Kyrgyzstan Financial Sector Information Security Requirements: What to Consider in AppSec

Information security requirements for Kyrgyz commercial banks are set by the Regulation of the National Bank of the Kyrgyz Republic (NBKR), approved by Board Resolution No. 2021-П-20/72-8-(НПА) dated 22 December 2021. Personal data has been governed by the Digital Code of the Kyrgyz Republic since 6 February 2026, replacing the former Law No. 58, and the general framework is set by the Law "On Cybersecurity" dated 17 July 2024 No. 121. For AppSec, the key points are security across the whole software lifecycle, vulnerability management, and careful handling of cross-border data transfers.

Key acts

• NBKR Board Resolution dated 22 December 2021 No. 2021-П-20/72-8-(НПА), the Regulation "On Requirements for Ensuring Information Security in Commercial Banks of the Kyrgyz Republic". Enters into force 15 days after official publication; repeals the Board Resolution dated 14 September 2011 No. 52/12.
• Law of the Kyrgyz Republic dated 17 July 2024 No. 121 "On Cybersecurity": adopted by the Jogorku Kenesh on 12 June 2024, in force 15 days after publication. Defines the legal basis for a unified cybersecurity system, critical information infrastructure and cybersecurity audit.
• Digital Code of the Kyrgyz Republic dated 31 July 2025 No. 178, which consolidated the previous regulation. The Law "On Personal Information" dated 14 April 2008 No. 58 lost force on 6 February 2026 in connection with the Law dated 31 July 2025 No. 179.
• Cabinet of Ministers resolution on a unified list of cybersecurity requirements for critically important information infrastructure facilities, according to a 24.kg report dated 21 April 2026. The publication does not give the resolution number.

What the NBKR Regulation requires of banks

The regulation is built on international standards and practices (the draft referred to ISO/IEC 27001 and 27005). From its content, which we confirmed against the text on the NBKR website, the following provisions matter for development and AppSec.

• System lifecycle. Security is considered at all stages; implementation and changes are documented and approved by bank management. Testing is carried out in an environment identical to production.
• Software. A bank may use licensed software, as well as open-source or in-house developments, provided there is complete approved documentation (specifications, test programs and results, commissioning acts).
• Vulnerabilities. The bank must identify, assess and remediate vulnerabilities; lessons learned from incident analysis are taken into account in risk assessment. For card systems, factory settings and manufacturer passwords are prohibited.
• Logging and audit. Logs are reviewed daily, changes to security settings are recorded, and internal audit covers IT and IS. The NBKR has the right to verify compliance with the requirements.
• Outsourcing and cloud. Before outsourcing functions, including data processing centers and cloud services, the bank assesses the risks and, on request, provides the assessment to the NBKR. The contract must cover security, confidentiality, continuity and interaction with the regulator.

What we did not find in the text: an explicit penetration testing requirement (regular testing of security systems is mentioned for card systems), specific deadlines for notifying the NBKR of incidents, and a requirement for mandatory static code analysis. This does not mean such requirements will not appear in supervisory practice, but formally they cannot be relied upon as norms.

Personal data under the Digital Code

Issues of processing, storage, transfer and protection of personal data are now covered in Chapter 11 of the Digital Code. The authorized body is the State Agency for Personal Data Protection. According to 24.kg, a procedure for assessing the adequacy of data protection in foreign states is being prepared for cross-border transfers: data could be freely transferred to countries on the list, and to other countries only with the data subject's consent. In May 2026, parliament approved in first reading a bill amending the Code of Administrative Offenses in connection with personal data protection.

To be clear about localization: in the sources available to us, the former Law No. 58 did not contain a general requirement to store data in the country, and we have not confirmed such a requirement for the Digital Code. Consulting reviews written before 2026 describe the register of personal data holders and fine risks, but they refer to the former law, so rely on the text of the Code and the agency's clarifications. Lawyers recommend reviewing data storage and transfer practices in connection with the transition to the Code.

What this means for AppSec practice

1. Document the lifecycle. The regulation requires approved documentation and testing. SAST, SCA and dynamic testing results are natural artifacts of these stages. For tools, see SAST, DAST, SCA and MAST.
2. Open source is allowed only with documentation. Open components must be described and tested. A software bill of materials (SBOM) solves this task. See what an SBOM is.
3. Test environments without production data. The environment must be identical to production, but the data in it should be masked or synthetic.
4. Vendor risk assessment. If a scanner, repository or CI runs at a third-party provider, this is outsourcing that requires a risk assessment and security terms in the contract. On-premise deployment simplifies this step.
5. Readiness for cyber incidents. The Cybersecurity Law introduces a cybersecurity audit and a unified threat database. Prepare an incident response process you can report on with confidence.
6. Independent verification. Security assessment of critical systems is a practical way to obtain evidence for internal audit and inspections. Learn more about security assessment.

A DevSecOps implementation helps bring these practices together in the development process. The basic route is described in the article "DevSecOps: where to start".

The Cybersecurity Law and critical infrastructure

Law No. 121 dated 17 July 2024 introduces the concepts of cybersecurity subjects and principles, critical information infrastructure, a unified cyber threat database, public-private interaction and cybersecurity audit. Under the Government Resolution dated 21 May 2020 No. 266, the State National Security Committee (Cybersecurity Coordination Center) was designated as the authorized body in the field of cybersecurity; check how this is reflected in the 2024 law's text. In April 2026, according to 24.kg, the Cabinet of Ministers approved a unified list of cybersecurity requirements for critically important information infrastructure facilities. It applies to state, commercial and non-profit organizations whose activities involve important information systems. Ask your IS team whether your systems fall under this category.

What the draft NBKR Regulation contained

In the materials accompanying the draft (2021), the NBKR described the structure of requirements more broadly than the title suggests. The draft included three levels of documentation (general policies, specific policies and procedures), a person responsible for the IS policy, background checks for new employees, the principle of least privilege, dual control of payment transactions, multi-factor authentication for remote access, retention of event logs for at least two years, PCI DSS requirements for cards, and storage of payment data in Kyrgyzstan. This is a draft, not an approved norm: compare with the adopted text to see which provisions made it into the final document. As a benchmark for a mature IS process, however, it is useful, and it is reasonable to use it as a reference when building your own policies.

Where a bank or fintech should start

1. Obtain the current text of the Regulation from nbkr.kg and list the applicable clauses.
2. Determine whether your systems belong to critical information infrastructure.
3. Review the storage and transfer of personal data in light of the Digital Code and the position of the State Agency for Personal Data Protection.
4. Close the gaps in the development process: code analysis, dependency control, test environments without production data.
5. Prepare a risk assessment for external services: hosting, cloud CI/CD and SaaS scanners.

Frequently asked questions

This article is for information purposes only and does not constitute legal advice. Kyrgyz regulations are frequently updated; check the current versions.

Sources

• NBKR: Resolution No. 2021-П-20/72-8-(НПА) and the Regulation on IS in commercial banks
• NBKR: draft Regulation on IS in commercial banks (rationale)
• CERT KR: legislation, Law "On Cybersecurity" No. 121
• Law of the Kyrgyz Republic No. 58 "On Personal Information" (lost force 06.02.2026)
• 24.kg: parliament approved the personal data protection bill
• 24.kg: requirements for protecting critical systems