Kazakhstan KZ

The function of Kazakhstan within the Russian sanctions-evasion architecture deepened materially this cycle, and the structural reading is that Kazakhstan operates as a mid-tier transit and intermediary jurisdiction inside the EAEU customs-free zone rather than as an incidental waypoint. This deepening occurred without any single new enforcement action inside Kazakhstan itself, underscoring the architecture-over-incident principle that structural exposure can intensify through external designation activity even absent a domestic Kazakh enforcement event. The European Union 19th Russia sanctions package, which entered into force on 23 October 2025, imposed a transaction ban on four banks in Belarus and Kazakhstan over connections to Russian financial-messaging and payment-system infrastructure, extending EU restrictive measures beyond Russia proper into the Central Asian financial corridor for the first time this cycle. The 20th package, adopted 23 April 2026, went further by designating Kazakhstan-based third-country suppliers of dual-use goods and weapons systems to the military-industrial complex of Russia, while in the same package the EU activated its anti-circumvention tool for the first time against neighbouring Kyrgyzstan, a mechanism whose extension toward Kazakhstan is now a live prospect rather than a remote one, given the shared corridor exposure.

Beneath the designation layer sits documented scheme architecture. Investigative reporting describes a false transit re-export scheme in which Kazakh-registered shell firms, including KBR-Technologies LLP and successor entities, receive Western semiconductor-production equipment as nominal end-users before re-routing the goods through Belarusian warehouses to sanctioned Russian military-industrial buyers such as Ostec Group. The resilience of the scheme depends on shared corporate personnel reused across successive shell-company registrations, allowing the network to survive individual designations, and on the customs-free movement provisions of the EAEU, which lower the friction cost of re-export relative to direct trade with Russia. A parallel aviation dual-use parts procurement route sees Russian carriers sustain Boeing and Airbus fleets by sourcing spare parts through an opaque network transiting Kazakhstan alongside Turkey, the UAE and India, using third-country one-day companies to obscure end-use. Both schemes exploit the same underlying condition: lighter or non-existent direct Western sanctions coverage of Kazakhstan and Belarus relative to Russia itself, a gap the escalation of the EU across the 19th and 20th packages is now visibly working to close.

The divergence between sanctions regimes compounds the transit-enabler picture. The UK designation of dual-national energy magnate Eduard Yurevich Khudainatov, effective 24 February 2025, applied an asset freeze and an additional trust-services prohibition under the Russia (Sanctions) (EU Exit) Regulations 2019 to reach Russia-linked energy wealth structured through Kazakhstan, a trust-services element that neither the EU nor the US has mirrored. At the same time, no confirmed parallel OFAC SDN action has been identified against the Belarus and Kazakhstan banks named in the EU 19th package or the dual-use suppliers named in the 20th, creating a listing-scope mismatch across the three regimes that complicates screening for firms operating under all of them. Public statements by Kazakh officials that the country will not blindly follow Western sanctions on Russia function less as rhetoric than as a structural signal: a political posture of selective compliance, prioritising domestic economic interests, that sustains rather than merely tolerates the enabling conditions documented in the false-transit and aviation-parts schemes. This is a capacity-deficit-versus-political-choice distinction with direct bearing on how enforcement expectations should be calibrated toward Kazakhstan relative to jurisdictions where evasion reflects supervisory weakness alone.

Outlook

Three forward elements bear on this trajectory. A proposed EU 21st sanctions package, expected during the second half of 2026, would extend trade controls to approximately fifty companies operating outside Russia, including entities domiciled in Kazakhstan, continuing the anti-circumvention and third-country designation trend established across the 19th and 20th packages; this is assessed rather than confirmed, and the adoption timing within H2 2026 remains uncertain. Whether the EU anti-circumvention tool, activated against Kyrgyzstan in the 20th package, extends formally to Kazakhstan will be the clearest structural marker of whether Brussels treats the wider Central Asian corridor as a unified evasion architecture. Absent a corresponding OFAC designation set, the divergence in listing scope between the EU, UK and US is likely to persist as a standing feature of the compliance landscape for firms screening Kazakhstan-linked counterparties, rather than a transitional gap that near-term US action would close. The Specific Goods Law licensing regime of Kazakhstan remains, in the absence of documented enforcement outcomes, an unverified substitute control layer rather than a confirmed mitigant.

