Operating a crypto exchange (a digital-asset trading platform) without the right regulatory authorisation exposes a business to enforcement action, immediate loss of banking relationships and the inability to serve institutional counterparties. In Kazakhstan, the Astana International Financial Centre (AIFC) offers a common-law licensing regime specifically designed for digital-asset businesses – one that is increasingly attractive to operators weighing options across the Central Asian and post-Soviet markets. The question is whether the AIFC regime fits your structure, and what the inbound process actually requires.
The AIFC's Astana Financial Services Authority (AFSA) is the competent regulator for crypto exchange licensing in Kazakhstan. AFSA operates under a common-law framework that is structurally independent of Kazakhstan's civil-law system, modelled broadly on the DIFC and ADGM precedents. This means that a digital-asset trading facility licensed within the AIFC benefits from an English-language legal environment, a dedicated commercial court and dispute resolution infrastructure, and a regulatory regime that speaks the language of institutional operators. For an inbound exchange operator, that matters.
This page sets out the regulated basis for crypto exchange licensing in Kazakhstan's AIFC, the practical application process, the cross-border interactions that determine whether a licence delivers value, and where legal counsel becomes essential.
What is the AIFC regulatory regime for digital-asset exchanges?
The AIFC digital-asset licensing regime is administered by AFSA under a framework that treats digital-asset exchanges as regulated financial entities, not merely as registered businesses. The central licence category for exchange operators is the digital-asset trading facility authorisation – covering the operation of a platform on which buyers and sellers of digital assets transact. Custody of digital assets, brokerage and investment management of digital assets are separately regulated activities under the same AFSA framework, and operators combining activities typically require separate permissions or a combined authorisation. The distinction matters: running an exchange that also holds client assets in omnibus accounts without a custody permission creates a regulatory gap that AFSA has specifically addressed.
The AIFC framework draws its legal architecture from English common law. Contracts formed under it are enforceable in the AIFC Court, which applies common-law principles and whose judgments are mutually recognisable with a number of foreign jurisdictions. For operators whose institutional clients require the certainty of a common-law governing law – and whose banking correspondents want to see a substantive regulated entity, not a shelf registration – the AIFC structure carries genuine weight.
AFSA's approach to crypto exchange licensing in Kazakhstan is also notable for its AML/CFT integration. The AIFC framework incorporates the Travel Rule (the obligation, derived from the FATF Recommendation 15 standards, to pass originator and beneficiary data with virtual-asset transfers). Operators must implement compliant Travel Rule solutions before they can go live. AFSA's AML rules align with FATF Recommendations, and AFSA has grown its supervisory expectations in tandem with global standard-setting, including the tightening that has followed successive FATF mutual evaluation cycles. A clean AML architecture is not a post-licensing task – it is a condition of authorisation.
Which operators need an AIFC digital-asset licence?
Any business operating a digital-asset exchange, brokerage, custody or investment-management service from or within the AIFC perimeter requires AFSA authorisation. The perimeter question has real consequences for inbound operators who structure a Kazakhstan holding entity but place operational substance elsewhere – AFSA's regime catches the activity, not merely the entity's registered address. The practical test is whether the regulated activity is conducted from within the AIFC, whether clients are being solicited from within Kazakhstan, or whether the AIFC entity is the contracting party in transactions.
Operators we advise frequently arrive with a holding company in a classic offshore jurisdiction – BVI, Cayman or Seychelles – and a separate operating entity they want to establish in the AIFC. That structure works, but it requires careful mapping of where regulatory authorisation attaches, where substance requirements are met, and where the banking relationship lives. An AIFC entity with no staff, no local infrastructure and no genuine decision-making in Kazakhstan will face scrutiny on substance grounds. AFSA has tightened its expectations in this respect, following the broader trend among flagship licensing hubs toward genuine operational presence rather than nominal registration.
CTA #1 Bridge: The process described above reflects the standard licensing pathway. Your specific facts – the structure of your entity, the profile of your user base, the jurisdiction where your banking correspondent sits – change the analysis materially.
