.
If your volumes have reached the point where this matters, an article can only get you ready for the conversation. We wrote a breakdown of the five legs where cross-border crypto receipts go wrong, which works reasonably well as preparation before you sit down with an adviser.
Where tax currently stands
In principle, gains on disposing of digital assets are taxable income. The reporting treatment, cost basis rules and practical mechanics are still being worked through. For anything material, confirm with a local tax adviser rather than copying what you read online.
I am deliberately not giving you a rate. Numbers of that kind move, and an article with a hard number in it becomes a misleading article a few months later. Crypto tax treatment is still evolving in many countries, and Kazakhstan is no different.
What I can give you are principles that will not go stale:
- Records matter more than the rate. When you bought, at what price, when you sold, at what price — those determine whether cost can be established at all. Exchanges let you export history; export it periodically and keep it. That takes minutes; reconstructing it afterwards often cannot be done.
- Swapping one asset for another can be a taxable event. Many people assume only conversion to fiat counts. Under plenty of regimes, crypto-to-crypto is a disposal too.
- Corporate and personal holding are different regimes. If it runs through a company, do not apply the individual treatment to it.
There is a fuller piece on tax, written the same way — principles rather than numbers that expire.
Questions people actually ask
Is holding bitcoin in Kazakhstan illegal?
No. Holding, buying and selling digital assets as an individual is not a criminal act. What is regulated is providing a service to others — exchanging on their behalf, collecting and paying out, matching trades for a return. That needs a licence.
Does using an offshore exchange break the law?
There is currently no provision aimed at individuals for personal use of an offshore platform. The exposure sits at the on- and off-ramp: when funds cross the domestic banking system, domestic AML rules apply regardless of the venue.
Can I buy USDT for a friend?
Helping someone you know once is not the same as taking money to buy on an ongoing basis. The second has continuity, open-ended counterparties and a return — the three features that make it a licensable service. People have been prosecuted for exactly that.
Where do I check the AFSA licence register?
AFSA maintains a public register of authorised firms on its own site, searchable by name and permission type. Rely on whether the entry exists in the register, not on wording on the platform's own website.
Will selling crypto get my bank account looked at?
It can. Bank monitoring looks at account behaviour — many small inbound transfers, unfamiliar counterparties, unusual frequency — and that is largely independent of whether the funds themselves are clean.
Risk notice: crypto prices move violently and you can lose everything you put in. Nothing here is investment, legal or tax advice. Some jurisdictions restrict crypto assets — check the current rules where you are.
The law itself, and the official notices
This one rests on legislation, so the sources are the texts rather than anyone’s reading of them. Where anything — this article included — disagrees with the text, the text is right.Read September 2026
- Law of the Republic of Kazakhstan No. 193-VII On Digital Assets (6 Feb 2023) Adilet legal information systemThe classification of digital assets and which activities require a licence come from the text of this law.
- Kazakhstan introduces regulation of digital asset circulation (announcement, 30 Apr 2026) National Bank of KazakhstanThe 1 May 2026 date and the shift to systematic regulation come from the National Bank's 30 April announcement.
- Regulation of the digital assets market National Bank of KazakhstanPlatforms outside the AIFC are licensed and supervised by the National Bank; this page is the basis for the split described above.
- Unsecured digital asset exchange operators: licensing conditions National Bank of KazakhstanThat running an exchange business is a licensed activity is not our inference — this page lists the actual entry conditions.
- AFSA public register of regulated entities Astana Financial Services AuthorityTo check whether a firm is licensed, search this register by name rather than trusting the firm's own marketing.
- AFSA warning on unlicensed digital asset platforms (29 April 2026) Astana Financial Services AuthorityThe regulator has issued public warnings about unlicensed platforms; the warning quoted above comes from here.
- AFSA regulatory actions Astana Financial Services AuthorityThe record of enforcement actions taken, useful for judging whether the rules are actually applied.
- Criminal Code of the Republic of Kazakhstan Adilet legal information systemThe criminal exposure referred to above corresponds to provisions of the Criminal Code, whose text is here.
- Code of the Republic of Kazakhstan on Administrative Offences Adilet legal information systemConduct below the criminal threshold may fall under administrative liability; the text is here.
- AFSA official website Astana Financial Services AuthorityAFSA's official site, where licence categories and the regulatory framework are defined.