Internal Control Rules for Crypto Assets in Uzbekistan: What Has Changed

NAPP and the Department for Combating Economic Crimes have updated the AML/CFT rules for licensed crypto providers: on 28 September 2026, the joint resolution passed state registration. Identification via third-party services, annual updates of client data, new requirements for managers and founders — what changes, based on the final text on regulation.adliya.uz.

In brief: the internal control rules on AML/CFT (anti-money laundering and countering the financing of terrorism) for crypto asset service providers in Uzbekistan have been updated: a joint resolution of the National Agency of Perspective Projects (NAPP) and the Department for Combating Economic Crimes under the Prosecutor General's Office (DCEC) passed state registration on 28 September 2026 and enters into force on the day of its official publication, NAPP reported on 28 September 2026. Under the final text in the card of draft 11031 on regulation.adliya.uz (status 'Tasdiqlandi', modified 28 September 2026), providers will be allowed to verify the authenticity of a client's personal data through a third-party organization, client data and client risk levels will have to be updated at least once a year, and the person responsible for internal control will have to be appointed from among the deputy heads. As of 29 September 2026, there is no official text on lex.uz (searched by title in Russian and Uzbek).

Key points: before and after

Before — the current version of the Rules (reg. No. 3309 of 9 June 2021, lex.uz version of 13 July 2022); after — the final text on regulation.adliya.uz, retrieved 29 September 2026; it will enter into force on the day of its official publication.

Provision of the Rules	Before (lex.uz, version of 13 July 2022)	After (final text on regulation.adliya.uz, 29 September 2026)
Client identification, para. 20	"using reliable sources of information and documents" (translated from Russian)	the same, "in which case the services of a third party may be used" (translated from Russian)
Data updates, para. 53	due diligence information — at least once a year	due diligence information and client risk levels — at least once a year
Responsible officer, para. 5	from among senior employees	from among the deputy heads; to be appointed within one month after obtaining a license
Manager, para. 8	three groups of prohibitions (management, terrorism, criminal record)	adds persons permanently residing, located or registered in states that do not participate in AML/CFT cooperation
Founders, para. 8¹	prohibition for persons under indents 4–5 of para. 8 (terrorism and WMD, criminal record) and for companies from offshore zones	prohibition for persons under indents 4–6 of para. 8 (adds persons from states that do not participate in AML/CFT cooperation) and for companies from such states instead of offshore zones
Freeze under the List, para. 45	only a reference to the procedure for suspension and resumption; para. 45 (version of 13 July 2022) says nothing about notifying the person	the responsible officer notifies the person and explains the procedure for resumption

Status: registered, but no official text yet

28 September 2026 — NAPP reported the registration of the joint resolution on Telegram (17:51 Tashkent time) and on its website; neither message gives the registration number.
Details under the portal's final text: NAPP resolution No. 5 of 21 August 2026 and DCEC resolution No. 32 of 20 August 2026.
Public consultation on the draft: 12–22 August 2026, 0 proposals (regulation.adliya.uz API, retrieved 29 September 2026).
lex.uz, 29 September 2026: a search by the resolution's title returns only 3309, 3309-1 and 3309-2 (2021–2022).

NAPP on Telegram on 28 September 2026 described the goals of the amendments as "improving the AML/CFT/CPF system, implementing FATF international standards and reducing the risks of service providers being used in unlawful activity" (translated from Russian).

What changes for clients of crypto exchanges and crypto stores (under the final text)

Verification via a third-party organization. Under the portal's final text (entering into force on the day of official publication), para. 1 of the Rules will introduce the concept of a "third party" — "organizations providing services for confirming the authenticity of personal data issued by competent state bodies of the Republic of Uzbekistan or a foreign state" (translated from Russian). Under para. 20, such services "may be used" (translated from Russian) in identifying and verifying a client — this will be a right of the provider, not an obligation.

Annual updates. New para. 53 under the portal's final text (after entry into force): the information obtained by the provider during client due diligence and identification, "as well as client risk levels, are subject to updating at least once a year" (translated from Russian). Para. 53 does not set out how the update is to be done (final text on regulation.adliya.uz, 29 September 2026).

Understanding the client's business. Under the portal's final text, para. 12 (duties of the responsible officer) will add: "to understand the activity (business) of the client, its ownership and management structure" (translated from Russian).

Notification of a freeze. Under the portal's final text, para. 45 will be supplemented: after suspending a transaction or freezing the crypto assets of a person on the List (persons involved or suspected of involvement in terrorist activity or the proliferation of weapons of mass destruction, WMD), the responsible officer "is obliged to notify as soon as possible" that person and "explain the procedure for resuming the transaction" (translated from Russian).

The Rules will apply only to licensees: under the final text, a service provider is "a legal entity that has obtained a license in the prescribed manner" (translated from Russian). Who is currently in the NAPP register — see our breakdown of the register as of 22 September 2026.

