Central Bank of Uzbekistan Anti-Fraud Requirements: What the Draft Changes
On 29 September 2026 the Central Bank of Uzbekistan put out for discussion draft anti-fraud requirements for banks and payment organizations. Under the draft, transactions are split into at least three risk levels, an active phone call during a session raises the risk to at least medium, and the final response to a customer complaint is given within 5 calendar days at the latest (up to 20 calendar days for a complex complaint, with notice to the customer). Discussion runs until 9 October 2026.
In brief: Anti-fraud requirements of the Central Bank of Uzbekistan (CBU): on 29 September 2026 the Central Bank put out for discussion on regulation.adliya.uz a draft Board resolution approving the Regulation on general requirements for detecting suspicious (fraudulent) transactions in the information systems of commercial banks, payment organizations and payment system operators. Discussion runs from 29 September to 9 October 2026; the draft text on the portal is in Uzbek, and the summary below is our own translation (translated from Uzbek). Under the draft, the anti-fraud system assigns each transaction a scoring value, and the bank sets at least three risk ranges: at low risk the transaction goes through, at medium risk it is suspended, additionally verified or the customer's confirmation is requested, and at high risk it is rejected (para. 16 of the Regulation). Under the draft, the resolution will take effect three months after its official publication (para. 3 of the draft resolution); as of 29 September 2026 it is a draft, not an adopted act.
Who the draft anti-fraud requirements apply to
Under the draft (the Regulation is Annex 1 to the draft resolution; text in Uzbek):
- Who is obliged. Commercial banks, payment organizations and payment system operators (title and preamble of the Regulation).
- Which transactions. Transactions of individual customers made without their voluntary consent (preamble). Under para. 1, this is a transaction using remote financial services that debits money from a customer's account, card or e-wallet, which was initiated on the customer's behalf by a third party or carried out by abusing the customer's trust through deception — provided the customer did not benefit from it.
- Exception (para. 2). The Regulation does not apply to transactions between bank cards and e-wallets belonging to the customer themselves. The Spot, Spot and UzDaily publications of 29 September 2026 do not mention this clause.
The text of the draft resolution (para. 2) states that the resolution has been agreed with the Ministry of Internal Affairs; Spot and UzDaily on 29 September 2026 write about agreement with the Ministry of Internal Affairs in the future tense.
Three risk levels under the draft: how a transfer's fate is decided
| Risk level (at least three ranges) | What happens to the transaction under the draft (para. 16) |
|---|---|
| Low | Processed without additional measures |
| Medium | Suspended, additionally verified, or the customer is notified and their confirmation obtained |
| High | Rejected |
How risk is calculated under the draft:
- Scoring (para. 15). Each indicator is assigned a score according to its significance, and a total score is calculated for the transaction.
- Not on a single indicator (para. 14). A decision — notification, verification, suspension or blocking — is taken based on a combination of several indicators from different groups. The exception is certain critical indicators provided for by the CBU Rules.
- Social engineering (para. 18). If there is an active phone call during the customer's session, remote access software is running, or the customer's behavior shows that they are being directed by someone else, the transaction must be classified as at least medium risk and undergo additional verification.
- Flexibility (paras. 13, 17). Banks and payment organizations may set different indicator thresholds for channels, customer segments and products, and may additionally use scoring models based on machine learning and AI; such models do not override the minimum requirements of the Regulation and the Rules.
Indicators of a suspicious transaction in the draft
Under the draft (para. 12), indicators for configuring anti-fraud systems are grouped into four areas (card issuing is a priority; the others require special attention):
- Remote channels for individuals — new recipients, atypical payment behavior, session risks (new device, SIM card replacement, emulators), signs of social engineering.
- Card transactions (issuing) — the location of the transaction does not match the customer's usual geography, a risky or atypical channel, unusual situations on card activation and first use.
- Card transactions (acquiring) — many transactions from one card or from different cards in a short time, a high concentration of suspicious transactions at one terminal, unusual refunds.
- E-wallets — including mass registration, frequent changes of linked details in a short time, transit movement of money.
Under para. 11 of the draft, the exact list of indicators, their codes, descriptions, thresholds, grouping procedure and application specifics will be set out in separate Rules, to be approved by the CBU Board and sent to banks and payment organizations. The Rules are not included in the draft package on regulation.adliya.uz (text of the resolution and Annex 1, retrieved 29 September 2026).
Complaint about a suspicious transaction: deadlines under the draft
Under the draft, the customer is notified immediately of a suspension or rejection: the message contains a general description of the transaction, the decision taken and the steps the customer can take (para. 19). For complaints, which are accepted around the clock, the bank must provide all three channels — a contact center, the mobile app and an electronic form — and must inform the customer that they can file a complaint (para. 20).
| Complaint review stage (draft, para. 21) | Deadline |
|---|---|
| Confirmation of receipt of the complaint | within 30 minutes at the latest |
| Preliminary review | within 24 hours |
| Final response | within 5 calendar days at the latest |
| Complex complaint | the deadline may be extended to up to 20 calendar days with notice to the customer |
Under the draft, statistics on complaints and their outcomes are submitted to the CBU as part of reporting under the Rules (para. 22).