Kazakhstan sits outside the AML Package perimeter of the European Union as a non-EU third country, so the directly relevant beneficial-ownership and corporate-transparency signal this cycle is the technical-compliance record of Kazakhstan under the mutual-evaluation process of the Eurasian Group, not EU instrument transposition. The 2023 EAG Mutual Evaluation Report rates Recommendation 26 for Kazakhstan, regulation and supervision of financial institutions, non-compliant, and Recommendation 25, transparency of legal arrangements, only partially compliant, alongside partial ratings across Recommendations 30, 31, 34, 35, 37 and 39. A non-compliant financial-institution-supervision rating is analytically significant beyond its own scope: it undermines the credibility of every downstream preventive measure that depends on a functioning supervisory backbone, including sanctions screening and beneficial-ownership verification, because the institution charged with enforcing those measures is itself assessed as structurally weak. Separately, the National Risk Assessment of Kazakhstan does not assess cross-border money-laundering risk despite the role of the country as a Eurasian transit hub, a gap in the risk-assessment methodology of the state itself, not a private-sector control failure, but one that leaves the transit-hub exposure documented elsewhere in this cycle structurally under-assessed at the level that should be catching it first.

The practical consequence of the partial-compliance gap under Recommendation 25 in legal-arrangement transparency is illustrated by the Caspian Cabals investigation of ICIJ, which documents use by the Kulibayev family of multi-jurisdictional offshore vehicles, structures spanning the British Virgin Islands and the Cook Islands among other secrecy jurisdictions, tied to Tengiz and CPC oil wealth. The legal-person beneficial-ownership framework of Kazakhstan is assessed as largely compliant via state registration under Recommendation 24, but that legal-person compliance does nothing to close the legal-arrangement gap that elite offshore structuring exploits. Exclusion of Kazakhstan from external high-risk mechanisms compounds the domestic picture: the December 2025 delegated-regulation update by the European Commission (2026/46, 2026/83) added Bolivia and the British Virgin Islands and delisted six African states without adding Kazakhstan, despite its EAEU and Russia-transit exposure, and Kazakhstan was similarly absent from the June 2026 Money Laundering Advisory Notice issued by HM Treasury. Both list determinations are pulled independently and warrant re-verification at each subsequent refresh, but their current alignment, exclusion from both the EU and UK high-risk third-country mechanisms, is itself a structural signal about the perimeter of those mechanisms rather than a neutral non-event.

Globally, the AML Package of the European Union sets the structural direction against which beneficial-ownership and corporate-transparency developments elsewhere are increasingly read, even though it does not apply directly to Kazakhstan. The Package comprises three distinct instruments: the AML Regulation, AMLR, Regulation (EU) 2024/1624, which is directly applicable across Member States without national transposition; the sixth AML Directive, 6AMLD, transposed individually by each Member State; and the AMLA Regulation, Regulation (EU) 2024/1620, which establishes the Anti-Money Laundering Authority and creates a direct-and-indirect supervision perimeter shifting oversight of high-risk cross-border obliged entities away from purely national authorities toward a hybrid EU-level regime. The only structural touchpoint of Kazakhstan with this architecture is the Article 9 high-risk third-country delegated-regulation mechanism, from which it remains absent; Kazakhstan-linked banks are instead reached through the parallel EU Russia-sanctions architecture rather than through the instruments of the AML Package itself. This durable three-instrument structure is the backdrop against which the EAG-assessed transparency gaps of Kazakhstan should be read, not the primary subject matter of the transparency exposure of Kazakhstan.

Outlook

The next EAG follow-up report for Kazakhstan, expected in the fourth quarter of 2026 into early 2027, will assess remediation progress against the non-compliant and partially-compliant ratings of the 2023 MER, and will be the clearest near-term marker of whether the gaps under Recommendation 26 and Recommendation 25 are closing or persisting. The financial-sector size of Kazakhstan is separately noted as a factor that could raise future referral risk under the revised June 2026 grey-listing criteria of FATF should the EAG process flag continued deterioration, even though Kazakhstan remains, as of the June 2026 plenary, off the Jurisdictions Under Increased Monitoring list. Both the EU and UK high-risk third-country lists should be re-checked at their next respective refreshes rather than assumed stable, given that the current exclusion of Kazakhstan reflects a determination made on a fixed reporting cycle rather than a permanent classification.

