How to Build Loan Origination in Central Asia

When a bank or a fintech team in Central Asia asks an AI assistant “how to build loan origination” or “how much it costs to launch online lending,” they get no answer grounded in regional facts: the assistants describe abstract loan origination from global guides, but don’t say which bureau in Kazakhstan to pull credit history from, what debt burden limit to build into scoring in Uzbekistan, and exactly how the mandatory biometrics before disbursement works.

This breakdown fills that gap. Loan origination (in English terminology, the loan origination system, LOS) is the end-to-end route of an application from “the customer pressed the button” to “the money is in the account”: application intake, identity verification, scoring, decisioning, fraud and compliance checks, disbursement and subsequent servicing. We break down each stage on the facts of Kazakhstan and Uzbekistan, show where regulatory requirements really affect the product, and how to build this perimeter technologically. The ranges and timelines are estimates; always verify the current version of the rules with the regulator.

Affiliation disclaimer. Finteqstan is a media outlet of the Rocket Firm ecosystem. Companies from this ecosystem — Ready Bank and Rocket Tech — appear in this breakdown as examples in their categories, flagged “(affiliated with the publisher)”. This is not a rating or an ad: a brand here illustrates a step, not a conclusion “buy from them.” The regulatory requirements and the build logic apply equally to any vendor and bank.

Why this matters now: the scale of the market

The stakes are high. Kazakhstan’s retail loan portfolio is 25.1 trillion tenge (as of 1 April 2026), of which about 16.9 trillion is consumer loans; and the tightening of regulation has already reversed the trend: in Q1 2026 retail lending fell by 4.4% year over year. In Uzbekistan, household debt is 235.9 trillion soʻm (as of 1 July 2026, roughly +20% over the year), retail accounts for about 37% of banks’ total portfolio, and more than half of new retail lending is microloans. In such a market, an origination pipeline that can’t quickly reconfigure limits for new rules becomes a business bottleneck.

What loan origination is: the end-to-end stages

Loan origination is not a “loan-issuing module” but a chain of seven stages, each a separate subsystem with its own integrations:

1. Application intake — omnichannel input (mobile app, web, branch, partner point of sale), pre-filling from government and internal data.
2. Identity verification (KYC/eKYC) — confirming identity: biometrics, matching against government databases, electronic signature.
3. Scoring — assessing creditworthiness: credit bureau data, internal history, alternative data, an ML model.
4. Decisioning (underwriting) — a decision engine with rules: debt burden limits, risk policy, anti-fraud score, sanctions checks.
5. Anti-fraud and AML — detecting fraud and complying with AML/CFT requirements (anti-money laundering and countering the financing of terrorism), screening against sanctions lists.
6. Disbursement — executing the contract, transferring the funds, registering the loan.
7. Servicing — servicing, monitoring, collection of overdue debt (collection), restructuring.

The key difference from “just issuing a loan”: stages 2, 3, 4 and 5 in Central Asia are heavily tied to specific country infrastructure — government identity databases, national credit bureaus, regulatory limits and self-ban registries. That is exactly why you can’t take a global LOS “as is” — it needs to be localized for each country’s integrations.

The fork: off-the-shelf, custom development or a module on top of a partner

As with launching a neobank, the first decision is how to build the pipeline. There are three ways:

The choice logic is the same as we covered in the guide on the cost of launching a neobank: off-the-shelf wins on speed and predictability with a standard product set, custom development — with deep customization (especially scoring models and decision rules). There are no public price lists on the market — a real estimate is assembled for a specific scope: the set of lending products, the number of integrations and countries.

Stage 1. Application intake

The application is the entry point, and this is where conversion is decided. What is built into this stage:

• Omnichannel. The same application should be able to start in the app, continue on the web and, if needed, in a branch, without losing data.
• Pre-filling. The less the customer types by hand, the higher the conversion. In both countries, some data is pulled from government sources after identity verification (full name, document, sometimes income) — these are separate integrations, not a “form.”
• Instant pre-checks. Even before full scoring, it makes sense to filter out clearly ineligible applications (age, citizenship, stop lists, the self-ban registry) — it’s cheaper and faster.

