Kazakhstan’s AIFC Court Targets Coinbase and Five Crypto Platforms Over Unlicensed Services

AIFC crypto injunctions put local permissions in focus

The AIFC crypto injunctions, detailed in an October 20 announcement, bring several internationally recognised platforms into a licensing dispute in Kazakhstan’s financial centre.

The case highlights a question that matters whenever a global exchange enters a local market: which legal entity provides the service, and what permission does it hold?

A familiar brand can make that question easy to overlook. Customers often recognise an exchange’s name long before they examine its contractual entity or regulatory status. For businesses, however, market access depends on the applicable legal framework.

What happened and when

The announcement describes restrictions on providing, offering or advertising digital-asset services without the appropriate licence within the AIFC. It also addresses making mobile applications available for those services.

The sequence is important:

AFSA said its enforcement work began with warnings to more than 20 platforms in 2025. Chief Executive Evgeniya Bogdanova described the case as the result of:

“extensive and consistent efforts by AFSA’s Supervision and Enforcement teams”

The dates prevent an important misunderstanding: publication of the update should not be presented as the day the court first acted.

Why “within the AIFC” needs to stay in the headline discussion

The Astana International Financial Centre has its own financial regulatory framework, administered by the Astana Financial Services Authority.

AFSA’s guidance explains that activities conducted “in or from” the AIFC can involve an AIFC participant dealing with another participant or with parties outside the centre. The framework therefore cannot be understood simply as a restriction applying inside a particular office building.

At the same time, AFSA says its authorisation does not automatically resolve every legal requirement elsewhere. A participant establishing an additional office outside the AIFC must comply with the relevant jurisdiction’s legislation and restrictions.

For readers, the practical lesson is to preserve the jurisdictional wording. Describing this development as a blanket prohibition on cryptocurrency ownership would go beyond the announced action.

The same care is needed when comparing countries. Bitnxt’s guide to VARA licensing in Dubai examines a separate regime where the activity being offered determines the permission a business needs.

App-store access and account access are different questions

AFSA’s announcement brings Google Play and Apple’s App Store into the access-restriction process.

That has practical significance because mobile distribution is a major route through which customers discover and use financial services. An exchange’s visibility in an app store can affect onboarding even when customers already recognise its brand.

However, an app-store restriction alone does not answer every account-level question. Customers would still need platform-specific information about existing balances, open positions, withdrawals and support.

This report does not establish a common withdrawal deadline for the affected platforms, or confirm how every existing account is being handled. Those details should come from the relevant operator’s authenticated notices.

Users should be particularly careful with messages claiming that urgent transfers are required to “unlock” an account. A regulatory headline does not authenticate a message, a support profile or a replacement website.

Authorisation involves more than registering a company

AFSA maintains a public register covering registered entities, authorised firms, market institutions and other categories. It also records licensing developments such as suspensions and withdrawals.

That structure makes a basic distinction essential: company registration and permission to provide a particular financial service are separate checks.

A business may have a legal presence without holding every permission its proposed activities require. Similarly, a group may operate through multiple entities, each with different responsibilities and geographical coverage.

For customers evaluating a provider, useful questions include:

• What is the exact legal name in the customer agreement?

• Does that entity appear in the regulator’s register?

• What activities does its authorisation cover?

• Are there restrictions, suspensions or conditions attached?

These questions are more informative than relying on a licence logo displayed on a website.

For another jurisdictional comparison, Bitnxt’s UK crypto licensing guide explores how different regulatory permissions can apply to the same business.

Enforcement is only one side of the regulatory approach

AFSA has separately introduced a fast-track authorisation process for eligible firms already supervised in regulatory regimes it considers acceptable.

The process can take account of an applicant’s existing licence, regulatory history and track record. Eligible businesses may submit a reduced application package, although AFSA retains discretion to request further information or return an application to the standard process.

Crucially, the fast-track mechanism concerns authorisation. It does not remove ongoing supervision or enforcement powers.

That provides useful context for the current case. Regulators can simplify entry for qualifying businesses while continuing to act against services offered without the required permission.

AFSA’s revised enforcement policy also addresses investigation procedures, sanctions, financial penalties, restitution and actions for damages. These are separate tools within its wider supervisory framework.

Bitnxt’s view: check the entity behind the app

Bitnxt’s assessment: The most useful takeaway is that a platform’s international reputation does not settle its local legal position.

For customers, the immediate priority is clear information: who holds their assets, which terms govern the account and what official service notices apply. For exchanges, regulatory access needs to be reflected in onboarding, marketing and distribution—not treated as paperwork disconnected from the product.

The next developments worth following are implementation notices and any subsequent court or licensing updates. A promise to apply for permission should be distinguished from permission actually being granted.

Custody also deserves a separate assessment. Moving away from an exchange changes who controls the keys and who bears responsibility for recovery. Bitnxt’s hot-wallet versus cold-wallet guide explains those trade-offs.

You might also like: SEC vs CFTC under the CLARITY Act: how the proposed US regulatory responsibilities differ.