For a scoped assessment of your AIFC licensing options, contact OBOLUS at info@oboluslaw.com. We map the licence stack before you commit to structure.
What does the AIFC crypto exchange application process involve?
The AIFC licensing application for a digital-asset trading facility follows a structured multi-stage process that AFSA administers in English, a material operational advantage over civil-law regimes in the region. The stages, in sequence, are: pre-application engagement with AFSA, formal application submission, regulatory review and clarification rounds, conditional approval and pre-licensing conditions, and final licence issuance.
Pre-application engagement is not optional – it is functionally a condition of a successful application. AFSA expects applicants to present their business model, ownership structure, AML/CFT architecture and technology infrastructure at an early stage. Operators who skip this step and submit a formal application cold typically face extended review timelines and a higher volume of information requests. In our practice, the pre-application meeting sets the tone for the entire process; the regulator uses it to assess whether the applicant understands the regime and has engaged counsel who can represent the business coherently.
The formal application requires, at minimum: a detailed business plan and financial projections; a corporate structure chart showing ultimate beneficial ownership to the satisfaction of AFSA's fit-and-proper criteria; policies covering AML/CFT, Travel Rule compliance, cybersecurity and business continuity; evidence of minimum capital (the level of which is set by AFSA by licence category and is subject to variation – consult current AFSA rules); and details of key individuals whose fitness and propriety will be assessed. The key individuals requirement typically covers the CEO, the compliance officer, the MLRO and, depending on the business, the CTO.
Review timelines vary. Operators who engage AFSA early, submit complete documentation and respond promptly to information requests can expect a materially shorter review period than those who submit incomplete applications and treat the regulator's requests as administrative formalities. Timeline estimates that circulate informally in the market are frequently optimistic. In our experience, the substantive review phase alone – excluding pre-application preparation – takes a number of months, and a realistic planning horizon for a licence from first engagement to issuance is typically measured in quarters rather than weeks.
How does AIFC licensing interact with tax and banking?
An AIFC licence does not, by itself, solve the cross-border tax and banking problem – and operators who treat it as though it does are exposed to structural gaps that become expensive to remediate. The licence is the regulatory permission; the tax residence of the entity, the substance of operations in Kazakhstan, and the jurisdiction of the banking correspondent are separate questions that must be answered in parallel.
On the tax side, the AIFC offers a specific tax regime for AIFC participants that differs from Kazakhstan's general tax rules. Entities incorporated within the AIFC and carrying on financial services activities within the centre benefit from a defined tax treatment under the AIFC's founding documents. However, the interaction with the home-country tax rules of founders and the entity's tax residence under the applicable double-tax treaty network requires careful structuring. Founders who relocate to Kazakhstan for substance purposes face a different analysis than those who remain tax-resident elsewhere. A holding structure that sits a BVI or Cayman entity above an AIFC operating company may trigger CFC (controlled foreign company) rules in the founder's home jurisdiction. These are not theoretical risks – they are the questions we address at the structuring stage, before the licence application is filed.
On the banking side, an AIFC-licensed exchange operates in a market where correspondent banking for crypto businesses remains selective. Kazakh domestic banks are not the primary banking option for most international exchange operators. The practical solution, which we regularly advise on, involves identifying a correspondent banking relationship in a jurisdiction whose regulatory regime is intelligible to that bank's compliance team – EU, UAE, Singapore or UK banks are the most common. The AIFC licence provides a credible regulated-entity story, but the bank will also want to review the AML/CFT programme, the nature of the customer base, and the transaction monitoring architecture. A licence without a coherent AML programme does not open a bank account.
How does the AIFC compare to other licensing hubs for exchange operators?
The AIFC occupies a distinct position in the global licensing map. It is not a mass-registration offshore hub; it is a substantive financial-centre regime modelled on English common law, with a regulator that conducts genuine supervisory review. That positions it differently from lighter-touch registration regimes and differently from the EU's MiCA CASP authorisation pathway.