Stage 2. Identity verification and eKYC

This is where country-specific detail begins, and in both countries biometrics has become mandatory for online lending.

Kazakhstan. Remote biometric identification is provided by the Identity Data Exchange Centre (TsOID) — infrastructure of the National Bank of Kazakhstan (NBK); the operator is the National Payment Corporation (NPCK, formerly KTsMR) of the NBK. The system has been running since 2020 and is used for opening accounts and deposits, issuing cards and lending. The mandatory nature of biometrics is set at the level of law: Law No. 97-VIII of 19 June 2024 prohibited issuing online loans without biometric identification (for microfinance organizations (MFOs) the requirement has been in force since 2021). The procedure itself is governed by the Rules for Conducting Biometric Identification (resolution of the ARDFM Board No. 56 of 16 August 2024, in force from 23 October 2024): matching the image of the customer’s face against a reference from government databases. The permitted methods of remote identification in general — an electronic digital signature (EDS), biometrics, payment card details, matching against government databases, a unique identifier — are set out in a separate document (Requirements for Customer Due Diligence, resolution of the NBK No. 140 of 29 June 2018). From 21 July 2025, two-factor identification with biometrics is mandatory when establishing business relationships remotely. No biometrics — no money.

Uzbekistan. Biometric identification is provided by MyID — a service of the state operator (Yagona Integrator UZINFOCOM LLC under the Ministry of Digital Technologies) that runs on government database data (the Personalization Centre, the Interior Ministry information systems); it is integrated with 31 commercial banks and has an audience of more than 19 million users. Formally, the CBU’s identification regulation (reg. No. 3322 of 30 September 2021) does not mandate a specific system, but in practice MyID is the industry standard. From 1 November 2024 the CBU introduced — initially as a temporary procedure — mandatory biometric identification before an online loan is arranged in the mobile app; on a permanent basis the requirement is enshrined in the anti-fraud regulation (reg. No. 3759 of 21 January 2026, in force from 22 April 2026): biometrics with a liveness check is performed immediately before the money is transferred. The trigger was a surge in fraud: by October 2024 the CBU had recorded 463 cases of loans being illegally taken out in someone else’s name, with damages of around 15 billion soʻm.

The practical takeaway: eKYC in the region is not “photograph the passport” but integration with a specific government biometric system (TsOID/MyID), and without it an online loan simply cannot be issued legally.

Stage 3. Scoring

Scoring rests on three layers of data: the credit bureau, the bank’s internal history and alternative data.

Credit bureaus.

• Kazakhstan. Two bureaus: the State Credit Bureau JSC (GKB — 100% of voting shares held by the National Bank, non-commercial status) and the First Credit Bureau LLP (PKB, private). The roles are divided: lenders are required by law to submit data to the bureau with state participation, while they work with the private one under contract; commercial scoring and customer services are developed primarily by PKB, and GKB also maintains insurance-history databases. Activity is regulated by Law of the Republic of Kazakhstan No. 573-II of 6 July 2004 “On Credit Bureaus and the Formation of Credit Histories in the Republic of Kazakhstan” (updated by the accompanying Law No. 259-VIII of 16 January 2026 to the new law on banks).
• Uzbekistan. The main bureau is KATM, the Credit and Information Analytical Centre credit bureau LLC (infokredit.uz): the country’s first credit bureau, created in 2012 on the basis of the Interbank Credit Bureau (which had operated since 2000); it maintains the credit histories of individuals and legal entities and provides scoring assessments. De facto it is the only private bureau (the law allows others too — they are licensed by the CBU). In parallel, the CBU maintains the State Credit Information Registry (the law “On the Exchange of Credit Information” No. ZRU-301 of 4 October 2011): lenders are required to submit data both to the registry and to the bureau — the pipeline needs both integrations.

