ARDFM requirements, the critical information infrastructure regime and mandatory personal data localisation shape the landscape of infrastructure projects in large businesses.
23 second-tier banks under tightened ARDFM cybersecurity requirements
The updated ARDFM resolution has been in force since 1 November 2025: encrypted connections, MFA plus biometrics, local data centres, automated incident exchange with the regulator, ISO 27001 and a security audit every 3 years, PCI DSS for card processing.
Bizmedia · ARDFM resolution
Law 94-V: mandatory personal data localisation plus the 2026 amendments
Personal data of Kazakhstani citizens must be stored inside Kazakhstan. Amendments on AI and digitalisation came into force in January 2026 (law No. 231-VIII) and in July 2026 (No. 256-VIII). Foreign legal entities must notify the regulator and ensure localisation.
Adilet legal information system · Law No. 94-V
The Kazakhstani critical infrastructure regime
Resolutions No. 529 and No. 832 define the list of critical facilities and uniform information security requirements. They cover energy, transport, telecom, banks and hydraulic structures. Compliance is a condition of operating, not a recommendation.
Adilet · Resolutions No. 529, No. 832
CISO of a top-10 second-tier bank · Almaty
A bank with 1.5–4 million customers, actively developing digital services. Under direct ARDFM supervision; the first deadlines under the new resolution fall within 60 days.
A monitoring centre and automated incident exchange with the ARDFM have to be built urgently without dropping the availability of critical systems. Staff turnover in Almaty is 37.9%, with competition for engineers against Kaspi and Halyk.
"The ARDFM deadline is in 60 days and the ISO 27001 audit is in March. Kaspi has already taken two strong network engineers. I need a partner who will close the regulator's requirements end to end, not a supplier with a box of hardware."
CIO of a mining company · Atyrau / Karaganda
A holding of 8,000–25,000 employees with 14 industrial sites from Atyrau to Ust-Kamenogorsk. A critical infrastructure facility.
Industrial control systems and the office network are still connected after 2022; supply and support from some Western manufacturers are unstable. Parallel imports through Almaty are more expensive and come without guarantees. There is no up-to-date network diagram.
"I have 14 industrial sites, each with its own set of switches and controllers. The regulator asks for a critical infrastructure register and a protection plan, and I do not even have a current diagram. I need a CCIE engineer who will come out to the site."
CTO of a payment processor / fintech · Almaty
Serves 2–6 second-tier banks and the e-commerce segment. Millions of transactions a day, PCI DSS Level 1, mandatory personal data localisation inside Kazakhstan.
Kaspi and Halyk are absorbing the market. According to IDC, cloud adoption in the corporate segment is only 10–11%; a hybrid architecture with a private cloud in Kazakhstan is needed.
"I cannot afford a year of tendering with the Big Four — my release cycle is 2 weeks. I need an integrator who turns up tomorrow with an architecture: where the Kazakhstani zone is, where the zone for Uzbekistan is, how we encrypt traffic and how this passes the ARDFM."