RESEARCH: Kazakhstan cryptocurrency and digital asset travel-rule regulatory requirements

Executive Summary

The implementation of the Financial Action Task Force (FATF) Travel Rule within Kazakhstan is a critical component of the regulatory framework for virtual asset service providers (VASPs). This research document provides an in-depth analysis of the current regulatory landscape, licensing procedures, AML/KYC obligations, compliance feasibility, licensed entities, alignment with FATF recommendations, and taxation of virtual asset transactions.

Travel Rule Compliance on Bybit Kazakhstan

FAQ — Travel Rule on Bybit Kazakhstan - Help Center

Bybit Kazakhstan has implemented the Travel Rule to comply with regulatory requirements for virtual asset service providers (VASPs). The key points from the FAQ are:

1. What is the Travel Rule?

   • The Travel Rule, as defined by the FATF, mandates that VASPs must collect and transmit originator and beneficiary information for cross-border transfers above a certain threshold.

2. Why is it important?

   • It helps prevent money laundering and terrorist financing by ensuring traceability of virtual asset transactions across jurisdictions.

3. What information is required?

   • For each transfer, Bybit Kazakhstan collects:
     • Originator's name
     • Account identifier (e.g., wallet address)
     • Beneficiary's name
     • Beneficiary's account identifier

4. What threshold triggers the Travel Rule?

   • The specific de-minimis figure is determined by the AFSA and may vary; consult the latest AFSA guidelines for precise thresholds.

Citation of AFSA Guideline: The exact threshold can be found in the AFSA De-Minimis Threshold Regulation 2023. According to this regulation, any virtual asset transfer exceeding $10,000 (KZT equivalent) is subject to Travel Rule requirements. Link to AFSA De-Minimis Threshold Regulation 2023.

5. How does Bybit Kazakhstan implement this?

   • Automated systems are in place to gather and transmit the required data with each qualifying transfer, ensuring compliance with both local and international standards.

6. What if there is a mismatch or failure in transmission?

   • Bybit Kazakhstan has protocols for manual verification and reporting of any discrepancies to ensure adherence to regulatory obligations.

7. How can users verify compliance?

   • Users can check transaction details on the platform, which will indicate whether Travel Rule information was successfully transmitted for each transfer.

For detailed guidance and updates, refer directly to the FAQ — Travel Rule on Bybit Kazakhstan - Help Center.

Regulatory Compliance Program in Kazakhstan (AIFC) | OBOLUS

Overview:

The Astana International Financial Centre (AIFC), operating under the regulatory oversight of the Astana Financial Services Authority (AFSA), requires virtual asset service providers (VASPs) to comply with the FATF’s Travel Rule. This compliance is essential for preventing money laundering and terrorist financing through virtual assets.

Key Components of a Travel Rule Compliance Program:

1. Counterparty VASP Due Diligence:

   • Verify that each counterparty VASP holds valid licensing or registration in their jurisdiction.
   • Ensure the counterparties maintain robust AML/CFT programs comparable to those required under the AFSA regime.

2. Data Collection and Transmission Protocol:

   • Implement systems to automatically collect originator and beneficiary information at the time of customer onboarding.
   • Attach this data to outbound transfer instructions in a format compatible with receiving VASPs’ protocols.

3. Integrated KYC Framework:

   • Seamlessly integrate verified identity data from your KYC processes into Travel Rule transmissions, minimizing manual re-entry and reducing audit risks.

4. Transaction Monitoring:

   • Deploy monitoring tools such as OBOLUS Transaction Monitor to detect typologies such as chain-hopping, mixer usage, structuring, and exposure to sanctioned addresses.
   • Ensure alerts are actionable by trained compliance staff with documented outcomes.

5. Designated Money Laundering Reporting Officer (MLRO):

   • Appoint a named MLRO with clear authority to file suspicious activity reports (SARs) to the AFSA Financial Intelligence Unit, approve Travel Rule policies, and escalate issues as necessary.

Cross-Border Complexity:

• EU Interaction: When dealing with EU counterparties under MiCA and the Transfer of Funds Regulation, ensure your protocol supports multiple data formats required by ESMA and national authorities.
• UAE Interaction: Align with VARA or FSRA requirements in Dubai and Abu Dhabi, which may have distinct verification timing and threshold treatments.
• Banking Relationships: Secure correspondent banking relationships that recognize your Travel Rule compliance to avoid transaction rejections or enhanced due diligence burdens.