What changes for providers (under the final text)

Under the final text on regulation.adliya.uz (29 September 2026; not yet published on lex.uz, enters into force on the day of official publication):

Responsible officer (para. 5): within one month after obtaining a license, the provider will have to appoint one and send NAPP the officer's last name, first name, patronymic and PINFL; in case of replacement — the details no later than the next business day (this rule existed before).
Managers and founders (paras. 8, 8¹): a person permanently residing, located or registered in a state that does not participate in international AML/CFT cooperation will not be able to serve as manager; participation in the charter capital by such persons and by companies registered in such states will be prohibited (the wording on offshore zones in para. 8¹ is replaced). Para. 1 of the Rules defines such states based on official FATF statements. The same replacement of offshore zones with such states is made in Licensing Regulation No. 3380 of 15 August 2022 as amended by 3380-3 of 29 June 2026 (para. 9(i), para. 54(v)), but only from 1 October 2026; until 30 September 2026, it keeps the prohibition for offshore companies (lex.uz).
Group-wide approach (new para. 13¹): if organizations dealing with money or other property are under the provider's control or within its significant influence, the internal rules will have to cover data sharing for risk management, group-level compliance, obtaining information from branches and subsidiaries, and protection of confidentiality.
Staff (para. 13): the internal rules must set requirements for appointment, training and education, "including their business reputation and qualifications" (translated from Russian).
Suspicious transaction reports (para. 41): the channels will be electronic systems with cryptographic protection, secure email or a personal account; to connect to the personal account, the provider will apply to NAPP with the information under new Appendix 3a (details of the organization and the responsible officer). The recipient is the "specially authorized state body" (translated from Russian), which under para. 1 of the Rules is the DCEC.
Monitoring (para. 57¹): it will be carried out on an ongoing basis by the provider's head; the internal audit service, where one exists, "may also" (translated from Russian) do so (previously, it was "carried out by the internal audit service", translated from Russian).
Terms: "persons engaged in activities in the field of crypto asset circulation" will be replaced with "service providers" (translated from Russian).

What is not new and how the final text differs from the draft

The one-business-day deadline. A suspicious transaction report is submitted "no later than one business day from the moment of detection" (translated from Russian) — this is already in the current version of para. 41 (lex.uz, version of 13 July 2022), and the final text keeps the deadline. Uznews on 13 August 2026 gave this rule the subheading "Suspicious transactions will have to be reported within one business day" (translated from Russian).

Indicators of suspicious transactions. Uznews wrote on 13 August 2026: "One of the main changes concerns the criteria" (translated from Russian), and listed them. They are already in the current para. 35, for example "making a large number of large transactions with crypto assets within 24 hours" (translated from Russian; lex.uz, version of 13 July 2022). The draft of 12 August 2026 proposed restating para. 35 in full. In the portal's final text, para. 35 changes only in terminology, plus the sixth paragraph of the Uzbek text is deleted.

Communication channels. Upl.uz on 14 August 2026 wrote that questionable transfers would be reported "strictly via encrypted communication" (translated from Russian). Both the draft and the final text of para. 41 allow three channels: systems with cryptographic protection, secure email or a personal account.

Final text vs. draft. The reference to client risk levels in para. 53 appeared only in the final version (in the draft of 12 August 2026, the paragraph repeated the current wording). The group-wide approach was moved from para. 14¹ of the draft to para. 13¹.

Who adopted it and on what basis

The base act is the joint resolution of the National Agency for Project Management under the President of the Republic of Uzbekistan No. 3 of 8 June 2021 and DCEC No. 16 of 7 June 2021, reg. No. 3309 of 9 June 2021; amendments — 3309-1 of 5 April 2022 (in force since 6 July 2022) and 3309-2 of 13 July 2022; the current version on lex.uz is of 13 July 2022 (lex.uz). The preamble of the amendments refers to the Law "On Countering the Legalization of Proceeds…" No. 660-II of 26 August 2004 (in force since 1 January 2006, lex.uz version of 17 April 2025, lex.uz) and PQ-3832 of 3 July 2018 (as amended by PQ-143 from 20 April 2026, lex.uz).

FAQ

What has changed in the internal control rules for crypto assets in Uzbekistan? Under the final text on regulation.adliya.uz (29 September 2026), providers will be allowed to confirm the authenticity of personal data through a third-party organization, client data and risk levels will have to be updated at least once a year, and the responsible officer will have to be appointed from among the deputy heads (the amendments enter into force on the day of official publication; as of 29 September 2026, there is no text on lex.uz). Prohibitions will be introduced for managers and founders linked to states that do not participate in AML/CFT cooperation (paras. 8, 8¹).

When do the new rules enter into force? On the day of official publication — as stated in NAPP's message of 28 September 2026 and in para. 2 of the resolution according to the portal text. As of 29 September 2026, there is no text on lex.uz (searched by title in Russian and Uzbek); the exact date will be known after publication.

Can I complete identification on a crypto exchange through a third-party service? Yes, once the amendments enter into force: under the portal's final text (29 September 2026), the Rules will allow a provider to use the services of a third party — an organization confirming the authenticity of personal data issued by state bodies of Uzbekistan or a foreign state. This will be a right, not an obligation, of the provider; the final text (29 September 2026) does not name specific services.

How often must a crypto exchange update client data? At least once a year once the amendments enter into force — under the new wording of para. 53 in the final text on regulation.adliya.uz (29 September 2026), this will apply both to due diligence information and to the client's risk level. The paragraph does not set out how the update is to be done (final text on regulation.adliya.uz, 29 September 2026).

Will a client be notified if their crypto assets are frozen? If the client is the one included in the List of persons linked to terrorism or WMD proliferation — yes, once the amendments enter into force: under the portal's final text (29 September 2026), the responsible officer will be obliged to notify that person "as soon as possible" (translated from Russian) and explain the procedure for resuming the transaction.

Do these rules apply to Binance, Bybit and other foreign exchanges? Under the definition in the final text on regulation.adliya.uz (29 September 2026; enters into force on the day of official publication) — no: a service provider is a legal entity that has obtained a license in the prescribed manner, i.e. a NAPP licensee. The list of licensees is in the NAPP register.