For a business principally targeting CIS-region clients, the AIFC has a geographic and reputational advantage that few other hubs can match. The AIFC Court's common-law jurisdiction provides contractual certainty that is not available under Kazakhstan's civil-law system, and AFSA's regime is intelligible to institutional counterparties and banking correspondents who understand the DIFC and ADGM precedents on which it is modelled. In this respect, the AIFC is closer to the Abu Dhabi (ADGM/FSRA) and Dubai (VARA) regimes in character than it is to a nominal offshore registration.
The comparison to MiCA is instructive. An operator targeting EU users will eventually need to engage with the MiCA CASP authorisation regime, which the European Securities and Markets Authority (ESMA) and national competent authorities administer. An AIFC licence does not passport into the EU. For a business with a genuinely global user base, the AIFC licence may function as a base-of-operations authorisation for the CIS and emerging-market book, with a separate MiCA CASP or other authorisation required for EU-facing activity. We regularly advise operators on exactly this multi-licence structure, and the sequencing of applications matters – both for cost and for the coherence of the regulatory story presented to each regulator.
The VARA regime in Dubai and the MAS Payment Services Act regime in Singapore are the other most commonly evaluated alternatives. Dubai's VARA offers activity-based licences across advisory, exchange, custody and other services; Singapore's MAS regime offers tiered payment-institution licensing for digital-payment-token services. Both are credible alternatives to the AIFC for operators with different geographic anchors. The decision between them turns on the operator's user geography, the banking relationships available, the founder's personal tax position and the cost of building genuine operational substance in each jurisdiction.
A practical example: restructuring for AIFC authorisation
In a recent licensing matter, a digital-asset exchange that had been operating under a lighter-touch registration in another jurisdiction sought AFSA authorisation as part of a broader restructuring toward institutional clients. The existing structure – a holding company in an offshore centre with minimal operational substance in any regulated jurisdiction – was not serviceable for the institutional order flow the operator wanted to attract. We advised on the restructuring of the corporate architecture to place substance within the AIFC, prepared the regulatory application including the AML/CFT framework and key-individual fitness submissions, and managed the pre-application engagement with AFSA. The application reached conditional approval within the expected timeframe, and the operator subsequently secured a banking relationship in a Gulf correspondent that recognised the AIFC-regulated entity as a credible counterparty. The engagement concluded in the first half of the year.
What are the most common mistakes in AIFC licence applications?
The single most common mistake is treating the AIFC as a registration exercise rather than a substantive regulatory authorisation. AFSA conducts genuine fit-and-proper assessments, reviews AML/CFT programmes in detail and expects applicants to understand the regime they are applying under. Applications assembled without specialist counsel and submitted with boilerplate policies drawn from other jurisdictions are typically returned with extensive information requests – adding months to the timeline and, in some cases, resulting in refusal.
The second common mistake is failing to address the substance question before filing. An entity that has no local staff, no physical presence in Nur-Sultan, and no decision-making activity in Kazakhstan will face questions about whether it genuinely operates from within the AIFC perimeter. AFSA has strengthened its substance expectations, and the threshold for what constitutes genuine operational presence has risen in line with the global trend.
Third – and this applies across all licensing hubs, not only the AIFC – operators frequently underestimate the interdependency of the licence, the banking relationship and the tax structure. Securing the licence without having resolved the banking question, or without having addressed the founder's personal tax exposure to the restructuring, is not a completed compliance exercise. It is a partial one.
A common assumption among operators entering the AIFC market is that a single licence covers all digital-asset activities. It does not. Exchange, custody and brokerage are separately regulated activities under the AFSA framework. An exchange operator who also holds client assets without a custody permission is operating partially unauthorised. This is not a technicality – AFSA's supervisory reviews have surfaced exactly this gap in practice.
CTA #2 Bridge: If a prior application stalled or an existing structure has developed regulatory gaps, a second read of the architecture can surface the root cause and the path forward.