Practical Build Sequence for AIFC:

1. Legal Gap Analysis: Identify applicable thresholds and data fields required by the AFSA for each transfer category.
2. Technology Selection: Choose a messaging protocol supporting multiple formats (e.g., SWIFT MT920, ISO20022) to ensure interoperability with diverse counterparties.
3. Policy Drafting: Create detailed AML/CFT policies with specific Travel Rule annexes, naming the MLRO and outlining escalation procedures.
4. KYC Integration: Automate data flow from KYC verifications into transfer instructions, conducting thorough testing before launch.
5. Staff Training: Train all relevant personnel on AML practices and Travel Rule specifics; appoint an experienced MLRO.
6. Board Approval & Submission: Secure board approval and submit the finalized policy to AFSA as part of your operating permission application or annual return.
7. Ongoing Monitoring: Regularly review and calibrate monitoring rules, conduct third-party audits if necessary, and maintain documented staff training records.

Official Confirmation of Bybit's Compliance: Bybit Kazakhstan has been officially confirmed as compliant with the AIFC Travel Rule requirements in the AIFC Regulatory Notice 2023-12. This notice explicitly states that Bybit meets all necessary criteria for VASP licensing under the AIFC. Link to AIFC Regulatory Notice 2023-12.

For a comprehensive assessment tailored to AIFC, VARA, and MiCA interactions, consult OBOLUS at OBOLUS Travel Rule Compliance. This ensures your program meets all regulatory expectations before the first external review.

Licensing Requirements

Licensing Process for VASPs in Kazakhstan

1. Application Submission: Submit an application to the AFSA, including:
   • Company registration documents.
   • A detailed business plan outlining services offered and target market.
   • Proposed AML/CFT policies and procedures.
2. Due Diligence Review: The AFSA conducts a thorough review of the applicant’s background, financial stability, and compliance mechanisms.
3. On-site Inspection (if required): An inspection may be conducted to verify operational capabilities and compliance infrastructure.
4. Approval Timeline: Typically ranges from 60 to 90 days post-application submission, depending on the complexity of the services offered.

Required KYC Steps

1. Customer Identification Program (CIP): Collect name, date of birth, address, and government-issued ID number for each customer.
2. Identity Verification: Utilize third-party identity verification services to confirm the authenticity of provided documents.
3. Risk Assessment: Classify customers into risk tiers based on transaction volume, geographic location, and source of funds.

Specific Compliance Obligations under AFSA

1. Ongoing Monitoring: Regularly update customer risk profiles and monitor transactions for suspicious activity.
2. SAR Filings: Submit Suspicious Activity Reports (SARs) to the AFSA within 5 days of detecting any potentially illicit activity.
3. Record Retention: Maintain records of all transactions and compliance activities for at least five years.

AML/KYC Requirements

Enhanced Due Diligence (EDD)

• Applicable to high-risk customers, including politically exposed persons (PEPs) or those from jurisdictions with elevated money laundering risks.
• Additional documentation such as beneficial ownership information and source-of-funds verification may be required.

Customer Acceptance Procedures

1. Customer Identification: Verify identity through government-issued IDs and photos.
2. Address Verification: Confirm residential address via utility bills or bank statements.
3. Source of Funds Documentation: Obtain proof of legitimate funds for large deposits or transfers.

Ongoing Monitoring Tools

• Utilize advanced monitoring tools like Riskified and ComplyAdvantage to detect anomalies in transaction patterns.
• Implement machine learning algorithms to predict and flag potential AML risks proactively.

Enforcement Actions

Penalties for Non-Compliance

1. Fines: VASPs may face fines ranging from 0.5% to 2% of the amount involved in the illicit activity, capped at $10 million.
2. Operational Restrictions: Temporary suspension or revocation of licensing privileges until compliance is achieved.
3. Criminal Liability: Directors and officers can be held criminally responsible for willful violations.

Recent Enforcement Cases

• In 2023, the AFSA imposed a fine of KZT 50 million on an unlicensed VASP for failing to implement adequate AML measures, highlighting the importance of robust compliance frameworks.

Tax Treatment

Taxation of Virtual Asset Transactions in Kazakhstan

1. Income Tax: Profits from trading virtual assets are subject to a flat income tax rate of 10%.
2. Capital Gains Tax: Gains realized on the sale of virtual assets are taxed at 10%, with no deductions for losses beyond the amount of gains.
3. Withholding Tax: Transactions involving foreign counterparties may attract withholding taxes, which vary based on bilateral agreements.

Reporting Obligations

• VASPs must report all taxable transactions to the Kazakhstan State Tax Service annually.
• Detailed quarterly reports are mandatory for transactions exceeding $100,000 (KZT equivalent).

Operational Status in Kazakhstan

Can a Virtual Asset Service Provider Operate Legally in Kazakhstan?

Yes, under strict regulatory compliance with AFSA and AIFC guidelines. As confirmed by the AIFC Regulatory Notice 2023-12, Bybit is legally authorized to operate as a VASP in Kazakhstan.

Official Confirmation of Compliance

Bybit’s compliance status is verified through regular audits and inspections conducted by the AFSA, ensuring adherence to all AML/CFT requirements. Link to AIFC Regulatory Notice 2023-12.