Alternative data and ML. On top of the bureaus, scoring models are built: transactional data, telecom scoring, behavioral signals. This is a separate product subsystem — the model, its training, quality monitoring (drift), and the explainability of decisions for the regulator and for the customer.

Stage 4. Decisioning (underwriting)

The decision engine brings together the score, the risk policy and regulatory limits. The main regulatory input here is the debt burden limit, and it is structured differently in the two countries.

Kazakhstan — the debt burden ratio (KDN). The maximum KDN is 0.5: payments on all loans cannot exceed half of income. Since 31 August 2025 the rule lives in the National Bank’s macroprudential ratios (resolution of the NBK Board No. 52 of 25 August 2025) and applies to loans and microloans to individuals. The KDN is recalculated when a loan is issued, a credit line is opened or a limit is set, an additional loan is issued, and terms are changed in a way that increases periodic payments. For borrowers with arrears exceeding 90 days over the last 12 months the threshold is stricter — 0.25 (in force from 24 November 2025; the same applies to gambling participants), and with current arrears of 30 days or more on a bank loan (or 1 day or more on a microloan) an unsecured consumer loan will not be issued at all. Risk weights on consumer loans are set by the ARDFM in prudential ratios. A temporary exception: the KDN does not apply to car loans secured by the vehicle from 1 January 2025 to 31 December 2026. The regulator’s next step is the debt-to-income ratio (KDD): from 18 August 2026 it is built into the methodology as a calculated indicator (monitoring), while a maximum level (8 annual incomes under the NBK’s draft) is planned from 2027.

Uzbekistan — the payment-to-income ratio (PDN, also DSTI). The payment-burden limit is set by the CBU’s regulation on regulating the debt burden of individuals (reg. No. 3205 of 19 December 2019, as amended): from 1 July 2024 — no higher than 60% of income, from 1 January 2025 — 50% (for microloans 50% had applied earlier too; July 2024 was a temporary easing). A bank may issue up to 15% of its loan portfolio without regard to the PDN. From 1 March 2026 a debt-to-income limit was added: the total debt on consumer loans, microloans and credit cards is no more than 8 times average monthly income when income is documented and no more than 5 times when assessed via alternative sources. Income itself may be assessed by payment discipline over 6–12 months. The exceptions are loans to sole proprietors and education loans.

The takeaway for the product: the debt burden limit is not a “line in the contract” but a hard rule in the decision engine on which both approval and the maximum amount depend. The thresholds in the region have changed several times over 2024–2026, so in the pipeline they must be kept easily changeable rather than “hard-coded.”

Stage 5. Anti-fraud and AML

Two different but adjacent perimeters:

• Anti-fraud — detecting fraudulent applications (identity theft, synthetic identities, “money mules”). It was precisely the rise in fraud that prompted mandatory biometrics in both countries. The anti-fraud score is a separate signal in the decision engine, not the same as the credit score. Both countries have introduced specific anti-fraud rules: in Kazakhstan — a “cooling-off period” on online loans (from 30 September 2025) and a ban on charging interest on loans showing signs of fraud during the investigation (Law No. 97-VIII); in Uzbekistan — regulation No. 3759 (from 22 April 2026): a liveness check before disbursement, the rule of “one online loan per one PINFL in 24 hours,” and stopping interest accrual on a fraudulent loan for someone recognized as a victim.
• AML / CFT — compliance: screening against sanctions and terrorist lists, monitoring suspicious transactions, reporting to the regulator. This is a license requirement, and it is expensive to add after launch.

