In short
Retail banking in Kazakhstan lives in mobile apps and QR payments, while corporate lending and the core systems underneath still run on older processes. AI reaches production first in compliance, and data residency shapes every architecture decision.
Kazakhstan has few banks, and the sector is highly concentrated: years of mergers, licence revocations and resolutions left a short list of institutions, with most assets in a few large groups. For retail customers, banking happens on the phone. Payments, transfers and loans run through apps, and QR payments have replaced card terminals across much of urban retail.
Corporate banking, SME lending and trade finance have moved more slowly. Corporate onboarding, larger credit decisions and cross-border payments still follow processes designed before the mobile wave. A highly digital retail front over a traditional corporate back office defines the sector, and the gap between digital leaders and the rest keeps widening. For mid-tier banks, the options on the table now include a sale, a white-label partnership or an exit from retail.
Two publicly listed groups set the pace. Halyk Bank is a universal bank with a large corporate book and its own retail app, Homebank. Kaspi.kz began as a retail lender and became a super-app: payments, a marketplace, travel, classifieds and government services in one application, with its shares listed on NASDAQ.
Around them sit mid-tier retail and SME banks, several repositioning after a restructuring or a change of owner; Otbasy Bank, the state housing savings bank; banks tied to brokerage and insurance groups; and subsidiaries of foreign banks that serve corporate and trade-finance clients without competing in retail. Kaspi has set the expectation every other player is measured against.
In strategic discussions, Kaspi.kz is a consumer super-app that holds a banking licence. People open it several times a day for payments, transfers, shopping and government services, and its NASDAQ listing makes its numbers public, so every competitor is measured against it, whether or not they compete head on.
Most retail banks now chase their own version of the super-app: a marketplace, government services, lifestyle features. Many underestimate the distribution Kaspi built over years and the engineering organisation behind it. The realistic question for most banks is which two or three adjacent services they can own, and a wrong answer now carries real strategic risk.
In Kazakhstan's banks, AI reaches production first in compliance, risk and document processing: anti-money-laundering transaction monitoring, sanctions screening, KYC document extraction, credit bureau data enrichment and internal audit sampling. Customer-facing AI, such as chatbots, personalisation and generative interfaces, mostly stays in pilots, held back by brand-safety concerns and regulatory uncertainty.
The reasons are structural. Compliance work is high in volume and well documented, and the cost of each case is easy to measure. Regulatory scrutiny forces the work to happen. Language models are good at the reading and matching that compliance teams have long done by hand.
Most banks still run core systems built long before mobile banking. The apps, QR payments and marketplace links customers see are layers on top of monolithic cores, often with brittle middleware, batch settlement and little real-time data. As digital volume grew, that architecture moved from tolerable technical debt to a bottleneck for the business.
Banks weighing a replacement compare commercial products (Temenos, Oracle FLEXCUBE, Finacle) with cloud-native cores (Mambu, Thought Machine, 10x). The choice is harder than it looks: data localisation limits which cloud regions a bank can use, and migrating a core is among the riskiest IT programmes a bank can run. Banks that complete it will ship products faster. Banks that wait fall further behind.
Kazakhstan requires personal data to be stored in the country, and banking data carries further restrictions. Global cloud providers have limited presence in the country, so banks that want AWS, Google Cloud or Azure for regulated workloads end up with hybrid architectures: regulated data on their own servers or in local colocation, everything else in regional cloud.
In practice, every serious AI or data-platform programme in a Kazakhstani bank starts with infrastructure design, before any model work. Vendors that can host AI locally, including sovereign cloud and language models on the bank's own servers, hold pricing power they would not have elsewhere. Underestimating this layer is a common reason programmes slip.
Banks now compete for engineering and data talent with Astana Hub startups, international remote employers paying in dollars and regional fintechs. Their old advantages, stable pay, prestige and an office in Almaty or Astana, have narrowed, and senior engineers, ML specialists and product managers often choose remote roles abroad.
Banks respond by building tech brands, spinning out technology subsidiaries with startup-style equity, running university pipelines and outsourcing specialised work. Kaspi hires as a technology company with a banking licence. The density of engineering talent is a good early indicator of which banks will lead.
The National Bank of Kazakhstan runs monetary policy and the payment systems, including the national instant payments infrastructure, and leads the Digital Tenge and the open-banking and open-API programme. The Agency for Regulation and Development of the Financial Market (ARDFM) supervises banks and keeps bringing its capital, anti-money-laundering and IT-risk rules closer to international standards.
The Astana International Financial Centre (AIFC) works under English common law and offers a separate regime for cross-border finance, Islamic finance and fintech testing, which gives banks room for cross-border and sharia-compliant products. The Law on Personal Data and Its Protection limits cloud choices, and AML/CFT requirements have tightened in line with FATF guidance.
Through 2028, retail digital banking approaches saturation, so growth comes from a larger share of each customer's wallet more than from new users. AI moves from compliance pilots into production at the largest banks, while customer-facing generative AI follows more cautiously. The Digital Tenge widens from its first uses toward merchant and interbank payments, at the pace the regulator and the banks are ready for.
Consolidation continues in the mid-tier, through mergers or a quiet retreat from retail by banks that cannot match the digital spending of the leaders. Banks buy fintechs where buying distribution or technology is faster than building it. Cross-border payments keep modernising under the National Bank and the AIFC, with most of the activity in the Gulf, China and Southeast Asia corridors.
Halyk Bank is the largest by total assets and by corporate lending. Kaspi.kz leads on retail reach and, listed on NASDAQ, carries the larger market capitalisation.
The Digital Tenge is a central bank digital currency issued by the National Bank of Kazakhstan. It is introduced in stages, with retail payments, programmable payments and interbank settlement tested one by one, and the National Bank sets the pace together with the commercial banks.
Kaspi.kz started as a retail lender and became a consumer super-app: payments, marketplace, classifieds, travel and government services in one application. It works at the engineering pace and with the product discipline of a technology company, and its NASDAQ listing makes its financials public. Strategically, it is a technology company with a banking licence.
In compliance and risk: AML transaction monitoring, KYC document extraction, sanctions screening, credit bureau data enrichment and internal audit sampling. Customer-facing AI such as chatbots and personalisation mostly stays in pilots, held back by brand and regulatory caution more than by technical limits.
The Astana International Financial Centre works under English common law and runs its own regulatory regime. Entities licensed there offer cross-border finance, Islamic finance and fintech services under rules separate from mainstream Kazakhstani banking regulation, which makes the AIFC the natural home for sharia-compliant products and fintech sandboxes.
An AI pilot in compliance passes on a sample of files. A system an AML team relies on depends on data that stays in the country, alerts an analyst can trace to their source, an audit trail the regulator can read and integration with a core built long ago. opengate designs and builds these systems and the infrastructure under them, and runs them where the data has to stay. Start with one workflow, and we measure what it gives back.