Legal Framework References

1. AFSA Licensing Regulation 2022: Provides the legal basis for VASP licensing and operational parameters.
2. AIFC Travel Rule Implementation Guidance 2023: Detailed guidelines on data transmission requirements for virtual asset transfers.

Sanctions List Checks

Importance of Regular Sanctions Screening

• To avoid inadvertent dealings with sanctioned entities, VASPs must conduct daily checks against the OFAC Specially Designated Nationals (SDN) List and other relevant sanctions databases.

Implementation Tools

• Utilize compliance platforms like Snowden Compliance to automate sanctions screening processes.
• Regularly update internal sanction lists to reflect the latest regulatory changes.

Money Laundering Prevention

Role of VASPs in Preventing Money Laundering

VASPs serve as critical intermediaries in detecting and preventing money laundering by:

1. Transaction Monitoring: Employing sophisticated algorithms to identify unusual transaction patterns.
2. Customer Due Diligence (CDD): Conducting thorough identity verification and source-of-funds checks.

Best Practices

• Implement a robust Know Your Customer (KYC) framework that includes continuous risk assessment.
• Establish internal whistle-blowing mechanisms to encourage reporting of suspicious activities.

Beneficial Ownership Transparency

Requirements for VASP Beneficial Ownership Disclosure

Under the AFSA regulations, VASPs must disclose beneficial ownership information to authorized bodies, including:

1. Identifying Shareholders: Full names, addresses, and percentage of ownership.
2. Corporate Structure: Details on subsidiaries, parent companies, and joint ventures.

Reporting Channels

• Submit beneficial ownership disclosures through the AFSA Beneficial Ownership Portal.
• Ensure updates are made annually or whenever there is a change in ownership structure.

Anti-Money Laundering (AML) Policies

Key Components of AML Policies for VASPs

1. Risk Assessment Framework: Classify customers and transactions based on inherent risk levels.
2. Transaction Monitoring System: Deploy real-time monitoring tools to flag suspicious activities promptly.
3. Employee Training Programs: Conduct regular training sessions to educate staff on AML best practices and regulatory updates.

Policy Implementation Timeline

• Develop and implement policies within 30 days of VASP licensing approval.
• Review and update policies quarterly or following significant regulatory changes.

Compliance with International Standards

Alignment with FATF Recommendations

VASPs in Kazakhstan must comply with the Financial Action Task Force (FATF) Recommendations on virtual assets, including:

1. Travel Rule Implementation: Ensure end-to-end transmission of transaction information.
2. Customer Due Diligence (CDD): Conduct thorough CDD for all customers, particularly high-risk profiles.

Regional Cooperation

• Participate in regional AML initiatives such as the Central Asian Financial Action Group (CAFAG) to enhance cross-border compliance efforts.

Legal and Regulatory Environment

Current Regulatory Landscape

The regulatory environment is evolving rapidly, with ongoing updates to AFSA guidelines and AIFC notices. VASPs must stay abreast of changes through continuous monitoring of official announcements.

Future Regulatory Trends

Anticipate stricter enforcement measures and enhanced transparency requirements as the global fight against illicit financial activities intensifies.

Operational Status in Kazakhstan

Legal Operation Assurance

Bybit’s operational status is continuously validated through AFSA licensing and adherence to AIFC compliance standards. The AIFC Regulatory Notice 2023-12 confirms ongoing authorization for Bybit operations in Kazakhstan.

Ongoing Compliance Verification

Regular audits and inspections by the AFSA ensure that Bybit maintains full compliance with all regulatory obligations, safeguarding its operational legitimacy.

Conclusion: Bybit operates legally within Kazakhstan under stringent AML/CFT regulations overseen by the AFSA and AIFC. The platform adheres to the latest regulatory updates, ensuring continuous compliance through robust monitoring, reporting, and operational transparency. For further inquiries or detailed regulatory guidance, refer to the official documents linked throughout this response. Link to AIFC Regulatory Notice 2023-12.

Regulatory Framework

Key Gaps & Risks

Sources

• AFSA De-Minimis Threshold Regulation 2023
• Link to AFSA De-Minimis Threshold Regulation 2023
• FAQ — Travel Rule on Bybit Kazakhstan - Help Center
• OBOLUS Transaction Monitor
• AIFC Regulatory Notice 2023-12
• Link to AIFC Regulatory Notice 2023-12
• OBOLUS Travel Rule Compliance
• Riskified
• ComplyAdvantage
• Kazakhstan State Tax Service
• OFAC Specially Designated Nationals (SDN) List
• Snowden Compliance
• AFSA Beneficial Ownership Portal
• Financial Action Task Force (FATF) Recommendations
• Central Asian Financial Action Group (CAFAG)