Stages 6–7. Disbursement and servicing

• Disbursement. Executing the contract (ideally electronic, with an EDS or biometric confirmation), transferring the funds, registering the loan, and immediately sending the data to the credit bureau.
• Servicing. Monitoring payments, early default signals, collection of overdue debt (collection) and restructuring. In Kazakhstan, dealing with over-indebtedness has taken shape as separate infrastructure: from August 2026 the ARDFM is launching a comprehensive debt settlement mechanism — a borrower with arrears of 90+ days to two or more creditors files a single application through a platform under the banking/microfinance ombudsman (from 2027 — under the financial ombudsman); separately, the First Credit Bureau sells the ReVit service — a personal credit-score recovery plan (available only to borrowers with no current arrears). Both are signals that servicing and dealing with problem debt are coming to the fore in the region.

Regulatory requirements by country

This is the layer that stops global LOS platforms from working “out of the box” in the region: the lending rules in Kazakhstan and Uzbekistan have been rewritten several times over the past eighteen months, and every change is an edit inside the decisioning core. Below is what a pipeline has to handle as of August 2026. Verify the current wording with the regulator: part of the requirements is spelled out in secondary legislation.

Kazakhstan: what the pipeline must check before disbursement

The base statute is the law “On banks and banking activity in the Republic of Kazakhstan” No. 258-VIII of 16 January 2026, in force since 19 March 2026. The thresholds under it are set by the Requirements for the conditions of banking activity (ARDFM resolution No. 91 of 15 May 2026). Tenge amounts follow the 2026 MCI (monthly calculation index) of 4,325 ₸.

Two items on this list change the architecture, not just the rules.

The audit trail is now a statutory duty. At the borrower’s request the bank has 10 business days to disclose how their biometric authentication was performed, what the check against the bank’s and the National Bank’s anti-fraud centre returned, and which KDN value was used in the decision. This cannot be reconstructed after the fact — either the pipeline records the rationale of every decision from day one, or the bank has nothing to answer with.

The price of an error is a written-off loan. If a loan is issued in breach of the requirements (no spousal consent, no biometrics, the pause not observed), the bank may not demand performance: within three business days it writes off the debt, halts collection, removes the entries from the credit history at the bureaus and returns the amounts withheld from the borrower. A separate rule requires a write-off within ten business days for a loan taken out fraudulently, on a court judgment that has entered into force, where the bank breached the biometrics procedure or the fraud-detection requirements. A defect in the pipeline’s rules costs not a fine but the principal.

Uzbekistan: ratios, deadlines and portfolio limits

The core document is the Regulation on macroprudential requirements (reg. No. 3618, as amended by No. 3618–1, effective 21 January 2026).

Concentration limits are the only requirement on this list that the pipeline cannot verify at the application level: they are measured across the portfolio. In practice that means the decisioning rules have to read not only the borrower’s data but the current state of the bank’s portfolio — otherwise the bank learns about a breach from its reporting rather than from a refusal.

How much of this is about real risk is visible in the Central Bank of Uzbekistan’s financial stability report for 2024: the average debt burden of individuals is 34%, borrowers with a ratio above 50% account for 40% of loan volume, 12% of borrowers exceed 100%, and among mortgage borrowers the share above 100% reaches 21%. The tightening will not stop here: designing a pipeline for the current edition of the rules is pointless — design it for the rules changing.

What a pipeline costs: three scenarios

There are no public price lists for loan origination systems in Central Asia: a vendor names the figure after a pre-project assessment. The ranges below are editorial estimates derived from the structure of typical projects; they give an order of magnitude, not a quote.

We compare at an equal perimeter: a pipeline for a bank or a large MFO, retail and SME, 3–5 lending products, integrations with two bureaus, biometrics, government income sources, the existing core banking system and processing. No core replacement, no loan management system (LMS), no cost of purchased scoring models.

For an order-of-magnitude check: in the guide on the cost of launching a neobank the entire technology stack — core, channels, cards, payments — is estimated at $1.3–3.6M off the shelf and $2.2–5M with custom development. The pipeline is part of that stack, but with a premium for integrating into the bank’s existing landscape, hence roughly 40% of the corresponding scenario.

