MFOs lend under ARDFM supervision
Banks and microfinance organisations (MFOs) both lend to consumers in Kazakhstan. MFOs are regulated entities supervised by the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market (ARDFM). ARDFM's 29 July 2026 summary counts 211 MFOs at 1 June 2026. It reports 824 inspections since 2023 and the revoked licences of 99 MFOs, names breaches of the rate limit and of debt burden rules among the most common violations, and lists phased limits on new microloans to people with overdue bank or MFO debt.
Interest rates are capped
Article 5 of the microfinance law caps the annual effective interest rate (AEIR) at a maximum set jointly by ARDFM and the National Bank of Kazakhstan. The joint resolution of April 2026, as amended on 30 June 2026, sets these limits:
| Loan type | Maximum rate |
|---|---|
| Microloan from an MFO | 46% a year |
| Short-term microloan | Below 0.3% a day and no more than 179% a year |
| Unsecured bank loan | 46% a year |
| Bank loan secured by collateral | 35% a year |
Limits in the ARDFM and National Bank joint resolution of April 2026 (Nos. 84 and 51). Annex 5, para 3 of ARDFM Resolution No. 92 defines a short-term microloan as a contract with an individual of up to 45 calendar days and up to 45 times the monthly calculation index (MCI), set yearly in the republican budget law. Mortgage loans have separate limits. Bank rows are for comparison.
To fall into the short-term category, the contract must also cap penalties at 0.3% of the overdue amount per day and the borrower's total payments, excluding the principal, at half the amount issued. MFOs must also keep within a borrower debt burden ratio limit, a check that stays with the lender.
Advertising rules apply to the lender and to whoever makes or places the ads
The Law on Advertising requires advertising to be reliable and recognisable when shown, and bars financial advertising from hiding material conditions. Where the advertiser's activity is licensed, the advertisement states the licence number and the issuing body, except on radio. Under Article 20 of that law, the advertiser answers for content and language, the producer for design and production, and the distributor for the time, place and manner of placement.
An MFO advertisement that states a rate must also state the AEIR, and both are shown as a range from lowest to highest for each loan type. Advertisements other than radio and television carry a message on the borrower's liability for missed payments, including the lender's right to charge penalties, pass the debt to a collection agency or go to court; the message may refer to the lender's mobile app.
Online advertising must be identifiable and labelled under the Law on Online Platforms and Online Advertising, which counts a platform user who produces or places online advertising as its distributor. When authorised agents or third parties under partnership agreements promote a microloan, the MFO must control their compliance with the ARDFM requirements. Authorised agents, who attract clients and check and pass documents to the MFO under a mandate agreement, go on a register the MFO keeps. The requirements count the actions of third parties who offer or promote a microloan as the lender's own when assessing fair conduct and responsible lending. How any partner arrangement is classified is a question for the lender and its counsel.
Identification and credit checks stay with the MFO
The microfinance law defines a consumer microloan as a microloan to an individual for non-business purposes that is not secured by a real estate mortgage. The rules put these steps on the lender:
- The credit report is checked before a decision. An MFO must decline on a voluntary refusal to receive microloans recorded there (pawnshop loans are exempt) or on a call-up to conscript military service.
- Before an unsecured consumer microloan, the MFO runs its own anti-fraud measures and, for an online loan, a questionnaire on signs of fraud or social engineering.
- Biometric authentication is required before an MFO concludes a microloan agreement with an individual over the internet.
- Online unsecured consumer microloans of 75 or more times the MCI are paid out no earlier than 24 hours after signing, with exceptions such as payment straight to a seller of goods or services.
- For an unsecured consumer microloan, a first-time borrower (no earlier loans on the credit report) asking for more than 75 times the MCI signs in person after biometric authentication, except for payment straight to a seller.
Identity fraud also costs the lender directly. Where a court act in force establishes that a borrower recognised as a victim in a criminal case had a microloan issued in their name by fraud, through a third party's unlawful use of their identification details, the MFO must within ten working days of receiving it decide to write off the debt and take measures to return amounts already collected.
Applicant data falls under the personal data law
Law No. 94-V on personal data governs how applicant data is collected, stored and moved. Consent must be given in a way that confirms it was received, and it states whether data may pass to third parties or cross a border. Personal data must be stored in a database or digital object located in Kazakhstan. Cross-border transfer is allowed to countries that protect personal data, and elsewhere only in listed cases such as the subject's consent. The microfinance law also requires an MFO to keep microloan information secret, disclosing it to third parties only with the borrower's written consent or in cases the law lists.
The regulatory sections above are general information as at October 2026, not legal advice, so lenders should confirm requirements with their counsel.
The lender sets the rules and keeps the credit decision
CYBERTECH is not a lender; company details are on the about page. The lender defines the product criteria and capacity for Kazakhstan and keeps the final credit decision, and each launch is confirmed market by market. Applicants are screened against the lender's rules, as set out on the anti-fraud page. Those checks do not replace the MFO's own identification, credit report and anti-fraud steps above; for the identity side, see recycled identities.
Delivery is by referral with an S2S postback for outcomes, or by direct API. See the postback guide, the API guide and the pricing page for the CPA and CPD models.
Four points to settle before a Kazakhstan launch
- Which applicant fields are shared, at which step, who acts as owner or operator of the data on each side, and how the consent text, the storage rule and any cross-border transfer are met.
- Who approves advertising copy, including the licence line, the AEIR range and the liability message, and how the lender and its counsel classify the arrangement under the ARDFM requirements.
- Which outcome is billable. Under the 24-hour rule above, a disbursal outcome on those loans cannot arrive within a day of the application, and a CPD agreement has to allow for that lag.
- How the billable event fits the lender's pay rules for agents and partners. The ARDFM requirements treat pay systems that encourage non-compliance, including pay tied only to sales volume, contract numbers or loan sizes without regard to service quality, as an unfair practice.
Related guides
- Screen loan leads for fraud and fit before they reach youFive checks, including fit to your own criteria, screen applicants before handoff. No single signal decides, and a stopped applicant is not delivered to you.
- Loan leads reach you by referral or by direct APIReferral with a server-to-server postback and a direct API deliver the same screened applicants; this page helps you choose and walks through a launch.
- How CPL, CPA and CPD price loan leadsHow CPL, CPA and CPD differ on risk and reporting, and which terms to fix in writing: billable event, validation window, caps.
- Duplicate, recycled and synthetic identities hide between applicationsHow duplicate applications, recycled identities and synthetic identities appear in lead flows, and why de-duplication should run before billing.
Sources
- Adilet: Law No. 56-V of 26 November 2012 on microfinance activity, Arts 3-2, 4, 5, 6 and 21, as amended, Russian text (2012)
- ARDFM and National Bank: Joint resolution on maximum annual effective rates, Nos. 84 and 51, Russian text (2026)
- ARDFM: Resolution No. 92 of 15 May 2026, Requirements for microfinance activity, paras 2, 11, 13, 40, 54 to 62, 78, 85 and 88 and Annexes 4 and 5, Russian text (2026)
- Adilet: Law No. 508 on advertising, Arts 6, 14 and 20, Russian text (2003)
- Adilet: Law No. 18-VIII on online platforms and online advertising, Arts 1 and 19, Russian text (2023)
- Adilet: Law No. 94-V on personal data and their protection, Arts 8, 12 and 16, Russian text (2013)
- ARDFM: Measures to tighten regulation of microfinance organisations and collection agencies, Russian text (2026)