What banks and payment organizations must do under the draft
- Governance (para. 3). The bank's management board, or the executive body of a payment organization or payment system operator, approves the anti-fraud strategy and policy, allocates financial, technical and human resources, receives information on the state of the system at least once a quarter and takes corrective action on identified systemic deficiencies.
- Risk assessment (para. 5). At least once a year, and also before introducing a new product, channel or significant technological changes.
- System (para. 6). Real-time detection, coverage of all remote channels, 24/7 operation, integration with other security systems, immutable logs.
- Separation of rights (para. 7). The rights to change anti-fraud rules and to lift a block on transactions are not given to a single employee.
- Logs (paras. 27–28). Integrity of records is ensured by cryptographic protection; records are kept for at least 5 years.
- Major incident (para. 31). A major incident under para. 1 is an incident that seriously affects the stability of the financial market or customers' rights, including a failure of the anti-fraud system, simultaneous suspicious transactions in large volume, or mass compromise of customer data: an initial report to the CBU within 4 hours of detection, a detailed report within 72 hours of occurrence, and a final conclusion within 30 calendar days after the consequences are fully eliminated; in addition, the CBU must be informed of the measures taken, lessons learned and preventive measures.
- Data exchange (paras. 23–24). Participation in centralized databases on fraudulent transactions (the CBU will set the access procedure separately) and exchange with the CBU of information on new fraud schemes, threats and major incidents (the CBU will determine the procedure and format).
- Customer warnings (para. 36). Messages in the app and internet banking, sections on the website, articles and videos about fraud schemes, consultations at the contact center.
How many fraudulent transactions Uzbek banks prevent now
According to the CBU press service, as reported by Spot on 17 September 2026, in the first half of 2026 commercial banks in Uzbekistan prevented 18.1 million fraudulent transactions worth 461.9 billion soums. According to the same report, banks have introduced session-based anti-fraud systems that assess transactions by risk level and restrict suspicious transactions when the risk is high.
Two services for cardholders operate separately from the draft. Spot, citing the CBU press service, reported on 15 September 2026 the launch of the InfoCards system: through the servicing bank, a cardholder can find out which law enforcement agency blocked the card, when and for what reason. Spot reported on 29 September 2026 a section listing the bank cards issued in a user's name on the Single Portal of Interactive Public Services: the section is running in test mode and includes only cards of resident banks of Uzbekistan.
Other CBU documents of September 2026 are the draft regulation on the regulatory sandbox (comments were accepted until 26 September 2026) and the fintech strategy to 2030, whose approval the CBU announced on 24 September 2026.
FAQ
What are the Central Bank of Uzbekistan's anti-fraud requirements? It is a draft of the CBU's general requirements for systems detecting suspicious (fraudulent) transactions at commercial banks, payment organizations and payment system operators, put out for discussion on 29 September 2026. Under the draft, the requirements cover transactions of individual customers made without their voluntary consent. The text on regulation.adliya.uz is published in Uzbek; discussion runs until 9 October 2026.
When will the new anti-fraud requirements take effect? Under the draft, the resolution will take effect three months after its official publication (para. 3). As of 29 September 2026 the document is a draft under discussion until 9 October 2026; as of 29 September 2026 the regulation.adliya.uz portal shows no adoption date.
Will my transfer be blocked if someone calls me during the transaction? Under the draft, an active phone call during the customer's session is a sign of social engineering: the transaction must be classified as at least medium risk and undergo additional verification (para. 18). At medium risk, under para. 16 of the draft, the transaction is suspended, additionally verified or the customer's confirmation is requested; it is rejected at high risk.
How long will a bank take to review a complaint about a suspicious transaction? Under the draft, receipt of the complaint is confirmed within 30 minutes at the latest, the preliminary review takes 24 hours, and the final response is given within 5 calendar days at the latest (para. 21). A complex complaint may be reviewed for up to 20 calendar days with notice to the customer.
Will the requirements apply to transfers between my own cards? Under para. 2 of the draft, the Regulation will not apply to transactions between bank cards and e-wallets belonging to the customer themselves. The draft requirements cover transactions made without the voluntary consent of an individual customer.
Where can I see the full list of suspicious transaction indicators? Under the draft, the full list of indicators, including codes and thresholds, will be set out in separate Rules to be approved by the CBU Board (para. 11). The Rules are not included in the draft package on regulation.adliya.uz (text of the resolution and Annex 1, retrieved 29 September 2026); the Regulation itself names the priority groups of indicators (para. 12).
Sources
- Draft resolution of the CBU Board and the Regulation (Annex 1), regulation.adliya.uz, discussion 29 September – 9 October 2026 (retrieved 29 September 2026): https://regulation.adliya.uz/project/11628/36673
- Spot, 29 September 2026: https://www.spot.uz/ru/2026/09/29/fraud-detection/
- Spot, 29 September 2026: https://www.spot.uz/ru/2026/09/29/antifraud-factors/
- UzDaily, 29 September 2026: https://www.uzdaily.uz/ru/tsb-uzbekistana-predlozhil-edinye-pravila-borby-s-frodom/
- Spot, 17 September 2026: https://www.spot.uz/ru/2026/09/17/cybersecurity/
- Spot, 15 September 2026: https://www.spot.uz/ru/2026/09/15/cards-block/
- Spot, 29 September 2026: https://www.spot.uz/ru/2026/09/29/mygov-cards/