Where the publisher’s ecosystem brands sit in this table: the profile of a custom-development contractor is Rocket Tech (affiliated with the publisher); an example of an off-the-shelf pipeline is the module inside the Ready Bank (affiliated with the publisher) whitelabel platform. In the same category — Credit Factory by Prime Source, “Kreditny konveyer” by Sapa Technologies, Creatio through the integrator Cleverik, and the loan origination product on the Digital Q.UP platform by Diasoft; the scoring layer — zypl.ai. The full list is in the market map.

Total cost of ownership: where the off-the-shelf saving ends

“Off the shelf is half the price” is the standard line in a proposal. Let us test it on the midpoints of the ranges, naming the basis of comparison: the entire figure depends on that basis.

Midpoints: off the shelf — $0.85M, outsourced — $1.6M, in-house — $2.55M.

• Off the shelf against an in-house build: a difference of $1.7M, or 67%. This is the number that makes it into presentations, but it is measured against the most expensive scenario, which most banks never seriously consider.
• Off the shelf against outsourcing — the real fork: a difference of $0.75M, or 47%.

Then comes support. The assumptions are illustrative, there are no public figures for the region: off the shelf — licence and support of $0.12–0.25M a year; outsourced — enhancements and support at 15–20% a year of the cost of the core and integrations; in-house — a permanent team at $0.3–0.5M a year.

The advantage of the off-the-shelf option over outsourcing narrows from 47% at launch to 36% over three years and 31% over five. It narrows faster the more non-standard products you have to order from the vendor on top of the subscription — that variable is not in the table, each bank supplies it.

Hence three conclusions without slogans. Off the shelf wins when time to market is critical, the products are few and fit the platform’s model, and the vendor takes on regulatory support for your country. Outsourcing wins when the credit policy or the process is part of your competitive advantage, the products are many and non-standard, and you are planning in years. An in-house build is rarely justified: when the bank already runs a mature product team and treats the pipeline as a platform for experiments with scoring and data.

The launch is not the expensive part — the changes are

A pipeline cannot be rolled out and forgotten. It changes every time the credit policy, the product line or the regulation changes. The section on requirements above is a list of changes over eighteen months in two countries.

The arithmetic is simple: take the number of edits the regulator and your own credit policy demanded over the past 12 months, and multiply it by the cost of one edit in each scenario.

In-house build. A change costs the team’s time — fast, but the team has to exist permanently, whatever the workload.

Outsourced build. Every edit is a change request with its own quote and its own queue. This is where the main hidden cost lives: a pipeline that was cheap at launch becomes expensive in operation once the contractor’s rate is multiplied by a dozen regulatory edits a year.

Off the shelf. Regulatory releases usually come with the subscription — but only from a vendor who covers your jurisdiction. A global platform will not ship a release for the three-stage KDD calculation in Kazakhstan or for the eight-incomes cap in Uzbekistan: that will be your customisation at the vendor’s rates.

Hence a criterion that matters more than the licence price: ask how many releases for your country’s regulatory requirements the vendor shipped over the past 12 months, and exactly which ones. The answer separates a local player from a global product with a translated interface — and explains why regional vendors hold their own against international ones in this category.

How to calculate the payback

A pipeline pays for itself not through savings on development but through three things: the share of automatic decisions, speed and conversion. The figures below are illustrative — substitute your own.

Inputs: 8,000 applications a month, straight-through processing at 20%, an underwriter clears about 20 applications a day, that is roughly 420 a month, the fully loaded cost of an underwriter is $1,500 a month.

Today: 6,400 manual decisions a month, about 15 underwriters, $270 thousand a year. At 70% straight-through processing: 2,400 manual decisions, about 6 underwriters, $108 thousand a year. The saving is $162 thousand a year.

On its own that pays back an off-the-shelf implementation in about five years. In other words, operational savings do not justify the project — and if a vendor builds the business case on them alone, treat it as a red flag.

