A bank choosing colocation in Kazakhstan is not shopping for a Tier badge. Two instruments set the location and the physical controls. Neither of them says “place the systems in a certified Tier facility.”
Which document applies
The current information-security requirements for banks, branches of non-resident banks, and organisations that carry out certain banking operations are Agency for Regulation and Development of the Financial Market Resolution No. 53 of 3 April 2026, registered with the Ministry of Justice on 6 April 2026 as No. 38336.
That resolution repealed National Bank Resolution No. 48 of 27 March 2018. Searches and older checklists that still cite “NBK No. 48” are pointing at a document that is no longer in force. The physical-security list moved into paragraph 12 of the 2026 requirements.
A second instrument is still in force and was amended as recently as December 2025: National Bank Resolution No. 34 of 28 January 2016 on the security and continuity of bank information systems. Clause 18-1 requires at least one backup center in a different locality from the primary center. Both the primary center and the backup center must be located in the Republic of Kazakhstan.
Personal-data localisation is a separate statute. If the systems hold data of Kazakhstani citizens, see the guide on data localisation in Kazakhstan.
What the data center must have
Resolution No. 53 defines a bank’s data center as a dedicated room in which the servers that run the bank’s information systems are placed. Paragraph 127 requires that room to be equipped with:
- an access-control system;
- an intrusion alarm;
- a fire alarm;
- an automatic fire-suppression system that covers the whole volume of the room and has a reserve supply;
- a system that holds temperature and humidity to set parameters;
- video surveillance with no uncovered zones inside the room or in front of the entrance.
Server and communications equipment is connected to power through uninterruptible power supplies.
Access is limited to a list approved by the head of information technology and agreed with the information-security unit. The access-control log is kept for at least one year. Video is recorded continuously or by motion detector, and the archive is kept for at least three months.
These duties stay with the bank. A colocation contract does not transfer them. The bank still approves the access list, keeps the log, and has to be able to show an examiner that the room matches paragraph 127.
What this is not
It is not a Tier requirement. The resolution does not mention Uptime Institute, Tier III, or Tier IV. A facility can satisfy the physical-security list without a Tier certificate, and a Tier certificate does not by itself satisfy the list.
It is not PCI DSS. PCI DSS applies to an entity that stores, processes, or transmits cardholder data. Requirement 9 of that standard covers restricted physical access, visitor logs, and cameras. A colocation site can be a place where the bank implements those controls. Akashi does not publish a PCI DSS Attestation of Compliance, and a design document is not one.
TCDD is not TCCF. Akashi holds an Uptime Institute Tier IV design certification (TCDD). The constructed-facility audit (TCCF) is scheduled for April 2027, and the first phase launches in 2027. TCDD confirms the design documents. It does not confirm that a built hall has already passed an operational inspection. The difference is set out in Tier III or Tier IV: what changes in a colocation contract.
What a bank can check now
The campus is under construction. A reservation conversation can map paragraph 127 onto the design. It cannot yet be a walkthrough of a live hall. The products on offer are a dedicated server room, a private cage, and cabinet rental.
Questions worth putting in the RFP:
- Where, physically, will the primary room sit, and is a second site in another Kazakhstani city part of the design or a separate contract?
- Which of the six systems in paragraph 127 are in the design, and which remain the bank’s own equipment or procedure?
- Who approves the access list, and who retains the one-year access log and the three-month video archive?
- Which document is being offered as evidence of reliability: TCDD, a target availability figure, or a future TCCF?
Frequently asked questions
Does a bank in Kazakhstan have to use a Tier-certified data center?
No. ARDFM Resolution No. 53 of 3 April 2026 requires a defined set of physical-security systems and the bank’s own access procedures. It does not require an Uptime Institute Tier certificate.
Is National Bank Resolution No. 48 still in force?
No. ARDFM Resolution No. 53 of 3 April 2026 repealed it. The physical-security list now lives in paragraph 12 of the 2026 requirements.
Does Akashi hold a PCI DSS certificate?
No. PCI DSS is an obligation of the entity that stores, processes, or transmits cardholder data. Akashi does not publish a PCI DSS attestation.
What certification does Akashi hold today?
An Uptime Institute Tier IV design certification (TCDD). The constructed-facility audit (TCCF) is scheduled for April 2027. The first phase launches in 2027.