The standing of Kazakhstan as a mid-tier enabler jurisdiction for Russia-bound dual-use and sanctioned-goods flows rests on the same evidentiary base as this cycle D1 sanctions findings, viewed here through the lens of jurisdictional facilitation rather than the sanctions-instrument lens. The aviation dual-use parts procurement network is the clearest illustration: Russian carriers sustain Boeing and Airbus fleets by sourcing spare parts through an opaque trade network transiting Kazakhstan alongside Turkey, the UAE and India, using third-country one-day companies to obscure end-use before the parts re-enter the sanctioned jurisdiction. The false transit re-export scheme documented via Kazakh-registered shell firms performs the same enabling function for higher-value dual-use goods, specifically Western semiconductor-production equipment, exploiting customs-free movement under the EAEU to move goods onward to Belarusian warehouses and then to sanctioned Russian military-industrial buyers. What distinguishes the enabler role of Kazakhstan from a pure capacity-deficit reading is the accompanying political signal: Kazakh officials have stated publicly that the country will not blindly follow Western sanctions on Russia, prioritising domestic economic interests instead. Under the capacity-versus-choice distinction applied by filter F3, this is evidence weighing toward political choice rather than administrative weakness alone, and it changes the appropriate compliance posture toward Kazakhstan-linked counterparties: enforcement gaps here should not be assumed transitional or resource-driven.

The professional-facilitator dimension of this enabler role is structural rather than centred on any single named intermediary. Both documented schemes rely on reuse of shell-company personnel and third-country one-day companies rather than on individually identifiable professional-services firms, which is itself analytically significant: it suggests the facilitation infrastructure is corporate-registration-based and disposable by design, engineered to survive individual designations by regenerating under new corporate shells rather than depending on a fixed set of enablers who could themselves be targeted. This has direct implications for screening design: red-flag indicators centred on shared directors or corporate personnel reused across successive shell-company registrations following a sanctions designation, and on ostensible end-user representations for high-technology goods followed by re-routing via third-country warehouses, are more diagnostic than counterparty-name screening alone in this specific architecture.

The enabler status of Kazakhstan also needs to be read against the absence of an EU or UK high-risk third-country listing and against a divergence in listing scope in which the EU and UK have proceeded further against Kazakhstan-linked entities than the US has, at least absent a confirmed parallel OFAC designation set. This creates a jurisdiction that functions as an active transit enabler by documented conduct while simultaneously sitting outside every formal high-risk classification mechanism, precisely the combination that architecture-over-incident analysis treats as most significant, because the absence of a listing does not track the presence of the underlying risk.

Outlook

The clearest near-term test of the enabler-jurisdiction trajectory of Kazakhstan is whether the EU anti-circumvention tool, activated against Kyrgyzstan in the 20th package, is formally extended to Kazakhstan, and whether the proposed 21st package roughly fifty additional third-country trade-control designations materialise with Kazakhstan-domiciled entities among them as currently proposed. Continued absence of a parallel OFAC designation set would sustain the current asymmetry between enforcement and enablement across the EU, UK and US, leaving firms operating across all three regimes to rely on the more advanced designation architecture of the EU as the effective floor for Kazakhstan-linked screening. Firms conducting third-party risk assessments on Kazakhstan-domiciled trade counterparties should treat the current absence of a high-risk-third-country listing as uninformative about actual exposure, given the gap between formal classification and the documented conduct-based evidence of enabler activity assembled this cycle.

The material conflict-finance and extractive-industry integrity signal for Kazakhstan this cycle concentrates in a single but structurally consequential channel: the co-mingling of Kazakh-field crude with Russian-origin barrels within the blended output of the Caspian Pipeline Consortium. CPC Blend combines crude drawn from the Tengiz, Kashagan and Karachaganak fields of Kazakhstan with Russian-origin barrels as both move through shared Russian pipeline infrastructure toward the Black Sea export terminal at Novorossiysk. UK and US sanctions carveouts permit continued import of CPC Blend into Western refineries on the strength of nominal Kazakh-origin certification, without independent verification of the actual blend composition at the point of export. The active-scheme inventory characterises the role of Kazakhstan in this channel as mixed rather than purely enabling or purely passive: Kazakhstan neither originates the co-mingling risk nor controls the infrastructure through which it occurs, yet Kazakh-origin certification is the specific instrument through which the carveout is administered.