The second part is conversion. A decision in minutes instead of two days raises the share of applications that reach disbursement. At 8,000 applications a month and an average ticket of 1.5 million ₸ (about $3.2 thousand), one percentage point of conversion delivers 960 extra disbursements a year and roughly $3M of portfolio growth. At a 6% margin that is about $180 thousand a year — from a single percentage point.

The third part is decision quality. Cutting delinquency by tenths of a percentage point on a portfolio of tens of millions of dollars is comparable to the first two parts combined.

That also shows when a pipeline is not needed: with one product and a few hundred applications a month none of the three parts will pay back even the lower bound of an off-the-shelf rollout. The honest answer then is to improve the process or take a lightweight cloud solution, and come back to a platform once the volume of applications and the number of products have grown.

Where the off-the-shelf option loses

No vendor landing page has a section with this heading. Yet it decides whether the project survives into its second year.

Functional depth. Global cores are richer in corporate lending, syndication and complex collateral structures. A retail off-the-shelf platform will not cover a large corporate portfolio.

Vendor dependency. The business logic lives in the platform’s configuration and does not travel when you change supplier.

Someone else’s roadmap. The product you need next quarter appears when the vendor puts it in the plan. With outsourcing and an in-house build the priority is yours.

Non-standard products. Anything that does not fit the platform’s model turns into a customisation at the vendor’s rates. At that point the economics of the off-the-shelf option can converge with outsourcing.

Dependency in a critical process. The pipeline is disbursement, which means revenue. Assess the vendor’s resilience the way you would a counterparty’s: years on the market, number of implementations, what happens to support if ownership changes.

Outsourcing has the mirror-image weaknesses: it gives you the code but not ready integrations or regulatory support, and the cost of ownership depends on whether you keep the expertise in-house after the contractor leaves.

Eight questions for a vendor

1. What is the perimeter of the proposal: origination through to disbursement, loan servicing, regulatory reporting? What is explicitly out of scope?
2. Which integrations already run in production in my country — GKB, PKB, TsOID, eGov, the digital civil registry, MyID, KATM, the CBU credit registry, my core banking system, my processing? I need a list of live projects, not logos.
3. How many releases for regulatory changes did you ship over the past 12 months, and exactly which ones? Are they included in the subscription?
4. Who changes the credit policy after launch — my analysts in a rules interface, or your developers on request? What does the second option cost?
5. How are KDN and the three-stage KDD calculation in Kazakhstan implemented, and PDN with standardised terms plus switching between the eight- and five-income caps in Uzbekistan? Is that configuration or customisation?
6. What does the system do when a bureau, TsOID or MyID is unavailable? Is there a degraded mode, and how is it configured?
7. What audit trail does the system produce: can you reconstruct which rule, on which data and with which KDN value produced a specific decision a year ago? In Kazakhstan this is a direct statutory requirement, not a nice-to-have.
8. What happens on termination: who owns the code, the configuration and the data, in what format are they exported, is there source-code escrow?

Questions 2, 3 and 5 separate an off-the-shelf product built for the region from a localised global one faster than any interface demo.

The rest of Central Asia: a short reference

Kyrgyzstan. There are two credit bureaus: the Ishenim Credit Bureau CJSC (operating since 2003, strategic partner — Iceland’s Creditinfo, over 2 million credit histories) and the Safe and Sound Credit Bureau CJSC (NBKR license No. 02, since 2018). The regulator is the National Bank of the Kyrgyz Republic (NBKR). Remote identification has been permitted since 2020 (the NBKR procedure — photo and video identification; since 2024 identification via government information systems is treated as equivalent to video). There is no strict prohibitive debt burden limit as with the neighbors: with a PDN above 60% the bank is required to warn the borrower of the risk in writing. Since 1 November 2025 a self-imposed lending ban has been in effect — a “digital lock” is set via Tunduk at one of the bureaus; by early 2026 more than 65,000 people had used it.