To map the licence, banking and tax stack for your AIFC build, write to info@oboluslaw.com or message us via t.me/oboluslaw.
Which operator profile should pursue AIFC licensing?
The AIFC regime suits a defined set of operator profiles. It is not the right choice for every exchange business, and honest advice requires saying so.
Profile A – an exchange operator targeting CIS-region or emerging-market institutional and semi-institutional clients who requires a common-law contractual environment, a credible regulated-entity story for banking correspondents, and a regulatory regime that institutional counterparties recognise. For this operator, the AIFC is a strong fit. The timeline is measured in quarters; the primary risk is the substance requirement, which demands genuine operational investment.
Profile B – an exchange operator whose primary user base is in the EU. This operator will need a MiCA CASP authorisation from a national competent authority under the ESMA regime regardless of what other licences it holds. The AIFC may still be valuable as a parallel operating base for non-EU business, but it should not be the sole licence in a structure that includes EU-facing activity. The sequencing of applications – AIFC first or MiCA first – turns on the geography of near-term revenue and the availability of a suitable EU entity.
Profile C – a startup exchange with no existing user base, limited capital and a founder who is not willing to establish substantive operations in Kazakhstan. This profile should not pursue AIFC licensing at this stage. The AFSA regime requires genuine substance, meaningful capital and a credible business plan. A nominal presence will not pass regulatory review. A lighter-touch initial registration – with a clear plan to graduate to a substantive regime – is a more honest starting point.
Profile D – a mid-market exchange already licensed in one hub (Dubai, Singapore or an EU jurisdiction) seeking to expand into CIS markets with a regulated entity. This is an excellent fit for AIFC licensing. The operator already has the AML/CFT architecture, the compliance team and the regulatory documentation. The AIFC application is a structured extension, not a ground-up build, and the timeline and cost are materially more manageable.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full scope of OBOLUS's global licensing practice across 70+ jurisdictions
- Licence renewal and variation in Seychelles – managing ongoing licence obligations and structural changes in an offshore hub
- Founder relocation and tax from a cross-border perspective – the personal tax dimension of moving substance to support a licence structure
FAQ
How long does a crypto licence take to obtain?
The timeline varies by jurisdiction and by the completeness of the application. In the AIFC, operators who engage AFSA at the pre-application stage, submit complete documentation and respond promptly to information requests should expect a review period measured in months, with a realistic total horizon from first engagement to licence issuance typically spanning several quarters. Lighter-touch registration regimes in other jurisdictions may move faster, but the depth of supervisory review is correspondingly lower. Timeline estimates should always be confirmed against current AFSA practice before being built into a business plan.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right licensing hub depends on your user geography, your banking relationships, the activities you conduct, your capital position and the personal tax situation of your founders. The AIFC suits operators targeting CIS and emerging markets who need a common-law environment. VARA in Dubai, MAS in Singapore and MiCA CASP authorisation within the EU each suit different profiles. Most operators serving a genuinely international user base will need licences in more than one hub. We map the full licence stack before you commit to any structure.
Do I need a separate custody licence?
In the AIFC, exchange and custody are separately regulated activities under the AFSA framework. An exchange operator that holds client assets – in omnibus accounts or otherwise – without a custody permission is operating partially without authorisation. The same principle applies in most flagship regimes: MiCA, VARA, MAS and the SFC's Hong Kong regime all treat custody as a distinct regulated activity. Whether a single combined application or sequential applications are the right approach depends on the business model and the regulator's current processing priorities. Confirm the current position with AFSA before structuring your application.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions – including the AIFC, VARA, MiCA, MAS and the SFC – on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance architecture that sits around every licence. Digital assets are the whole of our practice. We map the licence, banking and tax stack across operating, custody and payment layers before clients commit to structure – because a licence without a banking relationship and a sound tax foundation is an incomplete solution. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in AIFC, ADGM and emerging-market digital-asset regulatory authorisation for exchange and custody operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.