This is properly read as a sanctions-carveout co-mingling channel rather than as an enforcement gap in the conventional sense. The carveout itself reflects a deliberate Western policy choice: Kazakhstan retains a genuine commercial interest in CPC throughput, and Western economies retain a genuine dependence on Caspian crude that a blanket restriction on any oil moving through Russian pipeline infrastructure would disrupt. The structural weakness is not the existence of the carveout but its reliance on nominal, rather than independently verified, blend-composition certification. Because the pipeline runs through Russian territory to a Russian port before reaching Western buyers, any co-mingling that occurs upstream of independent verification has the practical effect of allowing a share of Russian-origin crude, and the war-economy revenue attached to it, to enter a sanctions-exempt commodity stream under cover of legitimate Kazakh production. The documented red-flag indicator here, co-mingled crude oil certified as single-country origin without independent verification of blend composition, is a trade-documentation-level signal rather than a transaction-level anomaly, meaning that no individual cargo or shipment need appear irregular for the channel to function as a durable revenue pathway over time.

The extractive-industry integrity dimension compounds the conflict-finance reading rather than sitting apart from it. The extractive sector of Kazakhstan itself is not the subject of adverse findings this cycle; the risk documented here is a downstream consequence of shared transport infrastructure rather than a governance failure within the upstream oil sector of Kazakhstan. This distinction matters for how the finding should be weighted: it is a structural vulnerability inherent to the CPC transport architecture, not evidence of extractive-sector corruption or state capture within Kazakhstan itself, and it should not be conflated with the separate elite-offshore-structuring findings documented elsewhere in this cycle beneficial-ownership assessment, even though both ultimately trace back to the oil-wealth base of Kazakhstan.

The absence of independent blend-composition verification means the scale of revenue diversion through this channel cannot currently be quantified with confidence. The assessment supportable on current evidence is that a structural channel exists and remains active, not that a measured volume of Russian-linked revenue has been confirmed to pass through it. This is precisely the class of finding that architecture-over-incident analysis is designed to surface: no single enforcement action or seizure marks this channel as active, and a purely incident-based monitoring approach would likely miss it entirely in the absence of a triggering event.

Outlook

No change to the CPC Blend carveout or its underlying verification regime is documented within this cycle regulatory horizon, and the channel is best characterised as stable and structurally unaddressed rather than actively deteriorating or improving. Any tightening would most plausibly originate from a UK or US rule change requiring independent verification of blend composition at export, rather than from action attributable to Kazakhstan, which does not control the pipeline infrastructure or the export terminal through which the co-mingling physically occurs. Absent such a change, this channel should be treated as a durable rather than transitional feature of the broader Russian sanctions-evasion architecture, warranting continued cross-monitor tracking through the war-economy financing coverage of SCEM and the commodity-flow monitoring of ERM, both of which this cycle finding has been flagged toward at medium strength.

The digital-asset regulatory environment of Kazakhstan itself, not the MiCA framework of the European Union or the global virtual-asset standards of FATF, is the directly relevant starting point for this cycle D5 signal. Kazakhstan operates a dual-track posture: a regulated sandbox under the Astana Financial Services Authority, AFSA, within the Astana International Financial Centre, AIFC, progressing toward full VASP licensing with embedded Travel Rule compliance during 2026, alongside a large and persistently under-supervised gray-market cryptocurrency mining sector. The June 2025 Best Practices on Travel Rule Supervision issued by FATF cited the AFSA sandbox as a positive example of embedded Travel Rule supervisory technology for VASP oversight, a genuine active-defence signal that should not be discounted by the parallel gaps documented elsewhere in the crypto sector of Kazakhstan. This dual-track structure, rather than any single incident, is the durable feature that this cycle assessment treats as the primary D5 finding for Kazakhstan.