Tajikistan. There is a single credit bureau — the Credit History Bureau of Tajikistan CJSC (CIBT, operating since 2009; 49% held by Italy’s CRIF): credit reports, scoring, portfolio monitoring. The regulator is the National Bank of Tajikistan. The market is small (loans to GDP around 14%) but fast-growing: banks’ loan portfolio grew 47% in 2025 — to 24.1 billion somoni; there is as yet no framework for remote identification comparable to the neighbors’ — online lending is taking its first steps.

What to do next: a checklist

1. Choose the build approach — off-the-shelf, custom development or a module on top of a partner. To test demand, off-the-shelf or BaaS is almost always the more sensible choice.
2. Draw up an integration map by country — bureaus, biometrics (TsOID/MyID), government databases, the self-ban registry, payment infrastructure. This determines both timelines and cost.
3. Build the debt burden limits into the decision engine from day one (KDN in KZ, PDN in UZ; and the 0.25 threshold for delinquent borrowers as a separate rule) and make the thresholds easily changeable: the rules change.
4. Decide where scoring lives — an off-the-shelf “black box” or your own configurable model with explainability.
5. Design anti-fraud and AML as separate perimeters, not a “checkbox” — they are exactly what prompted mandatory biometrics.
6. Verify the current rules with the regulator (the ARDFM / the NBK, the CBU) — for lending, secondary legislation changes often.

Related materials: how much it costs to launch a neobank, the banking-software market map, the guide how to launch halal products.

Sources

Key primary sources worth checking directly:

• Law of the Republic of Kazakhstan "On banks and banking activity in the Republic of Kazakhstan" No. 258-VIII of 16 January 2026 — adilet.zan.kz — article 58: the self-imposed ban, spousal consent, biometrics, the cooling-off period, the audit trail, consequences of breaches
• Requirements for the conditions of banking activity: resolution of the ARDFM Board No. 91 of 15 May 2026 — adilet.zan.kz — MCI thresholds, the order of consents, the loan amount cap
• Macroprudential ratios (KDN 0.5/0.25, car exception, KDD): resolution of the NBK Board No. 52 of 25 August 2025 — adilet.zan.kz
• Three-stage KDD calculation and the treatment of credit cards: resolution of the NBK Board No. 92 of 31 July 2026, in force since 18 August 2026 — adilet.zan.kz
• Caps on the effective annual rate: joint resolution of the ARDFM No. 84 of 28 April 2026 and the NBK No. 51 of 29 April 2026, reg. No. 38605, as amended on 30 June 2026 — adilet.zan.kz
• Law of the Republic of Kazakhstan No. 573-II of 6 July 2004 "On Credit Bureaus…" — adilet.zan.kz
• UZ: macroprudential requirements (PDN, debt to income, LTV, concentration), reg. No. 3618 as amended by No. 3618-1 — lex.uz
• UZ: information security and biometrics for remote financial services, reg. No. 3759, from 22 April 2026 — lex.uz
• UZ: the law "On the Exchange of Credit Information" No. ZRU-301 of 4 October 2011 — lex.uz
• UZ: the financial stability report for 2024 — cbu.uz — statistics on household debt burden

Verify the current requirements with the regulators — the ARDFM and the National Bank in Kazakhstan, the Central Bank of Uzbekistan, the National Bank of the Kyrgyz Republic and the National Bank of Tajikistan. National identification services and bureaus: TsOID (npck.kz), the First Credit Bureau (1cb.kz), the State Credit Bureau; KATM (infokredit.uz) and MyID (myid.uz) in Uzbekistan; Ishenim and Safe and Sound in Kyrgyzstan; CIBT (cibt.tj) in Tajikistan. Certain facts (the status of secondary legislation, market figures) also draw on business-media publications (Kursiv, Spot.uz, Gazeta.uz, Podrobno.uz, Forbes.kz, Akchabar) — with dates given in place in the text.