Those parallel gaps are material. Kazakh authorities have struggled to enforce against gray-market mining operators who register their businesses abroad specifically to exploit regulatory loopholes, a sector that sits entirely outside the AML/CFT and Travel Rule controls of the AIFC/AFSA sandbox and that has separately strained the power grid of Kazakhstan. More directly relevant to sanctions-evasion exposure, the exchange Exmo.me, serving a combined Russia, Belarus and Kazakhstan user base, continues to show direct transaction links to the sanctioned Russian exchange Garantex, a linkage that a March 2026 update by Elliptic corroborates as persistent rather than historical. The Kazakhstan-facing customer base is analytically significant here beyond its raw transaction volume: it provides plausible-deniability cover and cross-border liquidity for settlement infrastructure that is otherwise oriented around Russia-sanctions evasion, allowing ruble-to-crypto off-ramp activity to route through an ostensibly multi-country retail exchange rather than through an exchange transacting only with Russian counterparties.

Read against the global backdrop, the phased implementation of MiCA and the virtual-asset standards of FATF set the direction for VASP supervision generally, but the crypto-integrity trajectory of Kazakhstan this cycle is determined by the interaction of its own sandbox-to-licensing transition with its own gray-market enforcement gap, not by convergence toward the EU model. Progress on the AFSA sandbox is a genuine improvement in the regulated segment; it does nothing on its own to close the gray-market segment or to sever the Exmo.me-Garantex linkage, since neither currently falls within the supervisory perimeter of AFSA. This bifurcation between regulated-segment progress and unregulated-segment exposure is itself the structural finding meriting continued tracking, independent of whether any single new enforcement action against Exmo.me materialises. The trajectory assessed for the crypto posture of Kazakhstan is therefore worsening on balance this cycle, reflecting the persistence and corroboration of the sanctioned-exchange linkage and the gray-market enforcement gap, notwithstanding genuine progress on the regulated sandbox side.

Outlook

The AFSA sandbox-to-full-licensing transition, expected during 2026, is the clearest near-term determinant of whether the crypto sector of Kazakhstan materially tightens AML/CFT controls within the regulated perimeter; whether that transition extends supervisory reach to currently unregulated gray-market mining activity is a separate and currently unresolved question. The Exmo.me-Garantex transaction linkage should be treated as a standing rather than episodic exposure absent a specific enforcement action against Exmo.me itself, given two independent corroborating observations across this cycle and the preceding one. Firms with VASP counterparty or MSB exposure touching the Kazakhstan corridor should weight the persistence of this linkage more heavily than the improving sandbox-licensing trajectory when assessing net crypto-sector risk direction for Kazakhstan.

The Compliance Technology and Active Defence signal for Kazakhstan this cycle is limited and derivative of the D5 crypto-posture finding rather than a distinct RegTech or SupTech development in its own right. The only documented item is the June 2025 Best Practices on Travel Rule Supervision issued by FATF citing the AFSA regulatory sandbox within the AIFC as a positive example of embedded Travel Rule supervisory technology for VASP oversight. This is a genuine active-defence signal, a jurisdiction-level supervisory tool recognised by the standard-setting body itself, but it is properly a crypto-sector development being cross-referenced into D6 rather than an independent compliance-technology finding, since no separate SupTech, transaction-monitoring, or screening-technology development for Kazakhstan was identified within this cycle research window.

The absence of a distinct D6 development this cycle should be read as a coverage gap in available reporting rather than as evidence that Kazakhstan lacks compliance-technology activity; FIU enforcement statistics specific to Kazakhstan, including STR volumes, ML prosecution outcomes and confiscation data, were not available in English-language primary sources within the research window, which constrains any independent assessment of technology-enabled detection or enforcement capability beyond the AFSA sandbox reference. This domain is flagged as limited-signal for this cycle pending fuller documentation.

Outlook

The D6 status of Kazakhstan is best tracked through the D5 AFSA sandbox-to-licensing transition expected during 2026, since embedded Travel Rule compliance is the primary compliance-technology deliverable currently visible for Kazakhstan; a distinct D6-specific development, separate from the crypto-sector licensing track, was not identified this cycle and none is currently expected on the near-term regulatory horizon.